Installing and configuring Fail2ban bruteforce protection

Fail2ban protects your Linux VPS by banning IP addresses that attempt to break in. Fail2ban scans your VPS log files to decide which IPs should be banned (e.g. /var/log/apache/error_log). It checks for too many incorrect password attempts, exploit scans, and so on.

You can also have Fail2ban automatically send a report to yourself and to the owner of the attacking IP. Fail2ban comes with filters for various services (Apache, Courier, SSH, etc.).

Installing Fail2ban

sudo dnf -y update

sudo dnf -y install epel-release

sudo dnf -y install fail2ban

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

sudo apt -y update && sudo apt -y upgrade

sudo apt -y install fail2ban

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Configuring Fail2ban

By default Fail2ban uses /etc/fail2ban/jail.conf. Any changes you make there will be overwritten by updates. Instead, use /etc/fail2ban/jail.local; it is never overwritten and its settings override jail.conf.

Step 1

Create the jail.local file:

sudo nano /etc/fail2ban/jail.local

Step 2

Copy the block below and adjust the values to your needs (tip: use PuTTY and copy‑paste). Pay special attention to banaction (example assumes CentOS Steam, AlmaLinux, or Rocky Linux).

Change sender, destemail, and ignoreip to your own values, and enable only the jails for services actually running on your VPS (e.g. Exim or Postfix, not both). You can check which you use with systemctl status exim / postfix.

[DEFAULT]
# Ban for X amount of time
bantime = 604800
findtime = 3600
sender = fail2ban@example.com
destemail = admin@example.com
action = %(action_mwl)s
banaction = iptables-multiport
maxretry = 3
ignoreip = your.ip.address

[sshd]
enabled = true
port = ssh   # replace ssh with your configured SSH port

[exim]
enabled = true
filter = exim
logpath = /var/log/exim/mainlog
# cPanel: use /var/log/exim_mainlog
# Debian: /var/log/exim4/mainlog

[postfix]
enabled = true
port = smtp,ssmtp
filter = postfix
failregex = \[<HOST>]: 535 Incorrect authentication data
logpath = /var/log/maillog

[dovecot]
enabled = true
port = pop3,pop3s,imap,imaps
filter = dovecot
logpath = /var/log/maillog

Step 3

If you use Exim (e.g. in our DirectAdmin or cPanel images), extend the Exim filter. If not, skip to Step 5.

sudo nano /etc/fail2ban/filter.d/exim.conf

Step 4

Add the line below to the failregex section, then save (Ctrl + X → Y → Enter):

\[<HOST>\]: 535 Incorrect authentication data

Your [Definition] block should now look roughly like this:

[Definition]
failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: ...
            \[<HOST>\]: 535 Incorrect authentication data
ignoreregex =

Step 5

Restart Fail2ban so it picks up your changes:

sudo systemctl restart fail2ban

Advanced / optional: escalating Fail2ban ban time

To prevent a legitimate user from being permanently blocked for a brief mistake, you can configure escalating bans: an hour, then a day, then a week, etc.

Step 1

Create /etc/fail2ban/filter.d/f2b-repeat.conf:

sudo nano /etc/fail2ban/filter.d/f2b-repeat.conf

Step 2

Add the following and save your changes (ctrl + x > y > enter):

[INCLUDES]
before = common.conf
[Definition]
failregex = (?i)\]\s+ban\s+<HOST>
ignoreregex = (?i)\[f2b-repeat.*\]\s+ban\s+<HOST>

Step 3

In your jail.local file, insert the [f2b-repeat] jails shown below between the [DEFAULT] and [sshd] sections. Only adjust bantime, findtime, and optionally maxretry in [DEFAULT].

[DEFAULT]
# Ban for X amount of time
bantime = 3600
findtime = 86400
sender = fail2ban@example.com
destemail = admin@example.com
action = %(action_mwl)s
banaction = iptables-multiport
maxretry = 3
ignoreip = your.ip.address

[f2b-repeat2]
enabled = true
filter = f2b-repeat
bantime = 86400
findtime = 604800
logpath = /var/log/fail2ban.log
maxretry = 3

[f2b-repeat3]
enabled = true
filter = f2b-repeat
bantime = 604800
findtime = 2592000
logpath = /var/log/fail2ban.log
maxretry = 3

[f2b-repeat4]
enabled = true
filter = f2b-repeat
bantime = 2592000
findtime = 15552000
logpath = /var/log/fail2ban.log
maxretry = 3

By increasing findtime, Fail2ban looks further back and gets stricter with repeat attackers.

Step 4

If you specify /var/log/fail2ban.log as above, create that log file first or Fail2ban will not start:

sudo touch /var/log/fail2ban.log

Step 5

Now you can (re)start Fail2ban:

sudo systemctl restart fail2ban

Advanced / optional: extra filters / jails

Fail2ban ships with numerous filters which can be found in /etc/fail2ban/filter.d/:

Step 1

List the defaults with:

ls /etc/fail2ban/filter.d/

You will see a list like this:

Pick the filter you want, e.g. apache-auth.conf.

Step 2

Re‑open your jail file:

sudo nano /etc/fail2ban/jail.local

Step 3

Add a jail with this syntax:

[jailname]
enabled = true
filter = jailname
logpath = /var/log/yourlogfile

• [jailname] – choose any recognizable name.
• enabled – must be true.
• filter – the filter name you selected (omit .conf).
• logpath – the file Fail2ban scans for attacks.

Additional tips & commands

Check Fail2ban’s status:

sudo fail2ban-client status

View logs:

sudo nano /var/log/fail2ban.log
sudo vi /var/log/fail2ban.log
sudo cat /var/log/fail2ban.log

Verify the service is running:

sudo systemctl status fail2ban

Restart after changes:

sudo systemctl restart fail2ban

Manual banning / unbanning

Manual ban

If someone patiently tries once per hour, you can ban their IP manually. First list available jails:

sudo fail2ban-client status

Then ban an IP (replace JAIL and xxx.xxx.xxx.xxx):

sudo fail2ban-client -vvv set JAIL banip xxx.xxx.xxx.xxx

Manual unban

If an IP was blocked by mistake, unban it (replace JAIL and the IP):

sudo fail2ban-client set JAIL unbanip xxx.xxx.xxx.xxx

Unsure which jail? Search the log:

sudo nano /var/log/fail2ban.log

Inside nano, press Ctrl + W and enter the IP to search.

The installation and configuration of Fail2ban on your VPS is now complete. Your VPS is protected against brute‑force attacks!