# Install fail2ban on Rocky Linux, AlmaLinux, RHEL, CentOS Stream and Fedora

> Install fail2ban on Rocky Linux, AlmaLinux, RHEL 9/10, CentOS Stream and Fedora with dnf: EPEL, the firewalld ban action, systemd journal and SELinux.
>
> Source: https://fail2ban.dev/install/rhel/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

To install fail2ban on Rocky Linux or AlmaLinux 9 or 10, enable EPEL and install the packages: `sudo dnf install epel-release`, then `sudo dnf install fail2ban fail2ban-firewalld fail2ban-systemd`. On Fedora, fail2ban is in the main repositories: `sudo dnf install fail2ban fail2ban-systemd`. Enable the `[sshd]` jail in `/etc/fail2ban/jail.local`, start it with `sudo systemctl enable --now fail2ban`, and check `sudo fail2ban-client status sshd`.


#### Rocky / AlmaLinux
```bash
sudo dnf install epel-release
sudo dnf install fail2ban fail2ban-firewalld fail2ban-systemd
sudo systemctl enable --now fail2ban
```
```bash
sudo subscription-manager repos --enable codeready-builder-for-rhel-10-$(arch)-rpms
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm
sudo dnf install fail2ban fail2ban-firewalld fail2ban-systemd
sudo systemctl enable --now fail2ban
```
```bash
sudo systemctl enable --now fail2ban
```

## Repositories and versions by release

| Distribution | How to get fail2ban | fail2ban version |
|---|---|---|
| Fedora | Main repositories, no extra repo | 1.1.0 |
| Rocky Linux / AlmaLinux 10 | `sudo dnf install epel-release` | 1.1.0 |
| Rocky Linux / AlmaLinux 9 | `sudo dnf config-manager --set-enabled crb` then `sudo dnf install epel-release` | 1.1.0 |
| Rocky Linux / AlmaLinux 8 | `sudo dnf config-manager --set-enabled powertools` then `sudo dnf install epel-release` | 1.0.2 |
| CentOS Stream 9 / 10 | `sudo dnf install epel-release` | 1.1.0 |
| RHEL 9 / 10 | EPEL from the Fedora URL (see below) | 1.1.0 |
| Oracle Linux 8 / 9 | `sudo dnf install oracle-epel-release-el8` / `-el9` | EPEL build |
| CentOS 7 | End of life | Archived only |

fail2ban itself doesn't need CRB/PowerTools, but the EPEL project recommends enabling it because other EPEL packages do.

### RHEL 9 and RHEL 10: EPEL from the Fedora URL

On Red Hat Enterprise Linux, `epel-release` isn't in Red Hat's repositories. Enable CodeReady Builder through subscription-manager, then install the release RPM directly from dl.fedoraproject.org, as in the RHEL tab above.

> **RHEL 10 / EPEL 10 caveat**
EPEL 10 is built per RHEL minor release (10.0, 10.1, …) instead of one branch for the whole major version. Keep the OS itself updated: a system pinned to an older minor release can lag behind on EPEL updates, including fail2ban security fixes. Check what you have with `rpm -q fail2ban` and `dnf info fail2ban`.

### CentOS 7

CentOS 7 reached end of life on 30 June 2024 and EPEL 7 has been archived, so `yum install epel-release fail2ban` no longer works against the normal mirrors. The last EPEL 7 build is an old 0.11-series release. Migrate to Rocky/AlmaLinux 9 or 10 rather than installing fail2ban on an unsupported OS.

### Fedora Atomic desktops and CoreOS

On image-based variants (Silverblue, Kinoite, CoreOS), layer the packages with `sudo rpm-ostree install fail2ban fail2ban-systemd` and reboot. Configuration in `/etc/fail2ban` is preserved across updates as usual.

## What the packages contain

Fedora and EPEL build fail2ban from the same spec, split into subpackages so you only install the integrations you use:

| Package | Installs |
|---|---|
| `fail2ban` | Meta-package: the server plus the usual extras (firewalld, sendmail) |
| `fail2ban-server` | `fail2ban-server`, `fail2ban-client`, `fail2ban-regex`, filters and actions |
| `fail2ban-firewalld` | `/etc/fail2ban/jail.d/00-firewalld.conf`: firewalld rich rules as the default ban action |
| `fail2ban-systemd` | `/etc/fail2ban/jail.d/00-systemd.conf`: `backend = systemd` |
| `fail2ban-selinux` | SELinux policy module for fail2ban |
| `fail2ban-sendmail`, `fail2ban-mail` | Mail notification actions |
| `fail2ban-hostsdeny`, `fail2ban-shorewall` | Alternative ban actions |
| `fail2ban-all` | Everything above |

`dnf repoquery --requires fail2ban` shows what the meta-package pulls in on your release, and `cat /etc/fail2ban/jail.d/00-firewalld.conf` shows the firewalld default. Minimal setups can install `fail2ban-server fail2ban-firewalld fail2ban-systemd` and skip the mail actions.

## Configure the sshd jail

```ini
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.10
bantime  = 1h
findtime = 10m
maxretry = 5
bantime.increment = true
bantime.maxtime = 1w

[sshd]
enabled = true
backend = systemd
```

**Why the journal.** Fedora doesn't install rsyslog, and minimal and cloud images of Rocky, AlmaLinux and RHEL often don't run it either, so `/var/log/secure` may not exist and SSH failures are only in the journal. The packaged `paths-fedora.conf` already points the sshd jail at the journal; `backend = systemd` in `[sshd]` makes that explicit, so the jail never falls back to a missing file and fails with [no log file found](/troubleshooting/no-log-file/). The sshd filter brings its own `journalmatch`, so the jail reads only sshd's entries.

```bash
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd
```
`00-systemd.conf` puts `backend = systemd` in `[DEFAULT]`, so **every** jail reads the journal. If you add a jail for an application that writes its own log file (nginx, Apache, a web app), give that jail `backend = auto`, or it ignores `logpath` and never matches anything. [Backends and the systemd journal](/config/backend/) explains the rules.

The [jail.local example](/config/jail-local/) shows a fuller file with web and mail jails, and the [SSH guide](/guides/ssh/) covers aggressive filter modes and long bans for repeat offenders.

## fail2ban with firewalld

Fedora Server and Workstation and RHEL-family servers run firewalld, and `00-firewalld.conf` points `banaction` at the `firewallcmd-rich-rules` action. Each ban becomes a runtime rich rule in the default zone that rejects the IP on the jail's ports. firewalld must be running (`sudo systemctl enable --now firewalld`), and the SSH service must be allowed in your zone.

```bash
```

- fail2ban adds runtime rules only. `firewall-cmd --reload` drops them, including fail2ban's bans; restart fail2ban afterwards. A full `systemctl restart firewalld` restarts fail2ban automatically, because the unit is `PartOf=firewalld.service`.
- Rich rules are one rule per IP. With thousands of bans, consider the ipset-based action, which keeps all addresses in one set. It relies on firewalld's direct interface, which newer firewalld versions mark as deprecated, so test it on your release first:

```ini
[DEFAULT]
banaction = firewallcmd-ipset
banaction_allports = firewallcmd-ipset[actiontype=<allports>]
```

## SELinux notes

Keep SELinux enforcing; fail2ban works with it:

- `fail2ban-selinux` ships the policy that lets the fail2ban domain read logs and call firewall tools. Install it if your system didn't pull it in.
- Custom log locations need a log label. If a jail can't read `/srv/app/logs/auth.log`, check for denials with `sudo ausearch -m avc -ts recent`, then label the directory (for example `sudo semanage fcontext -a -t var_log_t "/srv/app/logs(/.*)?"` and `sudo restorecon -Rv /srv/app/logs`) instead of switching SELinux to permissive.
- fail2ban 1.1.1 fixed the nftables action for SELinux systems without `execmem` (its `grep -P` call caused denials). The 1.1.0 package in EPEL and Fedora predates that fix, which is one more reason to stay with the firewalld action.
- The `selinux-ssh` jail reads `/var/log/audit/audit.log` to catch SSH logins rejected by SELinux. It's separate from `sshd` and off by default.

## Verify

```text
$ sudo fail2ban-client ping
Server replied: pong
```

```bash
sudo fail2ban-client set sshd banip 192.0.2.15
sudo firewall-cmd --list-rich-rules | grep 192.0.2.15
sudo fail2ban-client set sshd unbanip 192.0.2.15
```

## FAQ

### How do I install fail2ban on Rocky Linux 9?

Run `sudo dnf config-manager --set-enabled crb`, `sudo dnf install epel-release`, then `sudo dnf install fail2ban fail2ban-firewalld fail2ban-systemd`. Create `/etc/fail2ban/jail.local` with an enabled `[sshd]` jail and start it with `sudo systemctl enable --now fail2ban`. EPEL provides fail2ban 1.1.0.

### Is fail2ban available for RHEL 10 and Rocky Linux 10?

Yes, from EPEL 10, which ships fail2ban 1.1.0. On Rocky and AlmaLinux 10, `dnf install epel-release` enables it. On RHEL 10, enable CodeReady Builder and install `epel-release-latest-10.noarch.rpm` from dl.fedoraproject.org, because epel-release isn't in Red Hat's repositories.

### How do I install fail2ban on Fedora?

Run `sudo dnf install fail2ban fail2ban-systemd` — no extra repository is needed. Create `/etc/fail2ban/jail.local` with `[sshd]` and `enabled = true`, then `sudo systemctl enable --now fail2ban`. The packages configure firewalld rich rules as the ban action and the systemd journal as the log source. Current Fedora releases ship 1.1.0.

### Why does the fail2ban sshd jail fail on Fedora or Rocky Linux?

Usually because the jail is looking for `/var/log/secure`, which doesn't exist without rsyslog — the default on Fedora and on many minimal Rocky and AlmaLinux images. Install `fail2ban-systemd` or set `backend = systemd` in the `[sshd]` jail so fail2ban reads SSH failures from the systemd journal.

### How do I install fail2ban on CentOS 7?

CentOS 7 has been end of life since June 2024 and EPEL 7 is archived, so the usual `yum install epel-release fail2ban` no longer works from the standard mirrors. The supported route is migrating to Rocky Linux or AlmaLinux 9 or 10 and installing fail2ban from EPEL there.

### Do I need to disable SELinux for fail2ban?

No. The `fail2ban-selinux` package provides the policy fail2ban needs. If a jail can't read a log in a non-standard location, find the denial with `ausearch -m avc -ts recent` and label the files with `semanage fcontext` and `restorecon` instead of disabling SELinux.