Security
What is fail2ban?
fail2ban monitors log files for repeated authentication failures and temporarily firewalls the offending addresses. It reduces log noise and slows brute-force attempts, and it is genuinely useful in front of services that must accept passwords. It is not a substitute for disabling password authentication on SSH, which removes the attack class entirely rather than throttling it — a key-based login cannot be brute-forced at all.
Why fail2ban matters
It reduces log noise and slows brute-force attempts, and it is genuinely useful in front of services that must accept passwords. It is not a substitute for disabling password authentication on SSH, which removes the attack class entirely rather than throttling it — a key-based login cannot be brute-forced at all. Tune it carefully: an aggressive findtime and maxretry will eventually ban you from your own server, which is one of the more common reasons people discover their provider has no out-of-band console. Modern equivalents such as sshguard and CrowdSec work the same way, and nftables can express simple rate limits without any daemon at all.
fail2ban in practice
Running fail2ban means reading /var/log/fail2ban.log and watching which jails trigger. Tune findtime, maxretry and bantime to your actual traffic; the defaults assume more patience than your users have. A wrong config bans you mid-migration and you discover your provider has no out-of-band console. That is the cost of getting it wrong: you are locked out with no recovery but a reboot.
What people get wrong about fail2ban
People treat fail2ban as a fix for SSH brute-force. It is not; it only throttles. The correction: disable password auth entirely, use keys. fail2ban then becomes what it is for — noise reduction — instead of a false shield.
fail2ban — common questions
What is the difference between fail2ban and a firewall?
A firewall is a static rule set, usually unchanging. fail2ban dynamically adds temporary blocks when it sees repeated authentication failures. A firewall still helps, but it is not fail2ban's replacement.
Does fail2ban work with UFW?
Yes, on Ubuntu. fail2ban can integrate with UFW to add and remove rules. You should still test the integration before relying on it, since defaults vary by distribution.
Where fail2ban comes up
- How do I secure a new VPS? Five steps cover the overwhelming majority of real-world compromises: key-based SSH with password authentication disabled, no direct root login, a default-…
- How do I stop SSH brute-force attacks? Disable password authentication entirely — brute force against key-based SSH is not possible. Add fail2ban to reduce log noise, and consider moving SSH off…
- Secure a new VPS in 10 minutes Five changes eliminate essentially every automated attack against a new server: key-based SSH with passwords disabled, no direct root login, a default-deny…
More from security
- LUKS
- LUKS is the standard Linux full-disk encryption format, storing key material in a header on the encrypted volume itself.
- DDoS
- A DDoS attack floods a target with traffic or expensive requests from many sources at once, to exhaust bandwidth, connection state or processing capacity.
- Traffic scrubbing
- Scrubbing routes traffic through filtering infrastructure that discards attack packets and forwards legitimate ones.
- Null route
- A null route discards all traffic to an IP address, protecting the wider network by making the target completely unreachable.