Fail2ban: Block SSH Brute Force Without Locking Yourself Out
Any server with SSH open to the internet gets thousands of login attempts a day from bots. Fail2ban watches your logs and bans IPs that fail too often. It's excellent — and it's also the most common reason people get locked out of their own server.
Install it
apt update && apt install -y fail2ban
Configure the SSH jail
Never edit jail.conf directly — create jail.local:
nano /etc/fail2ban/jail.local
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5
# Your own address(es) — never banned
ignoreip = 127.0.0.1/8 ::1 YOUR_HOME_IP
[sshd]
enabled = true
On Debian 12 there's no auth log file by default, so add backend = systemd under [sshd].
Restart it:
systemctl restart fail2ban
Check what it's doing
fail2ban-client status sshd
You'll see how many IPs are currently banned and the full list.
How people lock themselves out
You mistype your password five times — fail2ban bans your IP. From your side the server suddenly looks dead: connections are refused even though SSH is running fine. It happens to experienced admins all the time.
Three ways to prevent it:
- Put your IP in ignoreip. If your home IP changes, list the whole range.
- Use SSH keys. With keys there are no password typos to trigger a ban.
- Keep a way in that doesn't depend on SSH — such as your provider's web console.
If you're already banned
From another network (a phone hotspot works), or from the console, unban yourself:
fail2ban-client set sshd unbanip YOUR_IP
Keep it running
Fail2ban isn't the problem when you get locked out — it's doing its job. Whitelist yourself, switch to keys, and leave it on: the bots never stop.
Deploy a server — and set up fail2ban in the first ten minutes.