How to Install and Configure Fail2ban on Ubuntu to Prevent SSH Brute Force Attacks

Deploying an Ubuntu cloud server or public-facing VPS exposes port 22 (SSH) to immediate automated probing. Within minutes of provisioning a public IP address, automated botnets and malicious crawlers begin attempting thousands of brute-force dictionary logins, trying common usernames like root, admin, and ubuntu. Even if your server enforces strong cryptographic SSH keys or passwords, continuous brute-force floods consume valuable network bandwidth, bloat authentication log files, and increase system resource utilization. To automate intrusion prevention and dynamically block malicious IP addresses at the firewall layer, Linux system administrators rely on Fail2ban on Ubuntu.

How Fail2ban Operates Under Linux

Fail2ban functions as an automated log monitor and firewall orchestrator:

• Active Authentication Log Parsing: Fail2ban continuously monitors authentication logs (such as /var/log/auth.log or the systemd journal) using regular expressions (filters) designed to identify authentication failures.
• Dynamic Firewall Rules: When an IP address exceeds a pre-defined threshold of failed login attempts within a designated time window, Fail2ban dynamically injects a temporary drop rule into your server’s firewall (using nftables, iptables, or ufw).
• Automated Ban Expiration: Banned IP addresses remain blocked for a specified period (ban time), after which Fail2ban safely purges the firewall rule, restoring standard connectivity.
• Multi-Service Jails: While commonly used for SSH protection, Fail2ban supports modular “jails” protecting web servers (Nginx/Apache), mail servers (Postfix/Dovecot), and FTP daemons.

Step-by-Step: Installing Fail2ban on Ubuntu

Fail2ban is available in official Ubuntu package repositories (Ubuntu 20.04, 22.04, 24.04, and later):

1. Update your local package index and install Fail2ban:

   sudo apt update
   sudo apt install fail2ban -y

2. Verify that the background service is active and enabled to start on system boot:

   sudo systemctl status fail2ban

Creating a Safe Configuration File (jail.local)

Fail2ban packages its default configuration in /etc/fail2ban/jail.conf. However, you should never edit jail.conf directly, as package updates will overwrite your modifications. Always create an override file named jail.local:

1. Copy the default template to jail.local:

   sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

2. Open the configuration file in a text editor:

   sudo nano /etc/fail2ban/jail.local

Configuring Core Protection Rules for SSH

Inside /etc/fail2ban/jail.local, locate the [DEFAULT] section to adjust global variables, or scroll down to the [sshd] jail section:

1. Setting Whitelist Exceptions (ignoreip)

To prevent accidentally banning your own office or home IP address, append your static IP or subnet to the ignoreip directive:

ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.45

2. Setting Failure Thresholds and Ban Durations

Adjust the three fundamental timing parameters:

• bantime: The duration an offending IP remains banned (e.g., 1h for one hour, 1d for one day).
• findtime: The window of time during which failures are tallied (e.g., 10m for ten minutes).
• maxretry: The maximum number of failed authentication attempts allowed within the findtime window before triggering a ban (e.g., 3 or 5).

3. Enabling the SSH Jail

Ensure the [sshd] section is explicitly enabled:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
findtime = 10m
bantime = 24h

Save and close the file (press Ctrl + O, then Enter, followed by Ctrl + X).

Applying Changes and Verifying Fail2ban Status

Restart the Fail2ban service to apply your new configuration rules:

sudo systemctl restart fail2ban

Check the active status of the SSH jail using the fail2ban-client command-line utility:

sudo fail2ban-client status sshd

The terminal outputs a concise status summary, displaying:

• Currently failed: Current failed login attempts within the active findtime window.
• Total failed: Cumulative authentication failures tracked.
• Currently banned: Number of IPs actively blocked by the firewall.
• Banned IP list: A list of exact IP addresses currently blocked.

Manually Banning and Unbanning IP Addresses

If you need to unban an administrator who entered the wrong password, or manually ban a suspicious IP:

1. Unbanning an IP Address

sudo fail2ban-client set sshd unbanip 198.51.100.25

2. Manually Banning an IP Address

sudo fail2ban-client set sshd banip 198.51.100.25

Fail2ban vs UFW Firewall Rules vs SSH Key-Only Authentication

Security Layer	Fail2ban	UFW Firewall	SSH Keys (Passwordless)
Protection Type	Dynamic, reactive behavioral bans	Static, rule-based port filtering	Cryptographic authentication barrier
Log Bloat Mitigation	High (cuts off attackers after 3 tries)	Zero (all traffic allowed if port 22 open)	Low (attackers still flood logs with attempts)
CPU Overhead	Minimal (lightweight Python daemon)	Near-zero (Linux kernel Netfilter)	Near-zero
Configuration Complexity	Moderate (configuration file edits)	Simple (CLI port toggles)	Simple (SSH config toggles)

Troubleshooting Common Fail2ban Issues on Ubuntu

If Fail2ban fails to register failed logins or ban offending hosts:

• Missing auth.log in Ubuntu 24.04: Modern Ubuntu 24.04 LTS installations rely heavily on systemd-journald and may not populate /var/log/auth.log by default. In jail.local, set backend = systemd under [DEFAULT] to instruct Fail2ban to read directly from the systemd journal.
• Reverse Proxy / Cloudflare Issues: When protecting web services behind proxies, ensure your web server logs the real client IP (via X-Forwarded-For) rather than the proxy’s IP address.
• Checking Fail2ban Internal Logs: Inspect Fail2ban’s own diagnostic log for errors: sudo tail -f /var/log/fail2ban.log.

Frequently Asked Questions

Can Fail2ban protect non-standard SSH ports?

Yes. If you changed your SSH port to 2222 in /etc/ssh/sshd_config, simply update the jail definition to match: port = 2222.

Will Fail2ban lock me out if I use SSH keys?

If you only use SSH keys and have password authentication disabled, typing errors generally will not trigger a failure in the logs. However, always adding your static IP to ignoreip guarantees you are never locked out.

What is Fail2ban recidive jail?

The recidive jail is an advanced feature that tracks repeat offenders. If an IP address is banned repeatedly across multiple cycles, the recidive jail imposes a long-term ban (such as 1 week or 1 month).