How to Fix SSH Brute Force Attacks: Fail2Ban Configuration

Your VPS is under attack. Every second, automated bots are hammering your SSH port with thousands of password guesses. You notice your logs filling up with failed login attempts. Your server’s CPU is spiking. And you’re wondering: how do I stop SSH brute-force attacks?

This is one of the most common security threats facing Linux server administrators, VPS owners, and cloud hosting users. The good news? There’s a battle-tested solution: Fail2Ban.

Fail2Ban is a free, open-source tool that automatically detects and blocks brute-force SSH attacks by monitoring your server logs and banning IP addresses that make repeated failed login attempts. It’s lightweight, simple to configure, and incredibly effective at protecting your server from unauthorized access.

In this guide, we’ll walk you through installing and configuring Fail2Ban, understanding how it works, and securing your production server against the most common attack vector: SSH brute-force attempts.

Understanding SSH Brute-Force Attacks

Before we jump into Fail2Ban configuration, let’s understand what we’re defending against.

What is an SSH brute-force attack? An attacker (or automated bot) targets your server’s SSH port (port 22) and attempts to log in by guessing usernames and passwords. They might try:

• Common usernames like root, admin, user
• Weak passwords from leaked databases
• Automated lists of a million+ password combinations

Why is this a problem?

• Server strain: Processing thousands of login attempts consumes CPU and memory
• Bandwidth waste: Attack traffic clogs your network
• Successful breach risk: If you’re using a weak password, your server can be compromised
• Malware risk: Once inside, attackers install ransomware, cryptominers, or backdoors
• Compliance issues: Compromised servers violate security standards and expose customer data

How Fail2Ban helps: Fail2Ban monitors your SSH logs in real-time. When it detects a pattern of failed login attempts from a single IP address (e.g., 5 failed attempts in 10 minutes), it automatically adds a firewall rule to block that IP. This happens in seconds, stopping the attack before it causes damage.

Step 1: Install Fail2Ban

First, update your system and install Fail2Ban. These instructions work on Ubuntu, Debian, CentOS, and RHEL VPS systems.

On Ubuntu/Debian:

sudo apt update
sudo apt install fail2ban

On CentOS/RHEL:

sudo yum install fail2ban

Verify installation:

fail2ban-client --version

Start the Fail2Ban service:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

The enable command ensures Fail2Ban restarts automatically if your server reboots.

Check service status:

sudo systemctl status fail2ban

You should see active (running). If not, check logs:

sudo journalctl -u fail2ban -n 20

Step 2: Understand Fail2Ban Configuration

Fail2Ban’s configuration lives in /etc/fail2ban/. Let’s understand the key files:

• jail.conf — Default configuration (don’t edit this; use jail.local instead)
• jail.local — Your custom overrides (create this file to customize Fail2Ban)
• filter.d/ — Regex patterns that identify attack attempts in logs
• action.d/ — Actions to take when an attack is detected (ban IPs, send alerts)

The key jail for SSH is sshd, which monitors /var/log/auth.log (Ubuntu/Debian) or /var/log/secure (CentOS/RHEL) for failed login attempts.

Step 3: Create and Configure jail.local

Instead of editing jail.conf, create a new file called jail.local to override defaults:

sudo nano /etc/fail2ban/jail.local

Add this configuration:

[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5
destemail = your-email@example.com
sender = fail2ban@yourdomain.com
action = %(action_mwl)s

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
findtime = 600
bantime = 3600

What each setting means:

• bantime — How long (in seconds) to ban an IP. 3600 = 1 hour. Increase to 86400 (24 hours) for stricter security.
• findtime — The time window (in seconds) to monitor. 600 = 10 minutes. An IP is banned if it makes maxretry failed attempts within this window.
• maxretry — Number of failed attempts before banning. 5 is standard; reduce to 3 for stricter security.
• destemail — Your email (optional). Fail2Ban can send alerts when IPs are banned.
• action — What to do when an IP is banned. %(action_mwl)s bans the IP and sends an email with logs.

For the logpath, use:

• Ubuntu/Debian: /var/log/auth.log
• CentOS/RHEL: /var/log/secure

If your SSH runs on a non-standard port (e.g., 2222), change:

port = 2222

Save the file (Ctrl+X, Y, Enter).

Step 4: Restart Fail2Ban and Verify Configuration

Restart Fail2Ban to apply your changes:

sudo systemctl restart fail2ban

Check that the sshd jail is active:

sudo fail2ban-client status

You should see:

Status
|- Number of jail:	1
`- Jail list:	sshd

Check the sshd jail status specifically:

sudo fail2ban-client status sshd

Output will show:

Status for the jail: sshd
|- Filter
|  |- Currently failed:	0
|  |- Total failed:	0
|  `- Journal matches:	0
|- Actions
|  |- Currently banned:	0
|  |- Total banned:	0
|  `- Banned IP list:

Perfect! Fail2Ban is monitoring your SSH logs.

Step 5: Monitor Banned IPs and Test

View currently banned IPs:

sudo fail2ban-client status sshd

or list them directly:

sudo iptables -L -n | grep REJECT

Test Fail2Ban (optional but recommended)

To verify Fail2Ban is working, intentionally fail SSH login 5+ times from another machine:

ssh root@your-vps-ip-address
# Enter wrong password 5 times

After 5 failed attempts, that IP will be banned. Check:

sudo fail2ban-client status sshd

You’ll see the IP listed under Banned IP list:.

To unban an IP manually (if you locked yourself out):

sudo fail2ban-client set sshd unbanip your-ip-address

Step 6: Fine-Tune for Your Environment

For production servers with many legitimate users:

• Increase maxretry to 10 to avoid locking out users with typos
• Increase findtime to 1800 (30 minutes) to catch distributed attacks
• Keep bantime at 3600 (1 hour)

For strict security (single-user servers):

• Keep maxretry at 3 or 4
• Keep findtime at 600 (10 minutes)
• Increase bantime to 86400 (24 hours) to permanently deter attackers

To also protect other services (FTP, HTTP), create additional jails in jail.local:

[vsftpd]
enabled = true
port = ftp
filter = vsftpd
logpath = /var/log/auth.log
maxretry = 5

[apache-http-auth]
enabled = true
filter = apache-http-auth
port = http,https
logpath = /var/log/apache2/error.log
maxretry = 5

Bonus: Enable Email Alerts

To receive email notifications when IPs are banned, configure the destemail and ensure your server can send mail.

First, install a mail utility:

sudo apt install mailutils

Then edit jail.local and add:

destemail = admin@yourdomain.com
sender = fail2ban@yourdomain.com
action = %(action_mwl)s

Now Fail2Ban will email you a summary of banned IPs and attempted attacks. Perfect for staying aware of threats in real-time.

Hostzop Cloud: Stop SSH Brute-Force Attacks and Secure Your VPS

SSH brute-force protection is fundamental to running a secure VPS or cloud server, but configuring tools like Fail2Ban requires technical knowledge that many Indian SMBs don’t have readily available. Hostzop Cloud simplifies server security by offering managed VPS Hosting Solutions with pre-configured security defaults, including Fail2Ban support and expert guidance on brute-force attack prevention. Whether you’re launching your first production server or managing a fleet of instances, Hostzop Cloud’s transparent platform provides the tools, documentation, and responsive support needed to defend your infrastructure against unauthorized access attempts. With affordable, transparent pricing starting from competitive INR rates, Hostzop Cloud delivers enterprise-grade SSH security hardening without the complexity—so you can focus on growing your business instead of battling attackers.

Frequently Asked Questions

Will Fail2Ban block legitimate users?

Only if they repeatedly fail to enter the correct password. A user with a typo gets 5 chances (or whatever you set maxretry to). As long as users enter their password correctly, they’ll never be banned. If you do lock out a legitimate user, you can manually unban their IP using sudo fail2ban-client set sshd unbanip [ip-address].

Can Fail2Ban prevent distributed brute-force attacks?

Partially. If attackers use many different IPs (a botnet), each individual IP might not hit your maxretry threshold fast enough. However, Fail2Ban still reduces the attack surface significantly. For distributed attacks, combine Fail2Ban with other tools like rate limiting, WAF rules, or VPN-only SSH access.

What if I want to allow specific IPs to bypass Fail2Ban?

Add them to the whitelist in jail.local:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.1 203.0.113.45

Replace the last IP with IPs you trust (e.g., your office, VPN gateway).

How do I unban all IPs at once?

Reset Fail2Ban:

sudo fail2ban-client reload

This reloads the configuration and clears all current bans. Permanent bans in the firewall remain.

Does Fail2Ban work with SSH keys instead of passwords?

Yes. Even with SSH key-based authentication, Fail2Ban still protects you by banning IPs that make repeated connection attempts (authentication errors, invalid user attempts, etc.). However, with proper SSH key setup, attackers won’t succeed even if they bypass Fail2Ban, so the combination is extremely secure.

Can I see a log of all banned IPs and attacks?

Yes. Check the Fail2Ban log:

sudo tail -f /var/log/fail2ban.log

This shows real-time banning activity. For historical data, use:

sudo journalctl -u fail2ban | grep "Ban"