Fail2ban Cheat Sheet for Sysadmins

Fail2ban is a critical tool for safeguarding servers against brute-force attacks by monitoring logs and banning malicious IPs. This cheat sheet provides the most important concepts and commands for managing Fail2ban effectively. 1. Core Concepts Jail : A Fail2ban unit that defines which logs to monitor, filter rules, and actions (e.g., banning an IP). Example: SSH protection with sshd . Filter : A regex-based rule set to identify bad behavior in logs. Action : The response triggered by Fail2ban (e.g., banning an IP using iptables ). Ban Time : How long IPs stay banned (seconds). Max Retry : Maximum failed login attempts before banning an IP. 2. Service Management Start Fail2ban service: sudo systemctl start fail2ban Stop Fail2ban service: sudo systemctl stop fail2ban Restart Fail2ban service (for major configuration changes): sudo systemctl restart fail2ban Reload Fail2ban service (for minor configuration changes): sudo fail2ban-client reload Enable Fail2ban at startup: sudo systemctl