Public-facing cloud virtual machines and bare-metal Ubuntu servers are targeted by automated botnets executing brute-force dictionary attacks against SSH, web admin panels, and database ports within seconds of coming online. Without automated intrusion defense, thousands of authentication attempts clutter log files and consume server CPU. Fail2ban inspects authentication logs in real time, tracks repeated failure thresholds from individual IP addresses, and dynamically updates firewall packet filtering rules via UFW (Uncomplicated Firewall) or iptables to ban offending sources.
Modern Log Backend Shift: systemd-journald
In modern Ubuntu releases (Ubuntu 22.04 LTS and 24.04 LTS), standard legacy text log files like /var/log/auth.log are deprecated in favor of binary systemd-journald logging. Configuring Fail2ban to read directly from the systemd journal eliminates disk I/O bottlenecks and prevents log truncation issues caused by logrotate.
Installing and Staging Fail2ban in Ubuntu
Install Fail2ban using the standard package repository:
sudo apt update && sudo apt install -y fail2banNever edit the default distribution configuration file /etc/fail2ban/jail.conf directly, as package upgrades will overwrite modifications. Instead, create an override file:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.localConfiguring Fail2ban for systemd-journald and UFW
Open /etc/fail2ban/jail.local in your text editor and configure global defaults:
[DEFAULT]
# Whitelist trusted administrative IP addresses (never ban yourself)
ignoreip = 127.0.0.1/8 ::1 192.168.1.50
# Ban duration parameters
bantime = 1h
findtime = 10m
maxretry = 5
# Set backend to query binary systemd journal
backend = systemd
# Enforce UFW as the active packet filtering banning action
banaction = ufw
banaction_allports = ufwEnabling and Customizing the SSH Jail
Scroll down or define the [sshd] jail section to protect secure shell access:
[sshd]
enabled = true
port = ssh
filter = sshd
maxretry = 3
bantime = 24hSave your configuration and restart the Fail2ban service:
sudo systemctl restart fail2ban
sudo systemctl enable fail2banMonitoring Jails and Unbanning Legitimate Addresses
To inspect active defensive measures and query current bans:
- Display overall status across all active jails:
sudo fail2ban-client status - Inspect specific jail metrics and view banned IP lists:
sudo fail2ban-client status sshd - Verify that UFW has registered the active kernel reject rules:
sudo ufw status numbered - If an authorized team member is locked out accidentally, release the ban immediately:
sudo fail2ban-client set sshd unbanip 203.0.113.15