Protect SSH from brute-force attacks with Fail2ban

Fail2ban watches your logs for repeated failed logins and blocks the offending IP address in the firewall for a while. It cuts noise in your logs and makes password guessing far slower.

1. Install

Ubuntu and Debian:

sudo apt install -y fail2ban

AlmaLinux and Rocky Linux get it from EPEL:

sudo dnf install -y epel-release
sudo dnf install -y fail2ban

2. Create jail.local

Never edit jail.conf; updates overwrite it. Put your settings in jail.local:

sudo nano /etc/fail2ban/jail.local

[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5
ignoreip = 127.0.0.1/8 ::1

[sshd]
enabled = true

If you have a fixed home or office IP, add it to ignoreip (space separated) so you can never ban yourself. If SSH runs on another port, add port = 2222 under [sshd].

Debian 12 only: Debian 12 logs to the systemd journal and has no /var/log/auth.log by default, so tell the jail to read the journal. Add this line under [sshd]:

backend = systemd

3. Start it

sudo systemctl enable --now fail2ban
sudo systemctl status fail2ban --no-pager

4. Check bans

sudo fail2ban-client status
sudo fail2ban-client status sshd

The second command shows how many failures were seen and which IPs are banned right now.

Unban an address

sudo fail2ban-client set sshd unbanip 198.51.100.7

Troubleshooting

• Fail2ban will not start: run sudo fail2ban-client -t to test the configuration. On Debian 12, a missing log file error means backend = systemd is not set.
• No bans ever appear: check the jail reads the right port and log. sudo fail2ban-client get sshd logpath and sudo fail2ban-client get sshd journalmatch show what it watches.
• Rules not visible in UFW or firewalld: Fail2ban adds its own chains or ipsets. Check sudo fail2ban-client status sshd rather than the firewall rule list.

Next steps

• Set up a UFW firewall
• Monitor CPU, memory, disk and logs