Intrusion prevention
Software that automatically detects and blocks malicious behavior, such as fail2ban banning an IP after repeated failed logins, rather than only logging it for a human to review later.
How this differs from detection alone
A system that only logs or alerts on suspicious activity still requires a person to notice and act. Intrusion prevention takes the additional step of automatically blocking the identified threat, such as banning an offending IP address, without waiting for a human response.
The trade-off it introduces
Automatically blocking based on a pattern always carries some risk of a false positive blocking a legitimate user. Well-tuned intrusion prevention tools, like fail2ban's jail configuration, balance this by requiring a clear, repeated pattern before acting.
Frequently asked questions
Is intrusion prevention the same as a firewall?
Related but distinct. A firewall enforces static rules about which connections are allowed; intrusion prevention actively watches behavior and adds new blocks dynamically based on what it observes.
Can intrusion prevention accidentally block a real customer?
Yes, if thresholds are set too aggressively or a legitimate user genuinely mistypes credentials repeatedly. Reasonable thresholds and a documented unban process reduce this risk.
What is the most common intrusion prevention tool on Linux?
fail2ban, which is widely used specifically because it is straightforward to configure for common services like SSH and web login forms.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab