xiry.

Development · GitHub repo

Fail2Ban

Log-monitoring daemon that dynamically blocks IP addresses causing repeated authentication failures.

From the Xiry library · Updated 3 October 2026

Visit github.com ↗

Fail2Ban monitors system and service logs for malicious activity, such as repetitive SSH brute-force attempts. When an IP address exceeds the configured threshold of failed attempts, it dynamically updates system firewall rules (like iptables) to reject connections from that address for a set duration. It includes built-in filters for standard services like SSH and Apache and can be extended to monitor custom application logs.

What it's for

  • Block automated brute-force password guessing on SSH ports
  • Throttle repeated failed authentication attempts against Apache or Nginx servers
  • Ban abusive IP addresses from custom application endpoints based on log patterns

Features

  • Automated log monitoring across standard system logs (auth.log, syslogs)
  • Dynamic firewall management via iptables, nftables, or system firewalls
  • Configurable ban duration, find time, and retry limits per jail
  • Preconfigured filters for SSH, web servers, mail services, and more
  • Custom regex pattern matching for custom log files
  • Support for IPv4 and IPv6 address parsing and blocking

Pricing

Open source

Details

Type
GitHub repo
Category
Development
Topic
Server Security
Open source
Yes
Platforms
Linux, Command line, Self-hosted
For
Linux systems administrators, DevOps engineers, and self-hosters securing network servers.
Alternative to
CrowdSec, DenyHosts
Tags
security, firewall, sysadmin, brute force, intrusion prevention, linux

Why it was saved

  • @brusnicadev, 16 August 2026: Automatically updates firewall rules (e.g. iptables) to drop traffic from IPs that exceed failed authentication thresholds.

Related

  • Check SSH Brute-Force Login Attempts

    Terminal commands to count and monitor failed SSH logins on Linux

  • CrowdSec

    Open-source collaborative security engine and intrusion prevention system using crowdsourced threat data.

  • endlessh-go

    SSH tarpit written in Go with built-in Prometheus metrics and Grafana support

  • SSH Brute-Force Protection with fail2ban and ufw

    Quick commands to detect and block SSH brute-force attacks on Linux

  • AIMap

    Discovery and security testing platform for exposed internet-facing AI endpoints.

  • Better Auth

    Open-source TypeScript authentication framework for modern web applications.

All 5 in Server Security →

Updated