How to set up fail2ban to block brute-force attacks

Stop the constant password-guessing on your server: fail2ban watches your logs and auto-bans IPs that fail to log in too many times. Install it, enable the SSH jail, and tune the ban rules — in a few commands.

Even with everything else locked down, bots never stop trying passwords against port 22 — it's constant background noise and load. fail2ban watches your logs and automatically bans any IP that fails to log in too many times, so the attackers get shut out after a few tries instead of guessing forever. It's a small install and a big drop in log spam.

1. Install fail2ban

sudo apt update && sudo apt install -y fail2ban

2. Create a local config

Never edit the shipped jail.conf directly — override it in jail.local:

sudo tee /etc/fail2ban/jail.local > /dev/null <<'EOF'
[DEFAULT]
# don't ban yourself — add your home/office IP
ignoreip = 127.0.0.1/8 ::1
bantime  = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
EOF

That bans an IP for an hour after 5 failed logins within 10 minutes. Add your own IP to ignoreip so a mistyped password never locks you out.

3. Start it and enable on boot

sudo systemctl enable --now fail2ban

4. Check the SSH jail

sudo fail2ban-client status sshd

You'll see how many IPs are currently banned — often a surprising number within minutes.

Managing bans

sudo fail2ban-client set sshd unbanip 1.2.3.4   # lift a ban
sudo fail2ban-client status                     # list all jails
sudo systemctl reload fail2ban                  # apply config changes

Honest cautions

Add your own IP to ignoreip so repeated typos don't ban you. If you do get banned, wait out the bantime or use a provider console — EQVPS gives every VPS one.
fail2ban complements, not replaces, SSH keys. Keys stop the guessing from ever succeeding; fail2ban stops the noise and guards other services too.
Tune to taste: a longer bantime deters persistent attackers; too aggressive and you risk banning legitimate flaky connections.

Next steps

fail2ban is one layer of a hardened server. Combine it with SSH key authentication and a UFW firewall, and walk the full new-VPS security checklist before you expose anything to the internet.

FAQ

What does fail2ban actually do?

It watches log files (like the SSH auth log) for repeated failures from the same IP, and when an IP crosses a threshold it adds a temporary firewall ban. The bots that hammer port 22 all day get blocked after a few tries instead of guessing forever. It's automatic, ongoing protection.

Do I still need fail2ban if I use SSH keys?

They solve different problems. SSH keys make guessing effectively impossible; fail2ban stops the noise and load of endless attempts, and protects any other service you expose (mail, web logins). With key-only SSH the risk is already low, but fail2ban is cheap defence in depth and cuts log spam.

Will fail2ban ban me by mistake?

It can, if you fat-finger your own password several times — you'd be banned for the bantime, then automatically unbanned. To avoid ever locking yourself out, add your own IP to 'ignoreip' in the config, and remember a provider console (EQVPS has one) always gets you back in.

How do I see who's banned, or unban an IP?

Use 'sudo fail2ban-client status sshd' to see the jail and banned IPs. To lift a ban: 'sudo fail2ban-client set sshd unbanip 1.2.3.4'. To add a trusted IP permanently, put it in ignoreip and reload.

What are bantime, findtime and maxretry?

maxretry is how many failures are allowed, findtime is the window they're counted in, and bantime is how long the ban lasts. For example 5 failures within 10 minutes triggers a 1-hour ban. Raise bantime (or set it to a longer value) for more persistent attackers.

Comments

No comments yet. Be the first.