Jail (fail2ban)
A specific monitoring rule set inside fail2ban targeting one service, such as an sshd jail or an nginx-http-auth jail, each with its own ban conditions.
Why one server usually runs several jails at once
Each jail watches a different log file and service, so a server exposing SSH, a web application, and mail might run three separate jails simultaneously, each with its own ban thresholds tuned to that service's normal traffic patterns.
What goes wrong when a jail is misconfigured
A jail pointed at the wrong log file path, or using a filter regex that does not match the actual log format on a given distribution, will silently fail to trigger, leaving the operator believing they are protected when no bans are actually happening.
Frequently asked questions
Do all jails share the same ban settings?
No, each jail can have its own thresholds, ban time, and filter, configured independently in fail2ban's jail.local file or equivalent.
How do I check if a specific jail is actually active?
Run fail2ban-client status to see all active jails, and fail2ban-client status
Can I write a custom jail for an application not supported out of the box?
Yes. fail2ban supports custom filters using regular expressions matched against any log file you point it at, not just its built-in service definitions.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab