Block brute-force attempts with Fail2ban

Automated bots constantly try to guess passwords on every public server. Fail2ban watches the login logs and temporarily blocks any address that fails too many times. It is a simple, widely used safety net for SSH.

Before you begin

• A sudo-enabled user logged in over SSH.
• SSH working with your key. Fail2ban is still useful with key-only logins, because it cuts down the noise and load from bots.
• Your own public IP address, so you can keep yourself from being banned by accident. Find it with a search for "what is my IP address."

Step 1: Install Fail2ban

Refresh the package list, then install the package. Fail2ban starts automatically once it is installed:

sudo apt update
sudo apt install -y fail2ban

Step 2: Create a local configuration file

Fail2ban's default file, jail.conf, is overwritten during upgrades. Put your settings in jail.local, which takes priority and is safe to edit:

sudo nano /etc/fail2ban/jail.local

Enter the following, replacing the example address with your own:

[DEFAULT]
bantime   = 1h
findtime  = 10m
maxretry  = 5
backend   = systemd
ignoreip  = 127.0.0.1/8 198.51.100.7

[sshd]
enabled   = true
port      = ssh

The settings mean this: an address that fails 5 times within 10 minutes is banned for 1 hour. backend = systemd tells Fail2ban to read login records from the journal, which is where Ubuntu 24.04 logs SSH. ignoreip lists addresses that are never banned, including your own. Save with Ctrl+O, then exit with Ctrl+X.

Step 3: Start Fail2ban and enable it at boot

Restart the service so it reads your new file, and enable it so it starts after a reboot:

sudo systemctl restart fail2ban
sudo systemctl enable fail2ban

Synchronizing state of fail2ban.service with SysV service script...
Created symlink /etc/systemd/system/multi-user.target.wants/fail2ban.service.

Step 4: Check the SSH jail

A "jail" is one protected service with its own rules. List the active jails first:

sudo fail2ban-client status

Status
|- Number of jail:      1
`- Jail list:   sshd

Then look at the SSH jail itself. Currently banned shows how many addresses are blocked right now:

sudo fail2ban-client status sshd

Status for the jail: sshd
|- Filter
|  |- Currently failed:   0
|  |- Total failed:       12
|  `- Journal matches:    _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned:   1
   |- Total banned:       3
   `- Banned IP list:     203.0.113.23

Step 5: Read the Fail2ban log

Every ban and unban is recorded in a log file. Reading the last few lines tells you what has happened recently:

sudo tail -n 20 /var/log/fail2ban.log

Lines containing Ban show a blocked address, and Unban lines show when a ban expired.

Step 6: Unblock an address

If you were banned by mistake, for example after mistyping your password many times, remove the ban with unbanip. Replace the address with the one that was blocked:

sudo fail2ban-client set sshd unbanip 203.0.113.23

Troubleshooting

• The sshd jail is missing from the list. There is a typo in jail.local, most often in the [sshd] header. Check it, then run sudo systemctl restart fail2ban. The service status shows any startup error: sudo systemctl status fail2ban --no-pager.
• Failures are happening, but nothing gets banned. The jail may not be reading the SSH logs. Confirm that SSH messages reach the journal with sudo journalctl -u ssh --no-pager -n 5, and that backend = systemd is set.
• You banned yourself. Run the unbanip command from Step 6, then add your address to ignoreip.
• Fail2ban did not start after a reboot. Run sudo systemctl enable fail2ban again and confirm with systemctl is-enabled fail2ban, which should print enabled.

Next steps

Your server now resists both password guessing and automated bots. Next, point a domain name at it so people can reach your services by name.