Teadmistebaas

Fail2Ban monitors your server's log files and automatically blocks (bans) IP addresses that show malicious behavior, such as repeated failed SSH login attempts. It's one of the highest-impact, lowest-effort security tools you can install on a VPS.

Prerequisites

• Ubuntu 22.04/24.04 or Debian 11/12 VPS
• Root or sudo access
• UFW (recommended) already installed

Step 1 — Install Fail2Ban

sudo apt update
sudo apt install fail2ban -y

Step 2 — Enable and Start the Service

sudo systemctl enable fail2ban
sudo systemctl start fail2ban
sudo systemctl status fail2ban

Step 3 — Create a Local Configuration

Never edit jail.conf directly — it gets overwritten on updates. Create a local override:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Step 4 — Configure the SSH Jail

Find (or add) the [sshd] section. If you changed your SSH port, set it here as well:

[sshd]
enabled = true
port = 2222
maxretry = 5
findtime = 10m
bantime = 1h

maxretry = attempts allowed, findtime = the window they're counted in, bantime = how long the IP is banned.

Step 5 — Restart Fail2Ban

sudo systemctl restart fail2ban

Step 6 — Verify Active Jails

sudo fail2ban-client status

Check details of the SSH jail, including currently banned IPs:

sudo fail2ban-client status sshd

Unbanning an IP Address

sudo fail2ban-client set sshd unbanip 203.0.113.10

Protecting Other Services

Fail2Ban ships with filters for Nginx, Apache, Postfix, Dovecot and more. Enable one by adding a matching section, for example for Nginx HTTP auth failures:

[nginx-http-auth]
enabled = true

Making Bans Permanent for Repeat Offenders

To escalate bans for IPs that keep coming back, enable the recidive jail:

[recidive]
enabled = true
bantime = 1w
findtime = 1d
maxretry = 5

Common Errors

Fail2Ban won't start — check sudo journalctl -u fail2ban for a syntax error in jail.local.

SSH jail not banning anyone — verify the log path Fail2Ban is watching matches your distro (Ubuntu/Debian normally use systemd journal backend by default; confirm with sudo fail2ban-client get sshd logpath).

Best Practices

• Combine Fail2Ban with UFW and SSH key authentication
• Review banned IPs periodically: sudo fail2ban-client status sshd
• Don't set bantime too short — 1 hour minimum is reasonable for SSH

FAQ

Does Fail2Ban replace a firewall?
No — it complements UFW/CSF by dynamically banning based on log activity rather than static rules.

Can it protect more than SSH?
Yes, Fail2Ban includes filters for Nginx, Apache, Postfix, Dovecot, vsftpd and many others.

Continue Reading

• SSH Hardening: Change the Port, Disable Root Login & Use SSH Keys
• How to Configure UFW Firewall on a Linux VPS
• How to Monitor Auth Logs and Detect Intrusion Attempts

Browse more articles in Server Security & Hardening.