Skip to content
Back to Cloud Services

Fail2ban: auto-ban IPs that brute-force SSH and web apps

Install Fail2ban to watch logs and ban IPs that fail auth repeatedly, with custom jails for SSH, Nginx, and your app.

Server SecurityIntermediate

Why

Brute-force bots hit SSH and web login endpoints 24/7. Fail2ban watches auth logs and bans offending IPs at the firewall (iptables/nftables) after N failures, cutting noise and blocking real attacks automatically.

Verizon's 2024 DBIR shows 68% of breaches involve a non-malicious human element. SSH key compromise and misconfigured S3 buckets are top attack vectors — hardening reduces breach risk by 80%+.

When

Use on any internet-facing server with SSH or a web login. Especially valuable before you add WAF/Cloudflare.

How

1. Install: `apt install fail2ban`. 2. Config lives in /etc/fail2ban/jail.local (override jail.conf). 3. Enable sshd jail: `[sshd]\nenabled = true\nmaxretry = 4\nfindtime = 10m\nbantime = 1h\nbackend = systemd`. 4. For Nginx login: create a filter /etc/fail2ban/filter.d/nginx-login.conf matching your 401 log line, then a jail pointing at the access log. 5. For recidive (repeat offenders): bantime = 1w. 6. Restart: `systemctl restart fail2ban`. 7. Check: `fail2ban-client status sshd`. 8. Unban: `fail2ban-client set sshd unbanip 1.2.3.4`.

Example

// security-fail2ban — configuration example const config = { provider: "security" }; # /etc/fail2ban/jail.local [DEFAULT] bantime = 1h findtime = 10m maxretry = 4 backend = systemd destemail = [email protected] action = %(action_mwl)s # ban + mail + whois [sshd] enabled = true port = 22 maxretry = 3 # Custom jail for a web login returning 401 [nginx-login] enabled = true port = http,https filter = nginx-login logpath = /var/log/nginx/access.log maxretry = 5 bantime = 2h # Recidive: ban repeat offenders for a week [recidive] enabled = true bantime = 1w findtime = 1d maxretry = 3

Common Problems

  • ⚠backend = auto misses systemd-journald logs on modern Ubuntu — set backend = systemd explicitly.
  • ⚠Ban list grows unbounded; add recidive jail and ignoreip for your own office/VPN to avoid self-ban.
  • ⚠Cloudflare in front means Fail2ban bans the CF edge IP, blocking all users — use action_cf instead to ban via CF API.

Best Practices

  • ✓Add your own IP/VPN to ignoreip in [DEFAULT] so you never ban yourself during testing.
  • ✓Use recidive jail to escalate repeat offenders to week-long bans automatically.
  • ✓When behind Cloudflare, use the cloudflare action (cfapi) to ban at the edge, not at the origin firewall.

FAQ

What is Fail2ban: auto-ban IPs that brute-force SSH and web apps and what problem does it solve?

Install Fail2ban to watch logs and ban IPs that fail auth repeatedly, with custom jails for SSH, Nginx, and your app. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Fail2ban: auto-ban IPs that brute-force SSH and web apps in 5 minutes?

Two steps to run it: (1) Install: `apt install fail2ban`.; (2) Config lives in /etc/fail2ban/jail.local (override jail.conf).. Validate on the free tier first, then wire into production.

What is the #1 pitfall with Fail2ban: auto-ban IPs that brute-force SSH and web apps?

The most frequent issue is: backend = auto misses systemd-journald logs on modern Ubuntu — set backend = systemd explicitly.. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Fail2ban: auto-ban IPs that brute-force SSH and web apps?

Best practices for Fail2ban: auto-ban IPs that brute-force SSH and web apps include: Add your own IP/VPN to ignoreip in [DEFAULT] so you never ban yourself during testing.; Use recidive jail to escalate repeat offenders to week-long bans automatically.; When behind Cloudflare, use the cloudflare action (cfapi) to ban at the edge, not at the origin firewall.. The first one — "Add your own IP/VPN to ignoreip in [DEFAULT] so you never ban yourself during testing." — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Fail2ban: auto-ban IPs that brute-force SSH and web apps?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Fail2ban: auto-ban IPs that brute-force SSH and web apps options offer a free tier — validate within free quota before scaling.