How to Install and Configure Fail2Ban on a Linux VPS

Fail2Ban watches your server's logs and automatically bans IP addresses that repeatedly fail to log in — the classic sign of a brute-force attack. Instead of letting bots hammer your SSH port all night, Fail2Ban spots the pattern and blocks them at the firewall. On a VPS, it is one of the highest-value security tools you can add.

You will need root SSH access.

Step 1: Install Fail2Ban

sudo dnf install fail2ban (AlmaLinux/CentOS) or sudo apt install fail2ban (Ubuntu/Debian)

Then enable and start it:

sudo systemctl enable --now fail2ban

Step 2: Create your own config

Never edit the default file directly — it gets overwritten on updates. Copy it to a local override:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit jail.local and set sensible values near the top: bantime (how long to ban, e.g. 1h), findtime (the window to count failures), and maxretry (failures allowed before a ban, e.g. 5).

Step 3: Protect SSH

In jail.local, make sure the [sshd] jail is enabled. This is the big one — SSH is the most-attacked service on any server. If you have also changed your SSH port, point the jail at your custom port.

Step 4: Restart and verify

sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

The status shows currently banned IPs and totals, so you can watch it working.

Frequently asked questions

Could Fail2Ban lock me out?

It can if you fail your own login too many times. Add your own IP to the ignoreip list in jail.local, and set up SSH key authentication so you never rely on a password that could fail.

Does it work alongside CSF or a firewall?

Yes. Fail2Ban complements firewalls. If you run cPanel/WHM, you may already have CSF handling similar duties — see blacklisting IPs in CSF. Avoid running two tools that fight over the same rules without care.

What else should it protect besides SSH?

You can enable jails for mail, FTP and web login endpoints too. Start with SSH, confirm it works, then add jails for the other services you actually run.