Skip to content
Get started

Fail2ban on a VPS

SSH brute-force protection

Install on a VPSGitHub
Category
Dev / Tools
Author
Fail2ban
License
GPL-2.0
Version
1.1.1

The script is free · VPS from $2.79 per month · installs in about 30 seconds

Install over SSH

root@vps:~# sudo apt update && sudo apt install -y fail2ban && printf '[sshd]\nenabled = true\nbackend = systemd\n' | sudo tee /etc/fail2ban/jail.local && sudo systemctl enable --now fail2ban && sudo systemctl restart fail2ban

  • SystemUbuntu 24.04 · x86_64ok
  • Sourcegithub.com/fail2ban/fail2banok
  • Version1.1.1ok

✓ Fail2ban 1.1.1 installed · about 30 seconds

root@vps:~#

Install command from the library. Output is shortened and may differ on your server.

What it is

  • Security
  • SSH
  • Brute force

Fail2ban watches logs and temporarily bans IPs that try to guess passwords for SSH, mail or web panels. On any public VPS such attempts never stop.

SSH protection is enabled right after installation: a few failed logins and the IP gets banned. Rules (jails) can be added for Nginx, Postfix and other services.

The command installs the package from the repository and enables the sshd jail with the systemd backend, so it works even where there is no /var/log/auth.log.

  • Bans IPs after failed logins
  • Ready-made rules for SSH, Nginx, mail
  • Configurable ban time and retry count
  • Works with iptables or nftables
  • IP whitelists

Recommended plan

For Fail2ban: at least 1 vCPU, 2 GB RAM and 10 GB NVMe.

Minimum to run
1 vCPU · 1 GB RAM · 10 GB disk
Systems
Ubuntu 22.04 · Ubuntu 24.04 · Debian 11 · Debian 12

How to install

Three steps in the bot or one command over SSH; installation takes about 30 seconds.

  1. 01

    Choose a plan in the bot

    Open @ExpressHost_bot and pay for a VPS. The server will be ready in about 60 seconds.

  2. 02

    Add Fail2ban

    At the “Add-ons” step pick the script from the library, or run it later: Server settings → Scripts.

  3. 03

    Check SSH protection

    fail2ban-client status sshd

Manually over SSH

Connect to the server as root and run the command. Supported systems: Ubuntu 22.04, Ubuntu 24.04, Debian 11, Debian 12.

Install command
sudo apt update && sudo apt install -y fail2ban && printf '[sshd]\nenabled = true\nbackend = systemd\n' | sudo tee /etc/fail2ban/jail.local && sudo systemctl enable --now fail2ban && sudo systemctl restart fail2ban

After installation

  1. 1.Check SSH protection: fail2ban-client status sshd
  2. 2.Unban an IP: fail2ban-client set sshd unbanip 1.2.3.4
  3. 3.Add your own IP to ignoreip in /etc/fail2ban/jail.local so you don't lock yourself out

Fail2ban FAQ

Didn’t find an answer? Message @ExpressHost_SupportBot.

I banned myself. What now?

Log in through the VNC console and run fail2ban-client set sshd unbanip YOUR_IP.

Where are the settings?

Write your own rules in /etc/fail2ban/jail.local and leave the default jail.conf untouched: it is overwritten on updates.

Does fail2ban protect against DDoS?

No, it's designed for password brute-forcing and suspicious requests in logs, not volumetric attacks.

Fail2ban installs at checkout — in the bot.

Order a VPS for Fail2banBuy in Telegram