# SSH Brute-Force Protection with fail2ban and ufw

> Quick commands to detect and block SSH brute-force attacks on Linux

A concise server-hardening walkthrough for detecting SSH brute-force attempts in system logs and blocking repeat offenders. It uses fail2ban to automatically ban malicious IPs after failed logins alongside ufw to manage firewall access. It is a quick, standard setup for protecting a public VPS.

## How it works

Detect attacks live:

\> journalctl -u ssh --since "1 hour ago" \| grep "Failed"

Author's case: 30 failed login attempts in 10 minutes from 3 IPs (root, ubuntu, validator users) on their server.

The fix (commands):

\> apt install fail2ban -y

\> systemctl enable fail2ban --now

\> ufw allow 22

\> ufw enable

fail2ban auto-bans after 5 failed attempts; also block offending IPs manually. The commands below will help:

\> journalctl -u ssh --since "1 hour ago" \| grep "Failed"

\> apt install fail2ban -y

\> systemctl enable fail2ban --now

\> ufw allow 22

\> ufw enable

## What it is for

- Inspect systemd logs to identify recent failed SSH authentication attempts
- Automatically ban IP addresses that repeatedly fail SSH logins
- Configure a baseline firewall with ufw on a Linux server

## Key points

- Live inspection of SSH failures using journalctl
- Automated IP banning after five failed attempts via fail2ban
- Firewall setup and port allowance with ufw
- Minimal dependency installation suitable for Debian and Ubuntu servers

## Pricing

Free

## Details

- Type: Tip
- Category: [Development](https://xiry.app/topics/development.md)
- Topic: [Server Security](https://xiry.app/topics/development/server-security.md)
- Open source: yes
- Platforms: Linux, Command line, Self-hosted
- For: Developers and system administrators managing Linux VPS instances
- Alternative to: CrowdSec
- Tags: ssh, security, fail2ban, ufw, linux, sysadmin, devops

## Why it was saved

- [@the_smart_ape, 26 January 2026](https://x.com/the_smart_ape/status/2015779415448547488): When you run a VPS, brute-force SSH attempts are constant and easy to miss; the command takes about a minute and is free.

## Related

- [Check SSH Brute-Force Login Attempts](https://xiry.app/resources/check-ssh-brute-force-login-attempts): Terminal commands to count and monitor failed SSH logins on Linux (Tip, Free)
- [CrowdSec](https://xiry.app/resources/crowdsec): Open-source collaborative security engine and intrusion prevention system using crowdsourced threat data. (GitHub repo, Open source)
- [endlessh-go](https://xiry.app/resources/endlessh-go): SSH tarpit written in Go with built-in Prometheus metrics and Grafana support (GitHub repo, Open source)
- [Fail2Ban](https://xiry.app/resources/fail2ban): Log-monitoring daemon that dynamically blocks IP addresses causing repeated authentication failures. (GitHub repo, Open source)
- [AIMap](https://xiry.app/resources/aimap): Discovery and security testing platform for exposed internet-facing AI endpoints. (Web app, Open source)
- [Antimetal](https://xiry.app/resources/antimetal): Autonomous production engineering platform that diagnoses, triages, and fixes runtime issues (Web app, Paid)

Updated 11 October 2026. Page: https://xiry.app/resources/ssh-brute-force-protection-with-fail2ban-and-ufw

Make your own library: Xiry takes your saved reels, tweets, Reddit bookmarks and Watch Later videos, makes them searchable and pulls the useful stuff out, like this library. It's invite-only for now; join the waitlist at https://xiry.app/#waitlist.