fail2ban ssh protection

Configure Fail2Ban for SSH on Ubuntu

Fail2Ban can monitor failed SSH login attempts and temporarily block IP addresses that repeatedly fail authentication.

Open the Configuration File

Edit the local Fail2Ban configuration:

Configure the SSH Jail

Add or update the [sshd] section:

Change 1992 to the SSH port used by the server.

The important part is that settings such as:

must belong to a valid section such as:

Do not leave configuration options outside a section header, as this can prevent Fail2Ban from loading correctly.

What These Settings Mean

1. enabled = true — enables SSH protection.
2. port = 1992 — SSH port to monitor.
3. filter = sshd — uses the built-in SSH detection rules.
4. logpath = /var/log/auth.log — authentication log to monitor.
5. maxretry = 3 — bans an IP after 3 failed attempts.
6. findtime = 600 — counts failures within a 10-minute period.
7. bantime = 3600 — bans the IP for 1 hour.

Save the Configuration

In Nano:

Restart Fail2Ban

Apply the configuration:

Check that the service is running:

The service should show:

Check the SSH Jail

Check whether the SSH jail is active:

To see all enabled jails:

The SSH status output includes information such as currently failed attempts, currently banned IP addresses, and the total number of bans.

Test the Configuration

Before restarting Fail2Ban after larger configuration changes, the configuration can be checked with:

If the configuration is valid, Fail2Ban should report that the configuration test was successful.