fail2ban against password guessing

fail2ban reads your log and blocks IP addresses that keep failing to log in for a while. If you only use keys (see Disabling password login and root login), guessing attempts can no longer succeed anyway. fail2ban then mainly keeps your log quiet and slows attackers down.

Installing

anna@web1:~$ sudo apt install fail2ban

On Debian 13 and Ubuntu, monitoring of SSH (the sshd jail) works straight away. On Debian 12 you need one extra line, see below.

On AlmaLinux and Rocky Linux: sudo dnf install epel-release, sudo dnf install fail2ban and sudo systemctl enable --now fail2ban.

Your own settings

Don't edit jail.conf: an update will overwrite it. Put your own settings in /etc/fail2ban/jail.local:

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5
bantime.increment = true
ignoreip = 127.0.0.1/8 ::1 198.51.100.7

[sshd]
enabled = true

• maxretry failed attempts within findtime result in a block of bantime.
• bantime.increment: anyone who comes back is blocked for longer each time.
• ignoreip: addresses that are never blocked, such as your office's fixed IP address. Replace 198.51.100.7 with your own address, or leave it out.
• On Debian 12 you also add backend = systemd under [sshd] and install the python3-systemd package. fail2ban then reads the journal instead of the missing auth.log. Debian 13 already does this by itself.

anna@web1:~$ sudo systemctl restart fail2ban
anna@web1:~$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 2
|  |- Total failed:     41
|  `- Journal matches:  _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned: 3
   |- Total banned:     7
   `- Banned IP list:   192.0.2.44 198.51.100.23 203.0.113.99

Unblocking yourself

Have you blocked yourself, for example after using the wrong key a few times? Wait until the block expires, or log in via the console or from another address and type:

anna@web1:~$ sudo fail2ban-client set sshd unbanip 198.51.100.7