Fail2ban — Auto-Block Brute Force

~15 min · fail2ban, brute-force, linux, logwatching

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

Read the auth log, ban the offenders

Fail2ban watches log files for failed-login signatures and automatically blocks offending IPs at the firewall layer. After N failed attempts within M minutes, the IP gets a temporary ban. Even with key-only auth (which makes brute-force pointless), fail2ban cuts the noise in your auth logs and reduces the surface for slow-burn attacks.

The basic SSH jail

Fail2ban ships with a battle-tested SSH jail. You usually only override the threshold and ban duration in jail.local (never jail.conf — that gets overwritten by package upgrades). Set maxretry, findtime, bantime, and ignoreip for your LAN.

Code

Install and configure (Linux)·bash

# Install
sudo apt install fail2ban
sudo systemctl enable --now fail2ban

# Create local config (NEVER edit jail.conf directly)
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Minimal SSH jail in jail.local·ini

[sshd]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3
findtime = 600        # within 10 minutes
bantime  = 3600       # ban for 1 hour
ignoreip = 127.0.0.1/8 192.168.1.0/24 100.64.0.0/10  # localhost + LAN + Tailscale

Operate·bash

# Reload after editing
sudo systemctl restart fail2ban

# See banned IPs and stats
sudo fail2ban-client status sshd

# Manually unban (e.g., yourself after a typo storm)
sudo fail2ban-client set sshd unbanip 203.0.113.50

# Tail what fail2ban is seeing
sudo tail -f /var/log/fail2ban.log

External links

Fail2ban official docs

Exercise

On a Linux box you control (cloud VM or homelab Linux), install fail2ban and set up the SSH jail above. After 24 hours, run sudo fail2ban-client status sshd and look at the cumulative ban count. Public-facing servers typically rack up dozens to hundreds of bans per day. Even with key-only auth, that's a real measurement of how much background scanning your IP attracts.

Progress

Progress is local-only — sign in to sync across devices.

← PreviousKey-Only Access & Restrictions Next →Port Changing — Noise, Not Security

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.