{"id":1636,"date":"2026-01-02T20:57:36","date_gmt":"2026-01-02T20:57:36","guid":{"rendered":"https:\/\/b2bhostingclub.com\/blog\/?p=1636"},"modified":"2026-02-04T14:14:36","modified_gmt":"2026-02-04T14:14:36","slug":"how-to-prevent-ssh-brute-force-attacks-on-linux-using-fail2ban","status":"publish","type":"post","link":"https:\/\/b2bhostingclub.com\/blog\/how-to-prevent-ssh-brute-force-attacks-on-linux-using-fail2ban\/","title":{"rendered":"How to Prevent SSH Brute-Force Attacks on Linux Using Fail2ban"},"content":{"rendered":"
\n
\n
\n

What Is Fail2ban?<\/h2>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n

Fail2ban is an open-source intrusion prevention software that helps protect Linux servers from unauthorized access attempts. It is designed to scan log files, such as system logs or application logs, and identify suspicious or malicious activity, particularly repeated failed login attempts or other specified patterns. When such activity is detected, Fail2ban takes action by dynamically updating firewall rules to block the IP addresses associated with the suspicious activity, effectively preventing further unauthorized access. It works with most remote connection services such as SSH, FTP, SMTP, and HTTP.<\/p>\n<\/div>\n<\/div>\n

\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n

Situations Where Fail2ban Can Be Beneficial<\/h2>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n

Protection against SSH Brute-Force Attacks:<\/b>\u00a0Fail2ban is effective in mitigating SSH brute-force attacks targeting protocols like SSH, FTP, or any other service that generates logs. It detects repeated failed login attempts from specific IP addresses and dynamically blocks those addresses, preventing further unauthorized login attempts.<\/p>\n<\/div>\n<\/div>\n

\n
\n

Mitigating Password Guessing:<\/b>\u00a0Fail2ban helps in countering password guessing attacks where automated tools systematically try different username and password combinations to gain access. By recognizing and blocking IP addresses associated with such activity, Fail2ban reduces the chances of successful unauthorized access.<\/p>\n<\/div>\n<\/div>\n

\n
\n

Enhanced Server Security:<\/b>\u00a0By continuously monitoring logs and enforcing dynamic firewall rules, Fail2ban enhances server security and protects against various types of malicious activities. It provides an additional layer of defense, complementing other security measures implemented on the server.<\/p>\n<\/div>\n<\/div>\n

\n
\n

Prevention of Account Lockouts:<\/b>\u00a0Fail2ban can prevent legitimate user accounts from being locked out due to mistyped passwords or accidental login failures. It imposes temporary bans, allowing users to retry after a specific duration without permanently blocking them.<\/p>\n<\/div>\n<\/div>\n

\n
\n

Automated Response to Security Threats:<\/b>\u00a0Fail2ban automates the process of detecting and responding to security threats. It scans logs, identifies suspicious patterns, and takes action by dynamically updating firewall rules. This automation saves time and reduces the workload on administrators.<\/p>\n<\/div>\n<\/div>\n

\n
\n

Monitoring and Auditing:<\/b>\u00a0Fail2ban generates logs and reports on detected security events, providing valuable information for monitoring and auditing purposes. Administrators can review the logs to gain insights into potential security risks and take necessary corrective actions.<\/p>\n<\/div>\n<\/div>\n

\n
\n

Customizable Security Policies:<\/b>\u00a0Fail2ban allows administrators to define custom rules and filters based on specific security policies and requirements. This flexibility enables organizations to tailor the protection to their unique environment and address specific threats they may face.<\/p>\n<\/div>\n<\/div>\n

\n
\n

With Fail2ban, you can reduce the risk of security breaches by being proactive in securing your Linux servers or PCs.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n

How to Install Fail2ban on Linux Server<\/h2>\n
There are many Linux distributions available. In this tutorial, we will use Ubuntu as an example.<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n

1. Install Fail2ban<\/h3>\n
\n
\n
\n

After logging in to your Linux server, switch to the root account with the following command and input the password as prompted.<\/p>\n<\/div>\n<\/div>\n

\n
\n
sudo -i<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Install<\/div>\n<\/div>\n<\/div>\n
\n
\n
Then, install Fail2ban using the following command and enter y to continue the installation of the package.<\/p>\n<\/div>\n<\/div>\n
\n
\n
apt install fail2ban<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Install<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
2. Start the Fail2ban Service<\/h3>\n
\n
\n
\n
By enabling the service, the process will run in the background whenever your system boots.<\/p>\n<\/div>\n<\/div>\n
\n
\n
systemctl enable fail2ban.service<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Enable<\/div>\n<\/div>\n<\/div>\n
\n
Then, start the service with the command.<\/div>\n
\n
systemctl start fail2ban<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Start<\/div>\n<\/div>\n<\/div>\n
\n
Next, check the status of the Fail2ban service by issuing the command. From the output, you can see the service is running. Finally, press “Ctrl” and “C” together to exit the status checking.<\/div>\n
\n
systemctl status fail2ban<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Check<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
3. Configure Fail2ban<\/h3>\n
\n
\n
\n
The \/etc\/fail2ban\/jail.conf file stores the main Fail2ban configurations. By issuing the following command, you can get the first 20 lines of the jail.conf file. The content mainly directs you not to modify this file but to create separate files within the jail.d\/ directory or to provde customization in a jail.local file. The jail.conf file will be regularly updated alongside Fail2ban itself, serving as a reference for default settings in cases where you haven’t made any custom modifications.<\/p>\n<\/div>\n<\/div>\n
\n
\n
cd \/etc\/fail2ban\r\nhead -20 jail.conf<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Enable<\/div>\n<\/div>\n<\/div>\n
\n
\n
In this tutorial, we will create a jail.local file and provide customization in the file. We create the jail.local by copying the jail.conf. Issue the command below.<\/p>\n<\/div>\n<\/div>\n
\n
\n
cd \/etc\/fail2ban && cp jail.conf jail.local<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Start<\/div>\n<\/div>\n<\/div>\n
\n
\n
From the output, you can see that a jail.local file is copied.
\nNext, we can start making customizations to the jail.local file with any text editor you prefer. In this tutorial, we use the nano editor. Run the command below to open the file.<\/p>\n<\/div>\n<\/div>\n
\n
\n
nano jail.local<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Use<\/div>\n<\/div>\n<\/div>\n
\n
\n
This file is composed of many sections that define settings for specific services. The settings under the\u00a0DEFAULT<\/b>\u00a0header will be applied to all of the services supported by Fail2ban. Settings for other sections, such as sshd, contain service-specific settings that will apply over top of the defaults. When setting the specific values for a parameter, you can read the comment, which begins with # above each parameter, for reference.<\/p>\n
For example, under the DEFAULT section, the\u00a0bantime<\/b>\u00a0sets the length of time that a user will be banned when they have failed the authentication.
\nThe\u00a0maxretry<\/b>\u00a0parameter defines the max number of authentication failures a user can take within the findtime before they get banned.
\nFor testing, we have set the values to 20m and 2 respectively.<\/p>\n<\/div>\n<\/div>\n
\n
\n
\"Customize<\/div>\n<\/div>\n<\/div>\n
\n
\n
Scrolling down the file, you can make changes to the settings that you’d like to customize. For example, you can enable the sshd jail by adding the “enabled = true” to the sshd section.<\/p>\n<\/div>\n<\/div>\n
\n
\n
\"Enable<\/div>\n<\/div>\n<\/div>\n
\n
\n
After the customization, press “Ctrl” and “X”, followed by entering “y,” and then, hit the enter key to save the changes. Lastly, restart the Fail2ban service by running the command below so the changes will take effect.<\/p>\n<\/div>\n<\/div>\n
\n
\n
systemctl restart fail2ban<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Restart<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
4. Test the Fail2ban Configurations<\/h3>\n
\n
\n
\n
Now you can test if the maxretry configuration is working. Try to SSH login to the server you have configured. When prompted for login credentials, input wrong passwords. Fail2ban will block you for 20 minutes, as configured.<\/p>\n<\/div>\n<\/div>\n
\n
\n
\"Authentication<\/div>\n<\/div>\n<\/div>\n
\n
\n
You can check the logs of the Fail2ban service for more details.<\/p>\n<\/div>\n<\/div>\n
\n
\n
cat \/var\/log\/fail2ban.log<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Check<\/div>\n<\/div>\n<\/div>\n
\n
\n
The IP is banned for two authentication failures and gets unbanned after 20 minutes as configured.<\/p>\n<\/div>\n<\/div>\n
\n
\n
\"Log<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
Conclusion<\/h2>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n
Fail2ban is a powerful tool that can significantly enhance the security of your Linux system by preventing SSH brute-force attacks. By analyzing log files and automatically banning malicious IP addresses, Fail2ban serves as a reliable guardian against unauthorized access attempts. In this blog, we have explored the installation process and configuration options. You can start installing your Fail2ban and configure it to your needs to build a safer Linux server environment. Remember, staying proactive in safeguarding your system is crucial in today’s digital landscape, and Fail2ban is an invaluable tool in your arsenal. So, take the necessary steps to protect your Linux system and keep potential attackers at bay.<\/p>\n<\/div>\n<\/div>\n
\n
\n
While Fail2ban is a valuable tool for enhancing the security of your Linux server, it is not the sole solution for comprehensive security. In addition to implementing Fail2ban, you should also consider other measures to enhance the security of your Linux system, such as using strong passwords and Configuring a firewall.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
What Is Fail2ban? Fail2ban is an open-source intrusion prevention software that helps protect Linux servers from unauthorized access attempts. It is designed to scan log files, such as system logs or application logs, and identify suspicious or malicious activity, particularly repeated failed login attempts or other specified patterns. When such activity is detected, Fail2ban takes […]<\/p>\n","protected":false},"author":4,"featured_media":1637,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1636","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux-hosting"],"_links":{"self":[{"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/posts\/1636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/comments?post=1636"}],"version-history":[{"count":2,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/posts\/1636\/revisions"}],"predecessor-version":[{"id":1639,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/posts\/1636\/revisions\/1639"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/media\/1637"}],"wp:attachment":[{"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/media?parent=1636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/categories?post=1636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/tags?post=1636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}