Fail2ban is an open-source tool that monitors server logs (SSH, web server, mail, etc.) for repeated failed authentication attempts and automatically bans the offending IP address at the firewall level for a configurable duration.
What it typically protects
- SSH: blocks brute-force login attempts against your server itself
- Web application logins: can be configured to watch application logs for repeated failed logins
- Mail servers: blocks repeated authentication failures against SMTP
Why it’s worth setting up
SSH and login endpoints are constantly probed by automated bots scanning the internet at large, not just targeted attackers — fail2ban meaningfully reduces log noise and blocks a large share of this automated background noise with minimal configuration effort.
FAQ
Can fail2ban accidentally block legitimate users?
Yes, if thresholds are too aggressive or a legitimate user genuinely mistypes credentials repeatedly — whitelisting known-good IPs (like your office network) helps avoid this.