{"id":565,"date":"2026-07-04T10:19:31","date_gmt":"2026-07-04T10:19:31","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=565"},"modified":"2026-07-04T10:19:31","modified_gmt":"2026-07-04T10:19:31","slug":"vps-intrusion-detection-fail2ban-rkhunter-aide","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/","title":{"rendered":"VPS Intrusion Detection: Setting Up Fail2ban, RKHunter, and AIDE on Your Server"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Securing a VPS requires more than a strong SSH password and a firewall. Attackers constantly scan for vulnerable services, outdated packages, and backdoor access points. An intrusion detection strategy combines three tools \u2014 Fail2ban for active threat blocking, RKHunter for rootkit detection, and AIDE for filesystem integrity checking. This guide walks through installation and configuration for each. For providers with built-in DDoS protection and security features, see <a href=\"https:\/\/virtualserversvps.com\/#providers\">our VPS comparison table<\/a>.<\/p><h2 class=\"wp-block-heading\">What Youll Need<\/h2><ul class=\"wp-block-list\"><li>A VPS running Ubuntu 22.04, Debian 12, or AlmaLinux 9<\/li><li>Root or sudo access<\/li><li>Outbound email access (or an SMTP relay) for alert notifications<\/li><li>At least 1 GB of free disk space for log files and database snapshots<\/li><li>Basic familiarity with systemd, cron jobs, and Linux file permissions<\/li><\/ul><h2 class=\"wp-block-heading\">Step 1: Install and Configure Fail2ban<\/h2><p class=\"wp-block-paragraph\"><strong>Fail2ban<\/strong> scans log files (e.g., <code>\/var\/log\/auth.log<\/code>) for repeated authentication failures and temporarily bans offending IP addresses using iptables or nftables.<\/p><h3 class=\"wp-block-heading\">Installation<\/h3><pre class=\"wp-block-code\"><code>sudo apt update &amp;&amp; sudo apt install fail2ban -y   # Debian\/Ubuntu\\nsudo dnf install fail2ban -y                      # AlmaLinux\/RHEL<\/code><\/pre><h3 class=\"wp-block-heading\">Configuration<\/h3><p class=\"wp-block-paragraph\">Create a local jail file to override defaults:<\/p><pre class=\"wp-block-code\"><code>sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local\\nsudo nano \/etc\/fail2ban\/jail.local<\/code><\/pre><p class=\"wp-block-paragraph\">Configure SSH protection with a notification action:<\/p><pre class=\"wp-block-code\"><code>[sshd]\\nenabled = true\\nport = ssh\\nfilter = sshd\\nlogpath = \/var\/log\/auth.log\\nmaxretry = 5\\nbantime = 3600\\nfindtime = 600\\n\\n[nginx-http-auth]\\nenabled = true\\nport = http,https\\nfilter = nginx-http-auth\\nlogpath = \/var\/log\/nginx\/error.log\\nmaxretry = 10\\nbantime = 1800\\n\\n[postfix]\\nenabled = true\\nfilter = postfix\\nlogpath = \/var\/log\/mail.log\\nmaxretry = 3\\nbantime = 3600<\/code><\/pre><p class=\"wp-block-paragraph\">Enable the service and verify active jails:<\/p><pre class=\"wp-block-code\"><code>sudo systemctl enable fail2ban &amp;&amp; sudo systemctl start fail2ban\\nsudo fail2ban-client status<\/code><\/pre><h3 class=\"wp-block-heading\">Email Alerts<\/h3><p class=\"wp-block-paragraph\">Configure the <code>destemail<\/code> and <code>action<\/code> settings in <code>jail.local<\/code> to receive email notifications when an IP is banned.<\/p><h2 class=\"wp-block-heading\">Step 2: Install and Configure RKHunter<\/h2><p class=\"wp-block-paragraph\"><strong>RKHunter (Rootkit Hunter)<\/strong> scans for rootkits, backdoors, and local exploits by comparing file properties against known good values and checking for suspicious kernel modules.<\/p><h3 class=\"wp-block-heading\">Installation<\/h3><pre class=\"wp-block-code\"><code>sudo apt install rkhunter -y   # Debian\/Ubuntu\\nsudo dnf install rkhunter -y   # AlmaLinux\/RHEL<\/code><\/pre><h3 class=\"wp-block-heading\">Initial Database Setup<\/h3><p class=\"wp-block-paragraph\">Update RKHunters file properties database and run the initial system scan:<\/p><pre class=\"wp-block-code\"><code>sudo rkhunter --propupd\\nsudo rkhunter --check --skip-keypress<\/code><\/pre><h3 class=\"wp-block-heading\">Scheduled Scans<\/h3><p class=\"wp-block-paragraph\">Set up a daily cron job to check for rootkits and email the report.<\/p><h2 class=\"wp-block-heading\">Step 3: Install and Configure AIDE<\/h2><p class=\"wp-block-paragraph\"><strong>AIDE (Advanced Intrusion Detection Environment)<\/strong> initializes a database of file checksums, permissions, and ownership, then compares the live filesystem against that database to detect changes.<\/p><h3 class=\"wp-block-heading\">Installation<\/h3><pre class=\"wp-block-code\"><code>sudo apt install aide -y   # Debian\/Ubuntu\\nsudo dnf install aide -y   # AlmaLinux\/RHEL<\/code><\/pre><h3 class=\"wp-block-heading\">Configuration<\/h3><p class=\"wp-block-paragraph\">Edit <code>\/etc\/aide\/aide.conf<\/code> to define which directories to monitor. A sensible starting configuration for a typical web server monitors <code>\/etc<\/code>, <code>\/bin<\/code>, <code>\/sbin<\/code>, <code>\/lib<\/code>, <code>\/usr\/bin<\/code>, <code>\/usr\/sbin<\/code>, and <code>\/boot<\/code> while excluding <code>\/var\/log<\/code>, <code>\/tmp<\/code>, <code>\/proc<\/code>, and <code>\/sys<\/code>.<\/p><p class=\"wp-block-paragraph\">Initialize the AIDE database:<\/p><pre class=\"wp-block-code\"><code>sudo aideinit\\nsudo mv \/var\/lib\/aide\/aide.db.new \/var\/lib\/aide\/aide.db<\/code><\/pre><h3 class=\"wp-block-heading\">Scheduled Checks<\/h3><p class=\"wp-block-paragraph\">Add a daily cron job for AIDE integrity checks. Store the database on read-only media or transfer it off-server after initialization \u2014 an attacker who gains root can modify the database to hide changes.<\/p><h2 class=\"wp-block-heading\">Step 4: Interpret Scan Results<\/h2><p class=\"wp-block-paragraph\"><strong>Fail2ban logs<\/strong> \u2014 Check banned IPs with <code>sudo fail2ban-client status sshd<\/code>. Investigate repeated patterns from the same IP ranges (could be a distributed attack).<\/p><p class=\"wp-block-paragraph\"><strong>RKHunter warnings<\/strong> \u2014 Warnings about <code>\/dev<\/code> or <code>\/proc<\/code> are often false positives. Focus on Rootkit checks that flag hidden processes, suspicious kernel modules, or malware signatures.<\/p><p class=\"wp-block-paragraph\"><strong>AIDE changes<\/strong> \u2014 Legitimate system updates modify binaries in <code>\/usr\/bin<\/code> and <code>\/usr\/lib<\/code>. After a package update, regenerate the database. Unexpected changes to <code>\/etc\/shadow<\/code>, <code>\/etc\/cron*<\/code>, or <code>\/etc\/ssh<\/code> warrant immediate investigation.<\/p><h2 class=\"wp-block-heading\">Automating the Full Security Pipeline<\/h2><p class=\"wp-block-paragraph\">Create a shell script that runs all three checks sequentially and sends a consolidated daily report via cron.<\/p><h2 class=\"wp-block-heading\">Conclusion<\/h2><p class=\"wp-block-paragraph\">Fail2ban, RKHunter, and AIDE form a layered intrusion detection strategy. Fail2ban stops brute-force attacks in real time, RKHunter identifies active rootkits and malware, and AIDE detects unauthorized file changes that could indicate a breach. No single tool is sufficient \u2014 defense in depth is the only approach that works. For VPS providers with advanced security features like DDoS protection and automated patching, check <a href=\"https:\/\/virtualserversvps.com\/#providers\">our VPS comparison table<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"<p>Securing a VPS requires more than a strong SSH password and a firewall. Attackers constantly scan for vulnerable services, outdated packages, and backdoor access points. An intrusion detection strategy combines&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":0,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-565","post","type-post","status-publish","format-standard","hentry","category-security-compliance"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>VPS Intrusion Detection: Setting Up Fail2ban, RKHunter, and AIDE on Your Server - Virtual Servers VPS Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"VPS Intrusion Detection: Setting Up Fail2ban, RKHunter, and AIDE on Your Server\" \/>\n<meta property=\"og:description\" content=\"VPS Intrusion Detection: Setting Up Fail2ban, RKHunter, and AIDE on Your Server\" \/>\n<meta property=\"og:url\" content=\"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/\" \/>\n<meta property=\"og:site_name\" content=\"Virtual Servers VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-04T10:19:31+00:00\" \/>\n<meta name=\"author\" content=\"Virtual-Servers-Vps-Editor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Virtual-Servers-Vps-Editor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/\",\"name\":\"VPS Intrusion Detection: Setting Up Fail2ban, RKHunter, and AIDE on Your Server - Virtual Servers VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\"},\"datePublished\":\"2026-07-04T10:19:31+00:00\",\"author\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\"},\"breadcrumb\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/virtualserversvps.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"VPS Intrusion Detection: Setting Up Fail2ban, RKHunter, and AIDE on Your Server\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/\",\"name\":\"Virtual Servers VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\",\"name\":\"Virtual-Servers-Vps-Editor\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"caption\":\"Virtual-Servers-Vps-Editor\"},\"sameAs\":[\"https:\/\/virtualserversvps.com\/blog\"],\"url\":\"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"VPS Intrusion Detection: Setting Up Fail2ban, RKHunter, and AIDE on Your Server - Virtual Servers VPS Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/","og_locale":"en_US","og_type":"article","og_title":"VPS Intrusion Detection: Setting Up Fail2ban, RKHunter, and AIDE on Your Server","og_description":"VPS Intrusion Detection: Setting Up Fail2ban, RKHunter, and AIDE on Your Server","og_url":"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/","og_site_name":"Virtual Servers VPS Blog","article_published_time":"2026-07-04T10:19:31+00:00","author":"Virtual-Servers-Vps-Editor","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Virtual-Servers-Vps-Editor","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/","url":"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/","name":"VPS Intrusion Detection: Setting Up Fail2ban, RKHunter, and AIDE on Your Server - Virtual Servers VPS Blog","isPartOf":{"@id":"https:\/\/virtualserversvps.com\/blog\/#website"},"datePublished":"2026-07-04T10:19:31+00:00","author":{"@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0"},"breadcrumb":{"@id":"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/virtualserversvps.com\/blog\/vps-intrusion-detection-fail2ban-rkhunter-aide\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/virtualserversvps.com\/blog\/"},{"@type":"ListItem","position":2,"name":"VPS Intrusion Detection: Setting Up Fail2ban, RKHunter, and AIDE on Your Server"}]},{"@type":"WebSite","@id":"https:\/\/virtualserversvps.com\/blog\/#website","url":"https:\/\/virtualserversvps.com\/blog\/","name":"Virtual Servers VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0","name":"Virtual-Servers-Vps-Editor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","caption":"Virtual-Servers-Vps-Editor"},"sameAs":["https:\/\/virtualserversvps.com\/blog"],"url":"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/"}]}},"_links":{"self":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/565","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/comments?post=565"}],"version-history":[{"count":1,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/565\/revisions"}],"predecessor-version":[{"id":566,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/565\/revisions\/566"}],"wp:attachment":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/media?parent=565"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/categories?post=565"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/tags?post=565"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}