Guide to Installing Fail2Ban on Linux to Protect SSH

Thanh Hien Content has been moderated

Published date:18/7/2026 Update:24/7/2026 Views:165 Reviews: 4.9/5118reviews

Guide to installing Fail2Ban on Ubuntu, Debian, AlmaLinux, Rocky Linux, and CentOS. Configuring Fail2Ban helps automatically detect and block password-guessing IPs and protect SSH from brute force attacks.

Knowledge fail2banssh

While checking SSH logs on a Linux VPS, you notice many unfamiliar IP addresses continuously attempting to log in to the root account. As shown in the image below, a series of Failed password lines from multiple IP addresses appeared in a short period. This is a common sign of Internet bots performing SSH Brute Force attacks to guess the server password.

Installing Fail2Ban on Linux helps the VPS automatically detect and block IP addresses that repeatedly attempt SSH logins with incorrect passwords.

Today, VPTS will guide you on how to install Fail2Ban on Linux to automatically detect and block IP addresses that are spamming connections or failing SSH logins too many times. This article provides installation instructions for Fail2Ban on two popular Linux OS families: Ubuntu/Debian and CentOS Stream/RHEL/AlmaLinux/Rocky Linux. The steps are presented in detail so that even beginners can verify their operating system, install the correct software packages, and configure Fail2Ban to protect SSH.

1. What is Fail2Ban?

Fail2Ban is an open-source security tool for Linux designed to monitor system logs and automatically ban IP addresses exhibiting too many failed login attempts. It operates by scanning log files such as /var/log/auth.log or systemd journals, then generating IP blocking rules via the server's firewall.

Fail2Ban is commonly used to protect SSH from brute-force attacks and can also be configured for various other services like Nginx, Apache, FTP, and Postfix. When an IP address exceeds the allowable number of failed login attempts within a specified timeframe, Fail2Ban temporarily adds that IP to the ban list.

However, Fail2Ban does not completely replace strong passwords, SSH Keys, or firewalls. To better protect your Linux VPS, you should combine Fail2Ban with SSH Key authentication, restrict root login, and update your operating system regularly.

Before installing Fail2Ban on Linux, you should identify the active SSH port and the administrative IP address that needs to be whitelisted.

2. Quickly Install Fail2Ban on Linux

Fail2Ban installation steps on Linux differ slightly between Ubuntu, Debian, AlmaLinux, Rocky Linux, and CentOS.

2.1. For Ubuntu and CentOS:

For Ubuntu and Debian, run the following commands sequentially:

sudo apt update
sudo apt install fail2ban -y

2.2. For AlmaLinux 8

Step 1: Install repository management tools

sudo dnf install -y dnf-plugins-core

Step 2: Enable the PowerTools repository

sudo dnf config-manager --set-enabled powertools

Step 3: Install the EPEL repository

sudo dnf install -y epel-release
sudo dnf makecache

Step 4: Install Fail2Ban

sudo dnf install -y fail2ban fail2ban-firewalld

AlmaLinux 8 uses the repository name powertools; AlmaLinux 9 switched to crb. The Fail2Ban package for Enterprise Linux is provided via EPEL.

2.3. For CentOS

Step 1: Install repository management tools

sudo dnf install -y dnf-plugins-core

Step 2: Enable the CRB repository

sudo dnf config-manager --set-enabled crb

Step 3: Install EPEL and EPEL Next

sudo dnf install -y epel-release epel-next-release
sudo dnf makecache

Step 4: Install Fail2Ban

sudo dnf install -y fail2ban fail2ban-firewalld

2.4. Check Fail2Ban service

After installation is complete, check whether the Fail2Ban service is running using the command:

sudo systemctl status fail2ban

If the result shows Active: active (running), that means Fail2Ban has been installed and is running normally on the server.

3. Configure Fail2Ban to protect SSH

3.1. Create SSH protection configuration file

Open the configuration file using the Nano editor:

sudo nano /etc/fail2ban/jail.d/sshd.local

If the server uses the default SSH port 22, paste the entire following content:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
bantime = 1h
findtime = 10m
maxretry = 5

[sshd] enabled = true
port = 22
filter = sshd
backend = systemd

How to save files in Nano

After pasting the content into Nano, perform the following in sequence:

Press Ctrl + O.
Nano will ask for the filename; keep it unchanged and press Enter.
Press Ctrl + X to exit.

3.2. Meaning of Fail2Ban parameters

Specifications	Sample value	Meaning
ignoreip	127.0.0.1/8 ::1	IP addresses not blocked by Fail2Ban
bantime	1h	IP ban time is 1 hour
findtime	10m	Time window for Fail2Ban to monitor login failures
maxretry	5	Maximum failed login attempts
enabled	true	Enable SSH jail
port	22	SSH port needs protection
filter	sshd	Log filter for SSH
backend	systemd	Read SSH events from systemd journal

3.3. Check Fail2Ban configuration file

Before starting Fail2Ban, run the command:

sudo fail2ban-client -t

If an error occurs, do not restart Fail2Ban immediately. Check the common causes:

Missing section name [sshd].
Misspelling enabled = true.
Entered wrong time unit.
Using unusual characters when copying content.
Configure both parameters on the same line.
Entered wrong file name or wrong directory.

You can reopen the file using the command:

sudo nano /etc/fail2ban/jail.d/sshd.local

3.4. Start and enable Fail2Ban with the system

After valid configuration, activate Fail2Ban:

sudo systemctl enable --now fail2ban

This command performs two tasks simultaneously:

Start the Fail2Ban service immediately.
Enable Fail2Ban to run automatically on server boot.

Restart service to load configuration:

sudo systemctl restart fail2ban

Check status:

sudo systemctl status fail2ban --no-pager -l

If operating normally, the output will contain the line:Active: active (running)

3.5. Check if Fail2Ban has protected SSH

To confirm that the Fail2Ban installation on Linux was successful, check the jail list and the status of the sshd jail.

Run command:

sudo fail2ban-client status

A correct result will look similar to:

Status

|- Number of jail: 1

`- Jail list: sshd

If the Jail list line contains sshd, Fail2Ban has enabled SSH protection.

Continue running:

sudo fail2ban-client status sshd

Results may display:

Status for the jail: sshd

|- Filter

| |- Currently failed: 0

| `- Total failed: 0

`- Actions

|- Currently banned: 0

|- Total banned: 0

`- Banned IP list:

4. How to block and unblock IPs using Fail2Ban

4.1. Manually block an IP address

Syntax:

sudo fail2ban-client set sshd banip DIA_CHI_IP

Then check again:

sudo fail2ban-client status sshd

The IP address will appear in the Banned IP list section.

4.2. Unblock an IP address

Syntax:

sudo fail2ban-client set sshd unbanip DIA_CHI_IP

Check the list again:

sudo fail2ban-client status sshd

Check SSH logs

Command to check SSH logs:

sudo grep "Failed password" /var/log/auth.log | tail -n 20

If multiple Failed password lines appear from the same or multiple IP addresses, your VPS is likely being subjected to brute force attacks on the SSH service by bots. This is when Fail2Ban comes into play by automatically blocking IPs with abnormal login behavior.

Completing the Fail2Ban installation on Linux is only the first step; you should still combine it with SSH keys, strong passwords, and restricting root account logins.

Frequently asked questions about Fail2Ban

Is Fail2Ban a firewall?

No. Fail2Ban is a log-monitoring tool that detects suspicious behavior. When a violating IP is detected, Fail2Ban instructs the system firewall to block the IP.

Does Fail2Ban affect normal SSH connections?

Usually not. Fail2Ban only blocks IP addresses that exceed the configured number of failed login attempts. However, you should add trusted management IPs to ignoreip to avoid locking yourself out.

Can Fail2Ban protect a custom SSH port?

Yes. You just need to specify the correct port number in the port parameter.

6. Conclusion

In this article, VPTS has guided you on how to install Fail2Ban on Linux to protect SSH against Brute Force attacks. After configuration, Fail2Ban automatically monitors login logs, detects IP addresses showing suspicious behavior, and temporarily blocks them using the firewall.

Alongside Fail2Ban, you should also combine SSH Keys, strong passwords, disabling root login, and regularly updating the operating system to increase security for your Linux VPS or server.

Enter the description for the post here.

VPTS – Comprehensive Digital Infrastructure Solutions Provider

VPTS is a digital infrastructure solution provider in Vietnam, serving deployment, operation, and data storage needs for individuals, developers, and enterprises. The service ecosystem includesVietnam VPS, International VPS, VPS Anti DDoS, Hosting cPanel, dedicated server, Rack rental, Proxy IPv4/IPv6, S3 MinIOandCloud Storage.

Besides providing infrastructure resources, VPTS also focuses on assisting customers with deployment, configuration, and practical troubleshooting. Content on the VPTS Blog is drawn from common scenarios in operating VPS, servers, and online systems, helping readers understand root causes and apply clear solutions.

VPTS – Stable infrastructure, flexible solutions, and continuous partnership throughout operations.