How to Install and Configure Fail2ban on Ubuntu

If your Ubuntu server is connected to the public internet and you have SSH (Port 22) open, it is practically guaranteed that automated bots are currently attempting to guess your password. These “brute-force” attacks flood your server with hundreds of login attempts per minute, wasting system resources and posing a massive security risk.

The best defense against these attacks is Fail2ban. This lightweight security tool silently monitors your server’s log files. When it detects multiple failed login attempts from a specific IP address within a short time frame, it automatically updates your firewall rules to block (ban) that IP address. Here is how to install and configure it on Ubuntu.

Step 1: Install Fail2ban

Fail2ban is included in the official Ubuntu software repositories, making installation incredibly simple.

1. Connect to your Ubuntu server via SSH.
2. First, update your package lists to ensure you download the latest version:
   sudo apt update
3. Install the software:
   sudo apt install fail2ban -y
4. Once the installation is complete, the Fail2ban service will start automatically in the background. You can verify it is running by typing:
   sudo systemctl status fail2ban

Step 2: Create a Local Configuration File

The default configuration settings for Fail2ban are stored in a file named jail.conf. However, you should never edit this file directly. When Ubuntu updates Fail2ban in the future, it will overwrite jail.conf, deleting all your custom rules.

Instead, you must create a local copy called jail.local. Fail2ban will always prioritize the settings in the .local file over the default file.

1. Copy the default configuration file to create your local version:
   sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
2. Now, open your new local file using the nano text editor:
   sudo nano /etc/fail2ban/jail.local

Step 3: Configure the Ban Rules

With the jail.local file open in nano, scroll down to find the [DEFAULT] section. This area defines the baseline rules for all the services Fail2ban protects.

You will want to adjust the following three key settings:

• bantime: How long the offending IP address is banned. By default, it is set to 10 minutes (10m). For better security, change this to 1 hour (1h) or 1 day (1d).
• findtime: The window of time Fail2ban looks at. The default is 10 minutes (10m).
• maxretry: How many failed attempts are allowed before a ban is issued. The default is usually 5.

If you leave the default findtime and maxretry settings, Fail2ban will operate under this logic: “If an IP address fails to log in 5 times within a 10-minute window, ban them for 1 hour.”

Step 4: Enable SSH Protection

Scroll further down the configuration file until you find the [sshd] section. (You can press Ctrl + W in nano to search for it quickly).

To ensure Fail2ban is actively guarding your SSH port, add a line that says enabled = true directly beneath the [sshd] header. It should look like this:

[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

Save your changes by pressing Ctrl + O, then Enter. Exit nano by pressing Ctrl + X.

Step 5: Restart the Service and Check the Status

Because you changed the configuration file, you must restart the Fail2ban service for the new rules to take effect.

1. Restart the service:
   sudo systemctl restart fail2ban
2. To confirm that Fail2ban is actively monitoring your SSH port, run the client status command:
   sudo fail2ban-client status
3. The output will show the number of active “jails” (protective barriers) and list sshd.
4. To see if any malicious IP addresses have been blocked yet, check the specific status of the SSH jail:
   sudo fail2ban-client status sshd

This final command will display the total number of failed logins detected and provide a list of currently banned IP addresses. Your Ubuntu server is now actively defending itself against brute-force attacks.