How to Install Fail2ban on Linux

Fail2ban reads your server's log files for repeated failed logins and temporarily blocks the addresses responsible. It is a quick way to cut down on brute-force attacks against SSH and other services.

Step 1: Install it

sudo apt update
sudo apt install fail2ban

On CentOS, AlmaLinux and Fedora, install the EPEL repository first (sudo yum install epel-release), then sudo yum install fail2ban.

Step 2: Configure it

Never edit jail.conf directly. Copy it to jail.local, which overrides it and survives upgrades:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

The settings people change most are bantime (how long an address is blocked), findtime and maxretry (how many failures within that time cause a ban). On Debian and Ubuntu the SSH jail is on by default; on other systems enable it by adding enabled = true under [sshd].

Step 3: Start it and keep it running

sudo systemctl enable --now fail2ban

Step 4: Check it

sudo fail2ban-client status
sudo fail2ban-client status sshd

The second command lists the addresses currently banned in the SSH jail.

Fail2ban is one layer. For the rest, see how to secure your VPS.