fail2ban jail options: every jail.conf setting with defaults

Q: What are the default jail settings in fail2ban?

In the stock jail.conf: bantime = 10m, findtime = 10m, maxretry = 5, backend = auto, usedns = warn, enabled = false, action = %(action_)s (ban only) and ignoreself = true. Distributions add their own defaults in /etc/fail2ban/jail.d/, for example enabling the sshd jail.

Q: What is the default jail in fail2ban?

There is no single default jail. jail.conf defines nearly 100 jails, all disabled. Debian, Ubuntu and most other packages enable only [sshd] through a file in /etc/fail2ban/jail.d/. Run sudo fail2ban-client status to see which jails are running on your system.

Q: Can I set different settings per jail?

Yes. Put shared values in [DEFAULT] and override any option inside a jail section, for example maxretry = 3 under [sshd]. A jail's value replaces the default completely; for lists like ignoreip use %(default/ignoreip)s to keep the default entries.

Q: How do I see the settings a jail is actually using?

Query the running server with sudo fail2ban-client get , e.g. get sshd maxretry or get sshd logpath. To see the merged configuration from all files, run sudo fail2ban-client -d, which prints every resolved setting per jail.

Q: Which options can be set in [DEFAULT]?

Any jail option. In practice [DEFAULT] holds bantime, findtime, maxretry, ignoreip, banaction, action, destemail and the bantime.* options. Jail-specific options like logpath, port and filter belong in each jail.

A fail2ban jail combines a filter (what counts as a failure), a log source (logpath or the journal), thresholds (maxretry failures within findtime cause a ban of bantime) and actions (how to ban). Set any option in [DEFAULT] to apply it to every jail, or in a jail section such as [sshd] to override it for that jail. The stock defaults are bantime = 10m, findtime = 10m, maxretry = 5, backend = auto and enabled = false.

/etc/fail2ban/jail.local

[sshd]
enabled  = true          ; turn the jail on
port     = ssh           ; ports to block
backend  = systemd       ; read the journal instead of a file
maxretry = 3             ; failures…
findtime = 10m           ; …within this window…
bantime  = 1h            ; …ban for this long

All options below were checked against jail.conf, man jail.conf and fail2ban/client/jailreader.py in fail2ban 1.1.1. Times accept seconds or abbreviations like 10m, 1h, 1d, 1w (see time format).

Core jail options#

Option	Type	Default	What it does
`enabled`	bool	`false`	Turns the jail on. Every stock jail is off until you set `enabled = true`.
`filter`	name[opts]	`%(__name__)s[mode=%(mode)s]`	Filter file in `filter.d/` without extension. Defaults to the jail name, so `[sshd]` uses `sshd.conf`. One filter per jail.
`mode`	string	`normal`	Filter mode passed to filters that support modes, e.g. `sshd`: `normal`, `ddos`, `extra`, `aggressive`.
`logpath`	path(s)	from `paths-*.conf`	Log file(s) to read. Globs allowed; one path per line. Ignored with `backend = systemd`.
`backend`	string	`auto`	How logs are read: `auto`, `pyinotify`, `polling` or `systemd[...]`. See backends.
`journalmatch`	string	from filter	systemd journal filter, e.g. `_SYSTEMD_UNIT=sshd.service + _COMM=sshd`. Only used by the systemd backend (and needed for the auto switch to it).
`port`	list	`0:65535`	Ports the action blocks: names from `/etc/services` or numbers, comma-separated, ranges with `:`.
`protocol`	string	`tcp`	Protocol for the firewall rule: `tcp`, `udp`, or `all` (supported by the nftables and iptables actions).
`skip_if_nologs`	bool	`false`	If no file matches `logpath`, skip this jail with a warning instead of failing the whole start (1.1.1+).
`systemd_if_nologs`	bool	`true`	With `backend = auto`, switch to the systemd backend when no log file is found and a `journalmatch` exists (1.1.1+).

logpath examples#

ini

[nginx-http-auth]
enabled = true
logpath = /var/log/nginx/error.log
          /var/log/nginx/sites/*-error.log

[myapp]
# read from the end of the file only (skip old lines on start)
logpath = /var/log/myapp.log tail

Globs are expanded when the jail starts. A log file created later (a new vhost) is only picked up after fail2ban-client reload. If nothing matches and the backend can't switch to systemd, startup fails with "Have not found any log file for … jail". See no log file found.

Ban timing options#

Option	Type	Default	What it does
`bantime`	time	`10m`	Ban duration. `-1` = permanent. With incremental bans, the first ban's length.
`findtime`	time	`10m`	Window in which failures are counted.
`maxretry`	int	`5`	Failures within `findtime` that trigger a ban.
`maxmatches`	int	`%(maxretry)s`	Matched log lines kept per IP in memory (what `<matches>` shows in emails).

How these three interact, recommended values and the -1 / 0 edge cases: bantime, findtime and maxretry.

Incremental ban options#

All are unset (off) by default. Details and worked examples are on incremental bans.

Option	Type	Default	What it does
`bantime.increment`	bool	off	Make each repeat ban of an IP longer. Needs the database (`dbfile`).
`bantime.factor`	number	`1`	Coefficient used by the formula or multipliers.
`bantime.formula`	Python expr	`ban.Time * (1<<(ban.Count if ban.Count<20 else 20)) * banFactor`	How the next ban time is computed (1, 2, 4, 8… × bantime).
`bantime.multipliers`	list	unset	Explicit multipliers instead of the formula, e.g. `1 2 4 8 16 32 64`.
`bantime.maxtime`	time	unset	Upper limit for an increased ban.
`bantime.rndtime`	time	unset	Random extra seconds (0 to this value) added to each increased ban.
`bantime.overalljails`	bool	`false`	Count previous bans of the IP in all jails, not just this one.

Action options#

Option	Type	Default	What it does
`banaction`	action[opts]	`nftables` (Debian paths in 1.1.1); `iptables-multiport` before 1.1.1	Firewall action used by the `action_*` shortcuts for per-port bans.
`banaction_allports`	action[opts]	`nftables[type=allports]`; `iptables-allports` before 1.1.1	Same for all-port bans (used by `recidive`, `pam-generic`).
`action`	action list	`%(action_)s`	What happens on a ban. One action per line; several allowed.
`chain`	string	`<known/chain>`	Firewall chain for actions that take one. `<known/chain>` means "the action's own default" (`INPUT` for iptables, `f2b-chain` for nftables).
`destemail`	email	`root@localhost`	Recipient for the mail shortcuts.
`sender`	email	`root@<fq-hostname>`	From address for mail actions.
`mta`	string	`sendmail`	Mail action family: `sendmail` (sendmail-compatible binary) or `mail`.
`fail2ban_agent`	string	`Fail2Ban/%(fail2ban_version)s`	User agent string for reporting actions that call web APIs.

The action shortcuts defined in jail.conf:

Shortcut	Does
`%(action_)s`	Ban only (the default)
`%(action_mw)s`	Ban + email with whois report
`%(action_mwl)s`	Ban + email with whois report and matching log lines
`%(action_xarf)s`	Ban + X-ARF abuse report email to the IP's abuse contact
`%(action_cf_mwl)s`	Ban on Cloudflare (legacy API key) + email with log lines
`%(action_blocklist_de)s`	Report to blocklist.de (needs `blocklist_de_apikey`)
`%(action_abuseipdb)s`	Report to AbuseIPDB

Combine them by listing several actions, one per line:

ini

[sshd]
enabled = true
action  = %(action_)s
          abuseipdb[abuseipdb_apikey="YOUR_KEY", abuseipdb_category="18,22"]

Parameters for an action go in square brackets: banaction = nftables[blocktype=drop]. A plain blocktype = drop line in the jail does not reach the action. More in banaction, email alerts and the action library.

Ignore (whitelist) options#

Option	Type	Default	What it does
`ignoreip`	list	empty	IPs, CIDR ranges, hostnames or `file:/path` sets that are never banned. A jail value replaces the `[DEFAULT]` one.
`ignoreself`	bool	`true`	Never ban the server's own addresses (interface IPs, `localhost`, its hostname).
`ignorecommand`	command	empty	Script run for each candidate IP; exit code `0` means "don't ban". `<ip>` is substituted.
`ignorecache`	key/size/time	disabled	Caches ignore decisions, e.g. `key="<ip>", max-count=100, max-time=5m`.

ini

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 home.example.net file:/etc/fail2ban/ignore.list

All the details, including dynamic IPs and the "ignoreip not working" cases: whitelist IPs.

Log parsing options#

Option	Type	Default	What it does
`usedns`	string	`warn`	What to do with hostnames in logs: `yes` (resolve), `warn` (resolve and log a warning), `no` (only ban IPs), `raw` (use the matched value as-is, for non-IP IDs).
`logencoding`	string	`auto`	Log file encoding; `auto` uses the system locale. Set `utf-8` if you see decode errors.
`logtimezone`	string	server time zone	Time zone for log lines without one: `UTC`, `UTC+0200`, `GMT-0100`.
`datepattern`	pattern	from filter	Override how timestamps are found, e.g. `%%Y-%%m-%%d %%H:%%M:%%S` (note the doubled `%`).
`maxlines`	int	from filter (`1`)	Lines buffered for multi-line regexes.
`failregex`	regex(es)	from filter	Override or extend the filter's failure regexes from the jail.
`ignoreregex`	regex(es)	from filter	Lines matching these are never counted.
`prefregex`	regex	from filter	Common prefix every line must match before `failregex` runs.

You can extend a stock filter's regexes from the jail with %(known/failregex)s:

ini

[sshd]
enabled = true
ignoreregex = %(known/ignoreregex)s
              ^Connection closed by authenticating user deploy <HOST>

Writing filters from scratch is covered in custom filters.

Backend parameters#

The systemd backend accepts parameters in brackets: journalpath, journalfiles, journalflags, namespace and rotated (1.1.1+, default off). Example:

ini

backend = systemd[journalflags=4, rotated=on]

See backends and the systemd journal for when to use each.

Variables you can use in values#

Variable	Value
`%(__name__)s`	Current jail (section) name
`%(fail2ban_version)s`	fail2ban version, e.g. `1.1.1`
`%(fail2ban_confpath)s`	Config directory, normally `/etc/fail2ban`
`%(default/option)s`	The `[DEFAULT]` value of `option`
`%(known/option)s`	The previously loaded value of `option` (to extend instead of replace)
`%(sshd_log)s`, `%(apache_error_log)s`, `%(nginx_access_log)s`…	Log paths from `paths-*.conf`

Change options at runtime#

Many options can be changed on the running server without editing files (lost on restart or reload):

output

$ sudo fail2ban-client set sshd bantime 86400
86400
$ sudo fail2ban-client get sshd maxretry
3

set echoes the new value; get returns the value currently in effect. To make a change permanent, put it in jail.local. The full list of set/get commands is in the fail2ban-client command reference.

Default jail.conf [DEFAULT] section#

The stock [DEFAULT] section of fail2ban 1.1.1, with upstream comments. These values apply to every jail unless overridden:

Option	Default in jail.conf	Upstream comment
`ignorecommand`	`(empty)`	MISCELLANEOUS OPTIONS "bantime.increment" allows to use database for searching of previously banned ip's to increase a default ban time using special formula, default it is banTime * 1, 2, 4, 8, 16, 32... bantime.increment = true "bantime.rndtime" is the max number of seconds using for mixing with random time to prevent "clever" botnets calculate exact time IP can be unbanned again:
`bantime`	`10m`	"bantime" is the amount of time that a host is banned, integer in seconds or time abbreviation format (m - minutes, h - hours, d - days, w - weeks, mo - months, y - years). This is to consider as an initial time if bantime.increment gets enabled.
`findtime`	`10m`	A host is banned if it has generated "maxretry" during the last "findtime" seconds.
`maxretry`	`5`	"maxretry" is the number of failures before a host get banned.
`maxmatches`	`%(maxretry)s`	"maxmatches" is the number of matches stored in ticket (resolvable via tag <matches> in actions).
`backend`	`auto`	"backend" specifies the backend used to get files modification. Available options are "pyinotify", "polling", "systemd" and "auto". This option can be overridden in each jail as well. pyinotify: requires pyinotify (a file alteration monitor) to be installed. If pyinotify is not installed, Fail2ban will use auto. polling: uses a polling algorithm which does not require
`usedns`	`warn`	"usedns" specifies if jails should trust hostnames in logs, warn when DNS lookups are performed, or ignore all hostnames in logs yes: if a hostname is encountered, a DNS lookup will be performed. warn: if a hostname is encountered, a DNS lookup will be performed, but it will be logged as a warning. no: if a hostname is encountered, will not be used for banning, but it will be logged as info. raw: use raw va
`logencoding`	`auto`	"logencoding" specifies the encoding of the log files handled by the jail This is used to decode the lines from the log file. Typical examples: "ascii", "utf-8" auto: will use the system locale setting
`enabled`	`false`	"enabled" enables the jails. By default all jails are disabled, and it should stay this way. Enable only relevant to your setup jails in your .local or jail.d/*.conf true: jail will be enabled and log files will get monitored for changes false: jail is not enabled
`mode`	`normal`	"mode" defines the mode of the filter (see corresponding filter implementation for more info).
`filter`	`%(__name__)s[mode=%(mode)s]`	"filter" defines the filter to use by the jail. By default jails have names matching their filter name
`destemail`	`root@localhost`	ACTIONS Some options used for actions Destination email address used solely for the interpolations in jail.{conf,local,d/*} configuration files.
`sender`	`root@<fq-hostname>`	Sender email address used solely for some actions
`mta`	`sendmail`	E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA for the mailing. Change mta configuration parameter to mail if you want to revert to conventional 'mail'.
`protocol`	`tcp`	Default protocol
`chain`	`<known/chain>`	Specify chain where jumps would need to be added in ban-actions expecting parameter chain
`port`	`0:65535`	Ports to be banned Usually should be overridden in a particular jail
`fail2ban_agent`	`Fail2Ban/%(fail2ban_version)s`	Format of user-agent https://tools.ietf.org/html/rfc7231#section-5.5.3
`action`	`%(action_)s`	Choose default action. To change, just override value of 'action' with the interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local globally (section [DEFAULT]) or per specific section

All predefined jails#

Every jail defined in the stock jail.conf. All are disabled until you set enabled = true in jail.local. Each filter name links to its reference entry with the regexes and sample log lines:

Jail	Filter	Port	Log (Debian/Ubuntu)
`[sshd]`	`sshd`	`ssh`	`/var/log/auth.log`
`[dropbear]`	`dropbear`	`ssh`	`/var/log/auth.log`
`[selinux-ssh]`	`selinux-ssh`	`ssh`	`/var/log/audit/audit.log`
`[apache-auth]`	`apache-auth`	`http,https`	`/var/log/apache2/*error.log`
`[apache-badbots]`	`apache-badbots`	`http,https`	`/var/log/apache2/*access.log`
`[apache-noscript]`	`apache-noscript`	`http,https`	`/var/log/apache2/*error.log`
`[apache-overflows]`	`apache-overflows`	`http,https`	`/var/log/apache2/*error.log`
`[apache-nohome]`	`apache-nohome`	`http,https`	`/var/log/apache2/*error.log`
`[apache-botsearch]`	`apache-botsearch`	`http,https`	`/var/log/apache2/*error.log`
`[apache-fakegooglebot]`	`apache-fakegooglebot`	`http,https`	`/var/log/apache2/*access.log`
`[apache-modsecurity]`	`apache-modsecurity`	`http,https`	`/var/log/apache2/*error.log`
`[apache-shellshock]`	`apache-shellshock`	`http,https`	`/var/log/apache2/*error.log`
`[openhab-auth]`	`openhab`		`/opt/openhab/logs/request.log`
`[nginx-http-auth]`	`nginx-http-auth`	`http,https`	`/var/log/nginx/*error.log`
`[nginx-limit-req]`	`nginx-limit-req`	`http,https`	`/var/log/nginx/*error.log`
`[nginx-botsearch]`	`nginx-botsearch`	`http,https`	`/var/log/nginx/*error.log`
`[nginx-bad-request]`	`nginx-bad-request`	`http,https`	`/var/log/nginx/*access.log`
`[nginx-forbidden]`	`nginx-forbidden`	`http,https`	`/var/log/nginx/*error.log`
`[php-url-fopen]`	`php-url-fopen`	`http,https`	`/var/log/nginx/*access.log`
`[suhosin]`	`suhosin`	`http,https`	`/var/log/user.log`
`[lighttpd-auth]`	`lighttpd-auth`	`http,https`	`/var/log/lighttpd/error.log`
`[roundcube-auth]`	`roundcube-auth`	`http,https`	`/var/log/roundcube/errors.log`
`[openwebmail]`	`openwebmail`	`http,https`	`/var/log/openwebmail.log`
`[horde]`	`horde`	`http,https`	`/var/log/horde/horde.log`
`[groupoffice]`	`groupoffice`	`http,https`	`/home/groupoffice/log/info.log`
`[sogo-auth]`	`sogo-auth`	`http,https`	`/var/log/sogo/sogo.log`
`[tine20]`	`tine20`	`http,https`	`/var/log/tine20/tine20.log`
`[drupal-auth]`	`drupal-auth`	`http,https`	`/var/log/daemon.log`
`[guacamole]`	`guacamole`	`http,https`	`/var/log/tomcat*/catalina.out`
`[monit]`	`monit`	`2812`	`/var/log/monit`
`[webmin-auth]`	`webmin-auth`	`10000`	`/var/log/auth.log`
`[froxlor-auth]`	`froxlor-auth`	`http,https`	`/var/log/user.log`
`[squid]`	`squid`	`80,443,3128,8080`	`/var/log/squid/access.log`
`[3proxy]`	`3proxy`	`3128`	`/var/log/3proxy.log`
`[proftpd]`	`proftpd`	`ftp,ftp-data,ftps,ftps-data`	`/var/log/proftpd/proftpd.log`
`[pure-ftpd]`	`pure-ftpd`	`ftp,ftp-data,ftps,ftps-data`	`/var/log/syslog`
`[gssftpd]`	`gssftpd`	`ftp,ftp-data,ftps,ftps-data`	`/var/log/daemon.log`
`[wuftpd]`	`wuftpd`	`ftp,ftp-data,ftps,ftps-data`	`/var/log/syslog`
`[vsftpd]`	`vsftpd`	`ftp,ftp-data,ftps,ftps-data`	`/var/log/vsftpd.log`
`[assp]`	`assp`	`smtp,465,submission`	`/root/path/to/assp/logs/maillog.txt`
`[courier-smtp]`	`courier-smtp`	`smtp,465,submission`	`/var/log/mail.log`
`[postfix]`	`postfix`	`smtp,465,submission`	`/var/log/mail.log`
`[postfix-rbl]`	`postfix`	`smtp,465,submission`	`/var/log/mail.log`
`[sendmail-auth]`	`sendmail-auth`	`submission,465,smtp`	`/var/log/mail.log`
`[sendmail-reject]`	`sendmail-reject`	`smtp,465,submission`	`/var/log/mail.log`
`[qmail-rbl]`	`qmail`	`smtp,465,submission`	`/service/qmail/log/main/current`
`[dovecot]`	`dovecot`	`pop3,pop3s,imap,imaps,submission,465,sieve`	`/var/log/mail.log`
`[sieve]`	`sieve`	`smtp,465,submission`	`/var/log/mail.log`
`[solid-pop3d]`	`solid-pop3d`	`pop3,pop3s`	`/var/log/messages`
`[exim]`	`exim`	`smtp,465,submission`	`/var/log/exim4/mainlog`
`[exim-spam]`	`exim-spam`	`smtp,465,submission`	`/var/log/exim4/mainlog`
`[kerio]`	`kerio`	`imap,smtp,imaps,465`	`/opt/kerio/mailserver/store/logs/security.log`
`[courier-auth]`	`courier-auth`	`smtp,465,submission,imap,imaps,pop3,pop3s`	`/var/log/mail.log`
`[postfix-sasl]`	`postfix`	`smtp,465,submission,imap,imaps,pop3,pop3s`	`/var/log/mail.log`
`[perdition]`	`perdition`	`imap,imaps,pop3,pop3s`	`/var/log/mail.log`
`[squirrelmail]`	`squirrelmail`	`smtp,465,submission,imap,imap2,imaps,pop3,pop3s,http,https,socks`	`/var/lib/squirrelmail/prefs/squirrelmail_access_log`
`[cyrus-imap]`	`cyrus-imap`	`imap,imaps`	`/var/log/mail.log`
`[uwimap-auth]`	`uwimap-auth`	`imap,imaps`	`/var/log/mail.log`
`[named-refused]`	`named-refused`	`domain,953`	`/var/log/named/security.log`
`[nsd]`	`nsd`	`53`	`/var/log/nsd.log`
`[asterisk]`	`asterisk`	`5060,5061`	`/var/log/asterisk/messages`
`[freeswitch]`	`freeswitch`	`5060,5061`	`/var/log/freeswitch.log`
`[znc-adminlog]`	`znc-adminlog`	`6667`	`/var/lib/znc/moddata/adminlog/znc.log`
`[mysqld-auth]`	`mysqld-auth`	`3306`	`/var/log/mariadb/mariadb.log`
`[mssql-auth]`	`mssql-auth`	`1433`	`/var/opt/mssql/log/errorlog`
`[mongodb-auth]`	`mongodb-auth`	`27017`	`/var/log/mongodb/mongodb.log`
`[recidive]`	`recidive`		`/var/log/fail2ban.log`
`[pam-generic]`	`pam-generic`		`/var/log/auth.log`
`[xinetd-fail]`	`xinetd-fail`		`/var/log/daemon.log`
`[stunnel]`	`stunnel`		`/var/log/stunnel4/stunnel.log`
`[ejabberd-auth]`	`ejabberd-auth`	`5222`	`/var/log/ejabberd/ejabberd.log`
`[counter-strike]`	`counter-strike`		`/opt/cstrike/logs/L[0-9]*.log`
`[softethervpn]`	`softethervpn`	`500,4500`	`/usr/local/vpnserver/security_log/*/sec.log`
`[gitlab]`	`gitlab`	`http,https`	`/var/log/gitlab/gitlab-rails/application.log`
`[grafana]`	`grafana`	`http,https`	`/var/log/grafana/grafana.log`
`[bitwarden]`	`bitwarden`	`http,https`	`/home/*/bwdata/logs/identity/Identity/log.txt`
`[centreon]`	`centreon`	`http,https`	`/var/log/centreon/login.log`
`[nagios]`	`nagios`		`/var/log/daemon.log ; nrpe.cfg may define a different log_facility`
`[oracleims]`	`oracleims`		`/opt/sun/comms/messaging64/log/mail.log_current`
`[directadmin]`	`directadmin`	`2222`	`/var/log/directadmin/login.log`
`[portsentry]`	`portsentry`		`/var/lib/portsentry/portsentry.history`
`[pass2allow-ftp]`	`apache-pass`	`ftp,ftp-data,ftps,ftps-data`	`/var/log/apache2/*access.log`
`[murmur]`	`murmur`	`64738`	`/var/log/mumble-server/mumble-server.log`
`[screensharingd]`	`screensharingd`		`/var/log/system.log`
`[haproxy-http-auth]`	`haproxy-http-auth`		`/var/log/haproxy.log`
`[slapd]`	`slapd`	`ldap,ldaps`	`/var/log/slapd.log`
`[domino-smtp]`	`domino-smtp`	`smtp,ssmtp`	`/home/domino01/data/IBM_TECHNICAL_SUPPORT/console.log`
`[phpmyadmin-syslog]`	`phpmyadmin-syslog`	`http,https`	`/var/log/auth.log`
`[routeros-auth]`	`routeros-auth`	`ssh,http,https`	`/var/log/MikroTik/router.log`
`[zoneminder]`	`zoneminder`	`http,https`	`/var/log/apache2/*error.log`
`[traefik-auth]`	`traefik-auth`	`http,https`	`/var/log/traefik/access.log`
`[openvpn]`	`openvpn`	`443`	`/var/log/syslog`
`[scanlogd]`	`scanlogd`		`/var/log/messages`
`[monitorix]`	`monitorix`	`8080`	`/var/log/monitorix-httpd`
`[dante]`	`dante`	`1080`	`/var/log/daemon.log`
`[proxmox]`	`proxmox`	`https,http,8006`	`/var/log/daemon.log`
`[vaultwarden]`	`vaultwarden`	`http,https`	`/var/log/vaultwarden.log`
`[xrdp]`	`xrdp`	`3389`	`/var/log/xrdp-sesman.log`

FAQ#

What are the default jail settings in fail2ban?#

In the stock jail.conf: bantime = 10m, findtime = 10m, maxretry = 5, backend = auto, usedns = warn, enabled = false, action = %(action_)s (ban only) and ignoreself = true. Distributions add their own defaults in /etc/fail2ban/jail.d/, for example enabling the sshd jail.

What is the default jail in fail2ban?#

There is no single default jail. jail.conf defines nearly 100 jails, all disabled. Debian, Ubuntu and most other packages enable only [sshd] through a file in /etc/fail2ban/jail.d/. Run sudo fail2ban-client status to see which jails are running on your system.

Can I set different settings per jail?#

Yes. Put shared values in [DEFAULT] and override any option inside a jail section, for example maxretry = 3 under [sshd]. A jail's value replaces the default completely; for lists like ignoreip use %(default/ignoreip)s to keep the default entries.

How do I see the settings a jail is actually using?#

Query the running server with sudo fail2ban-client get <jail> <option>, e.g. get sshd maxretry or get sshd logpath. To see the merged configuration from all files, run sudo fail2ban-client -d, which prints every resolved setting per jail.

Which options can be set in [DEFAULT]?#

Any jail option. In practice [DEFAULT] holds bantime, findtime, maxretry, ignoreip, banaction, action, destemail and the bantime.* options. Jail-specific options like logpath, port and filter belong in each jail.

Spotted something wrong or out of date? Tell us — every page is checked against the current fail2ban release.