How to install Fail2ban

Quick answer: Install the package (apt install fail2ban or dnf install fail2ban with EPEL), create /etc/fail2ban/jail.local enabling the sshd jail, and start the service. Fail2ban reads your logs and temporarily bans IPs that keep failing to log in — brute-force attempts drop to near zero.

Overview

Fail2ban watches log files for repeated failures (SSH, panels, mail, web logins), then inserts firewall rules to ban the offending IP for a configurable time. It complements — not replaces — key-only SSH: even banned bots cost you log noise and CPU until Fail2ban silences them.

Before you start

• Root/sudo access.
• A working firewall backend (nftables/iptables — installed by default on supported distros).
• Awareness of your own IP so you can whitelist it.

Step-by-step guide

1. Install:

   apt install fail2ban -y                  # Ubuntu/Debian
   dnf install epel-release -y && dnf install fail2ban -y   # Alma/Rocky

2. Never edit jail.conf — create /etc/fail2ban/jail.local:

   [DEFAULT]
   bantime  = 1h
   findtime = 10m
   maxretry = 5
   ignoreip = 127.0.0.1/8 YOUR.HOME.IP.HERE
   
   [sshd]
   enabled = true

3. Start and enable:

   systemctl enable --now fail2ban

4. Check status and bans:

   fail2ban-client status
   fail2ban-client status sshd

5. If you changed the SSH port, set port = 2222 in the [sshd] section.

Common issues

• Banned yourself: unban with fail2ban-client set sshd unbanip YOUR.IP (via KVM Console if needed) and add your IP to ignoreip.
• Jail won't start on Alma/Rocky: ensure the log backend matches — with journald set backend = systemd in jail.local.
• No bans ever happen: check fail2ban-client status sshd shows the right log path/port and that failures actually reach the log.

When to contact support

Fail2ban is part of the OS you manage. Contact Cloud2Y support if you are locked out with no KVM Console access, or if login failures continue at a scale that looks like a distributed attack (how to report a DDoS attack).

Frequently asked questions

What exactly does Fail2ban do?

It watches log files for repeated authentication failures and temporarily bans the source IP with a firewall rule, typically for an hour, which makes brute-force campaigns ineffective.

Why should I edit jail.local instead of jail.conf?

Package updates overwrite jail.conf, silently discarding your settings. Everything you put in jail.local overrides jail.conf and survives every Fail2ban upgrade.

I banned my own IP with Fail2ban — how do I recover?

Log in through the KVM Console and run fail2ban-client set sshd unbanip with your address, then add your IP to the ignoreip list in jail.local so it cannot happen again.

Related articles

• How to protect against brute-force attacks
• How to secure SSH access
• How to read auth logs
• How to configure a firewall

Need a hand? Contact Cloud2Y support →