# Install fail2ban on Debian 12, Debian 13 and Raspberry Pi OS

> Install fail2ban on Debian 12, Debian 13 or Raspberry Pi OS: fix the missing auth.log with backend = systemd, ban with nftables, protect SSH and verify it.
>
> Source: https://fail2ban.dev/install/debian/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

To install fail2ban on Debian or Raspberry Pi OS, run `sudo apt update && sudo apt install fail2ban`. On **Debian 13 (trixie)** and Raspberry Pi OS Trixie the sshd jail is enabled and reads the systemd journal out of the box. On **Debian 12 (bookworm)** and Pi OS Bookworm there is no `/var/log/auth.log`, so fail2ban fails to start until you add `backend = systemd` to the `[sshd]` jail in `/etc/fail2ban/jail.local`.

```bash
sudo apt install fail2ban python3-systemd nftables
```

## fail2ban versions and defaults on Debian

| Debian release | Raspberry Pi OS | fail2ban | Default ban action | sshd jail out of the box |
|---|---|---|---|---|
| 13 trixie | Trixie (from October 2025) | 1.1.0 | nftables | Works: journal, `ssh.service` |
| **12 bookworm** | **Bookworm** | **1.0.2** | iptables-multiport | **Fails**: looks for `/var/log/auth.log` |
| 11 bullseye | Bullseye (legacy) | 0.11.2 | iptables-multiport | Works: `/var/log/auth.log` via rsyslog |
| testing / sid | — | 1.1.1 | nftables | Works: journal |

Check which release you have with `grep VERSION_CODENAME /etc/os-release`. The difference comes from `/etc/fail2ban/jail.d/defaults-debian.conf`, which the package installs:


#### Debian 13 trixie
```ini
[DEFAULT]
banaction = nftables
banaction_allports = nftables[type=allports]

[sshd]
backend = systemd
journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=sshd
enabled = true
```
#### Debian 12 bookworm
```ini
[sshd]
enabled = true
```

## Debian 12: fix "Have not found any log file for sshd jail"

Right after `apt install fail2ban` on Debian 12 or Pi OS Bookworm, `systemctl status fail2ban` shows the service failed, and `journalctl -u fail2ban` contains *Have not found any log file for sshd jail*. Logs go to the systemd journal only. You have two fixes; the first is the right one.

**Fix 1 — read the journal (recommended).** Create `/etc/fail2ban/jail.local`:

```ini
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24
bantime  = 1h
findtime = 10m
maxretry = 5
banaction = nftables
banaction_allports = nftables[type=allports]

[sshd]
enabled = true
backend = systemd
```

```bash
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd
```

**Fix 2 — bring back auth.log.** `sudo apt install rsyslog` recreates `/var/log/auth.log` and the stock config works. It also means every auth message is written twice (journal and file). Only do this if other tools need the text file.

More causes of this error, for other jails too, are on [no log file found for jail](/troubleshooting/no-log-file/).

## Debian 13: check and tune the defaults

Nothing is required on trixie; the service is running after install. Still create a `jail.local` so you control the policy instead of relying on the 10-minute stock ban:

```ini
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.10
bantime  = 1h
findtime = 10m
maxretry = 5
bantime.increment = true
bantime.maxtime = 1w

[sshd]
enabled = true
```

## fail2ban with nftables on Debian

With `banaction = nftables` (the default on Debian 13, set by hand on Debian 12), fail2ban creates its own table, `inet f2b-table`, with one address set per jail. It doesn't touch `/etc/nftables.conf` or your existing ruleset, and you don't need the `nftables` service enabled. Only the `nft` command must exist.

```bash
```

If you run firewalld or UFW on Debian instead, use `banaction = firewallcmd-rich-rules` or `banaction = ufw` (see [fail2ban with UFW](/guides/ufw/) and [choosing a ban action](/config/banaction/)).

## Raspberry Pi OS

Raspberry Pi OS is Debian with Raspberry Pi additions, so fail2ban comes from the Debian repositories and everything above applies: Bookworm behaves like Debian 12, Trixie like Debian 13. The Debian 12 `jail.local` works on both. Running Ubuntu on the Pi instead? Follow the [Ubuntu page](/install/ubuntu/).

On a Pi, a few settings matter more than on a server:

- **`ignoreip`** — set it to your home network's range (check with `ip -4 addr`). Otherwise a mistyped password from your laptop can lock you out of a headless Pi. More options in [whitelist IPs with ignoreip](/config/whitelist/).
- **`backend = systemd`** — required on Bookworm, harmless on Trixie.
- **`banaction = nftables`** — Bookworm's fail2ban defaults to iptables, which may not be installed. Trixie already uses nftables.

### Lighter on SD cards and low-memory Pis

fail2ban is a Python daemon. It runs comfortably on a Pi Zero 2 W and is barely noticeable on a Pi 4 or Pi 5. A few settings keep it lean:

- **Use the journal backend.** `backend = systemd` waits for new journal entries; there's no polling loop and no duplicate text log written by rsyslog. Installing rsyslog just to get `auth.log` doubles the writes to your SD card.
- **Enable only the jails you need.** Each jail is a separate thread reading its own log source. SSH plus one or two exposed services is typical.
- **Keep `maxretry` and `findtime` modest.** fail2ban keeps recent failures in memory for `findtime`, so very long windows on a busy jail cost memory.
- **Optionally log to the journal instead of a file.** In `/etc/fail2ban/fail2ban.local`, set `logtarget = SYSTEMD-JOURNAL` under `[DEFAULT]`, then read fail2ban's messages with `journalctl -u fail2ban`. If you use the [recidive jail](/config/recidive/), give it `backend = systemd` too, because its default `logpath` is `/var/log/fail2ban.log`.

The ban database at `/var/lib/fail2ban/fail2ban.sqlite3` is small and written only when bans change.

### Raspberry Pi SSH security beyond fail2ban

fail2ban slows down password guessing; it doesn't make a weak password safe. On a Pi reachable from the internet:

1. Use SSH keys: `ssh-copy-id user@pi`, then set `PasswordAuthentication no` in `/etc/ssh/sshd_config` and `sudo systemctl restart ssh`.
2. Don't use a default or reused username and password. Current Raspberry Pi Imager makes you create your own user.
3. Forward SSH from your router only if you need it. A VPN such as [WireGuard](/guides/wireguard/) on the Pi exposes one UDP port instead of a login prompt.
4. If you access the Pi through a tunnel (Cloudflare Tunnel, Tailscale Funnel, a reverse proxy), the logs may show `127.0.0.1` instead of the attacker's address. fail2ban can only ban addresses it sees — read [bans the proxy IP](/troubleshooting/reverse-proxy-ip/).

The [SSH guide](/guides/ssh/) covers aggressive filter modes, custom ports and long bans for repeat offenders.

## Verify fail2ban is protecting SSH

```text
$ sudo fail2ban-client ping
Server replied: pong
```
sudo fail2ban-client status sshd
```

```bash
sudo nft list table inet f2b-table | grep 192.0.2.15
sudo fail2ban-client set sshd unbanip 192.0.2.15
```

```bash
```

```log
```

During the upgrade, apt may ask whether to keep your version of `jail.conf` or `defaults-debian.conf` if you edited them. Take the maintainer's version; your settings belong in `jail.local`. After the upgrade, remove any `banaction` and sshd `backend` lines you added for bookworm only if you want trixie's defaults — keeping them is harmless.

## FAQ

### How do I install fail2ban on Debian 12?

Run `sudo apt install fail2ban python3-systemd nftables`, then create `/etc/fail2ban/jail.local` with `[sshd]`, `enabled = true` and `backend = systemd`, and set `banaction = nftables` under `[DEFAULT]`. Restart with `sudo systemctl restart fail2ban`. Without the backend line the service fails, because Debian 12 has no `/var/log/auth.log`.

### Why does fail2ban fail to start on Debian 12 or Raspberry Pi OS Bookworm?

The sshd jail looks for `/var/log/auth.log`, which Debian 12 and Pi OS Bookworm don't create because rsyslog isn't installed anymore. fail2ban stops with "Have not found any log file for sshd jail". Set `backend = systemd` for the sshd jail in jail.local, or install rsyslog.

### Does fail2ban work on Debian 13 out of the box?

Yes. Debian 13 ships fail2ban 1.1.0 with the sshd jail enabled, reading the systemd journal for `ssh.service` and banning with nftables. The same applies to Raspberry Pi OS Trixie. Add a jail.local only to set `ignoreip`, `bantime` and any extra jails.

### Does fail2ban use nftables on Debian?

On Debian 13, yes, by default. On Debian 12 the package still defaults to `iptables-multiport`; set `banaction = nftables` and `banaction_allports = nftables[type=allports]` in jail.local. fail2ban keeps its bans in its own `inet f2b-table` table, separate from your ruleset.

### How do I install fail2ban on a Raspberry Pi?

Run `sudo apt install fail2ban python3-systemd nftables`. Then create `/etc/fail2ban/jail.local` with your LAN in `ignoreip`, `banaction = nftables`, and an `[sshd]` section with `enabled = true` and `backend = systemd`. Restart with `sudo systemctl restart fail2ban` and check `sudo fail2ban-client status sshd`.

### Does fail2ban slow down a Raspberry Pi?

Not noticeably. fail2ban is a small Python daemon that sleeps until new log entries arrive. Using the systemd backend avoids polling and extra SD card writes. Enabling only the jails you need keeps memory use low, even on a Pi Zero 2 W.

### Is fail2ban needed on a Raspberry Pi?

If SSH or another login is reachable from the internet, it's a useful layer: it stops repeated guessing and keeps logs readable. On a Pi that is only reachable from your home network, SSH keys and a firewall matter more, and fail2ban is optional.