Fail2Ban

Overview

Fail2Ban (1.1.1, August 2026, is the latest release) monitors log files or the systemd journal for failed authentication attempts and bans offending IPs through the firewall (nftables or iptables). Protects SSH, Nginx, Apache, Postfix, and any service with log-based authentication.

Instructions

Step 1: Install

sudo apt install fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client -V   # confirm version

On Debian and Ubuntu the distribution package ships an enabled sshd jail that reads the systemd journal (upstream paths-debian.conf sets sshd_backend = systemd and, since 1.1.1, banaction = nftables; check fail2ban-client get sshd actions on your host). Elsewhere the upstream default banaction is iptables-multiport, and bantime/findtime default to 10m with maxretry = 5.

Step 2: Configure