Install and configure Fail2ban on a Linux VPS

Fail2ban watches log files for repeated failed logins and blocks the offending IP addresses in the firewall for a while. It sharply cuts brute-force noise against SSH, mail and web logins. This guide covers a clean Fail2ban setup on Ubuntu, Debian, AlmaLinux and Rocky Linux.

Before you start

• Root SSH access and your own public IP (check it with the IP checker) so you can whitelist it.
• A working firewall backend: nftables, iptables, firewalld or UFW.
• On cPanel/WHM servers use CSF/LFD or cPHulk instead; running Fail2ban alongside them causes conflicts.

Install Fail2ban

Ubuntu/Debian:

apt update && apt install fail2ban

AlmaLinux/Rocky (from EPEL):

dnf install epel-release && dnf install fail2ban

Enable and start it:

systemctl enable --now fail2ban

Create jail.local

Never edit jail.conf; package updates overwrite it. Create /etc/fail2ban/jail.local:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 198.51.100.25
bantime  = 1h
findtime = 10m
maxretry = 5
bantime.increment = true
backend = systemd

[sshd]
enabled = true
port    = ssh

• ignoreip: addresses never banned. Replace 198.51.100.25 with your own IP.
• maxretry failures within findtime trigger a ban lasting bantime.
• bantime.increment makes repeat offenders' bans grow longer.
• backend = systemd reads the journal, needed on systems without /var/log/auth.log. If SSH runs on another port, set port = 2222.

On AlmaLinux with firewalld, also add banaction = firewallcmd-rich-rules under [DEFAULT].

Apply the config:

systemctl restart fail2ban

Protect Nginx or Apache logins

Fail2ban ships filters for common services. Add to jail.local for Nginx basic-auth failures:

[nginx-http-auth]
enabled = true
logpath = /var/log/nginx/error.log
backend = auto

For Apache use [apache-auth] with logpath = /var/log/apache2/error.log (or /var/log/httpd/error_log). List the filters available with ls /etc/fail2ban/filter.d/.

Check status and manage bans

fail2ban-client status

fail2ban-client status sshd

The second command shows failed attempts and the list of banned IPs. To unban an address:

fail2ban-client set sshd unbanip 203.0.113.50

To test a filter against a log before enabling it:

fail2ban-regex /var/log/nginx/error.log /etc/fail2ban/filter.d/nginx-http-auth.conf

Troubleshooting

• Fail2ban will not start: run fail2ban-client -t to test the config, and read journalctl -u fail2ban. A logpath that does not exist is the most common cause.
• Jail shows 0 failures while attacks happen: wrong backend or log path. Use backend = systemd for sshd on modern distros.
• You banned yourself: log in from another IP or the provider console and run the unbanip command, then add your IP to ignoreip.

Fail2ban FAQ

Is Fail2ban enough to secure SSH?

It helps, but SSH keys with password logins disabled are the real protection. Fail2ban then mostly reduces log noise.

Fail2ban or CSF: which should I use?

On cPanel/WHM servers use CSF with LFD, which integrates with WHM. On a plain Linux VPS Fail2ban is simpler and lighter.

Do bans survive a restart?

Yes. Fail2ban stores bans in its database and restores active ones when it starts.

Next steps

• Set up SSH key authentication
• SSH lockdown checklist
• Install and configure CSF on WHM