Fail2ban
Install and configure Fail2ban to temporarily block repeated SSH authentication failures on an Ubuntu server.
Before you run
These examples target an Ubuntu server using systemd and a supported firewall. Package names, log sources and firewall backends differ by distribution. Fail2ban reduces repeated login attempts; it does not replace SSH keys, updates or access controls. Keep an existing administrative session and console recovery available, and avoid testing from your only working address. Check that the SSH jail reads the actual authentication logs and its firewall action is effective. Do not whitelist broad networks without understanding the risk.
After applying changes, verify that you can sign in and that the intended behavior works in a new SSH session. Keep the current session open until verification succeeds, so you can restore the configuration if necessary.
Examples
Install Fail2ban on Ubuntu and start its service. Installation requires administrator privileges.
sudo apt update
sudo apt install fail2ban
sudo systemctl enable --now fail2banCreate a separate jail override at /etc/fail2ban/jail.d/sshd.local; do not edit the packaged jail.conf. The example uses systemd logs and blocks an address for one hour after five failures in ten minutes.
Open the file with nano:
sudo nano /etc/fail2ban/jail.d/sshd.local[sshd]
enabled = true
backend = systemd
maxretry = 5
findtime = 10m
bantime = 1hValidate configuration, restart the service and inspect the SSH jail. Ensure the output identifies the intended log source and firewall action.
sudo fail2ban-client -t && sudo systemctl restart fail2ban && sudo fail2ban-client status sshdInspect recent service logs if the jail does not start or no failures are detected.
sudo journalctl -u fail2ban -n 100 --no-pagerIf an authorized address was banned, unban that address from an existing administrative session or the server console. Replace the example address.
sudo fail2ban-client set sshd unbanip 192.0.2.10Authoritative references
Reviewed October 27, 2026