Look at /var/log/auth.log on any internet-facing Ubuntu server and you will find an endless stream of failed SSH logins from bots guessing passwords. Fail2Ban reads those logs in real time and firewalls any IP address that fails too often — automatically, within seconds, around the clock. Together with key-only SSH and UFW, it forms the standard security trio for an Ubuntu 24.04 VPS.
Step 1 — Install Fail2Ban
sudo apt update sudo apt install fail2ban -y sudo systemctl enable --now fail2ban
Step 2 — Create a local configuration
Never edit jail.conf directly — package updates overwrite it. Create jail.local instead:
sudo nano /etc/fail2ban/jail.local
[DEFAULT] # Ban for 1 hour after 5 failures within 10 minutes bantime = 1h findtime = 10m maxretry = 5 # Never ban your own office/home IP: ignoreip = 127.0.0.1/8 ::1 198.51.100.7 [sshd] enabled = true
On Ubuntu 24.04 the sshd jail is enabled out of the box and reads the systemd journal directly. Restart to apply changes:
sudo systemctl restart fail2ban
Step 3 — Watch it work
sudo fail2ban-client status sshd
Within a day on a public IP you will typically see dozens of bans. Each banned address is blocked at the firewall level for the duration of bantime.
Managing bans
# Unban an address (e.g. you locked yourself out) sudo fail2ban-client set sshd unbanip 203.0.113.55 # Ban one manually sudo fail2ban-client set sshd banip 45.155.204.11 # See every jail sudo fail2ban-client status
Protecting more than SSH
Fail2Ban ships with filters for dozens of services. If you run a Nginx or Apache web server, these jails stop bots hammering login pages and probing for exploits:
[nginx-http-auth] enabled = true [apache-auth] enabled = true [apache-badbots] enabled = true
Recommended settings for real-world servers
The defaults are gentle. On production servers we typically raise bantime to 1d and enable the built-in incremental banning so repeat offenders are banned exponentially longer:
[DEFAULT] bantime.increment = true bantime.factor = 2 bantime.maxtime = 5w
ignoreip the day you install Fail2Ban. The most common Fail2Ban incident is an admin banning themselves with a mistyped password.Related Ubuntu guides
- How to Secure SSH on Ubuntu: Key Authentication, Custom Port and Best Practices
- How to Set Up UFW Firewall on Ubuntu 24.04: Complete Configuration Guide
- Initial Ubuntu 24.04 Server Setup Guide: Secure Your New VPS in 10 Steps
- How to Create a Sudo User on Ubuntu 24.04 and Disable Root Login
Prefer to have experts handle it?
LFA IT provides fully managed Ubuntu VPS and dedicated servers — initial setup, security hardening, monitoring and 24/7 support, so you can focus on your business. Explore our hosting and server management services or open a support ticket and our engineers will take it from there.
