How to install fail2ban

To install fail2ban, use your distribution's package manager: sudo apt install fail2ban on Ubuntu and Debian, sudo dnf install fail2ban on Fedora (and on Rocky, AlmaLinux and RHEL after enabling EPEL), sudo pacman -S fail2ban on Arch. Then create /etc/fail2ban/jail.local that enables the sshd jail, run sudo systemctl enable --now fail2ban, and confirm with sudo fail2ban-client status sshd.

# Debian / Ubuntu / Raspberry Pi OS / Proxmox VE
sudo apt update && sudo apt install fail2ban

# Fedora
sudo dnf install fail2ban

# Rocky Linux / AlmaLinux / CentOS Stream (EPEL first)
sudo dnf install epel-release && sudo dnf install fail2ban

# Arch Linux / Manjaro
sudo pacman -S fail2ban

The current upstream release is fail2ban 1.1.1. Most distributions ship an older but supported version; the table below shows what you get.

fail2ban install command per distribution#

Versions are the ones in each release's main or EPEL repository at the time of writing. Check yours with fail2ban-client --version.

What the package installs#

Every package lays out fail2ban the same way, because the paths come from upstream's setup.py:

On Debian-based systems the package also enables and starts the fail2ban systemd service. On Fedora, RHEL and Arch it's installed but not started.

If you want the full picture of how these parts fit together, read how fail2ban works.

First configuration: jail.local with the sshd jail#

Never edit jail.conf — package upgrades overwrite it. Put your settings in /etc/fail2ban/jail.local, which is read after jail.conf and everything in jail.d/*.conf, so it wins. A minimal, safe starting point:

[DEFAULT]
# your own addresses: never ban these
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24
bantime  = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
backend = systemd

Replace 192.168.1.0/24 with your LAN, and add the public IP you administer the server from — whitelisting with ignoreip explains the options. backend = systemd reads SSH failures from the systemd journal, which works on every current distribution, including the ones (Debian 12+, Fedora, Arch) that no longer write /var/log/auth.log or /var/log/secure by default.

Want more jails (nginx, Postfix, recidive)? The jail.local example walks through a complete file, and the jail.local generator builds one for your services.

Start and enable the service#

sudo fail2ban-client -t            # test the configuration first
sudo systemctl enable --now fail2ban
sudo systemctl restart fail2ban    # if it was already running (Debian/Ubuntu)

fail2ban-client -t parses every config file and prints OK: configuration test is successful when there are no errors. If the service fails to start, sudo journalctl -u fail2ban -n 50 shows why; the most common cause on a fresh install is no log file found for the sshd jail.

Verify fail2ban is working#

Check the server answers and the jail is loaded:

$ sudo fail2ban-client ping
Server replied: pong
$ sudo fail2ban-client status
Status
|- Number of jail:	1
`- Jail list:	sshd

Then look at the jail itself:

sudo fail2ban-client status sshd

With backend = systemd, the filter section shows a Journal matches: line (for example _SYSTEMD_UNIT=sshd.service + _COMM=sshd + _COMM=sshd-session) instead of File list:. "Currently failed" and "Total failed" climb as bots try passwords; on an internet-facing server you usually see the first ban within minutes. Every ban is logged:

sudo grep 'Ban ' /var/log/fail2ban.log

More on reading this output: fail2ban status and list banned IPs.

Install fail2ban from source (latest 1.1.1)#

Install from source when you need features your distribution's package doesn't have yet — for example sshd-session matching for OpenSSH 9.8+ or the skip_if_nologs option from 1.1.1. Remove the distro package first so you don't end up with two copies.

# Debian/Ubuntu build dependencies (python3-systemd for the journal backend)
sudo apt install git python3 python3-setuptools python3-systemd

git clone --branch 1.1.1 --depth 1 https://github.com/fail2ban/fail2ban.git
cd fail2ban
sudo python3 setup.py install

# install the systemd unit generated by setup.py
sudo cp build/fail2ban.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now fail2ban
fail2ban-client --version

The last command prints Fail2Ban v1.1.1. Upstream needs Python 3.5 or newer; on Python 3.12+ the removed asyncore/asynchat modules are bundled. Two caveats:

• The stock jail.conf includes paths-debian.conf. Distribution packages patch that line; from source on RHEL, Fedora or Arch you get Debian log paths, so set backend, logpath and banaction explicitly in jail.local.
• setup.py install doesn't update itself. Re-run it from a newer tag to upgrade.

Release tarballs are on the GitHub releases page — that is the official "fail2ban download". There is no fail2ban package on PyPI, so pip install fail2ban does not work. See versions and changelog for what changed in each release.

fail2ban on macOS#

Homebrew has a fail2ban formula (currently 1.1.1): brew install fail2ban, then sudo brew services start fail2ban. Configuration lives in $(brew --prefix)/etc/fail2ban. Upstream's paths-osx.conf uses the pf firewall action, and macOS keeps SSH failures in its unified log rather than a text file, so expect to adapt logpath yourself. It works, but fail2ban is primarily a Linux tool and most guides assume Linux.

FAQ#

How do I install fail2ban on Linux?#

Use your package manager: sudo apt install fail2ban (Debian, Ubuntu), sudo dnf install fail2ban (Fedora; Rocky/AlmaLinux/RHEL after dnf install epel-release) or sudo pacman -S fail2ban (Arch). Then enable the sshd jail in /etc/fail2ban/jail.local and run sudo systemctl enable --now fail2ban.

Where can I download fail2ban?#

From your Linux distribution's repositories, which is the recommended way. The source code and release tarballs are on GitHub at github.com/fail2ban/fail2ban/releases; the latest release is 1.1.1. fail2ban isn't published on PyPI, so pip install fail2ban fails.

Does fail2ban work out of the box?#

Partly. Debian, Ubuntu and their derivatives enable the sshd jail automatically, and on Ubuntu 24.04+ and Debian 13 it works immediately. Elsewhere every jail is disabled until you set enabled = true in jail.local. You should always add your own IPs to ignoreip and review bantime.

Can I install fail2ban on Windows or macOS?#

macOS: yes, with brew install fail2ban, using the pf firewall. Windows: no, fail2ban needs a Unix-like system and a Linux or BSD firewall. Windows servers use tools like IPBan instead — see fail2ban for Windows.