Security & Quality

Fail2ban Intrusion Prevention

Monitor logs and automatically ban IPs showing malicious signs with Fail2ban for Linux servers.

Claude Code Cursor

Overview

Fail2ban is an intrusion prevention software that monitors log files for suspicious activity and automatically bans offending IP addresses by modifying firewall rules. It protects Linux servers against brute force attacks on SSH, HTTP authentication, mail servers, and any service that produces log files with identifiable attack patterns.

The tool works by parsing log files (syslog, auth.log, nginx/Apache access logs) using configurable regex filters. When a filter matches a defined number of times within a time window, Fail2ban executes a ban action — typically adding an iptables or nftables rule to block the offending IP. Bans are temporary by default, with configurable ban durations and exponential backoff for repeat offenders.

Fail2ban comes with pre-configured filters for common services (sshd, nginx, apache, postfix, dovecot) and can be extended with custom filters for application-specific log formats. Actions can go beyond firewall rules to include email notifications, Slack alerts, or API calls to update external blocklists. The fail2ban-client CLI provides real-time monitoring of banned IPs, jail status, and manual ban/unban operations.

Who Is This For?

Block SSH brute force attempts automatically
Protect Nginx/Apache from repeated failed login attempts
Set up custom jail for application-specific attack patterns
Configure email alerts for banned IP addresses

Installation

Setup for Claude Code

sudo apt install fail2ban

Configuration

# /etc/fail2ban/jail.local
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600

[nginx-http-auth]
enabled = true
port = http,https
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
maxretry = 5
bantime = 7200