Overview

Fail2ban watches your log files and temporarily bans IP addresses that repeatedly fail to authenticate. It is a simple, effective layer of protection for SSH and other services on your Pod.

Before you begin

• Root or sudo access.
• A working firewall (for example UFW or firewalld) or iptables.
• Know that banning by IP can block legitimate users, so keep your own access safe.

Steps

1. Install the package. On Debian/Ubuntu:

bash sudo apt update sudo apt install fail2ban

On AlmaLinux/Rocky/RHEL:

bash sudo dnf install epel-release sudo dnf install fail2ban

1. Never edit jail.conf directly (updates overwrite it). Create a local override:

bash sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local sudo nano /etc/fail2ban/jail.local

1. Set sensible defaults in the [DEFAULT] section:

[DEFAULT] bantime = 1h findtime = 10m maxretry = 5

1. Ensure the SSH jail is enabled:

[sshd] enabled = true port = ssh

If you changed your SSH port, set port = 2222 (or your chosen port) accordingly.

1. Enable and start the service:

bash sudo systemctl enable --now fail2ban

1. Check status and see banned addresses:

bash sudo fail2ban-client status sudo fail2ban-client status sshd

1. To unban an address you accidentally blocked:

bash sudo fail2ban-client set sshd unbanip <ip-address>

Troubleshooting

• Problem: Fail2ban does not ban anyone. Solution: Confirm the jail uses the correct logpath for your distribution and that the service reads your log files.
• Problem: Your own IP got banned. Solution: Add it to ignoreip in [DEFAULT], then sudo systemctl restart fail2ban.

Related articles

• [Hardening SSH]
• [Security best practices for your Pod]
• [Auditing logins and access]