If your SSH logs are full of failed login attempts, fail2ban is the answer. It watches your logs and automatically bans any IP that fails too many times — turning a constant stream of attacks into background noise. Here is how to set it up.
Quick answer
Install fail2ban with your package manager (apt install fail2ban), create /etc/fail2ban/jail.local with the [sshd] jail enabled and your maxretry and bantime, then start it with systemctl enable --now fail2ban. Check bans with fail2ban-client status sshd.
Fail2ban scans log files for repeated failures (such as bad SSH logins) and adds a temporary firewall ban for the offending IP. It is the standard first line against brute-force bots.
Step 1: install it
On Debian/Ubuntu and RHEL-family systems it is one package:
# Debian / Ubuntu
sudo apt install fail2ban
# RHEL / AlmaLinux / Rocky
sudo dnf install fail2banStep 2: create a local config
Never edit the shipped config directly — it gets overwritten on updates. Create a jail.local that overrides it:
sudo nano /etc/fail2ban/jail.localA sensible SSH jail looks like this:
[sshd]
enabled = true
port = ssh
maxretry = 4
findtime = 10m
bantime = 1hThat bans an IP for one hour after four failed attempts within ten minutes. Raise bantime for repeat offenders.
Step 3: start and enable it
sudo systemctl enable --now fail2banStep 4: check status and bans
# overall status
sudo fail2ban-client status
# the SSH jail (shows banned IPs)
sudo fail2ban-client status sshdUnbanning an IP (e.g. yourself)
Banned your own IP by mistake? Unban it:
sudo fail2ban-client set sshd unbanip 1.2.3.4Fail2ban will not stop a targeted attacker, but it makes your server invisible to the endless background noise of credential-guessing bots.
Combine it with key-only SSH and a firewall for proper protection — all in the VPS hardening checklist.
Whitelist your own IP so you never lock yourself out
The most common fail2ban mishap is banning your own address after a few fat-fingered logins. Add your static IP (and any office/home ranges) to the ignoreip setting in jail.local so fail2ban never bans you, then reload the service.
Protecting more than just SSH
Fail2ban ships with jails for far more than SSH — web logins, mail (Postfix/Dovecot), FTP and WordPress with the right filter. Enable the jails that match the services you actually run, so brute-force protection covers your whole stack, not only the shell.
How to keep fail2ban effective
- Put all changes in jail.local, never jail.conf, so updates don't wipe them.
- Whitelist your own trusted IPs with ignoreip.
- Increase bantime for repeat offenders (or use recidive jail).
- Pair it with key-only SSH so brute-force is impossible even before bans kick in.
Related guides
Fail2ban is one layer. Combine it with hardened SSH, a UFW firewall, and the wider VPS hardening checklist. If you're seeing an SSH cutoff rather than a ban, see too many authentication failures.