Setting Up Fail2Ban to Block Brute-Force SSH Attacks on Linux

Within minutes of a Bare Metal Server getting a public IP, automated bots start knocking on SSH. SSH key authentication stops them from getting in, but a server can end up processing hundreds of failed login attempts a day just sitting there.

Fail2Ban is the standard answer to this. It watches your authentication logs, and once an IP crosses a threshold of failed attempts, it automatically bans that IP at the firewall level.

Step 1: Install Fail2Ban

Update your package index and install Fail2Ban on Ubuntu/Debian:

sudo apt update
sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban
sudo systemctl status fail2ban
Step 2: Create a Local Configuration File
Fail2Ban's main config file is /etc/fail2ban/jail.conf. Don't edit it directly — package updates overwrite it. Instead, copy it to jail.local:

Bash
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Step 3: Configure the SSH Jail
Open the local config file: sudo nano /etc/fail2ban/jail.local.
First, find the [DEFAULT] section and whitelist your own IP so you don't ban yourself:

Ini, TOML
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 YOUR_OWN_IP_HERE
Next, find the [sshd] section and set the ban behavior:

Ini, TOML
[sshd]
enabled = true
port = ssh
maxretry = 5
findtime = 10m
bantime = 1h
Step 4: Restart and Verify
Apply your changes:

Bash
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd
To learn how to test the ban mechanism safely and manually unban IPs if you make a mistake, read the full tutorial here: https://www.eservers.uk/tutorials/howto/fail2ban-block-ssh-brute-force-dedicated-server/


---

### 12. Hashnode (Technical Focus - Commercial Content Removed)

markdown

Security Engineering: Blocking SSH Brute-Force Attacks with Fail2Ban

Within minutes of a Linux server receiving a public IP address, automated scanners begin attempting to brute-force the SSH daemon (port 22). While disabling password authentication in favor of Ed25519 SSH keys prevents unauthorized access, the daemon still consumes CPU cycles processing the initial cryptographic handshakes of thousands of malicious requests.

To mitigate this, systems administrators deploy Fail2Ban. This daemon parses log files (like /var/log/auth.log or the systemd journal) for regex patterns matching failed logins. Upon reaching a defined threshold, it dynamically inserts a drop rule into the local firewall (iptables, nftables, or ufw), blocking the offending IP.

Step 1: Daemon Installation

Install Fail2Ban from the standard repositories (Ubuntu 24.04/Debian 12):

bash
sudo apt update
sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban
Step 2: Configuration Isolation
Never modify /etc/fail2ban/jail.conf. Upstream package updates will overwrite this file, destroying your ruleset. Always duplicate it to .local, which Fail2Ban reads as an override:

Bash
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Step 3: Jail Configuration
Edit /etc/fail2ban/jail.local. First, whitelist your administrative IP addresses under the [DEFAULT] block to prevent accidental lockouts:

Ini, TOML
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 203.0.113.50
Next, locate the [sshd] block and configure the enforcement metrics:

Ini, TOML
[sshd]
enabled = true
port = ssh
# Number of failures before a ban occurs
maxretry = 5
# The time window in which failures must occur
findtime = 10m
# The duration of the firewall ban
bantime = 1h
Note: If SSH operates on a non-standard port, explicitly define it (e.g., port = 2222).

Step 4: Application and Verification
Restart the service to load the overrides:

Bash
sudo systemctl restart fail2ban
Verify the sshd jail is actively monitoring:

Bash
sudo fail2ban-client status sshd
Step 5: Manual Administration
If a legitimate user triggers a ban, you can manually remove the firewall block using the Fail2Ban client:

Bash
sudo fail2ban-client set sshd unbanip <IP_ADDRESS>
To flush all active bans across all configured jails:

Bash
sudo fail2ban-client unban --all