Skip to content
June 1, 2026
  • Linkedin
  • Twitter
  • Facebook
  • Youtube

Daily CyberSecurity

Zero-hour alerts. Unmatched analysis.

Primary Menu
  • Home
  • CVE Watchtower
  • Cyber Criminals
  • Data Leak
  • Linux
  • Malware
  • Vulnerability
  • Submit Press Release
  • Vulnerability Report
Light/Dark Button
  • Home
  • Technique
  • How to use FAIL2BAN to protect SSH
  • Technique

How to use FAIL2BAN to protect SSH

Ddos June 22, 2017 2 minutes read
fail2ban-logo

Fail2Ban is an intrusion prevention software framework that protects computer servers from brute-force attacks. Written in the Python programming language, it is able to run on POSIX systems that have an interface to a packet-control system or firewall installed locally, for example, iptables or TCP Wrapper.

Wiki

On this post, i’m going to guide you how to use Fail2ban to protect SSH.

First you need to install Fail2ban is :

 apt-get install fail2ban

After installing Fail2ban, to starts to work immediately, you need to add the desired settings. All configuration is stored in a/etc/fail2ban/jail.conf file

We need to change the section of the SSH :

[ssh]
 
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 10
findtime = 3600
bantime  = 86400

Description:

maxretry – the maximum number of incorrect connections during specified parameter findtime ;
findtime – Time in the log-file, for which the analysis of the number of incorrect connections. Calculated in seconds;
bantime – blocking time in seconds;

and restart Fail2ban is :

 service fail2ban restart

Now, after 10 wrong password is entered for an hour address will be blocked for a day.

gets the current status of the server

fail2ban–client status 
And to know the statistics for blocked clients for each service with the command:
fail2ban–client status service_name

Share this article:

Facebook Post LinkedIn Telegram

Related posts:

  1. CVE-2023-42465: SUDO Affected by Stack/Register Flaw, OpenSSH, OpenSSL, and MySQL are Vulnerable
  2. Cybercriminals Exploit Swap Files: New E-commerce Skimming Tactic
  3. CVE-2025-22275 (CVSS 9.3): iTerm2 Patches Critical Security Flaw Exposing User Input and Output
  4. VyOS and Debian Systems Vulnerable to Man-in-the-Middle Attacks (CVE-2025-30095)
  5. Beyond Malware: Stealthy ASUS Router Exploitation Survives Reboots, Builds Botnet
Tags: FAIL2BAN ssh

Search

Translation

CVE WATCHTOWER
🚨

Receive alerts for vulnerabilities being exploited in the wild.

⚡

Get notified instantly when a Proof of Concept (PoC) exploit is published.

🔍

Access critical info on vulnerabilities even when marked as "RESERVED".

🧠

Insights powered by decades of expertise and global intelligence sources.

🎯

Customize alerts with up to 10 keywords for your specific tech stack.

📊

Export the raw CVE database for SIEM integration and reporting.

Upgrade Package

🔴 Live Critical Threats

  • CVE-2026-48879CVSS 9.8
    Incorrect Privilege Assignment vulnerability in Sergey AIWU allows Privilege Escalation. This issue...
  • CVE-2026-48866CVSS 9.6
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability...
  • CVE-2026-42682CVSS 9.1
    Missing Authorization vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access...
  • CVE-2026-42680CVSS 9.8
    Incorrect Privilege Assignment vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery...
  • CVE-2026-47413CVSS 9.6
    ## Summary **Type:** Privilege escalation / cross-tenant member injection. The `POST /workspaces/{workspace_id}/members`...
  • CVE-2026-47428CVSS 9.6
    ## Summary Vitest browser mode served `/__vitest_test__/` with the `otelCarrier` query parameter...
  • CVE-2026-7858CVSS 9.8
    A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic...
  • CVE-2026-48188CVSS 9.1
    An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer...
  • CVE-2026-10187CVSS 9.8
    A vulnerability was detected in Totolink N300RH 6.1c.1353_B20190305. Affected by this issue...
  • CVE-2018-25412CVSS 9.8
    Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated...
Powered by CVE WATCHTOWER

Recent Zero-Day Vulnerabilities

  • Exploited in the Wild: Critical OWA Spoofing Flaw (CVE-2026-42897) Hits On-Premises Exchange Servers
  • Exploited in the Wild: Maximum CVSS 10 SD-WAN Flaw (CVE-2026-20182) Grants Admin Control
  • Exploited in the Wild: Critical 9.8 CVSS RCE Hits Canon GUARDIANWALL MailSuite
  • Exploit Code Released: Public PoC Dumps for Windows BitLocker Bypass and SYSTEM Elevation Zero-Days
  • Exploited in the Wild: “Dirty Frag” Linux Vulnerability Grants Instant Root Access
  • Under Active Attack: Ivanti EPMM Zero-Day Exploited in the Wild via Harvested Admin Credentials
Our Websites
  • Penetration Testing Tools
  • The Daily Information Technology
  • Daily CyberSecurity

    • About SecurityOnline.info
    • Advertise with us
    • Announcement
    • Contact
    • Contributor Register
    • Login
    • About SecurityOnline.info
    • Advertise on SecurityOnline.info
    • Contact Us

    When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works

    • Disclaimer
    • Privacy Policy
    • DMCA NOTICE
    • Linkedin
    • Twitter
    • Facebook
    • Youtube
    Copyright Daily CyberSecurity © All rights reserved.