If you have ever spun up a new Ubuntu server on a cloud provider like DigitalOcean or AWS, you might assume it takes weeks for hackers to find it. In reality, automated botnets will begin relentlessly scanning your public IP address and attempting brute-force SSH logins within minutes of the server coming online.
While disabling password authentication and using SSH keys is your primary defence, these constant bot attacks still consume server resources and fill up your log files. To actively stop the attacks, you must learn how to secure your server by installing and configuring Fail2Ban.
What is Fail2Ban?
Fail2Ban is an intrusion prevention software framework that protects computer servers from brute-force attacks. It works as a background daemon that continuously monitors your system log files (such as /var/log/auth.log).
When Fail2Ban detects multiple failed login attempts from a single IP address, it dynamically updates your system’s firewall rules (usually UFW or iptables) to automatically block that IP address for a specified amount of time.
Step 1: Install Fail2Ban on Ubuntu
Because Fail2Ban is a foundational Linux security tool, it is available directly from the default Ubuntu repositories.
- Connect to your server via SSH.
- Update your local package index to ensure you get the latest version:
sudo apt update - Install the Fail2Ban package:
sudo apt install fail2ban
Once the installation is complete, the service will start automatically in the background.
Step 2: Create the jail.local Configuration File
The default configuration file for Fail2Ban is located at /etc/fail2ban/jail.conf. You should never edit this file directly. Whenever the package receives an update via apt, this file may be overwritten, which would destroy your custom settings.
Instead, the correct workflow is to copy the default file to a new file named jail.local. Fail2Ban will always prioritise settings in the .local file.
Run the following command in your terminal:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Step 3: Configure the SSH Ban Rules
Now that you have a safe configuration file, it is time to customise how aggressively you want to punish malicious bots.
- Open your new configuration file in a text editor:
sudo nano /etc/fail2ban/jail.local - Scroll down to the [DEFAULT] section. Here, you will find three critical settings you should adjust:
- bantime = 10m: This is the duration an IP address is banned. We highly recommend changing this to 1d (one day) or even 1w (one week) for maximum deterrence.
- findtime = 10m: The window of time Fail2Ban looks at to count failed logins.
- maxretry = 5: The number of failed attempts allowed before a ban is triggered. Changing this to 3 is a solid security practice.
Next, scroll down to the [sshd] section. Ensure that enabled = true is present under the `[sshd]` header to guarantee SSH monitoring is active.
Save your changes and exit the nano editor by pressing Ctrl + O, Enter, and then Ctrl + X.
Step 4: Restart and Verify the Service
For your new strict banning rules to take effect, you must restart the Fail2Ban service.
- Restart the service using systemctl:
sudo systemctl restart fail2ban - To verify that the SSH jail is actively running, you can use the built-in Fail2Ban client:
sudo fail2ban-client status
This command will output a list of your currently active jails (you should see sshd listed). To see exactly which IP addresses are currently banned by the SSH jail, you can run: sudo fail2ban-client status sshd.
By implementing this simple tool, you have successfully automated your server’s active defence mechanisms, saving your CPU cycles and massively reducing the risk of a successful brute-force breach.
