Install and tune Fail2ban

Fail2ban watches authentication logs and can temporarily ban an address after repeated failures. This walkthrough is for an Ubuntu or Debian self-managed VPS. It is not a shared-hosting setting. Keep your current SSH session and provider-console recovery path available while you configure it.

1. Install and enable the SSH jail

Run sudo apt update and sudo apt install fail2ban. Put local overrides in /etc/fail2ban/jail.d/sshd.local rather than editing the package's jail.conf. A conservative starting configuration is:

[DEFAULT]
bantime = 10m
findtime = 10m
maxretry = 5

[sshd]
enabled = true

Those are example thresholds, not a guarantee against attacks. The installed distribution may use systemd journal or a log file for SSH; check that the jail can read the actual authentication source before treating it as protection. Fail2ban's upstream jail configuration explains the settings.

2. Protect your own access

If your office or VPN has a stable public IP, add it to ignoreip in the local configuration, alongside loopback addresses. Do not whitelist a changing or shared public address merely to avoid a ban; use a VPN or a provider-console recovery path instead. Keep a second SSH session ready before reloading Fail2ban.

3. Verify the jail actually runs

Start or reload the service with sudo systemctl enable --now fail2ban and sudo systemctl reload fail2ban. Check sudo systemctl status fail2ban, sudo fail2ban-client status and sudo fail2ban-client status sshd. Confirm that sshd appears and reports its log or journal source; inspect service logs if it does not. Do not deliberately trigger bans from your only access IP.

Only add web-application jails after checking the relevant log paths and filters. Fail2ban complements, but does not replace, key-based SSH, system updates and a firewall. The Fail2ban client manual documents the status commands.