Protect SSH from brute-force attacks with Fail2ban

As soon as a server is on the internet, automated bots start trying to log in over SSH with common usernames and passwords. Fail2ban watches for failed logins and blocks any IP address that fails too many times in a short period. It cuts down the noise in your logs and makes password guessing far slower.

Fail2ban works best alongside SSH keys, with password logins turned off. See Set up SSH keys to log in to your VPS securely.

It works on every operating system we offer: Ubuntu 22.04, 24.04 and 26.04, Debian 12 and 13, AlmaLinux 8, 9 and 10, and Rocky Linux 9 and 10.

Before you start

• SSH access as root or as a user with sudo rights. If you're logged in as root, you can leave sudo off the commands.
• A firewall is recommended. See Set up a firewall on your VPS with UFW or firewalld. On AlmaLinux and Rocky, firewalld must be running, because Fail2ban uses it to block addresses.
• Your own public IP address, so you can make sure Fail2ban never blocks you. Search for "what is my IP" in your web browser to find it.

Step 1: Install Fail2ban

Ubuntu/Debian

sudo apt update
sudo apt install -y fail2ban python3-systemd

AlmaLinux/Rocky

Fail2ban comes from the EPEL repository, so add that first:

sudo dnf install -y epel-release
sudo dnf install -y fail2ban

Step 2: Create your settings file

Fail2ban's default settings are in /etc/fail2ban/jail.conf. Don't edit that file, because updates can replace it. Put your own settings in /etc/fail2ban/jail.local instead, which overrides the defaults:

sudo nano /etc/fail2ban/jail.local

Paste in the following. Replace YOUR_HOME_IP with your own IP address, or delete it if your IP address changes often:

[DEFAULT]
# Addresses that are never banned, separated by spaces
ignoreip = 127.0.0.1/8 ::1 YOUR_HOME_IP

# How long a ban lasts
bantime = 1h

# Ban an address after maxretry failures within findtime
findtime = 10m
maxretry = 5

[sshd]
enabled = true
backend = systemd

Press Ctrl+O and Enter to save, and Ctrl+X to exit.

What the settings mean:

• ignoreip: addresses Fail2ban will never block. Add your office or home IP so a few typos never lock you out.
• bantime: how long a ban lasts. Fail2ban's own default is 10 minutes. You can use values such as 30m, 1h or 1d.
• findtime and maxretry: with these settings, an address that fails 5 times within 10 minutes is banned.
• backend = systemd: tells Fail2ban to read SSH logins from the systemd journal.

Why backend = systemd? Fail2ban traditionally reads SSH logins from /var/log/auth.log. Debian 12 and 13 no longer install the rsyslog service that writes that file, so on Debian it doesn't exist, and the SSH jail fails to start with "Have not found any log file for sshd jail". Reading the systemd journal instead works on every operating system we offer. AlmaLinux and Rocky already read the journal by default, and Ubuntu, which usually still has /var/log/auth.log, works fine with the journal too.

Using a custom SSH port? Add a port line under [sshd], for example port = 2222, so bans block the right port.

Optional: to give repeat offenders longer bans each time they come back, add bantime.increment = true under [DEFAULT].

Step 3: Start Fail2ban

sudo systemctl enable fail2ban
sudo systemctl restart fail2ban

Run the restart command again whenever you change jail.local.

Step 4: Check it's working

sudo fail2ban-client status
sudo fail2ban-client status sshd

The first command should list sshd as a jail. The second shows how many failed logins Fail2ban has seen, how many addresses are banned right now, and the list of banned IP addresses. Bots try constantly, so on a public server you'll usually see failed logins within an hour or so.

Fail2ban's own log shows bans and unbans as they happen:

sudo tail -f /var/log/fail2ban.log

Press Ctrl+C to stop watching.

Step 5: Unban an IP address

sudo fail2ban-client set sshd unbanip 203.0.113.10

Banned yourself? Connect from a different network, such as your phone's hotspot, or log in with Open Console on your VPS's management page (see Use the web console to access your VPS). Then run the unban command with your own IP address. To stop it happening again, add your IP to ignoreip and restart Fail2ban. You can check the list with sudo fail2ban-client get sshd ignoreip.

How Fail2ban works with your firewall

Fail2ban blocks an address by adding a rule to the server's firewall. The setting that controls how it does this is called banaction.

• AlmaLinux/Rocky: the EPEL package includes /etc/fail2ban/jail.d/00-firewalld.conf, which sets banaction = firewallcmd-rich-rules, so bans are added through firewalld. You don't need to change anything, but firewalld must be running. You can see current bans with sudo firewall-cmd --list-rich-rules.
• Ubuntu/Debian: by default, Fail2ban adds its own blocking rules (using nftables or iptables) alongside UFW's rules. The two work together, but bans won't show in sudo ufw status. If you'd like bans to appear in UFW, and UFW is turned on, add these lines under [DEFAULT] in jail.local, then restart Fail2ban:

  banaction = ufw
  banaction_allports = ufw

An alternative: CrowdSec

CrowdSec is a newer, open-source tool that does a similar job. As well as watching your own logs, it can block addresses that other CrowdSec users have reported for attacks. CrowdSec itself only detects attacks; a separate component, called a bouncer, does the blocking, so you install both. If you'd like to try it, follow the official CrowdSec installation guide. Use either Fail2ban or CrowdSec to protect SSH, not both.

Troubleshooting

• "Have not found any log file for sshd jail": make sure backend = systemd is under [sshd] in jail.local. On Ubuntu/Debian, also install python3-systemd. Then restart Fail2ban.
• Fail2ban won't start: see the error with sudo journalctl -u fail2ban -n 50. A typo in jail.local is the usual cause.
• The sshd jail never shows any failed logins: check that backend = systemd is set, that the port matches your SSH port, and that you restarted Fail2ban after changing jail.local.
• Errors mentioning firewall-cmd on AlmaLinux/Rocky: firewalld isn't running. Check that SSH is allowed, then start it with sudo systemctl enable --now firewalld.
• You suddenly can't connect at all: you may have banned yourself. See Step 5.

Related guides

• Secure your new VPS: a checklist for the first 15 minutes
• Set up a firewall on your VPS with UFW or firewalld
• Set up SSH keys to log in to your VPS securely
• Fix common SSH connection errors

Need help?

Our Cloud VPS plans are self-managed, so you're responsible for installing, securing and maintaining the software on your server. If something on our side isn't working, such as the network, or your VPS won't boot, open a support ticket. New to your VPS? Start with our Cloud VPS Getting Started Guide.