How to Install fail2ban on Ubuntu 22.04 and 24.04
Install Fail2Ban using Ubuntu’s package tools, then confirm the service and actual enabled jails. Put SSH overrides in a local configuration file, choose the correct journal or log backend and test with fail2ban-client -t before applying changes. Keep console access and verify a targeted ban and unban; defaults and firewall actions vary by image.
For administrators protecting authorised Ubuntu SSH access, with configuration checks, targeted recovery and explicit cautions against assuming every image has identical defaults.
knowledge
- Read time
- 7 min
- Sections
- 7
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
What the Ubuntu package installs
Ubuntu provides Fail2Ban packages, but the installed version, enabled jails and logging backend depend on the release and image configuration. Inspect the effective configuration and service status instead of assuming SSH protection is already active.
/etc/fail2ban/jail.confholds the package defaults and is replaced on upgrade.- Package jail.d/*.conf files can enable or modify jails; inspect their actual contents on this image.
/etc/fail2ban/jail.localis yours; it survives upgrades and overrides both files above./etc/fail2ban/filter.d/sshd.confholds the regex that recognises a failed password./var/log/fail2ban.logrecords every ban and unban, andjournalctl -u fail2banmirrors it.
The service reads configuration from four places in a fixed order: jail.conf, jail.d/*.conf, jail.local, then jail.d/*.local. Later files win, which is why every change below goes into a local file rather than the shipped one.
Install fail2ban and confirm the service
Fail2Ban is available from Ubuntu’s package repositories; Ubuntu 24.04 lists it in universe. Confirm that the required repository and packages are enabled, then install and verify the service.
- Run
sudo apt update, thensudo apt install fail2ban. The post-install script enables and starts the unit. - Check
sudo systemctl status fail2banfor Active: active (running) and a Python main PID. - Run sudo fail2ban-client status and verify whether sshd is actually listed; enable and test its local configuration if it is not.
- Read the last twenty lines of
sudo journalctl -u fail2ban. A healthy start logs the jail count, not a traceback.
If the status shows inactive, run sudo systemctl enable --now fail2ban. A start that dies after a second usually means a syntax error in a file you already edited, and sudo fail2ban-client -t names the file and line.
jail.local versus jail.conf: edit the file that survives
Keep packaged Fail2Ban .conf defaults unchanged where possible and put explicit overrides in jail.local or jail.d/*.local. Package upgrade handling varies; a small local override is clearer than copying the entire shipped configuration.
The local file does not have to copy the whole default. fail2ban merges it over the package file, so three or four lines are enough for a working override. If you prefer per-service files, /etc/fail2ban/jail.d/sshd.local behaves the same way and keeps the override next to the jail it changes.
Test before you restart. sudo fail2ban-client -t parses every file and exits with OK: configuration test is successful. Then apply the change with sudo systemctl restart fail2ban and confirm the jail is still listed in sudo fail2ban-client status.
Configure the sshd jail for port 22 or a custom port
Configure the sshd jail for the actual authentication log source and SSH port. With backend = systemd, the jail reads the journal; the port controls the ban action, not which failed attempts the filter recognises.
enabled = trueis kept explicit so a future change todefaults-debian.confcannot switch the jail off silently.port = sshis correct for 22. Replace it with the number when sshd listens elsewhere, for exampleport = 2222.backend = systemdreads the journal on both releases and needs no log file on disk.maxretry,findtimeandbantimeinside the jail override the[DEFAULT]block for SSH only.- ignoreip lists trusted source addresses exempt from the configured jail. Add only addresses you control, with deliberate scope.
Everything you do not list is inherited, so a correct [sshd] block is four lines plus your ban values. After the restart, sudo fail2ban-client status sshd should print Filter: sshd, the port, and an empty banned list.
Pick bantime, findtime and maxretry values
For the sshd jail, maxretry failures during findtime trigger a ban lasting bantime. The values below are an illustrative policy, not verified defaults or a universal optimum; choose them around legitimate access and the observed threat.
| Setting | Example | Meaning |
|---|---|---|
| maxretry | 5 | Failures inside the observation window |
| findtime | 10m | Observation window |
| bantime | 1h | Ban duration |
| ignoreip | Trusted administration addresses | Explicit exception; do not add broad untrusted ranges |
Units are m, h, d and w, and a bare number means seconds. Reserve bantime = -1 for an address you are certain about, because a permanent ban has to be lifted by hand from a console.
Additional jails such as recidive need their own log source, policy and verified defaults. Do not enable a broad all-ports ban simply because an example names a repeated offender.
Test a ban and unban an IP with fail2ban-client
Keep a working provider console and existing session before testing a ban action. Use the documentation address 198.51.100.7 for a manual action check, then unban it; this checks action execution, not automatic detection of real log failures.
- Run
sudo fail2ban-client status sshdand note Currently banned, Total banned and the Banned IP list. - Ban the test address with
sudo fail2ban-client set sshd banip 198.51.100.7. The command echoes the address when the action ran. - Inspect the active jail status, action logs and the relevant firewall backend. Do not assume one iptables chain exists on every installation.
- Remove it with
sudo fail2ban-client set sshd unbanip 198.51.100.7and confirm the list is empty again.
Use the provider console or a still-working session to unban only the affected address: sudo fail2ban-client set sshd unbanip 203.0.113.10, replacing the example with your real address. Clearing all jails also releases unrelated bans and is not the default recovery step.
The effective ban action may use iptables, nftables or another supported action. Inspect the jail’s configured action and its logs before interpreting UFW output. Changing to the UFW action is a deliberate policy change, not a guarantee that arbitrary firewall configurations cannot conflict.
A cloud firewall or a proxy CDN changes the picture. Traffic is filtered or forwarded before it reaches the instance, so fail2ban sees the proxy address or sees nothing, and a ban on the VM never reaches the provider edge. Keep the provider security group for the ports you expose and let fail2ban handle repeat offenders at the host.
Key-only SSH reduces password-guessing risk, but verify working key access and recovery before disabling passwords or changing root-login policy. Validate sshd configuration before a controlled reload; Fail2Ban is an additional control, not a replacement for secure authentication.
Common mistakes, starting with banning yourself
Six problems account for almost every failed fail2ban setup on Ubuntu. Match the symptom in the left column, apply the fix in the right, and retest before touching anything else.
| Symptom | Cause | Fix |
|---|---|---|
| SSH hangs or refuses your address | A burst of failed logins banned your admin IP | Unban from the console, then add the address to ignoreip |
| Jail changes vanish after an upgrade | Edits were written into jail.conf | Move them to jail.local or jail.d/*.local |
| Have not found any log file for sshd jail | 24.04 minimal has no rsyslog, so there is no auth.log | Keep backend = systemd and install python3-systemd |
| status lists no jails at all | File saved but the service was never restarted | fail2ban-client -t, then systemctl restart fail2ban |
| No bans for SSH on port 2222 | The jail still watches port ssh | Add port = 2222 under [sshd] |
| Failed to execute ban jail action | iptables binary missing on a minimal image | apt install iptables, or set banaction = nftables |
The self-ban is the one that costs an afternoon. Before you enable the jail, open a second SSH session, add your office address to ignoreip, and leave the provider console tab open until a test ban and a test unban have both worked.
Plans are quoted by email at support@webji.services before payment, in INR before 18% GST. Support answers in Hindi and English, 24/7 by email, with an average first reply under 60 minutes. If a ban has locked you out of a panel-managed server instead, our guide to unblocking an IP in cPanel covers that firewall, and the contact page reaches the team directly.
Agree who owns this firewall configuration through the managed VPS responsibility checklist; installation alone does not define ongoing monitoring or recovery support.
Frequently asked questions
How do I install fail2ban on Ubuntu 22.04 or 24.04?
Install the Ubuntu package with apt after checking repository availability, then inspect systemctl status fail2ban and fail2ban-client status. Ubuntu 24.04 lists Fail2Ban in universe. A package installation is not proof that a specific jail has the correct logging source or firewall action.
Is the sshd jail enabled by default after install?
Do not assume it is enabled on every Ubuntu image. Inspect the packaged jail configuration and fail2ban-client status. If sshd is absent, add a local override, confirm the correct log backend, test configuration and verify the active jail before relying on bans.
Should I edit jail.conf or jail.local?
Edit jail.local, never jail.conf. fail2ban reads jail.conf, then jail.d/*.conf, then jail.local, then jail.d/*.local, and later files win. apt replaces jail.conf on upgrade, so anything you wrote there is lost. Put only your overrides in jail.local and test them with sudo fail2ban-client -t.
How do I unban my own IP in fail2ban?
Use the provider console or an existing session and target the affected address with fail2ban-client set sshd unbanip, followed by the real IP. Confirm the active jail name. Do not clear every jail unnecessarily, and check why the legitimate address was banned before adding an exception.
Why does fail2ban say it found no log file for the sshd jail?
A minimal Ubuntu 24.04 image has no rsyslog, so /var/log/auth.log does not exist. Keep backend = systemd, which reads the journal instead, and install python3-systemd if the journal socket cannot be opened. Ubuntu 22.04 usually has rsyslog, so the file is there.
Last editorial update: 14 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.