How to set up Fail2Ban to protect SSH on Linux

Install Fail2Ban using apt or dnf, start and enable the service. 2. Create jail.local from jail.conf and configure [sshd] with enabled=true, correct logpath, maxretry=3, bantime=3600, findtime=600. 3. Verify with fail2ban-client status sshd and monitor logs to confirm protection against SSH brute-force attacks.

Protecting your SSH service from brute-force attacks is essential when running a Linux server exposed to the internet. Fail2Ban is a powerful tool that monitors log files and automatically blocks suspicious IP addresses using firewall rules. Here's how to set it up to secure SSH on a typical Linux system.

Install Fail2Ban

Most modern Linux distributions include Fail2Ban in their package repositories.

After installation, start and enable the service so it runs at boot:

Configure Fail2Ban for SSH

Fail2Ban uses configuration files located in /etc/fail2ban/. The main configuration is in jail.conf, but you should avoid editing it directly. Instead, create a local override file:

Edit the local file:

Find the [sshd] section and ensure it’s enabled:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600

Explanation of key options:

• maxretry: Number of failed attempts before banning (3 is recommended)
• bantime: How long (in seconds) to block the IP (3600 = 1 hour)
• findtime: Window in which retries are counted (600 = 10 minutes)
• logpath: Path to SSH authentication logs (varies by distro; Debian/Ubuntu use /var/log/auth.log, RHEL/CentOS use /var/log/secure)

If you're on RHEL-based system, update logpath = /var/log/secure.

Verify and Monitor Protection

Check if the SSH jail is active:

This shows how many IP addresses are currently banned.

To view recent bans or debug issues:

You can also test by intentionally failing SSH login a few times from another machine (not your only access). After three failures, the IP should be blocked.

To unban an IP manually (if needed):

Fail2Ban works with iptables by default, but supports nftables and firewalld depending on your system. As long as the backend detects your firewall correctly, rules will be applied automatically.

Basically just install, configure the jail.local file, and let Fail2Ban run. It’s simple to set up and dramatically improves SSH security against automated attacks.

The above is the detailed content of How to set up Fail2Ban to protect SSH on Linux. For more information, please follow other related articles on the PHP Chinese website!