Logo RoxyCloudAccount
Hosting

Fail2ban: how to protect a VPS against brute force

Fail2ban blocks an IP that fails the SSH password too many times. Install, paste one file, turn it on. It is not Anti-DDoS.

Samuel AkiresCEO RoxyCloud
1 min read154 words
Fail2ban: how to protect a VPS against brute force

A VPS with SSH on the internet gets password guesses all day. Fail2ban counts the misses. Past the limit, that IP stays out for an hour.

This does not stop DDoS. DDoS fills the network pipe. Fail2ban watches login.

1. Install

Ubuntu / Debian
sudo apt update
sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban

2. Paste this file

Do not edit jail.conf. Create jail.local. Replace YOUR.FIXED.IP with your home IP.

/etc/fail2ban/jail.local
[DEFAULT]
backend = systemd
banaction = ufw
maxretry = 3
bantime = 1h
ignoreip = 127.0.0.1/8 ::1 YOUR.FIXED.IP

[sshd]
enabled = true

3. Restart and check

Terminal
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

If you locked yourself out:

Unban
sudo fail2ban-client set sshd unbanip YOUR.IP

Frequently asked questions

Straight answers before you order

It reads the login log. After a few wrong passwords, it blocks that IP for a while.

No. Fail2ban is login. DDoS is a flood on the network.

Yes, if you miss the password several times. Put your home IP in ignoreip first.

sudo fail2ban-client set sshd unbanip YOUR.IP

You may also like