Home › Guides › Linux
Linux · How-to

How to Install and Configure fail2ban on Ubuntu

Blunt SSH brute-force attacks by banning IPs that fail login repeatedly.

You'll need: Ubuntu with SSH exposed (ideally already using key auth).

Steps

  1. Install: sudo apt update && sudo apt install fail2ban.
  2. Enable and start it: sudo systemctl enable --now fail2ban.
  3. Create a local jail config: copy /etc/fail2ban/jail.conf to /etc/fail2ban/jail.local.
  4. In jail.local, set [sshd] enabled = true and configure bantime, findtime, and maxretry.
  5. Restart: sudo systemctl restart fail2ban.
  6. Check status: sudo fail2ban-client status sshd.
Watch outfail2ban is not a substitute for SSH key auth — use both. Also edit jail.local, never jail.conf, so updates don't overwrite your settings.

Go deeper: Build a Hardened Linux Workstation

The Linux guide covers fail2ban alongside key auth and the full sshd_config hardening.

Get the guide