How to Use Ubuntu Server fail2ban to Prevent SSH Brute Force Attacks

If you connect a fresh Ubuntu Server to the public internet and leave port 22 (SSH) open, it will take less than five minutes for automated botnets to find it. These bots will tirelessly attempt to guess your root password, trying thousands of common combinations per hour. While using strong passwords or SSH keys mitigates the risk of a successful breach, the sheer volume of these “brute force” login attempts wastes your server’s CPU and bandwidth, while cluttering your authentication logs. To stop this harassment automatically, you must deploy fail2ban.

How fail2ban Works

Fail2ban is a background daemon that actively monitors your server’s log files (like /var/log/auth.log). It looks for patterns of suspicious behavior, primarily repeated failed login attempts. When a specific IP address fails to log in too many times within a specified time window, fail2ban dynamically updates your server’s firewall (iptables or UFW) to completely block that IP address for a set amount of time. It acts as an automated bouncer for your server.

Step 1: Install fail2ban

Fail2ban is available in the default Ubuntu repositories.

sudo apt update && sudo apt install fail2ban -y

Once installed, the service will start automatically in the background.

Step 2: Create a Local Configuration File

Fail2ban is configured via a file named jail.conf. However, you should never edit this file directly, as your changes will be overwritten during the next software update. Instead, you must copy it to a new file called jail.local. Fail2ban will always read the .local file first and use it to override the defaults.

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Now, open the new local file in a text editor like Nano:

sudo nano /etc/fail2ban/jail.local

Step 3: Configure the Default Rules

Scroll down to the [DEFAULT] section. Here you can set the overarching rules for all the services fail2ban monitors.

• ignoreip: By default, this is set to 127.0.0.1/8 ::1. You should add your own static IP address here (e.g., your office VPN) so you never accidentally ban yourself. Separate IPs with a space.
• bantime: This is how long an attacker is banned. By default, it is 10m (10 minutes). It is highly recommended to increase this to 1h or 1d (1 day) to truly discourage botnets.
• findtime: The window of time in which the failures must occur. Default is 10m.
• maxretry: The number of failures allowed before a ban is triggered. Default is 5. If someone fails 5 times within 10 minutes, they get banned.

Step 4: Enable the SSH “Jail”

Fail2ban uses the concept of “jails”—specific rules for specific services (SSH, Apache, Postfix, etc.).

Scroll down the file until you find the [sshd] block. By default, it might just look like this:

[sshd]
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

To explicitly turn it on, add enabled = true below the header:

[sshd]
enabled = true
port    = ssh

Save the file (Ctrl+O, Enter) and exit Nano (Ctrl+X).

Step 5: Restart and Monitor

For your new rules to take effect, you must restart the service.

sudo systemctl restart fail2ban

Now, you can monitor fail2ban in action. To see the overall status and which jails are currently active, run:

sudo fail2ban-client status

To see detailed information about the SSH jail specifically, including the live list of IP addresses currently banned by your server, run:

sudo fail2ban-client status sshd

As you watch this list populate, you can rest easy knowing those malicious scripts are hitting a brick wall before they even reach your SSH daemon.