Fail2Ban

This documentation contains various notes on setting up and configuring the Fail2Ban intrusion prevention framework on a Debain server. (At the time of writing, based on Debian 13.)

Attention

Let the bootstrap script do the work for you!

Don’t bother doing this manually, our Debian bootstrap script can do this for you if you’re setting up a fresh Debian server. Check the script’s README for details and instructions.

Install Fail2Ban

On Debain, install Fail2Ban with apt:

sudo apt update
sudo apt install fail2ban

SSH

Once Fail2Ban is installed, configure it to protect brute-force attacks against SSH. While SSH protection comes enabled by default, we are going to make some customizations to better suit our needs.

sshd configuration

Make a sshd.conf file in the /etc/fail2ban/jail.d directory:

sudo nano /etc/fail2ban/jail.d/sshd.conf

Paste in the following contents:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
findtime = 300
bantime = 3600
ignoreip = 127.0.0.1/8 ::1 100.64.0.0/10

Save and close the file with Ctrl+X, Y to confirm, and Enter to select the save location.

Restart the service so that our new configuration takes effect:

sudo systemctl restart fail2ban

Check the service status to make sure that Fail2Ban is running happily:

sudo systemctl status fail2ban

Settings

Using the configuration above, there are 3 attempts permitted to connect within a 5 minute timespan from a single IP address. If these attempts are exceeded, the IP address will be blocked for 60 minutes.

Localhost IP addresses (127.0.0.1/8 and ::1) and NetBird VPN IP addresses (100.64.0.0/10) are exempted from this rate limiting.

Manually ban or unban

If you need to manually ban or unban a specific IP address, you can do so using fail2ban-client.

To ban a specific IP address:

sudo fail2ban-client set sshd banip <REMOTE-IP-ADDRESS>

To unban a specific IP address:

sudo fail2ban-client set sshd unbanip <REMOTE-IP-ADDRESS>