# How to install fail2ban

> How to install fail2ban on Ubuntu, Debian, Rocky, Fedora, Arch, Docker and from source (1.1.1), then enable the sshd jail, start the service and verify it.
>
> Source: https://fail2ban.dev/install/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

To install fail2ban, use your distribution's package manager: `sudo apt install fail2ban` on Ubuntu and Debian, `sudo dnf install fail2ban` on Fedora (and on Rocky, AlmaLinux and RHEL after enabling EPEL), `sudo pacman -S fail2ban` on Arch. Then create `/etc/fail2ban/jail.local` that enables the `sshd` jail, run `sudo systemctl enable --now fail2ban`, and confirm with `sudo fail2ban-client status sshd`.

```bash
sudo apt update && sudo apt install fail2ban

# Fedora
sudo dnf install fail2ban

# Rocky Linux / AlmaLinux / CentOS Stream (EPEL first)
sudo dnf install epel-release && sudo dnf install fail2ban

# Arch Linux / Manjaro
sudo pacman -S fail2ban
```

## fail2ban install command per distribution

| Distribution | Install command | Packaged version | Guide |
|---|---|---|---|
| Ubuntu 26.04 LTS | `sudo apt install fail2ban` | 1.1.0 | [Ubuntu](/install/ubuntu/) |
| Ubuntu 24.04 LTS | `sudo apt install fail2ban` | 1.0.2 | [Ubuntu](/install/ubuntu/) |
| Ubuntu 22.04 LTS | `sudo apt install fail2ban` | 0.11.2 | [Ubuntu](/install/ubuntu/) |
| Debian 13 trixie | `sudo apt install fail2ban` | 1.1.0 | [Debian](/install/debian/) |
| Debian 12 bookworm | `sudo apt install fail2ban` | 1.0.2 | [Debian](/install/debian/) |
| Rocky / AlmaLinux / RHEL 9 and 10 | `sudo dnf install fail2ban` (EPEL) | 1.1.0 | [RHEL family](/install/rhel/) |
| Rocky / AlmaLinux / RHEL 8 | `sudo dnf install fail2ban` (EPEL) | 1.0.2 | [RHEL family](/install/rhel/) |
| Fedora | `sudo dnf install fail2ban` | 1.1.0 | [Fedora](/install/rhel/) |
| Arch Linux | `sudo pacman -S fail2ban` | 1.1.1 | [Arch](/install/arch/) |
| Raspberry Pi OS | `sudo apt install fail2ban` | 1.0.2 (Bookworm), 1.1.0 (Trixie) | [Raspberry Pi](/install/debian/) |
| Proxmox VE 8 / 9 | `apt install fail2ban` | 1.0.2 / 1.1.0 | [Proxmox](/guides/proxmox/) |
| openSUSE | `sudo zypper install fail2ban` | varies | — |
| macOS (Homebrew) | `brew install fail2ban` | 1.1.1 | see below |
| OpenWrt | `opkg install fail2ban` | 1.1.0 | [OpenWrt](/guides/openwrt/) |
| Docker | `crazymax/fail2ban` or `lscr.io/linuxserver/fail2ban` | image tag | [Docker](/guides/docker/) |
| Windows | not supported natively | — | [Windows](/alternatives/windows/) |

Versions are the ones in each release's main or EPEL repository at the time of writing. Check yours with `fail2ban-client --version`.

## What the package installs

Every package lays out fail2ban the same way, because the paths come from upstream's `setup.py`:

| Path | What it is |
|---|---|
| `/usr/bin/fail2ban-server` | The daemon that reads logs and runs ban actions (runs as root) |
| `/usr/bin/fail2ban-client` | The command-line tool that talks to the server |
| `/usr/bin/fail2ban-regex` | Tests filters against log files ([fail2ban-regex](/fail2ban-regex/)) |
| `/etc/fail2ban/jail.conf` | Stock jail definitions — **don't edit** |
| `/etc/fail2ban/jail.d/` | Drop-in jail files (distros put their defaults here) |
| `/etc/fail2ban/filter.d/` | 96 filters — regexes that find failures in logs |
| `/etc/fail2ban/action.d/` | 66 actions — firewall and notification commands |
| `/etc/fail2ban/paths-*.conf` | Per-distro log paths and default backends |
| `/etc/fail2ban/fail2ban.conf` | Server settings: log target, socket, database |
| `/var/lib/fail2ban/fail2ban.sqlite3` | Ban database, so bans survive restarts |
| `/var/log/fail2ban.log` | fail2ban's own log |
| `/var/run/fail2ban/fail2ban.sock` | Socket between client and server |

On Debian-based systems the package also enables and starts the `fail2ban` systemd service. On Fedora, RHEL and Arch it's installed but not started.

If you want the full picture of how these parts fit together, read [how fail2ban works](/how-it-works/).

## First configuration: jail.local with the sshd jail

Never edit `jail.conf` — package upgrades overwrite it. Put your settings in `/etc/fail2ban/jail.local`, which is read after `jail.conf` and everything in `jail.d/*.conf`, so it wins. A minimal, safe starting point:

```ini
[DEFAULT]
# your own addresses: never ban these
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24
bantime  = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
backend = systemd
```

> **Lock-out insurance**
Before you enable any jail, keep a second SSH session open and make sure you can reach the server another way (provider console, VNC, IPMI). If fail2ban bans you, [unbanning takes one command](/unban-ip/) — but only if you can still run it.

Want more jails (nginx, Postfix, recidive)? The [jail.local example](/config/jail-local/) walks through a complete file, and the [jail.local generator](/tools/jail-generator/) builds one for your services.

## Start and enable the service

```bash
sudo systemctl enable --now fail2ban
sudo systemctl restart fail2ban    # if it was already running (Debian/Ubuntu)
```

## Verify fail2ban is working

Check the server answers and the jail is loaded:

```text
$ sudo fail2ban-client ping
Server replied: pong
$ sudo fail2ban-client status
Status
|- Number of jail:	1
`- Jail list:	sshd
```

```bash
```

```bash
```

## Install fail2ban from source (latest 1.1.1)

Install from source when you need features your distribution's package doesn't have yet — for example `sshd-session` matching for OpenSSH 9.8+ or the `skip_if_nologs` option from 1.1.1. Remove the distro package first so you don't end up with two copies.

```bash
sudo apt install git python3 python3-setuptools python3-systemd

git clone --branch 1.1.1 --depth 1 https://github.com/fail2ban/fail2ban.git
cd fail2ban
sudo python3 setup.py install

# install the systemd unit generated by setup.py
sudo cp build/fail2ban.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now fail2ban
fail2ban-client --version
```

- The stock `jail.conf` includes `paths-debian.conf`. Distribution packages patch that line; from source on RHEL, Fedora or Arch you get Debian log paths, so set `backend`, `logpath` and `banaction` explicitly in `jail.local`.
- `setup.py install` doesn't update itself. Re-run it from a newer tag to upgrade.

Release tarballs are on the [GitHub releases page](https://github.com/fail2ban/fail2ban/releases) — that is the official "fail2ban download". There is no `fail2ban` package on PyPI, so `pip install fail2ban` does not work. See [versions and changelog](/versions/) for what changed in each release.

## fail2ban on macOS

Homebrew has a `fail2ban` formula (currently 1.1.1): `brew install fail2ban`, then `sudo brew services start fail2ban`. Configuration lives in `$(brew --prefix)/etc/fail2ban`. Upstream's `paths-osx.conf` uses the `pf` firewall action, and macOS keeps SSH failures in its unified log rather than a text file, so expect to adapt `logpath` yourself. It works, but fail2ban is primarily a Linux tool and most guides assume Linux.

## FAQ

### How do I install fail2ban on Linux?

Use your package manager: `sudo apt install fail2ban` (Debian, Ubuntu), `sudo dnf install fail2ban` (Fedora; Rocky/AlmaLinux/RHEL after `dnf install epel-release`) or `sudo pacman -S fail2ban` (Arch). Then enable the sshd jail in `/etc/fail2ban/jail.local` and run `sudo systemctl enable --now fail2ban`.

### Where can I download fail2ban?

From your Linux distribution's repositories, which is the recommended way. The source code and release tarballs are on GitHub at github.com/fail2ban/fail2ban/releases; the latest release is 1.1.1. fail2ban isn't published on PyPI, so `pip install fail2ban` fails.

### Does fail2ban work out of the box?

Partly. Debian, Ubuntu and their derivatives enable the sshd jail automatically, and on Ubuntu 24.04+ and Debian 13 it works immediately. Elsewhere every jail is disabled until you set `enabled = true` in `jail.local`. You should always add your own IPs to `ignoreip` and review `bantime`.

### Can I install fail2ban on Windows or macOS?

macOS: yes, with `brew install fail2ban`, using the pf firewall. Windows: no, fail2ban needs a Unix-like system and a Linux or BSD firewall. Windows servers use tools like IPBan instead — see [fail2ban for Windows](/alternatives/windows/).