Fail2Ban¶
This documentation contains various notes on setting up and configuring the Fail2Ban intrusion prevention framework on a Debian server. (At the time of writing, based on Debian 13.)
Let the bootstrap script do the work for you!
Don’t bother doing this manually, our Debian bootstrap script can do this for you if you’re setting up a fresh Debian server. Check the script’s README for details and instructions.
Install Fail2Ban¶
On Debian, install Fail2Ban with apt:
SSH¶
Once Fail2Ban is installed, configure it to protect brute-force attacks against SSH. While SSH protection comes enabled by default, we are going to make some customizations to better suit our needs.
sshd configuration¶
Make a sshd.conf file in the /etc/fail2ban/jail.d directory:
Paste in the following contents:
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
findtime = 300
bantime = 3600
ignoreip = 127.0.0.1/8 ::1 100.64.0.0/10
Save and close the file with Ctrl+X, Y to confirm, and Enter to select the save location.
Restart the service so that our new configuration takes effect:
Check the service status to make sure that Fail2Ban is running happily:
Settings¶
Using the configuration above, there are 3 attempts permitted to connect within a 5 minute timespan from a single IP address. If these attempts are exceeded, the IP address will be blocked for 60 minutes.
Localhost IP addresses (127.0.0.1/8 and ::1) and NetBird VPN IP addresses (100.64.0.0/10) are exempted from this rate limiting.
Manually ban or unban¶
If you need to manually ban or unban a specific IP address, you can do so using fail2ban-client.
To ban a specific IP address:
To unban a specific IP address: