Return to blog
VPS and LinuxFail2banVPS LinuxSSH SecurityBrute force

Fail2ban: How to protect your VPS against brute force attacks

Bots try to access servers with public IPs every day. With the Fail2ban, you automatically block IPs with many login failures and add a practical layer of defense to SSH.

Published in Matheus Henrique12 min read

Quick Summary

What the Fail2ban does to the VPS

The Fail2ban monitors system log files, identifies suspicious patterns such as multiple failed login attempts in a short time, and bans the source IP using the server's firewall. In practice, it greatly reduces automated brute force attacks against SSH.

Main service
sshd
Configuration
jail.local
Test
fail2ban-client

Prerequisites

  • A VPS with Ubuntu, Debian, Rocky Linux, AlmaLinux, CentOS, RHEL or similar distribution.
  • Root or privileged user access sudo.
  • Configured basic firewall such as UFW, iptables or nftables. It is optional, but recommended.

Step by step

  1. 01

    Install the Fail2ban

    On Debian or Ubuntu based distributions, update the packages and install the service:

    sudo apt update
sudo apt install fail2ban -y

    On Rocky Linux, AlmaLinux, CentOS, or RHEL, enable the EPEL repository when necessary and install:

    sudo dnf install epel-release -y
sudo dnf install fail2ban -y
  2. 02

    Enable and start the service

    After installing, let the Fail2ban start up with the system and check the status:

    sudo systemctl enable fail2ban
sudo systemctl start fail2ban
sudo systemctl status fail2ban
  3. 03

    Use the jail.local file

    The file jail.confIt is the package default and may change in updates. Your settings should be atjail.local.

    sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local
  4. 04

    Configure master limits

    In the section [DEFAULT], adjust ban time, analysis window, allowed attempts and ignored IPs:

    [DEFAULT]
# Tempo que o IP fica banido. 3600 = 1 hora
bantime = 3600

# Janela de tempo para contar tentativas falhas
findtime = 600

# Tentativas falhas antes do banimento
maxretry = 5

# IPs que nunca devem ser banidos
ignoreip = 127.0.0.1/8 ::1

    If you have a fixed IP at home or work, add that IP toignoreipto prevent accidental blocking.

  5. 05

    Enable SSH jail

    Still in jail.local, look for the section [sshd]and leave protection active:

    [sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600

    If SSH uses a custom port, changeport = sshthrough the correct port. On RHEL-like systems, confirm that the log is/var/log/secure.

  6. 06

    Restart and test the Fail2ban

    Restart the service and validate that the SSH jail is active:

    sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

    The output should show the jail sshd, the monitored log file and the list of currently banned IPs.

Useful everyday commands

See all active jails

sudo fail2ban-client status

View banned IPs in SSH

sudo fail2ban-client status sshd

Manually unban or ban an IP

sudo fail2ban-client set sshd unbanip 123.45.67.89
sudo fail2ban-client set sshd banip 123.45.67.89

Monitor logs in real time

sudo tail -f /var/log/fail2ban.log

Securing other services

The Fail2ban can also protect Nginx, Apache, Postfix, WordPress and other services. Most ready-made filters are in/etc/fail2ban/filter.d/.

[nginx-http-auth]
enabled = true
filter = nginx-http-auth
logpath = /var/log/nginx/error.log

[nginx-limit-req]
enabled = true
filter = nginx-limit-req
logpath = /var/log/nginx/error.log

[postfix]
enabled = true
filter = postfix
logpath = /var/log/mail.log

Good security practices

  • Use SSH key: Fail2ban reduces attacks, but public key login is a layer stronger than password.
  • Apply progressive ban: in supported versions, use bantime.increment = true for repeat offenders.
  • Review logs: track attack patterns to adjust maxretry e findtime.
  • Don't depend on just one tool: combine Fail2ban with firewall, updates and good permissions on the server.

Common errors when configuring Fail2ban

  • Edit jail.conf: prefer jail.local to avoid losing changes in updates.
  • Using wrong logpath: confirm that your distribution uses /var/log/auth.log or /var/log/secure.
  • Bypass your fixed IP: if possible, put your trusted IP in ignoreip.
  • Do not restart the service: After editing the configuration, run sudo systemctl restart fail2ban.

FAQ

Fail2ban replaces firewall on VPS?

No. The Fail2ban is an automatic layer of protection against repeated login attempts or abuse. It should be used in conjunction with firewall, SSH key authentication and regular updates.

Can I accidentally lock myself out of Fail2ban?

Yes, especially if you get the password wrong several times in SSH. If you have a fixed IP, add it to ignoreip to reduce this risk.

What log does the Fail2ban use to secure SSH?

On Ubuntu and Debian, this is typically /var/log/auth.log. In distributions such as Rocky Linux, AlmaLinux, CentOS and RHEL, the authentication log is usually located in /var/log/secure.

Does Fail2ban only protect SSH?

No. It can also protect Nginx, Apache, Postfix, WordPress and other services as long as there is a compatible filter and correct log path.

Conclusion

Fail2ban is lightweight, free and very efficient in mitigating automated brute force attacks on VPS. In just a few minutes, you can add automatic defense to SSH and gain more control over suspicious access attempts.

As a next step, also configure firewall, SSH public key authentication and a system update routine.

BedHosting LTDA | CNPJ: 60.677.890/0001-00 | BedHosting.com.br