fail2ban — Ban the Password Guessers

With keys only, guessing passwords can't work — but the bots keep trying, thousands of times a day, filling your logs. fail2ban reads the log and blocks an address that fails too often.

sudo grep "Failed password" /var/log/auth.log | tail

Install

sudo apt install fail2ban

Debian turns on the sshd jail right away (/etc/fail2ban/jail.d/defaults-debian.conf) and starts the service:

sudo fail2ban-client status
sudo fail2ban-client status sshd

Status for the jail: sshd
|- Filter
|  |- Currently failed:	1
|  |- Total failed:	23
|  `- Journal matches:	_SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned:	3
   |- Total banned:	3
   `- Banned IP list:	218.92.0.112 61.177.172.140 192.168.1.42

The rule (from jail.conf): maxretry = 5 failures within findtime = 10 minutes → banned for bantime = 10 minutes.

Oops — that's you

192.168.1.42 is your own office: someone mistyped the password five times. Let it back in:

sudo fail2ban-client set sshd unbanip 192.168.1.42

Your rules: jail.local

Never edit jail.conf — an update overwrites it. Your changes go in /etc/fail2ban/jail.local:

sudo nano /etc/fail2ban/jail.local

[sshd]
maxretry = 3
bantime = 1h
ignoreip = 127.0.0.1/8 ::1 192.168.1.42

sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

sudo fail2ban-client get sshd bantime shows what the jail uses (in seconds).

💡 fail2ban doesn't replace keys-only SSH: it keeps the noise down and slows attackers, the keys keep them out.