Install fail2ban on Rocky Linux, AlmaLinux, RHEL, CentOS Stream and Fedora

To install fail2ban on Rocky Linux or AlmaLinux 9 or 10, enable EPEL and install the packages: sudo dnf install epel-release, then sudo dnf install fail2ban fail2ban-firewalld fail2ban-systemd. On Fedora, fail2ban is in the main repositories: sudo dnf install fail2ban fail2ban-systemd. Enable the [sshd] jail in /etc/fail2ban/jail.local, start it with sudo systemctl enable --now fail2ban, and check sudo fail2ban-client status sshd.

sudo dnf config-manager --set-enabled crb   # 9 and 10; on 8 the repo is powertools
sudo dnf install epel-release
sudo dnf install fail2ban fail2ban-firewalld fail2ban-systemd
sudo systemctl enable --now fail2ban

# RHEL 10 (use 9 in both places for RHEL 9)
sudo subscription-manager repos --enable codeready-builder-for-rhel-10-$(arch)-rpms
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm
sudo dnf install fail2ban fail2ban-firewalld fail2ban-systemd
sudo systemctl enable --now fail2ban

sudo dnf install fail2ban fail2ban-systemd
sudo systemctl enable --now fail2ban

The service is not started on install, and every jail is disabled until you enable it — unlike on Debian and Ubuntu. EPEL 9/10 and current Fedora releases ship fail2ban 1.1.0; the latest upstream release is 1.1.1.

Repositories and versions by release#

fail2ban itself doesn't need CRB/PowerTools, but the EPEL project recommends enabling it because other EPEL packages do.

RHEL 9 and RHEL 10: EPEL from the Fedora URL#

On Red Hat Enterprise Linux, epel-release isn't in Red Hat's repositories. Enable CodeReady Builder through subscription-manager, then install the release RPM directly from dl.fedoraproject.org, as in the RHEL tab above.

CentOS 7#

CentOS 7 reached end of life on 30 June 2024 and EPEL 7 has been archived, so yum install epel-release fail2ban no longer works against the normal mirrors. The last EPEL 7 build is an old 0.11-series release. Migrate to Rocky/AlmaLinux 9 or 10 rather than installing fail2ban on an unsupported OS.

Fedora Atomic desktops and CoreOS#

On image-based variants (Silverblue, Kinoite, CoreOS), layer the packages with sudo rpm-ostree install fail2ban fail2ban-systemd and reboot. Configuration in /etc/fail2ban is preserved across updates as usual.

What the packages contain#

Fedora and EPEL build fail2ban from the same spec, split into subpackages so you only install the integrations you use:

dnf repoquery --requires fail2ban shows what the meta-package pulls in on your release, and cat /etc/fail2ban/jail.d/00-firewalld.conf shows the firewalld default. Minimal setups can install fail2ban-server fail2ban-firewalld fail2ban-systemd and skip the mail actions.

Configure the sshd jail#

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.10
bantime  = 1h
findtime = 10m
maxretry = 5
bantime.increment = true
bantime.maxtime = 1w

[sshd]
enabled = true
backend = systemd

Leave banaction out of jail.local unless you want to replace firewalld: jail.local is read after jail.d/00-firewalld.conf and would override it. If sshd listens on a custom port, add port = 2222 to [sshd], and tell SELinux about that port too (sudo semanage port -a -t ssh_port_t -p tcp 2222).

Why the journal. Fedora doesn't install rsyslog, and minimal and cloud images of Rocky, AlmaLinux and RHEL often don't run it either, so /var/log/secure may not exist and SSH failures are only in the journal. The packaged paths-fedora.conf already points the sshd jail at the journal; backend = systemd in [sshd] makes that explicit, so the jail never falls back to a missing file and fails with no log file found. The sshd filter brings its own journalmatch, so the jail reads only sshd's entries.

sudo fail2ban-client -t
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

The jail.local example shows a fuller file with web and mail jails, and the SSH guide covers aggressive filter modes and long bans for repeat offenders.

fail2ban with firewalld#

Fedora Server and Workstation and RHEL-family servers run firewalld, and 00-firewalld.conf points banaction at the firewallcmd-rich-rules action. Each ban becomes a runtime rich rule in the default zone that rejects the IP on the jail's ports. firewalld must be running (sudo systemctl enable --now firewalld), and the SSH service must be allowed in your zone.

sudo firewall-cmd --list-rich-rules

Banned addresses show up as rule family="ipv4" source address="…" entries. Things to know:

• fail2ban adds runtime rules only. firewall-cmd --reload drops them, including fail2ban's bans; restart fail2ban afterwards. A full systemctl restart firewalld restarts fail2ban automatically, because the unit is PartOf=firewalld.service.
• Rich rules are one rule per IP. With thousands of bans, consider the ipset-based action, which keeps all addresses in one set. It relies on firewalld's direct interface, which newer firewalld versions mark as deprecated, so test it on your release first:

[DEFAULT]
banaction = firewallcmd-ipset
banaction_allports = firewallcmd-ipset[actiontype=<allports>]

Not using firewalld? Remove fail2ban-firewalld and set banaction = nftables and banaction_allports = nftables[type=allports] in jail.local (RHEL 9 and 10 and Fedora use nftables underneath). Bans then live in fail2ban's own inet f2b-table table. The firewalld guide compares the actions, zones and ipset options in detail; parameters for each are in the action reference.

SELinux notes#

Keep SELinux enforcing; fail2ban works with it:

• fail2ban-selinux ships the policy that lets the fail2ban domain read logs and call firewall tools. Install it if your system didn't pull it in.
• Custom log locations need a log label. If a jail can't read /srv/app/logs/auth.log, check for denials with sudo ausearch -m avc -ts recent, then label the directory (for example sudo semanage fcontext -a -t var_log_t "/srv/app/logs(/.*)?" and sudo restorecon -Rv /srv/app/logs) instead of switching SELinux to permissive.
• fail2ban 1.1.1 fixed the nftables action for SELinux systems without execmem (its grep -P call caused denials). The 1.1.0 package in EPEL and Fedora predates that fix, which is one more reason to stay with the firewalld action.
• The selinux-ssh jail reads /var/log/audit/audit.log to catch SSH logins rejected by SELinux. It's separate from sshd and off by default.

Verify#

$ sudo fail2ban-client ping
Server replied: pong

Then check the jail and do a harmless test ban with a documentation address:

sudo fail2ban-client status sshd
sudo fail2ban-client set sshd banip 192.0.2.15
sudo firewall-cmd --list-rich-rules | grep 192.0.2.15
sudo fail2ban-client set sshd unbanip 192.0.2.15

The status should show Journal matches: rather than File list: in the filter section. Real bans are written to /var/log/fail2ban.log as NOTICE [sshd] Ban <IP>; follow them with sudo tail -f /var/log/fail2ban.log. If bans appear in fail2ban but traffic still gets through, check that firewalld is running and that the rich rule is in the zone your interface uses — the firewalld guide covers zones.

FAQ#

How do I install fail2ban on Rocky Linux 9?#

Run sudo dnf config-manager --set-enabled crb, sudo dnf install epel-release, then sudo dnf install fail2ban fail2ban-firewalld fail2ban-systemd. Create /etc/fail2ban/jail.local with an enabled [sshd] jail and start it with sudo systemctl enable --now fail2ban. EPEL provides fail2ban 1.1.0.

Is fail2ban available for RHEL 10 and Rocky Linux 10?#

Yes, from EPEL 10, which ships fail2ban 1.1.0. On Rocky and AlmaLinux 10, dnf install epel-release enables it. On RHEL 10, enable CodeReady Builder and install epel-release-latest-10.noarch.rpm from dl.fedoraproject.org, because epel-release isn't in Red Hat's repositories.

How do I install fail2ban on Fedora?#

Run sudo dnf install fail2ban fail2ban-systemd — no extra repository is needed. Create /etc/fail2ban/jail.local with [sshd] and enabled = true, then sudo systemctl enable --now fail2ban. The packages configure firewalld rich rules as the ban action and the systemd journal as the log source. Current Fedora releases ship 1.1.0.

Why does the fail2ban sshd jail fail on Fedora or Rocky Linux?#

Usually because the jail is looking for /var/log/secure, which doesn't exist without rsyslog — the default on Fedora and on many minimal Rocky and AlmaLinux images. Install fail2ban-systemd or set backend = systemd in the [sshd] jail so fail2ban reads SSH failures from the systemd journal.

How do I install fail2ban on CentOS 7?#

CentOS 7 has been end of life since June 2024 and EPEL 7 is archived, so the usual yum install epel-release fail2ban no longer works from the standard mirrors. The supported route is migrating to Rocky Linux or AlmaLinux 9 or 10 and installing fail2ban from EPEL there.

Do I need to disable SELinux for fail2ban?#

No. The fail2ban-selinux package provides the policy fail2ban needs. If a jail can't read a log in a non-standard location, find the denial with ausearch -m avc -ts recent and label the files with semanage fcontext and restorecon instead of disabling SELinux.