Stop Brute-Force Attacks in Their Tracks: Installing Fail2ban on Ubuntu/Debian

Learn how to protect your Linux server from malicious login attempts by setting up Fail2ban in just a few simple steps.

ansible

Protecting Your Server

Ubuntu/Debian

What is Fail2ban?

Fail2ban is a powerful security tool that acts as a digital security guard for your server. It constantly watches your system's log files looking for suspicious behavior, like someone trying to guess your password over and over again. This type of repeated guessing is called a brute-force attack, and it is one of the most common ways hackers try to break into systems.

When Fail2ban spots a bad actor making too many failed login attempts, it takes immediate action. It automatically blocks their IP address using your server's firewall rules. This means the attacker is completely locked out and cannot try to log in again until a certain amount of time has passed, keeping your server safe.

One of the best things about Fail2ban is that it works in the background without needing your constant attention. Once you set it up, it automatically handles the blocking and unblocking of IP addresses. It is highly customizable, allowing you to choose exactly how many strikes an attacker gets and how long they stay banned.

Prerequisites

  • A server running a modern version of Ubuntu (like 22.04 or 24.04) or Debian (like 11 or 12).
  • A user account with sudo (administrator) privileges.
  • A basic understanding of how to use the command-line terminal.
  • An active internet connection to download the required software.

Step-by-Step Installation

1

Update the System and Install Fail2ban

Installs Fail2ban and the systemd python wrapper
First, make sure your server's package list is up-to-date. The python3-systemd package is needed on modern systems so Fail2ban can read the system logs correctly.
BASH 
sudo apt update && sudo apt upgrade -y
sudo apt install fail2ban python3-systemd -y
2

Enable and Start the Service

Ensures Fail2ban survives reboots
Turn on the Fail2ban service and set it to start automatically every time your server turns on.
BASH 
sudo systemctl enable --now fail2ban
Check to make sure the service is running without any errors:
BASH 
sudo systemctl status fail2ban
3

Create the Local Configuration File

Use a sparse file to avoid upgrade conflicts
Never edit the main jail.conf file directly, and do not copy the whole file. Instead, create a brand new, empty file called jail.local. Fail2ban will automatically use this file to overwrite any default settings you want to change.
BASH 
sudo nano /etc/fail2ban/jail.local
4

Configure the Global Settings and SSH Jail

Explicitly set the backend and rules
Paste the text below into your new, empty jail.local file.
Important: Change the ignoreip numbers to match your own computer's IP address so you do not accidentally lock yourself out!
Ini, TOML 
[DEFAULT]
# Tell Fail2ban to read from the modern systemd journal
backend = systemd

# Whitelist localhost and your own static IP (Space separated)
ignoreip = 127.0.0.1/8 ::1 192.168.1.100

# How long an IP is banned (1h = 1 hour)
bantime  = 1h

# The time window Fail2ban watches for failed attempts
findtime  = 10m

# Number of failed attempts allowed before banning
maxretry = 5

# Optional: Only uncomment on UBUNTU if you actively use UFW. 
# Do NOT uncomment on Debian.
# banaction = ufw

[sshd]
# Turn on the SSH protection rules
enabled = true

# Change 'ssh' to your custom port number if you do not use port 22
port    = ssh
filter  = sshd

# Stricter rules for SSH logins
maxretry = 3
bantime = 2h
Save the file and exit the editor (in nano, press CTRL+O, Enter, then CTRL+X).
5

Restart Fail2ban to Apply Changes

Whenever you add or change rules in the jail.local file, you must restart the service for them to take effect.
BASH 
sudo systemctl restart fail2ban
6

Verify Your Configuration

Checking the jail status
You can use the fail2ban-client command to check if your SSH protection is actively running.
BASH 
sudo fail2ban-client status
sudo fail2ban-client status sshd
If you ever lock yourself or a friend out by mistake, you can remove the ban with this command (just replace the IP address):
BASH 
sudo fail2ban-client set sshd unbanip 192.168.1.50

Final Thoughts

You have now successfully secured your server against unwanted access attempts.

  • Installed Fail2ban: You added the main security software and the required tools to read modern system logs.
  • Enabled the Service: You set up the program to run constantly in the background and start automatically when the server boots.
  • Created Custom Settings: You safely made a new jail.local file to hold your rules without messing up future software updates.
  • Protected SSH: You turned on the specific security rule to block attackers while making sure your own IP address is whitelisted.

With these automatic defenses running in the background, you can rest easy knowing your server is actively fighting off hackers.

Explore Dedicated Servers

CTCservers Recommended Tutorials

Install-ROCm

Web, Network

Step-by-Step Guide: Install AMD ROCm on Ubuntu with RX 6600 GPU

Learn how to quickly and easily set up AMD ROCm on Ubuntu for your RX 6600 GPU, enabling powerful machine learning, AI workloads, and GPU-accelerated computing right on your system.
Install LAMP

Web, Network, Linux, Mysql, Ubuntu

LAMP Setup Guide 2026: Ubuntu & Debian | CTCservers

Install a secure LAMP stack on Debian or Ubuntu. Follow our step-by-step guide to configure Linux, Apache, MySQL, and PHP for your web server.
Deploy Phi-3

Web, Network, Ubuntu

Deploy Phi-3 with Ollama on Ubuntu GPU | CTCservers

Learn how to easily deploy the Phi-3 LLM on an Ubuntu 24.04 GPU server using Ollama and WebUI. Follow our step-by-step tutorial for seamless AI hosting.

Discover CTCservers Dedicated Server Locations

CTCservers servers are available around the world, providing diverse options for hosting websites. Each region offers unique advantages, making it easier to choose a location that best suits your specific hosting needs.