База на знаења

Fail2Ban is one of the most effective security tools for Linux VPS servers. It monitors log files and automatically blocks IP addresses that repeatedly fail authentication attempts, protecting your server against brute-force attacks targeting SSH, Nginx, Apache, FTP, and other services.

Requirements

• Ubuntu 24.04 VPS
• Root or sudo privileges
• SSH access

Step 1 — Update Your Server

sudo apt update
sudo apt upgrade -y

Step 2 — Install Fail2Ban

sudo apt install fail2ban -y

Step 3 — Enable the Service

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Step 4 — Check Service Status

sudo systemctl status fail2ban

You should see active (running).

Step 5 — Create a Local Configuration File

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit the local configuration:

sudo nano /etc/fail2ban/jail.local

Step 6 — Configure SSH Protection

Find the [sshd] section and ensure it contains:

[sshd]
enabled = true
port = ssh
maxretry = 5
findtime = 10m
bantime = 1h

Step 7 — Restart Fail2Ban

sudo systemctl restart fail2ban

Step 8 — Verify Active Jails

sudo fail2ban-client status

You should see:

Status
|- Number of jail: 1
`- Jail list: sshd

View SSH Jail Details

sudo fail2ban-client status sshd

This command displays currently banned IP addresses.

Unban an IP Address

sudo fail2ban-client set sshd unbanip 192.168.1.100

View Fail2Ban Logs

sudo journalctl -u fail2ban

Useful Commands

sudo systemctl restart fail2ban
sudo systemctl stop fail2ban
sudo systemctl status fail2ban
sudo fail2ban-client reload
sudo fail2ban-client status

Best Practices

• Disable direct root SSH login.
• Use SSH key authentication instead of passwords.
• Change the default SSH port if appropriate.
• Combine Fail2Ban with a firewall such as UFW.
• Review Fail2Ban logs regularly for suspicious activity.

Why Install Fail2Ban?

• Protects against brute-force attacks.
• Automatically blocks malicious IP addresses.
• Improves VPS security with minimal resource usage.
• Works with SSH, Nginx, Apache, Postfix, Dovecot, and many other services.
• Easy to configure and maintain.

Conclusion

Fail2Ban is an essential security tool for every Linux VPS. By automatically blocking repeated login attempts, it significantly reduces the risk of unauthorized access and helps keep your server secure.

Related Articles

• How to Secure Your Linux VPS
• How to Change the SSH Port on Ubuntu
• How to Disable Root Login on Your VPS
• How to Configure UFW Firewall
• How to Connect to Your VPS via SSH