Install and Configure Fail2ban on Debian / Ubuntu
Complete guide to install Fail2ban on a Linux VPS and protect your services (SSH, Nginx, Apache) against brute-force attacks. This tutorial covers installation, creating custom jails, email notifications and UFW integration.
Introduction
Fail2ban is a protection tool that continuously analyzes your server logs to detect suspicious connection attempts. When an IP address exceeds a defined threshold of failed attempts, it is automatically blocked at the firewall level for a configurable duration.
This is the essential first line of defense for a VPS exposed to the Internet: without Fail2ban, your SSH server receives thousands of connection attempts per day from bots scanning the global IP space.
Prerequisites
- A Debian 11/12 or Ubuntu 20.04/22.04/24.04 VPS
- Root or sudo access
- Working SSH
- UFW installed (recommended) or iptables
Step 1: Installation
Update your system and install Fail2ban:
sudo apt update && sudo apt upgrade -y
sudo apt install -y fail2ban
Enable and start the service:
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
sudo systemctl status fail2ban
Step 2: Base configuration
Never edit jail.conf directly: this file is overwritten on every update. Create a jail.local file instead:
sudo nano /etc/fail2ban/jail.local
Add the base configuration:
[DEFAULT]
# IPs to never ban (your fixed IP, monitoring, etc.)
ignoreip = 127.0.0.1/8 ::1
# Ban duration (default 10 minutes, here 1 hour)
bantime = 1h
# Detection window (attempts within 10 minutes)
findtime = 10m
# Number of attempts before ban
maxretry = 5
# Log reading backend (systemd recommended on Debian 12+)
backend = systemd
# Default action: ban the IP
action = %(action_)s
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 3
bantime = 2h
Step 3: Enable the SSH jail
The SSH jail protects your server against attacks on port 22 (or your custom port). If you changed the SSH port, adjust the port directive:
[sshd]
enabled = true
port = 22022
logpath = %(sshd_log)s
maxretry = 3
bantime = 24h
Reload Fail2ban:
sudo systemctl reload fail2ban
Step 4: Verify operation
List active jails:
sudo fail2ban-client status
You should see:
Status
|- Number of jail: 1
`- Jail list: sshd
Inspect the SSH jail in detail:
sudo fail2ban-client status sshd
Displays currently banned IPs, total ban count and monitored log file.
Step 5: Manual ban / unban
Ban an IP immediately:
sudo fail2ban-client set sshd banip 203.0.113.10
Unban an IP (e.g. if you locked yourself out):
sudo fail2ban-client set sshd unbanip 203.0.113.10
List all banned IPs across all jails:
sudo fail2ban-client banned
Step 6: Protect Nginx
Create a jail to block bots scanning your site:
sudo nano /etc/fail2ban/jail.local
Add at the end:
[nginx-http-auth]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log
maxretry = 3
[nginx-botsearch]
enabled = true
port = http,https
logpath = /var/log/nginx/access.log
maxretry = 2
bantime = 24h
[nginx-limit-req]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log
maxretry = 10
Reload:
sudo systemctl reload fail2ban
Step 7: Email notifications
To receive an email on every ban, edit jail.local:
[DEFAULT]
destemail = [email protected]
sender = [email protected]
mta = sendmail
action = %(action_mwl)s
The %(action_mwl)s action sends an email with the attack logs and a WHOIS report of the banned IP.
Install an MTA if needed:
sudo apt install -y sendmail
Step 8: Advanced configuration
Progressive ban time
Increase ban duration on each repeat offense with bantime.increment:
[DEFAULT]
bantime.increment = true
bantime.factor = 2
bantime.maxtime = 7d
An IP banned 3 times will eventually be blocked for 1 week.
Custom jail for Plesk
[plesk-postfix]
enabled = true
filter = postfix-sasl
port = smtp,submission,smtps
logpath = /var/log/maillog
maxretry = 5
Permanent whitelist
Add your office IPs to ignoreip:
ignoreip = 127.0.0.1/8 ::1 82.26.157.0/24 your.fixed.ip
Troubleshooting
Fail2ban won't start
Check logs:
sudo journalctl -u fail2ban -n 50 --no-pager
Test configuration:
sudo fail2ban-client -t
Bans don't work
Verify the correct backend is used. On Debian 12 and Ubuntu 22.04+, systemd is required:
[DEFAULT]
backend = systemd
Verify regex filters match your logs:
sudo fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
I locked myself out
If you have noVNC or console access from your VeryCloud customer area, log in and unban your IP:
sudo fail2ban-client set sshd unbanip YOUR_IP
Useful commands
# General status
sudo fail2ban-client status
# Jail status
sudo fail2ban-client status sshd
# Reload config without restart
sudo systemctl reload fail2ban
# List all banned IPs
sudo fail2ban-client banned
# Clear all jails
sudo fail2ban-client unban --all
# Test a regex filter
sudo fail2ban-regex /var/log/auth.log sshd
Conclusion
Your VPS is now protected against brute-force attacks on SSH, Nginx and other services. Going further:
- Combine Fail2ban with SSH keys and disable password authentication
- Change the default SSH port (22)
- Install UFW to close all unused ports
- Enable email notifications for real-time alerts
Happy sysadmining!
Resources
- Official Fail2ban documentation: https://github.com/fail2ban/fail2ban/wiki
- VeryCloud guide — Secure your VPS: https://verycloud.fr/docs/article/how-to-secure-vps
- VeryCloud guide — SSH keys: https://verycloud.fr/docs/article/configure-sshkey-linux