fail2ban: ban hosts that fail to log in too often
The standard intrusion-prevention daemon on Linux servers: it watches logs or the journal for repeated failures and adds temporary firewall rules against the offending addresses.
Drafted with AI from official documentation. Scripts were run in a test environment and repository links verified. Awaiting a human check. Did it work for you? Last edited Outdated?
fail2ban/fail2ban
- Stars
- 18.8k
- Forks
- 1.5k
- Language
- Python
- Licence
- NOASSERTION
- Last push
- 10 Oct 2026
On GitHub: Daemon to ban hosts that cause multiple authentication errors
Open on GitHubfail2ban (about 18,800 stars on GitHub) is a Python daemon that has been protecting Linux servers for two decades. It is built from three parts: filters (regular expressions that recognize a failure line in a log), jails (a filter plus a log source plus thresholds) and actions (what to do when the threshold is crossed, normally adding an nftables or iptables rule for a while). It ships filters for sshd, nginx, Apache, Postfix, Dovecot, vsftpd, Asterisk and dozens more.
When to use it
- Any server with SSH or another login service exposed to the internet, even with passwords disabled, to keep logs readable and load low.
- Web applications with a login form, by writing a small filter for your application’s failure log line.
- Not sufficient on its own against distributed attacks; combine with key-only SSH and a firewall that exposes as little as possible.
How to install it
Use the distribution package rather than the source checkout; configuration lives in /etc/fail2ban/:
Check before you run this
- Runs with administrator rights. Make sure you understand every line.
sudo apt install fail2ban # Debian / Ubuntu
sudo dnf install epel-release && sudo dnf install fail2ban # RHEL / Rocky / Alma
sudo systemctl enable --now fail2ban
sudo fail2ban-client statusPut your settings in jail.local, never in jail.conf. The how-to in this topic has a working configuration including the backend = systemd line that journal-only Debian 12 systems need. The repository’s wiki holds the reference for filters, actions and writing your own regular expressions, and fail2ban-regex from the same package tests a filter against a log file.
Credit
fail2ban was started by Cyril Jaquier in 2004 and is maintained by Sergey Brester and the fail2ban contributors. It is released under the GPL-2.0 license.
Did this work for you?
No votes yet. Be the first.
If it did not work, the report form below tells the editors what went wrong.
See also
- 0276 What is SSH? SSH is a secure way to open a command line on another computer over the network, with everything encrypted. Beginner · Explains an idea · Any system Article SSH 15 Oct 2026
- 0322 Fix: user is not in the sudoers file sudo refuses because your account is not allowed to use it. Add the user to the sudo group (Debian, Ubuntu) or wheel… Beginner · Fixes an error · Linux, macOS Article Server hardening · Users, sudo & hardening 15 Oct 2026
- 0345 SSH keys: create, copy and use them Generate an ed25519 key pair, install the public key on a server with ssh-copy-id, keep the private key protected with a passphrase… Beginner · Step by step · Linux, macOS, Windows Article Keys & config · SSH 15 Oct 2026
- 0346 The SSH config file: aliases, jump hosts and keys per server Reference for ~/.ssh/config: short names for servers, the right user, port and key per host, ProxyJump through a bastion, connection reuse and… Intermediate · Cheat sheet · Linux, macOS, Windows Article Keys & config · SSH 15 Oct 2026
- 0352 Harden a fresh Linux server in 30 minutes The baseline for any new Debian, Ubuntu or RHEL-family server: updates on, a non-root user with sudo, SSH keys only, a firewall… Beginner · Step by step · Linux Article Server hardening · Users, sudo & hardening 15 Oct 2026
- 0353 fail2ban: block repeated failed logins Install fail2ban, enable the sshd jail with sane ban times, whitelist your own address, read the ban list, unban someone, and add… Intermediate · Step by step · Linux Article Server hardening · SSH 15 Oct 2026
History
Every saved edit is kept. The plot on the sleeve draws one line per edit. Open any edit to see exactly what changed.
- Dominik +1,769 chars