Security guide

How to Install and Configure Fail2ban on Linux

By Gander Web · Published 16 October 2026 · 3 min read

Short answer

Install the package, create /etc/fail2ban/jail.local with your ban settings and an [sshd] section, then restart Fail2ban. With the settings below, an IP address that fails to log in five times in ten minutes is blocked in the firewall for an hour.

Fail2ban reads your logs or the systemd journal, counts failed logins from each IP address, and adds a firewall rule to block any address that goes over the limit. It cuts the noise and load from password-guessing bots. It doesn't replace SSH keys: once password logins are off, guessing can't succeed anyway. Use both.

Install Fail2ban

On Ubuntu and Debian:

sudo apt update
sudo apt install fail2ban python3-systemd

On AlmaLinux and Rocky Linux, Fail2ban comes from the EPEL repository and isn't started for you:

sudo dnf install epel-release
sudo dnf install fail2ban
sudo systemctl enable --now fail2ban

Check it's running:

sudo systemctl status fail2ban

Create jail.local

Don't edit jail.conf, because package updates replace it. Put your settings in jail.local, which Fail2ban reads after jail.conf and which updates leave alone:

sudo nano /etc/fail2ban/jail.local

Paste this, replacing 203.0.113.10 with your own home or office IP address:

[DEFAULT]
# never ban these addresses
ignoreip = 127.0.0.1/8 ::1 203.0.113.10
# ban for 1 hour after 5 failures within 10 minutes
bantime  = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
backend = systemd

ignoreip: addresses that are never banned. Separate them with spaces.
bantime, findtime, maxretry: how long a ban lasts, the window failures are counted in, and how many failures trigger a ban. Units such as 30m, 1h and 1d work.
backend = systemd: reads SSH failures from the systemd journal. Debian 12 doesn't write /var/log/auth.log by default, so without this line the sshd jail can fail to start.

On AlmaLinux and Rocky, delete the backend line: SSH failures are written to /var/log/secure, which Fail2ban finds by default. If SSH listens on a port other than 22, add port = 2222 (with your port) to the [sshd] section.

Apply and check

sudo fail2ban-client -t
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

-t tests the configuration and reports mistakes before you restart. The last command shows how many failures Fail2ban has counted, how many addresses are banned now, and which ones. To watch bans happen, follow the log:

sudo tail -f /var/log/fail2ban.log

Unban an IP address

sudo fail2ban-client set sshd unbanip 203.0.113.10

To clear every ban at once, run sudo fail2ban-client unban --all. If you've banned yourself and can't connect, log in through the browser console for your VPS in Virtualizor and run the command there, or wait for the ban to expire. Adding your IP to ignoreip stops it happening again.

Ban repeat offenders for longer

The same bots come back once a ban expires. With incremental bans, each new ban for the same address lasts about twice as long as the last. Add these lines under [DEFAULT] and restart Fail2ban:

bantime.increment = true
bantime.maxtime = 1w

Protect other services

Fail2ban ships filters for many services. To ban addresses that fail Nginx password prompts or probe for admin pages, add:

[nginx-http-auth]
enabled = true

[nginx-botsearch]
enabled = true

These read Nginx's error log (/var/log/nginx/error.log), so don't add the backend = systemd line to them. List the filters available on your server with ls /etc/fail2ban/filter.d/, and restart Fail2ban after each change.

UK VPS hosting with full root access

Guaranteed AMD EPYC cores, SSD RAID storage and DDoS protection on every plan, from £5.99 a month with no VAT to add. Need faster cores? Upgrade to Ryzen.

See VPS plans

Questions

Does Fail2ban work with UFW?

Yes. Fail2ban adds its own firewall rules, which work alongside UFW. If you'd rather see bans in ufw status, set banaction = ufw under [DEFAULT] and restart Fail2ban.

Do I still need Fail2ban if I use SSH keys?

Keys stop password guessing from ever succeeding. Fail2ban still cuts the log noise and load from bots, and protects services that do use passwords, such as mail and web logins.

How do I see which IPs are banned?

Run sudo fail2ban-client status sshd. The banned IP list is at the bottom of the output.

Why won't the sshd jail start on Debian 12?

Debian 12 logs SSH to the systemd journal instead of /var/log/auth.log, so Fail2ban finds no log file. Add backend = systemd to the [sshd] section and restart Fail2ban.

How to Secure a Linux VPS: The First Steps That Matter How to Set Up SSH Keys and Turn Off Password Logins How to Set Up a UFW Firewall on Ubuntu and Debian DDoS Protection for a VPS: What You Need to Know

Sources

Commands are for Ubuntu 24.04, Debian 12 and AlmaLinux 9, as of 16 October 2026. If something here no longer matches what you see, tell us and we'll update it.