Development · Tip
SSH Brute-Force Protection with fail2ban and ufw
Quick commands to detect and block SSH brute-force attacks on Linux
A concise server-hardening walkthrough for detecting SSH brute-force attempts in system logs and blocking repeat offenders. It uses fail2ban to automatically ban malicious IPs after failed logins alongside ufw to manage firewall access. It is a quick, standard setup for protecting a public VPS.
How it works
Detect attacks live:
> journalctl -u ssh --since "1 hour ago" | grep "Failed"
Author's case: 30 failed login attempts in 10 minutes from 3 IPs (root, ubuntu, validator users) on their server.
The fix (commands):
> apt install fail2ban -y
> systemctl enable fail2ban --now
> ufw allow 22
> ufw enable
fail2ban auto-bans after 5 failed attempts; also block offending IPs manually. The commands below will help:
> journalctl -u ssh --since "1 hour ago" | grep "Failed"
> apt install fail2ban -y
> systemctl enable fail2ban --now
> ufw allow 22
> ufw enable
What it's for
- Inspect systemd logs to identify recent failed SSH authentication attempts
- Automatically ban IP addresses that repeatedly fail SSH logins
- Configure a baseline firewall with ufw on a Linux server
Key points
- Live inspection of SSH failures using journalctl
- Automated IP banning after five failed attempts via fail2ban
- Firewall setup and port allowance with ufw
- Minimal dependency installation suitable for Debian and Ubuntu servers
Pricing
Free
Details
- Type
- Tip
- Category
- Development
- Topic
- Server Security
- Open source
- Yes
- Platforms
- Linux, Command line, Self-hosted
- For
- Developers and system administrators managing Linux VPS instances
- Alternative to
- CrowdSec
- Tags
- ssh, security, fail2ban, ufw, linux, sysadmin, devops
Why it was saved
- @the_smart_ape: When you run a VPS, brute-force SSH attempts are constant and easy to miss; the command takes about a minute and is free.
Related
Terminal commands to count and monitor failed SSH logins on Linux
Open-source collaborative security engine and intrusion prevention system using crowdsourced threat data.
SSH tarpit written in Go with built-in Prometheus metrics and Grafana support
Log-monitoring daemon that dynamically blocks IP addresses causing repeated authentication failures.
Discovery and security testing platform for exposed internet-facing AI endpoints.
Autonomous production engineering platform that diagnoses, triages, and fixes runtime issues
Updated