Fail2ban

Fail2ban is a security tool that detects brute-force attacks by monitoring login failures and automatically blocking the offending IP addresses.

By default, it bans an attacker for 10 minutes after 5 failed attempts, significantly slowing down repeated intrusion attempts.

This guide is intended for Debian and Ubuntu-based systems.

---

Update your system:

sudo apt update

---

Install Fail2ban:

sudo apt install -y fail2ban

---

Enable at boot and start the service:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

enable → automatically starts Fail2ban on boot
start → starts Fail2ban immediately

---

Check status:

sudo systemctl status fail2ban

---

Configure Fail2ban safely:

Never modify the default configuration file /etc/fail2ban/jail.conf.

Instead, create and use /etc/fail2ban/jail.local for all custom settings.

sudo nano /etc/fail2ban/jail.local

Add the following:

[DEFAULT]
backend = systemd
ignoreip = 127.0.0.1/8 192.168.1.0/24
bantime = 3600
findtime = 600
maxretry = 3

[sshd]
enabled = true
port = 22

⚠ Make sure your own IP or local network is in ignoreip, so you don’t lock yourself out.

---

Check configuration for errors:

sudo fail2ban-client -d

This command dumps the current Fail2ban configuration and will report any issues or misconfigurations.

---

Restart Fail2ban to apply the changes:

sudo systemctl restart fail2ban

Verify the status, including banned IPs and failed login attempts.

---

Commands:

Enable at boot (important)	sudo systemctl enable fail2ban
Start	sudo systemctl start fail2ban
Stop	sudo systemctl stop fail2ban
Restart	sudo systemctl restart fail2ban
Check status	sudo systemctl status fail2ban

---

Unban an IP address manually :

sudo fail2ban-client set sshd unbanip <IP_ADDRESS>

If needed, you can manually remove a banned IP from the SSH jail. Replace <IP_ADDRESS> with the IP you want to unban.