← Directory

fail2ban

Fail2ban(http://www.fail2ban.org/) is a daemon to ban hosts that cause multiple authentication errors.

  • Home Automation
  • Network Services
  • Security
  • Tools & Utilities
Fail2ban(http://www.fail2ban.org/) is a daemon to ban hosts that cause multiple authentication errors.

Platform availability

Available on 3 of 6 install platforms

Also on Docker Hub and GitHub

Health score

73/100 Good

Maintained
100last commit 10 days ago
Popular
4098 GitHub stars
Easy to install
452 install platforms, install notes, Docker image
Light to run
95500 MB minimum RAM, runs on ARM
How is this calculated?

A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). Factors without data are left out and the rest are rescaled.

Availability: platform listings confirmed today, links checked today

GitHub stars
98
Open issues
0
Last commit
2026-09-25
Latest release
1.1.0-r2-ls44
License
GPL-3.0
Activity
rising

Checked 7 days ago - source: GitHub (linuxserver/docker-fail2ban)

Resources & Compatibility

Minimum requirements: 500 MB RAM, 1 CPU core(s). ARM (e.g. Raspberry Pi) is supported.

Checked 7 days ago - source: Docker Hub image tags and published docs

First-install notes

  • Install fail2ban with apt on Ubuntu/Debian Run `apt install fail2ban` so the package installs and its service starts automatically. If the service is not running, fail2ban cannot watch logs or block repeated bad login attempts. source
  • Enable the fail2ban service on CentOS/RHEL Use `systemctl start fail2ban` and `systemctl enable fail2ban` so it is running now and starts after a reboot. Without enabling it, your system can lose protection after a restart. source
  • Turn on the jails you need in jail.local Create or edit jail.local, set enabled=true for things like sshd or nginx, and point logpath to the exact log file fail2ban should watch. If the jail is disabled or watches the wrong log, fail2ban never sees the attempts and won't ban them. source

Fetched 7 days ago - each note links to its source

Alternatives (7)

  • CrowdSec - CrowdSec is a free, open-source and collaborative IPS.
  • IPBanPro - IPBan is a FREE and open source application that allows auto banning ip addresses from failed login attempts.
  • crowdsec-dashboard - Metabase dashboard template for displaying Crowdsec statistics.
  • crowdsec-threat-map
  • qbit guard - A zero-dependency Python guard for qBittorrent that blocks pre-air TV episodes (Sonarr), deletes ISO/BDMV-only torrents, and auto-blocklist…
  • reactionlight - Reaction Light is an easy-to-use, self-hosted reaction role bot for Discord, written in Python.
  • zoraxy-crowdsec-bouncer - Zoraxy-CrowdSec-Bouncer is a Docker image that bundles the Zoraxy reverse proxy with the CrowdSec bouncer plugin pre-installed, ready to ru…

Checked 4 days ago - source: AlternativeTo

Common questions

Why can Fail2Ban ban an IP but the original IP still connect when using Cloudflare?

If the server is behind Cloudflare, the server sees Cloudflare addresses instead of the client's original address. Fail2ban may ban the Cloudflare address, while the original IP can still connect through the proxy.

Why does Fail2Ban stop protecting the system after a reboot?

The fail2ban service must be enabled so it starts after a reboot. On CentOS/RHEL, use systemctl start fail2ban and systemctl enable fail2ban; otherwise protection can be lost after a restart.

Can Fail2Ban reduce resource usage from repeated failed login attempts?

Yes, dropping all requests from an IP after N failed login attempts uses fewer resources than processing those attempts indefinitely. At scale, this can make a difference against DDoS-like repeated request pressure.

Answers sourced from github.com, www.reddit.com, www.reddit.com

Community

Collected 6 days ago - public community threads