DEV Community

Aayush Bhadana
Aayush Bhadana

Posted on

Hardening Arch Linux Cloud Servers using UFW and Fail2Ban: A Practical Guide

#security #linux #cybersecurity #archlinux

Deploying an Arch Linux server in the cloud gives you absolute control over your environment, but out-of-the-box minimal installations leave your SSH port exposed to automated brute-force botnets.
To secure a cloud instance effectively, implementing a network firewall combined with an automated intrusion prevention system is essential. In this guide, we will configure Uncomplicated Firewall (UFW) and Fail2Ban on Arch Linux to lock down non-essential ports and automatically ban malicious IP addresses.
Prerequisites
*A running Arch Linux instance with sudo privileges.
*Basic familiarity with Systemd services (systemctl).

Step 1: Installing and Configuring UFW (Uncomplicated Firewall)

While Arch Linux defaults to iptables or nftables, UFW provides a manageable CLI interface to handle packet filtering without syntax overhead.
First, update your package database and install UFW:

sudo pacman -Syy ufw
Enter fullscreen mode Exit fullscreen mode

Before enabling the firewall, always explicitly allow SSH traffic, otherwise you will immediately lock yourself out of your remote server.
Set default policies to deny incoming and allow outgoing traffic

sudo ufw default deny incoming
sudo ufw default allow outgoing
Enter fullscreen mode Exit fullscreen mode

Allow SSH traffic (Port 22 or your custom SSH port)

sudo ufw allow 22/tcp
Enter fullscreen mode Exit fullscreen mode

(Optional) Allow standard web traffic if running Nginx/Apache

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
Enter fullscreen mode Exit fullscreen mode

Enable the UFW service and ensure it starts on system boot:

sudo ufw enable
sudo systemctl enable ufw
Enter fullscreen mode Exit fullscreen mode

To verify active rules:

sudo ufw status verbose
Enter fullscreen mode Exit fullscreen mode

Step 2: Preventing Brute-Force Attacks with Fail2Ban

While UFW restricts open ports, botnets can still spam your open SSH port with thousands of authentication attempts. Fail2Ban inspects log files (like journalctl) and alters UFW rules to dynamically ban offending IPs.
Install Fail2Ban via pacman:

sudo pacman -S fail2ban
Enter fullscreen mode Exit fullscreen mode

Fail2Ban uses a local configuration file jail.local to override default settings safely. Create and edit this file:

sudo nano /etc/fail2ban/jail.local
Enter fullscreen mode Exit fullscreen mode

Paste the following baseline security configuration:

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 3
[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
backend = systemd
Enter fullscreen mode Exit fullscreen mode

Save the file, then enable and start the Fail2Ban service:

sudo systemctl enable --now fail2ban
Enter fullscreen mode Exit fullscreen mode

Step 3: Monitoring Banned IPs and Testing

To verify that Fail2Ban is actively parsing logs and protecting your SSH daemon, check the status of the sshd jail:

sudo fail2ban-client status sshd
Enter fullscreen mode Exit fullscreen mode

If an attacker fails 3 password attempts within 10 minutes, Fail2Ban automatically appends a temporary drop rule directly to your UFW engine. To manually unban an IP (e.g., if you accidentally lock yourself out from another network):

sudo fail2ban-client set sshd unbanip <TARGET_IP_ADDRESS>
Enter fullscreen mode Exit fullscreen mode

Summary

Combining UFW's static packet filtering with Fail2Ban's dynamic log monitoring establishes a robust baseline defense for any Arch Linux cloud server. This layered approach stops port scanners and mitigates automated SSH attacks before they can consume system resources.

Top comments (0)