Protect Plesk with Fail2Ban (IP address banning)

Fail2Ban watches log files for repeated failed logins and temporarily blocks the offending IP address in the firewall. Plesk includes it as IP Address Banning, with ready-made jails for SSH, mail, FTP, the Plesk panel and WordPress. Enabling it is one of the quickest ways to cut brute-force traffic on a Plesk server.

Before you start

• Administrator access to Plesk on a VPS or dedicated server.
• Your own public IP address, so you can whitelist it. Find it with the IP checker.
• If the component is missing, install it in Tools & Settings → Updates → Add/Remove Components → Plesk hosting features → Fail2Ban.

Turn on Fail2Ban

1. Go to Tools & Settings → Security → IP Address Banning (Fail2Ban).
2. Open the Settings tab.
3. Tick Enable intrusion detection.
4. Set the defaults:
   • IP address ban period – 600 seconds is the default; 3600 or more is common.
   • Time interval for detection of subsequent attacks – the window in which failures are counted, for example 600 seconds.
   • Number of failures before the IP address is banned – 5 is sensible.
5. Click OK.

Activate jails

Open the Jails tab. Each jail combines a log filter and an action. Turn on at least:

• plesk-panel – failed Plesk logins.
• ssh – SSH brute force.
• plesk-postfix and plesk-dovecot – SMTP and IMAP/POP3 password guessing.
• plesk-proftpd – FTP logins.
• plesk-wordpress – WordPress login attacks on sites managed by WP Toolkit.
• recidive – bans repeat offenders for much longer.

Select a jail and click Switch On. Click a jail's name to override its ban time or retry count.

Whitelist trusted addresses

1. Open the Trusted IP Addresses tab.
2. Click Add Trusted IP and enter your office IP, monitoring service or a CIDR range.
3. Click OK. Trusted addresses are never banned.

Unban an IP address

1. Open the Banned IP Addresses tab.
2. Find the address (use the search box) and see which jail banned it.
3. Select it and click Unban, or Trust to unban and whitelist it in one step.

Custom jails

In the Jails tab, click Add Jail to combine an existing filter with a log path, or use Manage Filters to write a new regular expression. For complex rules see writing a custom Fail2Ban filter.

Troubleshooting

• Nothing is banned: the jail may watch the wrong log file or the server uses a different firewall backend. Check Logs in the Fail2Ban screen.
• Locked out of Plesk: connect through your provider's console (for example the Virtualizor VNC console) and run fail2ban-client set plesk-panel unbanip YOUR.IP.
• Bans disappear after restart: that is normal; bans are temporary. Use recidive for long-term blocks.

Next steps

• Configure the Plesk Firewall.
• Harden Plesk with Security Advisor.
• Unban an IP address in Fail2Ban.