> For the complete documentation index, see [llms.txt](https://docs.ititanhosting.ro/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ititanhosting.ro/docs/english/vps/linux/how-to-install-fail2ban-on-ubuntu.md).

# How to install Fail2Ban on Ubuntu

If you check your server logs, you might be surprised how often random IPs try to guess your SSH password. Fail2Ban watches those logs and automatically blocks IPs that make too many failed attempts.

It is a simple tool that makes a big difference in server security. Here is how to set it up.

### Step 1: Install Fail2Ban

Ubuntu has Fail2Ban in its default repositories, so installation is straightforward:

```bash
sudo apt update
sudo apt install fail2ban -y
```

### Step 2: Understand the config files

Fail2Ban uses two types of configuration files:

* `/etc/fail2ban/jail.conf` - the default config (do not edit this one directly)
* `/etc/fail2ban/jail.local` - your custom config (this overrides the defaults)

Create your local config by copying the default:

```bash
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
```

Or start fresh with just the settings you need:

```bash
sudo nano /etc/fail2ban/jail.local
```

### Step 3: Basic SSH protection

Here is a solid starting configuration. Paste this into `jail.local`:

```ini
[DEFAULT]
# Ban IPs for 24 hours after 5 failed attempts
bantime = 24h
maxretry = 5
findtime = 10m

# Send email alerts (optional)
# destemail = your@email.com
# action = %(action_mw)s

[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
```

This monitors SSH login attempts. If someone fails 5 times within 10 minutes, they get blocked for 24 hours.

### Step 4: Start and enable Fail2Ban

```bash
sudo systemctl start fail2ban
sudo systemctl enable fail2ban
sudo systemctl status fail2ban
```

### Step 5: Check what Fail2Ban is doing

See the status for SSH protection:

```bash
sudo fail2ban-client status sshd
```

The output shows how many times the jail has triggered and which IPs are currently banned.

List all active jails:

```bash
sudo fail2ban-client status
```

### Step 6: Protect additional services

Fail2Ban comes with built-in filters for many popular services. Enable them by adding to `jail.local`:

```ini
[nginx-http-auth]
enabled = true
logpath = /var/log/nginx/error.log

[nginx-botsearch]
enabled = true
logpath = /var/log/nginx/access.log

[postfix]
enabled = true
logpath = /var/log/mail.log
```

After changing the config, apply it:

```bash
sudo systemctl restart fail2ban
```

### Unbanning an IP

If you accidentally block yourself or want to release a blocked IP:

```bash
sudo fail2ban-client set sshd unbanip 203.0.113.4
```

To unban across all jails:

```bash
sudo fail2ban-client unban 203.0.113.4
```

### Whitelisting trusted IPs

If you have a static IP that should never be blocked (like your office or home), add it to the config:

```ini
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 203.0.113.4
```

### Custom ban actions

By default, Fail2Ban just adds an iptables rule to block the IP. But you can do more:

* Send an email alert
* Run a custom script
* Block the IP in Cloudflare as well

Here is an example that sends email alerts:

```ini
[DEFAULT]
destemail = admin@example.com
action = %(action_mw)s
```

The `%(action_mw)s` action bans the IP and sends you an email with the whois info.

### Viewing logs

If something seems off, check the Fail2Ban logs:

```bash
sudo tail -f /var/log/fail2ban.log
```

### Testing that it works

From a different machine, try to SSH into your server with the wrong password a few times. After 5 failed attempts, run this on your server:

```bash
sudo fail2ban-client status sshd
```

You should see the IP listed as banned.

### Common questions

**How long should I ban IPs for?** 24 hours is a reasonable default. For aggressive protection, use 1 week or even permanent bans. Keep in mind that some bots rotate IPs regularly.

**Does Fail2Ban use a lot of resources?** No. It runs as a lightweight daemon and only scans log files for new entries. You will not notice it on even a small VPS.

**What if I reboot?** The iptables rules are lost on reboot, but Fail2Ban restores them automatically when it starts back up.

### Conclusion

Fail2Ban is one of those set-it-and-forget-it tools. Spend ten minutes configuring it now, and it will block thousands of unwanted login attempts over the lifetime of your server.