How to Configure Fail2ban to Protect SSH and Nginx from Brute-Force Attacks in Ubuntu

Deploying a public-facing Ubuntu server for web hosting, cloud databases, or personal VPNs instantly exposes port 22 and port 80 to relentless automated botnets. Within minutes of provisioning, automated scanners commence rapid-fire dictionary and brute-force authentication attempts against your SSH daemon and web login endpoints. Left unaddressed, these connection floods consume server bandwidth, spike CPU utilization, and increase the likelihood of credential compromise. While changing default ports and enforcing SSH keys provide baseline defences, Fail2ban establishes an active intrusion prevention framework that automatically detects abusive IP behaviour in system logs and bans offenders at the firewall level.

How Fail2ban Operates Under the Hood

Fail2ban functions as an automated log-parsing sentinel:

• Log Monitoring: Fail2ban continuously monitors authentication logs (such as /var/log/auth.log for SSH or /var/log/nginx/error.log for web servers).
• Filter Matching: It matches log lines against regular expression rules (called filters) to identify failed login attempts, HTTP 401 errors, or malicious URL exploits.
• Firewall Enforcement (Jails): When an IP address exceeds a configured threshold of failures within a defined timeframe, Fail2ban executes an automated action, inserting temporary drop rules into the Linux kernel firewall (iptables or nftables) to drop all packets from that origin.

Step 1: Install Fail2ban on Ubuntu

Fail2ban is included in the default Ubuntu package repositories:

1. Open your terminal and update the local package index:

   sudo apt update

2. Install Fail2ban:

   sudo apt install -y fail2ban

3. Verify that the service is running and enabled on boot:

   sudo systemctl status fail2ban

Step 2: Create a Local Configuration File (jail.local)

Fail2ban provides an upstream configuration file at /etc/fail2ban/jail.conf. Never modify this file directly, as package upgrades will overwrite your settings. Instead, copy it to a local override file:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Step 3: Configure Global Ban Parameters

Inside /etc/fail2ban/jail.local, scroll to the [DEFAULT] section and tune these core directives:

• ignoreip: Add your trusted administrative IP address or home subnet so you never accidentally lock yourself out:

  ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.45

• bantime: The duration an offending IP remains blocked (e.g. 1h for 1 hour, or 1d for 24 hours).
• findtime: The sliding window within which failed attempts are counted (e.g. 10m for 10 minutes).
• maxretry: The maximum number of failed authentication attempts permitted before triggering a ban (e.g. 5).

Step 4: Enable the SSH Protection Jail

Scroll down inside jail.local until you find the [sshd] section. Configure it as follows:

[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
backend = %(default_backend)s
maxretry = 3
bantime  = 1d

Save and close the file (Ctrl + O, then Ctrl + X).

Step 5: Restart and Monitor Fail2ban Status

Apply your configuration changes and confirm that the SSH jail is actively monitoring:

sudo systemctl restart fail2ban

Checking Jail Activity and Banned IPs

Query Fail2ban’s command-line interface to inspect active defensive filters:

sudo fail2ban-client status sshd

The output displays real-time statistics:

Status for the jail: sshd
|- Filter
|  |- Currently failed: 2
|  |- Total failed:     48
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 4
   |- Total banned:     12
   `- Banned IP list:   198.51.100.14 203.0.113.88 ...

How to Manually Unban an IP Address

If a colleague or client accidentally enters the wrong password multiple times and gets banned:

sudo fail2ban-client set sshd unbanip 198.51.100.14

Core Fail2ban Directives Reference

Directive	Default Value	Recommended Production Setting	Operational Impact
bantime	10m	1d (24 hours)	Stops persistent botnets from retrying frequently
findtime	10m	10m	Measurement window for calculating failed logins
maxretry	5	3	Leaves little margin for automated password guessing
ignoreip	127.0.0.1/8	Add admin static IP	Prevents accidental administrative lockouts

Troubleshooting Fail2ban Log Parsing in Modern Ubuntu

In Ubuntu 24.04 LTS, standard logging transitioned heavily toward systemd-journald. If Fail2ban reports that it cannot find /var/log/auth.log, install rsyslog (sudo apt install rsyslog) or update the backend directive inside jail.local to read backend = systemd.

Implementing Fail2ban on your Ubuntu servers establishes a proactive, automated defense perimeter, silencing brute-force botnets and preserving server resources for legitimate user traffic.