fail2ban
A widely used intrusion-prevention tool that watches log files for patterns like repeated failed logins and temporarily or permanently bans the source IP address using the server's firewall.
How it actually decides to ban an address
fail2ban watches specific log files for patterns matching failed login attempts, and once a source IP crosses a configured threshold of failures within a set time window, it instructs the server's firewall to block that address, either temporarily or permanently.
Why it complements, not replaces, other controls
fail2ban reduces the volume of brute-force attempts that even reach the point of being tried against your login system, but it does nothing to strengthen the login itself, which is why it is typically paired with key-based authentication rather than used alone.
Frequently asked questions
Does fail2ban work for services other than SSH?
Yes. It ships with jail configurations for many common services, including web server authentication and mail servers, and can be extended with custom filters for other logs.
How long does a fail2ban ban typically last?
It is configurable, ranging from a few minutes to permanent, and many setups use escalating ban times that grow longer for repeat offenders.
Can a legitimate user get banned by fail2ban by accident?
Yes, if they mistype credentials enough times within the configured window. Most setups include a documented way to request an unban or a generous enough threshold to avoid this in normal use.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab