fail2ban

fail2ban reads service logs, spots signs of an attack (for example, failed SSH logins), and temporarily bans the IP through the firewall. The fail2ban service runs under systemd.

systemctl status fail2ban
sudo fail2ban-client status        # list of active jails
sudo fail2ban-client status sshd   # sshd jail details (banned IPs)

Setup

Don't edit jail.conf — create jail.local (it survives package updates):

# /etc/fail2ban/jail.local
[DEFAULT]
bantime  = 1h          # how long to ban for (accepts 10m, 1h, 1d)
findtime = 10m         # the window over which attempts are counted
maxretry = 5           # how many failures before a ban
ignoreip = 127.0.0.1/8 10.0.0.0/24    # allowlist (your own networks!)
backend  = systemd     # on Ubuntu, SSH logs are often in journald

[sshd]
enabled = true

[recidive]             # ban repeat offenders for a long time
enabled  = true
bantime  = 1w
findtime = 1d
maxretry = 5

sudo systemctl restart fail2ban

Your own jail/filter

For your own service: a filter (a regex with an <HOST> group) plus a jail:

# /etc/fail2ban/filter.d/myapp.conf
[Definition]
failregex = ^.*authentication failed from <HOST>.*$

# /etc/fail2ban/jail.local
[myapp]
enabled  = true
logpath  = /var/log/myapp/access.log
maxretry = 4

Test the regex before enabling it: fail2ban-regex <log> <filter> (shows how many matches it caught).

File order

fail2ban reads jail settings in order, and the last value wins:

1. jail.conf — from the package, do not edit;
2. jail.d/*.conf — alphabetically, defaults-debian.conf among them;
3. jail.local;
4. jail.d/*.local — alphabetically.

maxretry = 6 in jail.d/aa.conf, 4 in jail.local and 3 in jail.d/zz.local give 3. fail2ban-client -d prints the result for a jail:

student@ubuntu:~$ sudo fail2ban-client -d | grep "'sshd', '"
['set', 'sshd', 'maxretry', 3]
['set', 'sshd', 'findtime', '10m']
['set', 'sshd', 'bantime', '10m']
['set', 'sshd', 'addignoreip', '127.0.0.1/8', '192.0.2.20']

An error in any file keeps the service from starting — fail2ban-client -d shows it too.

What Ubuntu sets

On the lab machine the fail2ban service is off. The package ships jail.d/defaults-debian.conf:

[DEFAULT]
banaction = nftables
banaction_allports = nftables[type=allports]
backend = systemd

[sshd]
enabled = true

backend = systemd means the jail reads the systemd journal and needs no logpath. fail2ban-client status sshd shows what it looks for: Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd (+ means "or"; on Ubuntu 24.04 the service is called ssh.service, and the lines are found by _COMM=sshd).

A ban is an address in a set of the inet f2b-table table, and the rule answers with reject:

table inet f2b-table {
	set addr-set-sshd {
		type ipv4_addr
		elements = { 192.0.2.20 }
	}
	chain f2b-chain {
		type filter hook input priority filter - 1; policy accept;
		tcp dport 22 ip saddr @addr-set-sshd reject with icmp port-unreachable
	}
}

The banned address sees port 22 as filtered (see nmap); after unbanip it is open again.

• sshd — The SSH server — remote access via keys, config and hardening.
• firewall — Traffic filtering — simple ufw and low-level nftables.
• journalctl — Reading the systemd journal (journald) — filters by service, time, priority.