Setting up Fail2ban against brute force attacks

sudo apt update && sudo apt -y install fail2ban

On RHEL-based systems, use `dnf`:

sudo dnf -y install fail2ban

Both commands install Fail2ban including all Python dependencies needed to run the service.

2. Enable and start the service

Fail2ban runs as a systemd service. Enable the service so it starts automatically when the server boots, and start it immediately:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

The first command registers the service for automatic startup. The second command activates the daemon immediately.

3. Create a configuration file

The default configuration is in `/etc/fail2ban/jail.conf`. Do not modify this file directly — package updates will overwrite it. Instead, create a local file that overrides the default values:

sudo nano /etc/fail2ban/jail.local

This file is preserved during system updates and takes precedence over `jail.conf`.

4. Define global settings

The `[DEFAULT]` section in `jail.local` contains parameters that apply to all services. Set the two most important values:

[DEFAULT]
bantime = 3600
maxretry = 3

`bantime = 3600` blocks an IP address for 3600 seconds (one hour). `maxretry = 3` means an IP address is blocked after three failed login attempts. These values offer a balance between security and usability: users who accidentally type their password incorrectly are not locked out for too long, while attackers are effectively stopped.

5. Activate the SSH jail

Add a `[sshd]` section to `jail.local` to enable Fail2ban for SSH:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600

This configuration scans `/var/log/auth.log`, the default authentication log file on Ubuntu and Debian. The `filter = sshd` refers to `/etc/fail2ban/filter.d/sshd.conf`, which recognizes patterns such as "Failed password" and "Invalid user". On RHEL-based systems, the log file is at `/var/log/secure` — adjust `logpath` accordingly.

6. Load the configuration

Fail2ban does not automatically read configuration changes. Load the new settings with the client:

sudo fail2ban-client reload

This command applies the configuration without restarting the service. Fail2ban's client-server model makes this possible: the `fail2ban-client` communicates with the `fail2ban-server` running in the background.

7. Check the status

Check whether the SSH jail is active and which IP addresses are currently blocked:

sudo fail2ban-client status sshd

The output shows the number of currently blocked IP addresses and the total count of bans since the service started.

8. Secure other services

Fail2ban works not only for SSH. Add sections for other publicly accessible services. For nginx HTTP authentication:

[nginx-http-auth]
enabled = true
port = http,https
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
maxretry = 3
bantime = 3600

For Plesk control panels, Fail2ban scans Plesk services' log files for authentication errors. The Plesk documentation confirms that it recognizes known attacks and automatically blocks IP addresses once the threshold is reached.

Verification

Check whether the Fail2ban service is running:

sudo systemctl status fail2ban

The output should show `active (running)`. Then check whether the SSH jail is loaded correctly:

sudo fail2ban-client status

This command shows a list of all active jails. The list should include `sshd`. Finally, simulate an attack by logging in three times with a wrong password from the same IP address. Then check whether that IP address appears in the ban list:

sudo fail2ban-client status sshd

The IP address should appear under "Banned IP list".

Common issues

Fail2ban does not start after installation

Check whether the firewall is active. Fail2ban adds rules to `iptables`, `nftables`, or `firewalld` — if no firewall is active, the service cannot start. View the logs:

sudo journalctl -u fail2ban -n 50

IP address is not blocked despite failed attempts

Check whether the log path is correct. On Debian/Ubuntu, SSH logging is in `/var/log/auth.log`, on RHEL-based systems in `/var/log/secure`. Set `logpath` in the `[sshd]` section to the correct file. Also check that `enabled = true` is in the section — without this line, the jail remains inactive.

Manually remove a blocked IP address

A user who was blocked by accident can be unblocked directly:

sudo fail2ban-client set sshd unbanip 192.168.1.100

Replace `192.168.1.100` with the actual IP address. The IP address is immediately removed from the ban list and the firewall rule is lifted.

Fail2ban forms one layer in a security strategy — it does not replace strong passwords, SSH keys, or a correctly configured firewall. An attack simulation from a test environment showed that Fail2ban detected 28 failed login attempts from one IP address and blocked the address as soon as the threshold of three attempts was reached. That speed makes the difference between a server that stays standing and a server that is taken over — but the next attack is already on its way, and Fail2ban is only the first safety net.