Knowledge centre

Make repeated login attempts less useful

A cautious setup path for log-based blocking on a Linux server.

2 min readEnglish

Content revised 10 October 2026 · English

At a glance

Guide type: Operate & secure
Examples: Illustrative, environment-specific
Integration scope: No remote machine connected

Confirm the event and log source

Fail2ban reads authentication failures and asks a firewall backend to block repeated sources. It helps with repeated attempts; it does not replace key authentication or system updates. Confirm that SSH failures reach the journal or log file the jail will read.

Install the package for your distribution

On a maintained Debian or Ubuntu host the package manager can install it. Review its defaults and backend before enabling a custom jail. Other distributions may use a different package repository or firewall action.

Debian / Ubuntu exampleReview for your environment

sudo apt update
sudo apt install fail2ban

Add a small override, not a copied global file

Create an override in /etc/fail2ban/jail.d/sshd.local. Match the actual SSH port. This example reads the systemd journal; use an appropriate backend and log path if the system writes a different log. Add a trusted administration address to ignoreip only after you have verified it.

Illustrative /etc/fail2ban/jail.d/sshd.localReview for your environment

[sshd]
enabled = true
port = 22
backend = systemd
maxretry = 5
findtime = 10m
bantime = 1h
ignoreip = 127.0.0.1/8 ::1

Check configuration and the active jail

Start the service only after reviewing the file and keeping a recovery session open. Inspect the service and jail output; an active daemon with no matching events may provide no protection.

Validate and inspectReview for your environment

sudo fail2ban-client -t
sudo systemctl enable --now fail2ban
sudo fail2ban-client status
sudo fail2ban-client status sshd

Test without losing the only access path

Use a separate controlled test source to verify detection, ban and expiry. Check IPv6 and the effective firewall rules. If a trusted source is incorrectly banned, use the retained console to remove that specific ban and then fix the policy; do not disable all protection to work around one mistake.

A specific unban · documentation addressReview for your environment

sudo fail2ban-client set sshd unbanip 192.0.2.44

BEFORE THE NEXT STEP

Leave with a verifiable result.

Confirm the event and log source.
Test without losing the only access path.
Keep recovery information and secrets outside public files.

GO TO THE PRIMARY SOURCEFail2ban · official jail configuration