Skip to content
LinuxHardening

Glossary

fail2ban

An intrusion-prevention tool that scans service logs for repeated failures and temporarily bans the offending IP addresses via the firewall.

fail2ban is an intrusion-prevention daemon that watches log files for patterns of malicious activity, such as repeated failed SSH logins, and reacts by adding a firewall rule to block the offending IP address for a configurable period. This blunts brute-force and credential-stuffing attacks against exposed services.

It works through jails that pair a log filter with a ban action; local settings go in /etc/fail2ban/jail.local, and fail2ban-client status sshd shows currently banned hosts.