Fail2Ban is a protection service that analyzes system logs to detect intrusion attempts and automatically bans suspicious IP addresses by applying firewall rules (iptables, nftables, firewalld, etc.) or other configurable actions.
⚙️ Service Management
📌 Action
🧠 Command
▶️ Start service
sudo systemctl start fail2ban
⏹️ Stop service
sudo systemctl stop fail2ban
🔁 Restart service
sudo systemctl restart fail2ban
🔄 Reload config
sudo fail2ban-client reload
📊 Service status
sudo systemctl status fail2ban
🚀 Enable at boot
sudo systemctl enable fail2ban
🔍 View system logs
sudo journalctl -u fail2ban -f
📋 Monitoring and Status
📌 Action
🧠 Command
📊 General status
sudo fail2ban-client status
🔍 Jail details
sudo fail2ban-client status sshd
📋 List active jails
sudo fail2ban-client status | grep "Jail list"
📊 Jail statistics
sudo fail2ban-client status <jail>
🔢 Fail2Ban version
sudo fail2ban-client version
📜 Real-time logs
sudo tail -f /var/log/fail2ban.log
🚫 Ban Management
📌 Action
🧠 Command
👁️ View banned IPs
sudo fail2ban-client status <jail>
🚫 Ban an IP
sudo fail2ban-client set <jail> banip <IP>
🔓 Unban an IP
sudo fail2ban-client set <jail> unbanip <IP>
🗑️ Unban all IPs
sudo fail2ban-client unban --all
🔍 Search bans
sudo grep "Ban " /var/log/fail2ban.log
🔓 Search unbans
sudo grep "Unban " /var/log/fail2ban.log
📂 Configuration
📌 File
🧠 Description
/etc/fail2ban/jail.conf
Default configuration (do not modify)
/etc/fail2ban/jail.local
Custom configuration (recommended)
/etc/fail2ban/filter.d/
Filters for log analysis
/etc/fail2ban/action.d/
Actions to execute when banning
/var/log/fail2ban.log
Fail2Ban logs
🔒 Jail Configuration
📌 Parameter
🧠 Description
📊 Example
enabled
Enable/disable the jail
true
port
Port(s) to protect
ssh,22
filter
Filter to use
sshd
logpath
Path to the log file
/var/log/auth.log
maxretry
Maximum number of attempts
5
bantime
Ban duration (seconds)
3600
findtime
Time window for counting attempts
600
📝 Configuration Examples
Basic SSH Configuration(protect SSH connections)
[sshd]enabled = true # Enable this jailport = ssh # Protect SSH port (22)filter = sshd # Use built-in SSH filterlogpath = /var/log/auth.log # Analyze this log filemaxretry = 5 # 5 max attempts before banningbantime = 3600 # Ban for 1 hour (3600 sec)findtime = 600 # Within a 10-minute window
Simple Web Configuration(protect web server)
[apache-auth]enabled = trueport = http,https # Protect ports 80 and 443filter = apache-auth # Filter for Apachelogpath = /var/log/apache2/error.logmaxretry = 3 # Stricter: only 3 attemptsbantime = 7200 # Ban for 2 hours
Syspirit