{"id":1024,"date":"2026-08-31T23:12:58","date_gmt":"2026-08-31T23:12:58","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=1024"},"modified":"2026-08-31T23:12:58","modified_gmt":"2026-08-31T23:12:58","slug":"vps-fail2ban-ssh-brute-force-protection","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/","title":{"rendered":"How to Set Up and Configure Fail2ban on Your VPS for SSH Brute-Force Protection"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">SSH brute-force attacks are one of the most common threats facing any internet-connected VPS. Automated bots scan the entire IPv4 address space every few minutes, trying default credentials and common passwords. Fail2ban is a lightweight, open-source intrusion prevention tool that monitors log files for repeated failed authentication attempts and temporarily bans the offending IP addresses using iptables or nftables.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide covers installing Fail2ban on a Linux VPS (Ubuntu\/Debian and CentOS\/Rocky), configuring it for SSH protection, creating custom jail rules, and testing the setup to ensure it works correctly. Before you begin, make sure you have a non-root sudo user configured \u2014 you do not want to lock yourself out. If you are still choosing a provider, <a href=\"https:\/\/virtualserversvps.com\/#providers\">compare VPS providers for your security setup<\/a> to find one with strong DDoS protection and firewall options.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A Linux VPS running Ubuntu 20.04+, Debian 11+, CentOS Stream 8, or Rocky Linux 8+<\/li>\n<li>Root or sudo access<\/li>\n<li>SSH access configured with key-based authentication (optional but recommended)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Install Fail2ban<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Ubuntu \/ Debian<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt install fail2ban -y<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">CentOS \/ Rocky Linux \/ AlmaLinux<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install epel-release -y\nsudo dnf install fail2ban -y<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">After installation, Fail2ban starts automatically. Verify the service status:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl status fail2ban<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Configure Fail2ban for SSH Protection<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fail2ban uses a two-file configuration system: <code>jail.conf<\/code> (default, overwritten on updates) and <code>jail.local<\/code> (your custom settings, persistent). Never edit <code>jail.conf<\/code> directly \u2014 create or edit <code>\/etc\/fail2ban\/jail.local<\/code> instead.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Create or edit <code>jail.local<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/fail2ban\/jail.local<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Add the following configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>[DEFAULT]\n# Ban IPs for 1 hour (3600 seconds)\nbantime = 3600\n\n# Find failed attempts within the last 10 minutes\nfindtime = 600\n\n# Max 5 failed attempts before banning\nmaxretry = 5\n\n# Ban action: use iptables (or nftables on newer systems)\nbanaction = iptables-multiport\n\n# Ignore these IPs (never ban your own IP)\nignoreip = 127.0.0.1\/8 ::1\n\n[sshd]\nenabled = true\nport = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Explanation of key settings:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>bantime<\/strong>: How long an IP is banned (in seconds). 3600 = 1 hour. Set to -1 for permanent ban.<\/li>\n<li><strong>findtime<\/strong>: The window of time (in seconds) in which failed attempts are counted.<\/li>\n<li><strong>maxretry<\/strong>: Number of failed attempts allowed within findtime before a ban is triggered.<\/li>\n<li><strong>ignoreip<\/strong>: IP addresses that should never be banned. Add your own public IP here.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Customizing for Non-Standard SSH Ports<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you changed your SSH port from the default 22, update the <code>[sshd]<\/code> section:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>[sshd]\nenabled = true\nport = 2222\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Creating Custom Jails<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fail2ban ships with dozens of pre-configured jails for services like Apache, Nginx, Postfix, Dovecot, and WordPress. Enable them by adding sections to <code>jail.local<\/code>. Here is an example for Nginx and WordPress:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>[nginx-http-auth]\nenabled = true\nport = http,https\nlogpath = \/var\/log\/nginx\/error.log\n\n[wordpress]\nenabled = true\nport = http,https\nlogpath = \/var\/log\/nginx\/access.log\nmaxretry = 10\nfindtime = 300\nbantime = 1800<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To see all available jails on your system: <code>ls \/etc\/fail2ban\/jail.d\/<\/code> and <code>ls \/etc\/fail2ban\/filter.d\/<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Restart and Verify Fail2ban<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After editing the configuration, restart Fail2ban:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart fail2ban<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check the status of all jails:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo fail2ban-client status<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check the SSH jail specifically:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo fail2ban-client status sshd<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You should see output showing the number of currently banned IPs and the total number of failures. Example output:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Status for the jail: sshd\n|- Filter\n|  |- Currently failed: 0\n|  |- Total failed: 12\n|  `- File list: \/var\/log\/auth.log\n`- Actions\n   |- Currently banned: 3\n   |- Total banned: 7\n   `- Banned IP list: 45.33.32.156 185.220.101.42 103.235.46.94<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Testing the Configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Important:<\/strong> Run this test from a separate terminal session so you do not lock yourself out of your current SSH connection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Simulate brute-force attacks by attempting SSH logins with incorrect passwords from another machine:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># From another machine, attempt 6 failed logins\nssh nonexistent@your-server-ip\n# (enter wrong password 6 times)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">After the 5th failed attempt (per our maxretry setting), the IP should be banned. Check the Fail2ban logs:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tail -f \/var\/log\/fail2ban.log<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You should see entries like:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>2025-12-01 14:32:15,123 fail2ban.actions [1234]: NOTICE  [sshd] Ban 203.0.113.42<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To unban an IP manually (e.g., if you accidentally locked yourself out via a second IP):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo fail2ban-client set sshd unbanip 203.0.113.42<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 7: Advanced Configuration<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Recidive Jail (Permanent Ban for Repeat Offenders)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Add a recidive jail to permanently ban IPs that keep getting banned repeatedly:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>[recidive]\nenabled = true\nlogpath = \/var\/log\/fail2ban.log\nbanaction = iptables-multiport\nbantime = 604800   # 1 week\nfindtime = 86400   # 24 hours\nmaxretry = 3<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Email Notifications<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To receive email alerts when an IP is banned, add to <code>jail.local<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>[DEFAULT]\ndestemail = you@example.com\nsendername = Fail2ban\nmta = sendmail\naction = %(action_mwl)s<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fail2ban is one of the most effective and lightweight security tools you can deploy on a VPS. With the simple configuration above, you can block thousands of brute-force attempts per day with minimal CPU or memory overhead. The key is to start with sensible defaults (bantime=1h, maxretry=5) and adjust based on your own usage patterns \u2014 you may find that setting maxretry to 3 is too strict if you frequently mistype your password.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a comprehensive security setup, combine Fail2ban with SSH key-only authentication, a properly configured firewall (UFW or firewalld), and automatic security updates. <a href=\"https:\/\/virtualserversvps.com\/#providers\">Compare VPS providers for your security setup<\/a> to find a host that offers robust firewall, DDoS protection, and a secure default configuration.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>SSH brute-force attacks are one of the most common threats facing any internet-connected VPS. Automated bots scan the entire IPv4 address space every few minutes, trying default credentials and common&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":0,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1024","post","type-post","status-publish","format-standard","hentry","category-vps-guides-tutorials"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to Set Up and Configure Fail2ban on Your VPS for SSH Brute-Force Protection - Virtual Servers VPS Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Set Up and Configure Fail2ban on Your VPS for SSH Brute-Force Protection\" \/>\n<meta property=\"og:description\" content=\"How to Set Up and Configure Fail2ban on Your VPS for SSH Brute-Force Protection\" \/>\n<meta property=\"og:url\" content=\"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/\" \/>\n<meta property=\"og:site_name\" content=\"Virtual Servers VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-31T23:12:58+00:00\" \/>\n<meta name=\"author\" content=\"Virtual-Servers-Vps-Editor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Virtual-Servers-Vps-Editor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/\",\"name\":\"How to Set Up and Configure Fail2ban on Your VPS for SSH Brute-Force Protection - Virtual Servers VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\"},\"datePublished\":\"2026-08-31T23:12:58+00:00\",\"author\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\"},\"breadcrumb\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/virtualserversvps.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Set Up and Configure Fail2ban on Your VPS for SSH Brute-Force Protection\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/\",\"name\":\"Virtual Servers VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\",\"name\":\"Virtual-Servers-Vps-Editor\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"caption\":\"Virtual-Servers-Vps-Editor\"},\"sameAs\":[\"https:\/\/virtualserversvps.com\/blog\"],\"url\":\"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"How to Set Up and Configure Fail2ban on Your VPS for SSH Brute-Force Protection - Virtual Servers VPS Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/","og_locale":"en_US","og_type":"article","og_title":"How to Set Up and Configure Fail2ban on Your VPS for SSH Brute-Force Protection","og_description":"How to Set Up and Configure Fail2ban on Your VPS for SSH Brute-Force Protection","og_url":"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/","og_site_name":"Virtual Servers VPS Blog","article_published_time":"2026-08-31T23:12:58+00:00","author":"Virtual-Servers-Vps-Editor","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Virtual-Servers-Vps-Editor","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/","url":"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/","name":"How to Set Up and Configure Fail2ban on Your VPS for SSH Brute-Force Protection - Virtual Servers VPS Blog","isPartOf":{"@id":"https:\/\/virtualserversvps.com\/blog\/#website"},"datePublished":"2026-08-31T23:12:58+00:00","author":{"@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0"},"breadcrumb":{"@id":"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/virtualserversvps.com\/blog\/vps-fail2ban-ssh-brute-force-protection\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/virtualserversvps.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Set Up and Configure Fail2ban on Your VPS for SSH Brute-Force Protection"}]},{"@type":"WebSite","@id":"https:\/\/virtualserversvps.com\/blog\/#website","url":"https:\/\/virtualserversvps.com\/blog\/","name":"Virtual Servers VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0","name":"Virtual-Servers-Vps-Editor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","caption":"Virtual-Servers-Vps-Editor"},"sameAs":["https:\/\/virtualserversvps.com\/blog"],"url":"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/"}]}},"_links":{"self":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/1024","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/comments?post=1024"}],"version-history":[{"count":1,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/1024\/revisions"}],"predecessor-version":[{"id":1026,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/1024\/revisions\/1026"}],"wp:attachment":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/media?parent=1024"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/categories?post=1024"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/tags?post=1024"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}