Kingsfordweg 151, 1043GR Amsterdam, The Netherlands ● 24/7 support — support@novogara.com
Novogara BV
Knowledge base

fail2ban

Any server on a public address sees thousands of login attempts a day. fail2ban turns that noise into a short ban list.

How it works

It reads log files, matches failure patterns, and after N failures from one address in a time window it inserts a firewall rule. After the ban time the rule is removed. That is the whole idea, and it is remarkably effective against the automated traffic that makes up most of the attempts.

apt install fail2ban — then configure in /etc/fail2ban/jail.local, never in jail.conf, which is replaced on upgrade.

Whitelist yourself first

Before anything else:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 203.0.113.0/24

Put your office range in there. Locking yourself out of your own server with your own tool is a rite of passage you can skip — and if you do manage it, remote KVM is how you get back in.

Jails worth enabling

[sshd]
enabled = true
maxretry = 4
findtime = 10m
bantime = 24h

Then, depending on what the machine runs: nginx-http-auth, nginx-botsearch, nginx-limit-req, postfix-sasl, dovecot, and your control panel's own jail if it ships one.

Long bans are fine. These are not customers; a 24-hour ban on an address that tried four passwords costs you nothing.

Check it is actually working

fail2ban-client status — which jails are active

fail2ban-client status sshd — currently and totally banned

If the counts are zero after a day on a public address, the filter is not matching your log format. Test the regex against the real file:

fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

To release an address:

fail2ban-client set sshd unbanip 203.0.113.5

Be clear about what it is not

fail2ban is a noise filter, not a defence:

  • It does nothing against a distributed attack from thousands of addresses
  • It reacts after the fact, so the first attempts always get through
  • It is no substitute for key-based SSH. With PasswordAuthentication no there is nothing to brute force at all — see securing a new server.
  • It does not stop a volumetric attack; that is DDoS filtering, and it happens upstream of your machine

Think of it as the thing that keeps your logs readable, with a security benefit attached. The real locks are keys, a firewall and patches.

Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base