---
title: Protecting a server with Fail2Ban
description: This page shows how to protect a server against brute force attacks with Fail2Ban
tags: security Fail2Ban
products:
  - instances
dates:
  validation: 2025-08-25
  posted: 2018-08-22
  validation_frequency: 12
difficulty: beginner
usecase:
  - security
ecosystem:
  - third-party
---
import image from './assets/scaleway-postfix-install.webp'

import Requirements from '@macros/iam/requirements.mdx'

Fail2Ban is a powerful tool that analyzes server log files for recurring patterns of failed login attempts, enabling the blocking of IPs attempting brute force attacks against a server.
In this tutorial, you will learn how to configure Fail2Ban on an Ubuntu 24.04 LTS (Noble Numbat) server to protect the SSH service. Fail2Ban can be used with any service that generates log files.

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- An [SSH key](/organizations-and-projects/how-to/create-ssh-key/)
- An Ubuntu Bionic [Instance](/instances/how-to/create-an-instance/)
- `sudo` privileges or access to the root user

## Installing Fail2Ban

1. Install Fail2Ban and Postfix (optional, for email notifications) using the package manager:
    ```bash
    sudo apt-get install fail2ban postfix
    ```
2. During Postfix installation, select **Internet Site** when prompted for configuration.
    <Lightbox image={image} alt="" />

3. After installation, edit `/etc/aliases` to configure email notifications:
    ```bash
    sudo nano /etc/aliases
    ```

4. Add the following line, replacing me@mydomain.tld with your email address:
    ```bash
    root: me@mydomain.tld
    ```

5. Save the file, exit nano and run the following command:
    ```bash
    sudo newaliases
    ```
    <Message type="note">
    - To receive email notifications, ensure outbound email ports (e.g., 25, 587) are open on your server.
    - Postfix is optional. Alternatives like `ssmtp` or external SMTP services can be used for notifications.
    </Message>

## Configuring Fail2Ban

1. Copy the default configuration file to create a custom configuration:
    ```bash
    cd /etc/fail2ban && sudo cp jail.conf jail.local
    ```
    The jail.local file overrides jail.conf for custom settings, preserving the default configuration.

2. Edit `/etc/fail2ban/jail.local` with your preferred editor (e.g., nano):
    ```bash
    sudo nano /etc/fail2ban/jail.local
    ```
    Modify the following parameters:
    ```bash
    ignoreip = 127.0.0.1/8 - Ignores localhost IPs to prevent self-banning. Add other trusted IPs if needed (e.g., 127.0.0.1/8 192.168.1.0/24).
    bantime = 3600 - Duration of a ban, set to 1 hour (3600 seconds) by default in newer versions. Consider increasing to 86400 (1 day) for stronger protection.
    findtime = 3600 - Time window for counting failed attempts (1 hour). Adjust to 600 (10 minutes) for stricter monitoring if preferred.
    maxretry = 5 - Number of failed attempts before a ban. The default in Ubuntu 24.04 is 5.
    destemail = root@localhost - Email recipient for notifications. Leave as is if /etc/aliases is configured.
    sendername = Fail2Ban - Sender name for notification emails.
    banaction = nftables[multiport] - Default ban action using nftables, which is preferred in Ubuntu 24.04 over iptables.
    action = %(action_mwl)s - Sends email with logs when banning. Use %(action_mw)s for email without logs, or %(action_)s for no email.
    ```

3. Enable the SSH jail by ensuring the following configuration is present:
    ```bash
    [sshd]
    enabled  = true
    port     = ssh
    filter   = sshd
    logpath  = /var/log/auth.log
    ```
    If your SSH service uses a non-standard port, update the `port` line. For example, for ports 22 and 1234:
    ```
    port = ssh,1234
    ```
    Fail2Ban will monitor the specified ports for intrusion attempts.
    <Message type="tip">
    For systems using `systemd` logging (e.g., Proxmox), use:
    ```
    [sshd]
    enabled  = true
    port     = ssh
    filter   = sshd
    logpath  = %(sshd_log)s
    backend  = systemd
    ```
    </Message>

4. Save the file.
 Fail2Ban uses filter files in `/etc/fail2ban/filter.d` to parse logs. The `sshd` filter is pre-configured for SSH. Custom [filters](https://fail2ban.readthedocs.io/en/latest/filters.html) can be created for other services.

5. Restart Fail2Ban to apply changes:
    ```bash
    sudo systemctl restart fail2ban
    ```

Fail2Ban will now monitor SSH connections. Check logs at `/var/log/fail2ban.log` for activity.