How to Secure Your Linux VPS Against Brute-Force Attacks Using Fail2ban

If you manage a Linux Virtual Private Server (VPS), your server is constantly exposed to automated bots scanning the internet for weak login credentials. Every minute, malicious scripts attempt to break into Secure Shell (SSH) and other services via brute-force attacks—relentlessly guessing passwords until they gain access. To secure your Linux VPS against these threats, you need an automated defense system that can detect malicious behavior and ban the offending IP addresses before they compromise your data.

One of the most effective and widely trusted tools for this job is Fail2ban. This guide provides a practical, technical walkthrough for developers and small business owners on how to install, configure, and manage Fail2ban on a Linux VPS to automatically block unauthorized login attempts and harden your overall server security.

What is Fail2ban and How Does It Work?

Fail2ban is an intrusion prevention software framework that protects computer servers from brute-force attacks. Written in the Python programming language, it monitors your server’s log files—such as /var/log/auth.log or systemd journal logs—for malicious patterns, such as repeated failed authentication attempts.

n

n

When Fail2ban detects a threshold of failed login attempts from a specific IP address within a defined timeframe, it updates your firewall rules (using tools like iptables, nftables, or firewalld) to dynamically block that IP address for a set duration. Once the ban time expires, the IP is automatically unblocked, ensuring that legitimate users locked out by mistake are not permanently barred from accessing the server.

Prerequisites

Before proceeding, ensure you have the following:

• A running Linux VPS (such as Ubuntu, Debian, CentOS, or AlmaLinux).
• Sudo or root administrative privileges on the server.
• Basic familiarity with the Linux command line and text editors (like nano or vim).

Step 1: Installing Fail2ban on Your Linux VPS

The installation process varies slightly depending on your Linux distribution. First, always update your local package index to ensure you get stable packages from your distribution’s official repositories.

For Ubuntu / Debian-based distributions:

sudo apt update
sudo apt install fail2ban -y

For CentOS / RHEL / AlmaLinux / Rocky Linux:

On RHEL-based systems, Fail2ban is often hosted within the EPEL (Extra Packages for Enterprise Linux) repository. You must enable EPEL before installing.

sudo dnf install epel-release -y
sudo dnf install fail2ban -y

Once installed, start the Fail2ban service and enable it to launch automatically on system boot:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

You can verify that the service is running properly by checking its status:

sudo systemctl status fail2ban

Step 2: Configuring Fail2ban Using Local Overrides

Fail2ban comes with a default configuration file named jail.conf. However, you should never modify jail.conf directly. Package updates can overwrite this file, wiping out your custom settings. Instead, Fail2ban reads configurations from files ending in .local, which override the default settings.

Create your custom local configuration file by copying the default template:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Now, open the new jail.local file in your preferred text editor:

sudo nano /etc/fail2ban/jail.local

Step 3: Customizing Core Settings and SSH Protection

Inside jail.local, look for the [DEFAULT] section. This section defines global rules that apply to all services unless explicitly overridden. Key settings to adjust include:

• bantime: The length of time an IP address is banned. The default is often 10 minutes (600 seconds), but many administrators increase this to 1 hour (3600 seconds) or longer for persistent attackers.
• findtime: The window of time during which failures must occur for a ban to trigger (e.g., 10m for 10 minutes).
• maxretry: The number of failures allowed before a host is banned (e.g., 5).
• ignoreip: IP addresses or subnets that should never be banned by Fail2ban. You should always add your own office or home static IP address here to prevent locking yourself out.

A sample configuration snippet looks like this:

[DEFAULT]
# "ignoreip" can list an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1/8 ::1 203.0.113.50

bantime  = 1h
findtime = 10m
maxretry = 5

Enabling the SSH Jail

Scroll down through the file until you locate the [sshd] section. By default, SSH protection may not be fully active or might use older backend filters. Ensure the section looks similar to this:

[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 3

Save and close the file (in nano, press CTRL+O, Enter, then CTRL+X).

Step 4: Restarting and Testing Fail2ban

After saving your configuration changes, you must restart the Fail2ban service to apply them:

sudo systemctl restart fail2ban

To verify that your SSH jail is actively running and monitoring logs, use the Fail2ban client utility:

sudo fail2ban-client status

This command will output a list of active jails (such as sshd). To check the specific status and banned IPs for the SSH jail, run:

sudo fail2ban-client status sshd

This will display statistics including the number of currently banned IP addresses and a history of total bans.

Step 5: Managing Bans and Troubleshooting

Sometimes, administrators accidentally lock themselves out of a server during testing. If this happens, you can access your server via a web-hosting provider’s VNC console or rescue mode, and manually unblock your IP address using the Fail2ban client:

sudo fail2ban-client set sshd unbanip YOUR_IP_ADDRESS

Conversely, if you notice a malicious IP that hasn’t triggered enough automated failures yet, you can manually ban it immediately:

sudo fail2ban-client set sshd banip 198.51.100.45

Best Practices for Comprehensive VPS Security

While Fail2ban is an essential layer of defense against brute-force attacks, it should be part of a broader, multi-layered security strategy for your Linux VPS:

• Use SSH Key Authentication: Disable password-based logins entirely and rely exclusively on cryptographically secure SSH key pairs.
• Change the Default Port: Moving SSH from port 22 to a non-standard port reduces the volume of automated bot traffic hitting your server logs.
• Keep Software Updated: Regularly apply operating system patches and update applications like WordPress and cPanel to prevent exploit escalation.
• Configure a Firewall: Ensure tools like UFW (Uncomplicated Firewall) or firewalld are active and only necessary ports (like HTTP, HTTPS, and your custom SSH port) are open to the public internet.

Conclusion

Securing your Linux VPS against automated threats is crucial for maintaining data integrity, server uptime, and user trust. By installing and properly configuring Fail2ban, you automate the tedious and critical task of detecting and blocking malicious brute-force actors before they can compromise your system. Combined with SSH keys and regular system maintenance, Fail2ban provides robust protection for your online infrastructure.

Explore reliable hosting and domain services from Bukabyte.

Monitoring Logs and Verifying Fail2ban Actions in Real Time

Once your jails are up and running, it is vital to know how to inspect Fail2ban’s real-time activity. System administrators often need to verify whether the software is successfully parsing logs and triggering firewall rules during active attacks. Fail2ban logs all its internal operations, warnings, and ban/unban events to a dedicated log file, typically located at /var/log/fail2ban.log.

You can monitor this log file in real time using the tail command:

sudo tail -f /var/log/fail2ban.log

When monitoring the log, you will see entries indicating when a filter matches a failure pattern, when a jail detects a threshold breach, and when a firewall rule is successfully executed to drop packets from the attacker’s IP address. For example, a successful ban event will output an entry showing the targeted jail name and the offending IP address.

Checking Firewall Rules Directly

Because Fail2ban interacts directly with your server’s packet filtering framework, you can also inspect your active firewall rules to confirm that bans are being enforced at the network layer. Depending on your Linux distribution, Fail2ban may use iptables, nftables, or firewalld.

If your VPS uses standard iptables, you can list the active rules inside the Fail2ban-managed chain by running:

sudo iptables -S f2b-sshd

This command outputs the precise drop rules applied to individual malicious IP addresses, giving you absolute transparency into what traffic is currently being blocked at the kernel level.

Protecting Additional Services Beyond SSH

While securing SSH is the most common use case, automated bots frequently target other network services running on your Linux VPS. If you host web applications, mail servers, or control panels like cPanel, you should extend Fail2ban protection to cover those entry points as well.

Fail2ban includes built-in filters and jails for a wide variety of software stack components, including:

• Web Servers (Apache and Nginx): Protects against HTTP brute-force attempts, web scanning bots, and excessive requests targeting login endpoints or administrative directories.
• Mail Servers (Postfix and Dovecot): Prevents unauthorized actors from brute-forcing SMTP and IMAP credentials to relay spam through your server.
• FTP Servers (ProFTPD and vsftpd): Blocks repeated failed file transfer login attempts.
• WordPress and Custom Applications: You can create custom filters to monitor application-specific error logs, such as failed XML-RPC or wp-login.php attempts.

To enable an additional service jail, open your /etc/fail2ban/jail.local file and locate the corresponding section. For example, to protect an Nginx HTTP authentication page, you would enable the nginx-http-auth jail by setting enabled = true under that block, adjusting the maxretry and bantime values to suit your traffic patterns, and restarting the Fail2ban service.

Advanced Configuration: Persistent Bans and Recidive Jails

Persistent attackers often change their IP addresses after an initial ban expires to resume their brute-force campaign. To counteract this behavior, Fail2ban offers an advanced feature known as the recidive jail. The recidive jail monitors Fail2ban’s own log files to identify repeat offenders who get banned multiple times across other jails within a specified period.

When an IP address triggers repeated bans, the recidive jail steps in to impose a much longer, harsher penalty—such as a ban lasting several weeks or even permanently. To configure the recidive jail, scroll to the bottom of your /etc/fail2ban/jail.local file and add a dedicated block:

[recidive]
enabled  = true
logpath  = /var/log/fail2ban.log
bantime  = 1w
findtime = 1d
maxretry = 3

In this example, if an IP address is banned three separate times within a single day across any of your server’s jails, the recidive jail will block that IP address for an entire week (1w). This significantly reduces the load on your server by neutralizing persistent automated scanning scripts.

Related Bukabyte guides

• Top Ten Web Hosting Businesses in Nigeria – A Practical Guide