Fail2ban

Fail2ban is a free security tool for Linux systems that analyses service logs in real time and automatically bans IP addresses showing malicious behaviour. It most commonly defends against brute-force attacks on SSH, login panels, mail servers and FTP, where an attacker tries to guess a password through thousands of requests. By cutting off persistent sources before they cause harm, Fail2ban reduces the risk of account takeover and relieves load on the server.

How Fail2ban works

The tool operates through jails — sets of rules tied to specific services. Each jail watches a designated server log file and compares entries against patterns (filters) that describe failed attempts. When a single IP address produces too many matches within a defined time window, Fail2ban adds a rule to the firewall that blocks that address for a set period.

Filters and actions

A filter is a regular expression that recognises a failed-login entry in the log. An action defines what happens once the limit is exceeded — most often adding a block in iptables or nftables, but it can also send an email notification or report the address to an external reputation database.

Practical applications

Fail2ban is a standard part of hardening VPS and dedicated servers. Administrators configure it above all for the SSH service, whose logs immediately fill with login attempts from around the world, and also for mail servers, WordPress and other applications with login forms. In managed services, Fail2ban typically runs quietly in the background as one of the first lines of defence, complementing SSH keys, strong passwords and security updates.