How to Install and Configure Fail2ban on an Ubuntu VPS Print

How to Install and Configure Fail2ban on an Ubuntu VPS

Fail2ban is an open-source intrusion prevention tool that helps protect Linux servers against repeated authentication failures and automated brute-force attacks.

It monitors system logs for suspicious activity and temporarily blocks offending IP addresses using firewall rules.

In this guide, you will learn how to install and configure Fail2ban on an Ubuntu VPS, protect SSH connections, integrate Fail2ban with UFW, manage banned IP addresses, and troubleshoot common configuration problems.

These instructions apply to Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and other supported Ubuntu releases.

Prerequisites

• An Ubuntu VPS with root or sudo access.
• SSH access to your server.
• An installed and running OpenSSH server.
• UFW configured if you intend to use the UFW banning action.
• Access to your VPS recovery console, if available.

Need a Linux server? Explore Owned Networks KVM VPS hosting for full root access and flexible server resources.

1. Install Fail2ban on Ubuntu

Update your package repositories and install Fail2ban:

sudo apt update
sudo apt install -y fail2ban

Verify the installed version:

fail2ban-client --version

Check the service status:

sudo systemctl status fail2ban --no-pager

Fail2ban reads its configuration from files located under:

/etc/fail2ban/

2. Understand Fail2ban Configuration Files

Fail2ban uses jails to define which services to monitor and how suspicious activity should be handled.

Important configuration files include:

• jail.conf — default jail configuration supplied by the package.
• jail.local — local configuration overrides.
• jail.d/ — additional jail configuration files.
• filter.d/ — log-matching filters.
• action.d/ — firewall and notification actions.

Best practice: Avoid modifying jail.conf directly because package upgrades may replace it.

Instead, create a dedicated configuration file under /etc/fail2ban/jail.d/.

3. Configure SSH Protection

Ubuntu uses systemd-journald to record many system events, including SSH authentication activity.

Create a dedicated SSH jail configuration:

sudo nano /etc/fail2ban/jail.d/sshd.local

Add:

[sshd]
enabled = true
backend = systemd
port = ssh
filter = sshd

maxretry = 5
findtime = 10m
bantime = 1h

This configuration blocks an IP address for one hour after five matching authentication failures within ten minutes.

Important: The systemd backend requires the Python systemd integration used by Fail2ban. On Ubuntu, this is normally provided by the python3-systemd package.

If required, install it:

sudo apt install -y python3-systemd

4. Configure Fail2ban for a Custom SSH Port

If your SSH server uses a nonstandard port, update the jail configuration accordingly.

For example, if SSH listens on port 2222:

[sshd]
enabled = true
backend = systemd
port = 2222
filter = sshd

maxretry = 5
findtime = 10m
bantime = 1h

Replace 2222 with your actual SSH listening port.

To identify the effective SSH port, run:

sudo sshd -T | grep '^port '

Note: When using a port-specific firewall action, the configured jail port must match the SSH service port.

5. Integrate Fail2ban with UFW

Fail2ban can use UFW to block IP addresses that trigger jail rules.

First, verify that UFW is installed and enabled:

sudo ufw status verbose

Open the SSH jail configuration:

sudo nano /etc/fail2ban/jail.d/sshd.local

Add the following directive inside the existing [sshd] section:

banaction = ufw

For example:

[sshd]
enabled = true
backend = systemd
port = ssh
filter = sshd
banaction = ufw

maxretry = 5
findtime = 10m
bantime = 1h

Fail2ban will now use its UFW action to manage bans for this jail.

Important: Verify that the UFW action is available in your installed Fail2ban package before enabling it:

ls -l /etc/fail2ban/action.d/ufw.conf

Fail2ban also supports other firewall actions. The appropriate action depends on your system's firewall configuration.

6. Protect Trusted IP Addresses from Accidental Bans

Fail2ban supports an ignoreip setting for addresses that should not be banned.

For example:

ignoreip = 127.0.0.1/8 ::1 203.0.113.10

Replace 203.0.113.10 with your trusted administrative public IP address.

You can add this directive inside the SSH jail or under the [DEFAULT] section of a separate local configuration file.

Security recommendation: Only exempt IP addresses you fully trust. Avoid adding broad public IP ranges to the ignore list.

7. Validate and Start Fail2ban

Before applying changes, test the configuration:

sudo fail2ban-client -t

If validation succeeds, enable and restart Fail2ban:

sudo systemctl enable fail2ban
sudo systemctl restart fail2ban

Verify the service:

sudo systemctl status fail2ban --no-pager

List active jails:

sudo fail2ban-client status

Check the SSH jail:

sudo fail2ban-client status sshd

The output displays information such as currently failed attempts, total failures, and banned IP addresses.

8. View and Manage Banned IP Addresses

Display the status of the SSH jail:

sudo fail2ban-client status sshd

To manually ban an IP address:

sudo fail2ban-client set sshd banip 203.0.113.50

To remove an IP address from the ban list:

sudo fail2ban-client set sshd unbanip 203.0.113.50

Replace the example IP address with the actual address.

Important: Manually banning an IP address can interrupt legitimate connections. Verify the address before applying a ban.

9. Configure Progressive Ban Durations

Fail2ban supports increasing ban durations for repeat offenders.

Create an additional local configuration file:

sudo nano /etc/fail2ban/jail.d/ban-increment.local

Add:

[DEFAULT]
bantime.increment = true
bantime.factor = 1
bantime.maxtime = 1w

With incremental banning enabled, repeated offenses can result in longer ban durations, up to the configured maximum.

Validate and restart Fail2ban:

sudo fail2ban-client -t
sudo systemctl restart fail2ban

Note: Incremental banning depends on the Fail2ban version and its persistent ban database. Review the installed version's supported settings before relying on this feature.

10. Protect Nginx Authentication Endpoints

Fail2ban can also monitor Nginx authentication failures.

For websites using HTTP Basic Authentication, create an Nginx jail:

sudo nano /etc/fail2ban/jail.d/nginx-http-auth.local

Add:

[nginx-http-auth]
enabled = true
port = http,https
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
maxretry = 5
findtime = 10m
bantime = 1h

This jail monitors Nginx authentication failures recorded in the error log.

Validate the configuration:

sudo fail2ban-client -t

Restart Fail2ban:

sudo systemctl restart fail2ban

Verify the jail:

sudo fail2ban-client status nginx-http-auth

Important: This jail is intended for Nginx HTTP authentication failures. It does not automatically protect WordPress login forms or other application-specific authentication endpoints. Those require appropriate filters and log sources.

11. Review Fail2ban Logs

Fail2ban records information about detected failures, bans, unbans, and configuration errors.

View recent service logs:

sudo journalctl -u fail2ban -n 100 --no-pager

Depending on the logging configuration, Fail2ban may also write to:

/var/log/fail2ban.log

To follow the log in real time:

sudo tail -f /var/log/fail2ban.log

If the file does not exist, use journalctl instead.

12. Troubleshooting Common Fail2ban Problems

Fail2ban service fails to start: Validate the configuration and review service logs.

sudo fail2ban-client -t
sudo journalctl -u fail2ban -n 100 --no-pager

SSH jail is missing: Confirm that the jail is enabled and that the configuration file is being loaded.

sudo fail2ban-client status
sudo fail2ban-client -t

No SSH failures detected: Verify the configured log backend and confirm that SSH authentication events are available in the system journal.

sudo journalctl -u ssh -n 50 --no-pager

UFW bans are not applied: Check that UFW is active, the UFW action file exists, and Fail2ban has permission to execute firewall commands.

sudo ufw status numbered
sudo fail2ban-client status sshd

Legitimate administrator blocked: Use an existing trusted session or your VPS recovery console to remove the ban and review the jail configuration.

13. Fail2ban Security Best Practices

• Use SSH key authentication instead of passwords.
• Disable SSH password authentication after verifying key-based access.
• Use UFW or another properly configured firewall.
• Monitor authentication logs for suspicious activity.
• Configure reasonable retry limits and ban durations.
• Restrict administrative access to trusted IP addresses where practical.
• Keep Ubuntu, OpenSSH, and Fail2ban updated.
• Test configuration changes before closing active SSH sessions.
• Maintain access to a VPS recovery console.

Remember: Fail2ban is an additional security layer. It does not replace secure authentication, regular updates, firewall restrictions, or application security controls.

Related Ubuntu VPS Tutorials

• How to Set Up and Secure a New Ubuntu VPS
• How to Set Up SSH Key Authentication on an Ubuntu VPS
• How to Configure UFW Firewall on an Ubuntu VPS
• How to Install and Configure Nginx on an Ubuntu VPS
• How to Install and Configure Apache on an Ubuntu VPS

Secure Your VPS with Owned Networks

Deploy your applications on an Owned Networks KVM VPS with full root access and flexible server resources.

Whether you host websites, databases, Docker containers, or development environments, securing SSH access and monitoring authentication attempts are essential parts of protecting your Linux infrastructure.

Explore Owned Networks VPS Hosting and deploy your next Ubuntu server today.