{"id":720,"date":"2026-07-25T23:45:07","date_gmt":"2026-07-25T23:45:07","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=720"},"modified":"2026-10-08T22:02:23","modified_gmt":"2026-10-08T22:02:23","slug":"how-to-configure-fail2ban-for-vps-security","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/","title":{"rendered":"Fail2ban Jail Tuning on a VPS: findtime, maxretry and Testing Without Locking Yourself Out"},"content":{"rendered":"<div style=\"padding:20px\">\n<p class=\"wp-block-paragraph\">The default fail2ban jail bans an IP after five failed SSH attempts inside ten minutes, for ten minutes. On an internet-facing VPS that is close to useless: botnets rotate source addresses faster than a ten-minute ban expires, and a legitimate user mistyping a key twice can get caught. Effective protection comes from tuning three numbers &mdash; <code>maxretry<\/code>, <code>findtime<\/code> and <code>bantime<\/code> &mdash; plus enabling the recidive jail and testing the whole thing deliberately instead of discovering the config when you are locked out.<\/p>\n<p class=\"wp-block-paragraph\">Fail2ban is a wrapper around your host firewall, so it needs a provider that grants full root and lets you own the nftables\/iptables ruleset. If you are picking a host, <a href=\"https:\/\/virtualserversvps.com\/\">compare VPS plans here<\/a> and confirm root access and a dedicated IPv4 before assuming fail2ban will behave the same way everywhere. The <a href=\"https:\/\/virtualserversvps.com\/\">same comparison<\/a> shows which plans give you the connection-tracking headroom that thousands of banned IPs will consume.<\/p>\n<h2 class=\"wp-block-heading\">Install and Understand the Three Knobs<\/h2>\n<pre class=\"wp-block-code\"><code>apt update &amp;&amp; apt install -y fail2ban\nsystemctl enable --now fail2ban\nfail2ban-client status sshd<\/code><\/pre>\n<p class=\"wp-block-paragraph\">The behaviour of every jail is governed by:<\/p>\n<ul class=\"wp-block-list\">\n<li><code>maxretry<\/code> &mdash; failures permitted within the window before a ban.<\/li>\n<li><code>findtime<\/code> &mdash; the sliding window, in seconds, over which failures are counted.<\/li>\n<li><code>bantime<\/code> &mdash; how long the ban lasts; increase it for repeat offenders.<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">Tune the SSH Jail<\/h2>\n<p class=\"wp-block-paragraph\">Never edit files in <code>\/etc\/fail2ban\/jail.conf<\/code> &mdash; they are overwritten on upgrade. Create <code>\/etc\/fail2ban\/jail.local<\/code>:<\/p>\n<pre class=\"wp-block-code\"><code>[DEFAULT]\nignoreip = 127.0.0.1\/8 ::1\nbackend = systemd\nbantime.increment = true\nbantime.factor = 2\nbantime.maxtime = 48h\nfindtime = 10m\nmaxretry = 4\n\n[sshd]\nenabled = true\nport = ssh\nmaxretry = 3\nfindtime = 60m\nbantime = 1h<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Three settings carry the weight. <code>backend = systemd<\/code> makes fail2ban read the journal rather than a log file, which is correct for modern Debian and Ubuntu. <code>bantime.increment = true<\/code> with a factor of 2 doubles each ban for repeat offenders up to 48 hours &mdash; this is what actually neutralises a persistent scanner. And a wide <code>findtime<\/code> of one hour catches slow brute forces that pace attempts to slip under a short window.<\/p>\n<h2 class=\"wp-block-heading\">Override Instead of Editing<\/h2>\n<p class=\"wp-block-paragraph\">Remember that <code>jail.local<\/code> overrides ship defaults per jail. To confirm what a jail is actually using, ask fail2ban, not the file:<\/p>\n<pre class=\"wp-block-code\"><code>fail2ban-client get sshd maxretry\nfail2ban-client get sshd findtime\nfail2ban-client get sshd bantime\nfail2ban-client status sshd<\/code><\/pre>\n<p class=\"wp-block-paragraph\">After any change, run <code>fail2ban-client reload<\/code> and re-read the live values so you are never reasoning about a value that was not applied.<\/p>\n<h2 class=\"wp-block-heading\">Add a Web Jail<\/h2>\n<p class=\"wp-block-paragraph\">If Nginx runs on the box, a jail on repeated 404s from a single IP blocks directory scanners:<\/p>\n<pre class=\"wp-block-code\"><code>[nginx-botsearch]\nenabled = true\nport = http,https\nfilter = nginx-botsearch\nlogpath = \/var\/log\/nginx\/access.log\nmaxretry = 2\nbantime = 24h<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Test the filter against your own log before enabling it, because a mis-shaped regex can ban normal visitors: <code>fail2ban-regex \/var\/log\/nginx\/access.log \/etc\/fail2ban\/filter.d\/nginx-botsearch.conf<\/code>. The summary line tells you which lines the jail would have matched.<\/p>\n<h2 class=\"wp-block-heading\">Enable the Recidive Jail<\/h2>\n<p class=\"wp-block-paragraph\">Recidive watches fail2ban&rsquo;s own ban actions and bans IPs that trip any jail repeatedly:<\/p>\n<pre class=\"wp-block-code\"><code>[recidive]\nenabled = true\nlogpath = \/var\/log\/fail2ban.log\nbanaction = %(banaction_allports)s\nbantime = 1w\nfindtime = 1d\nmaxretry = 5<\/code><\/pre>\n<p class=\"wp-block-paragraph\">This escalates an address that keeps returning from a one-hour SSH ban to a week-long all-ports ban &mdash; the single highest-value jail to enable on a public VPS, because it turns many rotating one-hour bans into one durable block.<\/p>\n<h2 class=\"wp-block-heading\">Test Without Locking Yourself Out<\/h2>\n<p class=\"wp-block-paragraph\">Before trusting the config, verify the ban path from a second machine (or a second IP), never your only session:<\/p>\n<pre class=\"wp-block-code\"><code># from test host: trigger failures\nfor i in $(seq 1 5); do ssh -o BatchMode=yes wrong@your-vps; done\n# on the VPS: confirm the ban landed\nfail2ban-client status sshd | grep Banned\n# unban immediately\nfail2ban-client set sshd unbanip &lt;test-ip&gt;<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Always keep an <code>ignoreip<\/code> entry for your management address or jump host. Combined with <code>bantime.increment<\/code> and the recidive jail, tuned jails turn background SSH noise from a daily log flood into a handful of long-lived bans you can audit with <code>fail2ban-client status<\/code>.<\/p>\n<h2 class=\"wp-block-heading\">Watch the Ban Database Over Time<\/h2>\n<p class=\"wp-block-paragraph\">Because <code>bantime.increment<\/code> stores per-IP history in <code>\/var\/lib\/fail2ban\/fail2ban.sqlite3<\/code>, that file grows with every distinct offender. On a small VPS under heavy scanning it can reach tens of megabytes, and a corrupt database stops bans silently. Check both size and integrity periodically:<\/p>\n<pre class=\"wp-block-code\"><code>du -h \/var\/lib\/fail2ban\/fail2ban.sqlite3\nsqlite3 \/var\/lib\/fail2ban\/fail2ban.sqlite3 \"PRAGMA quick_check;\"\nfail2ban-client banned | wc -l<\/code><\/pre>\n<p class=\"wp-block-paragraph\">A <code>quick_check<\/code> that returns anything other than <code>ok<\/code> means the ban history is unreliable &mdash; stop fail2ban, back the file up, and let it rebuild rather than discovering at 2 a.m. that an offending IP was never blocked.<\/p>\n<h2 class=\"wp-block-heading\">Fail2ban Is Not a Substitute for Keys<\/h2>\n<p class=\"wp-block-paragraph\">Bans reduce log noise and stop opportunistic scanners; they do not stop a targeted attacker with a valid key. Keep <code>PasswordAuthentication no<\/code>, disable root login, and treat fail2ban as the cheap outer layer it is. With the jails above, an aggressive SSH rate, and keys only, the background hum of the internet becomes a number you check once a week instead of an incident.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The default fail2ban jail bans an IP after five failed SSH attempts inside ten minutes, for ten minutes. On an internet-facing VPS that is close to useless: botnets rotate source&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":6,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-720","post","type-post","status-publish","format-standard","hentry","category-security-compliance"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Fail2ban Jail Tuning on a VPS: findtime, maxretry and Testing Without Locking Yourself Out - Virtual Servers VPS Blog<\/title>\n<meta name=\"description\" content=\"The default fail2ban jail bans an IP after five failed SSH attempts inside ten minutes, for ten minutes. On an internet-facing VPS that is close to\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Fail2ban Jail Tuning on a VPS: findtime, maxretry and Testing Without Locking Yourself Out\" \/>\n<meta property=\"og:description\" content=\"Fail2ban Jail Tuning on a VPS: findtime, maxretry and Testing Without Locking Yourself Out\" \/>\n<meta property=\"og:url\" content=\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/\" \/>\n<meta property=\"og:site_name\" content=\"Virtual Servers VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-25T23:45:07+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-08T22:02:23+00:00\" \/>\n<meta name=\"author\" content=\"Virtual-Servers-Vps-Editor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Virtual-Servers-Vps-Editor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/\",\"name\":\"Fail2ban Jail Tuning on a VPS: findtime, maxretry and Testing Without Locking Yourself Out - Virtual Servers VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\"},\"datePublished\":\"2026-07-25T23:45:07+00:00\",\"dateModified\":\"2026-10-08T22:02:23+00:00\",\"author\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\"},\"description\":\"The default fail2ban jail bans an IP after five failed SSH attempts inside ten minutes, for ten minutes. On an internet-facing VPS that is close to\",\"breadcrumb\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/virtualserversvps.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Fail2ban Jail Tuning on a VPS: findtime, maxretry and Testing Without Locking Yourself Out\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/\",\"name\":\"Virtual Servers VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\",\"name\":\"Virtual-Servers-Vps-Editor\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"caption\":\"Virtual-Servers-Vps-Editor\"},\"sameAs\":[\"https:\/\/virtualserversvps.com\/blog\"],\"url\":\"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Fail2ban Jail Tuning on a VPS: findtime, maxretry and Testing Without Locking Yourself Out - Virtual Servers VPS Blog","description":"The default fail2ban jail bans an IP after five failed SSH attempts inside ten minutes, for ten minutes. On an internet-facing VPS that is close to","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/","og_locale":"en_US","og_type":"article","og_title":"Fail2ban Jail Tuning on a VPS: findtime, maxretry and Testing Without Locking Yourself Out","og_description":"Fail2ban Jail Tuning on a VPS: findtime, maxretry and Testing Without Locking Yourself Out","og_url":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/","og_site_name":"Virtual Servers VPS Blog","article_published_time":"2026-07-25T23:45:07+00:00","article_modified_time":"2026-10-08T22:02:23+00:00","author":"Virtual-Servers-Vps-Editor","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Virtual-Servers-Vps-Editor","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/","url":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/","name":"Fail2ban Jail Tuning on a VPS: findtime, maxretry and Testing Without Locking Yourself Out - Virtual Servers VPS Blog","isPartOf":{"@id":"https:\/\/virtualserversvps.com\/blog\/#website"},"datePublished":"2026-07-25T23:45:07+00:00","dateModified":"2026-10-08T22:02:23+00:00","author":{"@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0"},"description":"The default fail2ban jail bans an IP after five failed SSH attempts inside ten minutes, for ten minutes. On an internet-facing VPS that is close to","breadcrumb":{"@id":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/virtualserversvps.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Fail2ban Jail Tuning on a VPS: findtime, maxretry and Testing Without Locking Yourself Out"}]},{"@type":"WebSite","@id":"https:\/\/virtualserversvps.com\/blog\/#website","url":"https:\/\/virtualserversvps.com\/blog\/","name":"Virtual Servers VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0","name":"Virtual-Servers-Vps-Editor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","caption":"Virtual-Servers-Vps-Editor"},"sameAs":["https:\/\/virtualserversvps.com\/blog"],"url":"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/"}]}},"_links":{"self":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/720","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/comments?post=720"}],"version-history":[{"count":5,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/720\/revisions"}],"predecessor-version":[{"id":1339,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/720\/revisions\/1339"}],"wp:attachment":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/media?parent=720"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/categories?post=720"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/tags?post=720"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}