How to protect your server from brute-force attacks with fail2ban

Any server with SSH open receives thousands of automated login attempts. fail2ban watches the logs and bans IPs that get the password wrong too many times.

1. Install

apt-get update -y
apt-get install -y fail2ban

2. Configure

Do not edit the default file; create /etc/fail2ban/jail.local:

[sshd]
enabled = true
maxretry = 4
bantime = 1h
findtime = 10m

After 4 wrong attempts in 10 minutes, the IP is banned for an hour.

3. Start the service

systemctl enable --now fail2ban
systemctl restart fail2ban

4. Check banned IPs

fail2ban-client status sshd

5. Unban an IP (if needed)

fail2ban-client set sshd unbanip 1.2.3.4

fail2ban can protect other services too (Nginx, WordPress). Combine it with SSH key authentication for the best protection.