How to Install and Use Fail2ban (Stop SSH Brute-Force)

If your SSH logs are full of failed login attempts, fail2ban is the answer. It watches your logs and automatically bans any IP that fails too many times — turning a constant stream of attacks into background noise. Here is how to set it up.

Step 1: install it

On Debian/Ubuntu and RHEL-family systems it is one package:

# Debian / Ubuntu
sudo apt install fail2ban

# RHEL / AlmaLinux / Rocky
sudo dnf install fail2ban

Step 2: create a local config

Never edit the shipped config directly — it gets overwritten on updates. Create a jail.local that overrides it:

sudo nano /etc/fail2ban/jail.local

A sensible SSH jail looks like this:

[sshd]
enabled  = true
port     = ssh
maxretry = 4
findtime = 10m
bantime  = 1h

That bans an IP for one hour after four failed attempts within ten minutes. Raise bantime for repeat offenders.

Step 3: start and enable it

sudo systemctl enable --now fail2ban

Step 4: check status and bans

# overall status
sudo fail2ban-client status

# the SSH jail (shows banned IPs)
sudo fail2ban-client status sshd

Unbanning an IP (e.g. yourself)

Banned your own IP by mistake? Unban it:

sudo fail2ban-client set sshd unbanip 1.2.3.4

Fail2ban will not stop a targeted attacker, but it makes your server invisible to the endless background noise of credential-guessing bots.

Combine it with key-only SSH and a firewall for proper protection — all in the VPS hardening checklist.

Whitelist your own IP so you never lock yourself out

The most common fail2ban mishap is banning your own address after a few fat-fingered logins. Add your static IP (and any office/home ranges) to the ignoreip setting in jail.local so fail2ban never bans you, then reload the service.

Protecting more than just SSH

Fail2ban ships with jails for far more than SSH — web logins, mail (Postfix/Dovecot), FTP and WordPress with the right filter. Enable the jails that match the services you actually run, so brute-force protection covers your whole stack, not only the shell.

How to keep fail2ban effective

• Put all changes in jail.local, never jail.conf, so updates don't wipe them.
• Whitelist your own trusted IPs with ignoreip.
• Increase bantime for repeat offenders (or use recidive jail).
• Pair it with key-only SSH so brute-force is impossible even before bans kick in.

Related guides

Fail2ban is one layer. Combine it with hardened SSH, a UFW firewall, and the wider VPS hardening checklist. If you're seeing an SSH cutoff rather than a ban, see too many authentication failures.