Fail2Ban Cheatsheet

Fail2Ban scans log files (e.g. /var/log/auth.log) and bans IPs that show malicious signs — too many password failures, seeking for exploits, etc.

Installation

# Debian / Ubuntu
sudo apt install fail2ban
 
# RHEL / CentOS / Fedora
sudo dnf install epel-release      # EPEL repo required on RHEL/CentOS
sudo dnf install fail2ban
 
# Arch Linux
sudo pacman -S fail2ban

Service Management

sudo systemctl enable --now fail2ban   # Start and enable on boot
sudo systemctl restart fail2ban        # Restart after configuration changes
sudo systemctl status fail2ban         # Check if running

Configuration Structure

Never edit /etc/fail2ban/jail.conf directly — it gets overwritten during updates. Create a .local copy or add files to jail.d/.

# Create a local configuration copy
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Basic `jail.local` Configuration

[DEFAULT]
bantime  = 1h          # How long an IP is banned (1 hour)
findtime = 10m         # Time window to count failures (10 minutes)
maxretry = 5           # Number of failures before banning
ignoreip = 127.0.0.1/8 192.168.1.0/24   # IPs that are never banned
 
[sshd]
enabled  = true
port     = ssh         # Port to monitor (uses /etc/services to resolve "ssh" to 22)
logpath  = %(sshd_log)s
backend  = %(sshd_backend)s

Custom Jail Example (Nginx)

[nginx-http-auth]
enabled  = true
port     = http,https
logpath  = /var/log/nginx/error.log
maxretry = 3
bantime  = 24h
findtime = 1h

Monitoring and Managing Bans (`fail2ban-client`)

# Show global status (lists all active jails)
sudo fail2ban-client status
 
# Show status of a specific jail (e.g., sshd) including banned IPs
sudo fail2ban-client status sshd
 
# Manually ban an IP in a specific jail
sudo fail2ban-client set sshd banip 192.168.1.50
 
# Manually unban an IP from a specific jail
sudo fail2ban-client set sshd unbanip 192.168.1.50
 
# Unban all IPs across all jails
sudo fail2ban-client unban --all
 
# Reload configuration without restarting the service
sudo fail2ban-client reload
 
# Reload a specific jail only
sudo fail2ban-client reload sshd

Filter Regex

Filters define what log patterns to match. They live in /etc/fail2ban/filter.d/.

# Test a filter regex against a log file before deploying
sudo fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
 
# Test a custom regex string against a log file
sudo fail2ban-regex /var/log/nginx/error.log "Authentication failure.*client: <HOST>"

Log File Locations

# Fail2Ban's own log
tail -f /var/log/fail2ban.log
 
# Auth log (what Fail2Ban monitors for SSH)
tail -f /var/log/auth.log          # Debian / Ubuntu
tail -f /var/log/secure            # RHEL / CentOS

Cheatsheets