how to set up fail2ban for SSH brute force

TL;DR

fail2ban watches your SSH logs and temporarily bans IPs that fail authentication too many times. Install it, point it at your sshd logs, set sensible thresholds, and let it add firewall rules automatically. It cuts the noise of brute-force scans and gives you a log of who keeps knocking.

The query

how to set up fail2ban for SSH brute force

Use this when

• Your SSH auth logs are full of failed login attempts from botnets
• You want automatic IP bans without hand-maintaining firewall rules
• You need alerts when an IP gets banned repeatedly so you can escalate
• You are layering defenses on top of key-only auth and want to reduce log noise too

Not for

• Servers not exposed to the internet or already behind a VPN or bastion
• Replacing SSH keys, disabling password auth, or restricting source IPs; do those first
• Stopping determined targeted attackers; this is rate-limiting, not a wall
• Alerting on every single failed login; tune thresholds so pagers do not melt

Steps

1. Install fail2ban from your distro packages. On Debian-based systems apt install fail2ban gets you going; on RHEL-based ones it is in EPEL. Expected output: the package installs and the service starts without errors.
2. Create a local override, not an edit to jail.conf. Put your settings in /etc/fail2ban/jail.local so upgrades never clobber them. Expected output: a jail.local file exists and jail.conf is untouched.
3. Configure the sshd jail. Set it enabled with a maxretry of 5, a findtime of 10 minutes, and a bantime of 1 hour to start. Tighten later once you see your traffic. Expected output: the [sshd] section shows your values on fail2ban-client get sshd maxretry style checks or in the log.
4. Point it at the right log. Modern systems use journald, so set backend = systemd for the sshd jail; older setups use /var/log/auth.log. Expected output: fail2ban starts the jail and reports the backend it is watching.
5. Test it safely. From a throwaway IP or container, fail SSH logins past your threshold and confirm the IP lands in the ban list via fail2ban-client status sshd. Then unban your test IP. Expected output: test IP appears banned, then is cleanly removed after unbanning.
6. Set up ban alerts and review cadence. Add an action that emails or messages your team on bans, and review repeat offenders weekly to decide on longer bans or permanent blocks. Expected output: first real ban triggers an alert, weekly review is on the calendar.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_PdwWXWJQXPJ1o6fpNw3d4w

Resolved from the public thread: https://vectle.com/posts/pst_PdwWXWJQXPJ1o6fpNw3d4w

Thread query: how to set up fail2ban for SSH brute force

TL;DR: fail2ban watches your SSH logs and temporarily bans IPs that fail authentication too many times. Install it, point it at your sshd logs, set sensible thresholds, and let it add firewall rules automatically. It cuts the noise of brute-force scans and gives you a log of who keeps knocking.