{"id":47274,"date":"2026-06-27T22:45:45","date_gmt":"2026-06-27T13:45:45","guid":{"rendered":"https:\/\/raybeam.jp\/docs\/initial-server-setup\/how-to-install-and-configure-fail2ban-to-secure-access-to-your-vps\/"},"modified":"2026-06-27T22:46:11","modified_gmt":"2026-06-27T13:46:11","slug":"how-to-install-and-configure-fail2ban-to-secure-access-to-your-vps","status":"publish","type":"docs","link":"https:\/\/raybeam.jp\/ja\/docs\/initial-server-setup\/how-to-install-and-configure-fail2ban-to-secure-access-to-your-vps\/","title":{"rendered":"VPS\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u4fdd\u8b77\u3059\u308b\u305f\u3081\u306eFail2Ban\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3068\u8a2d\u5b9a\u65b9\u6cd5"},"content":{"rendered":"\n<h2 id=\"motivation\" class=\"wp-block-heading\">Motivation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We primarily utilize Fail2Ban to safeguard access to our server through SSH. This tool monitors failed authentication attempts and automatically bans repeat offenders, effectively preventing direct attacks.<\/p>\n\n\n\n<h2 id=\"alternatives\" class=\"wp-block-heading\">Alternatives<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">DenyHosts and CrowdSec are often cited as good, or even superior, alternatives, but we at Raybeam haven&#8217;t particularly tested them.<\/p>\n\n\n\n<h2 id=\"install-fail2ban\" class=\"wp-block-heading\">Install Fail2Ban<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fail2Ban is part of WordOps Stack and can be easily installed with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wo stack install --fail2ban<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can also install it in Ubuntu with APT:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt install fail2ban<\/code><\/pre>\n\n\n\n<h2 id=\"configuring-it-to-send-alerts\" class=\"wp-block-heading\">Configuring it to send alerts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If not configured properly, Fail2Ban can and will lock you outside of your own VPS. So let&#8217;s do every step very carefully. Before enabling it, let&#8217;s copy the config file into a new one so we can safely edit it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The default settings are robust enough and WordOps also adds some custom filters on Nginx and <em>wp-login.php<\/em>, which are good for our use case. Most settings won&#8217;t directly affect our own access since we only login via public key. The only configuration we are doing is changing the mode from normal to aggressive on <em>[sshd]<\/em>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mode = aggressive<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can optionally configure email notifications so that you receive alerts from the system whenever some IP gets banned:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>destemail = <span \n                data-original-string='a6Ddws3O6D\/AfVuIeqCPEw==a66UT4efep8yOa1TBG282ISeu\/KX3zbyjjFQnZjjT3w9ug='\n                class='apbct-email-encoder'\n                title='This contact has been encoded by Anti-Spam by CleanTalk. Click to decode. To finish the decoding make sure that JavaScript is enabled in your browser.'>yo<span class=\"apbct-blur\">********<\/span>@<span class=\"apbct-blur\">*****<\/span>le.com<\/span>\nsender = <span \n                data-original-string='U6VHz53Yu\/Bbqx71qvlguw==a66dgQtpsxrirGvLhDOCr3hrhssTp+IVKHaOAnrDvsj8ak='\n                class='apbct-email-encoder'\n                title='This contact has been encoded by Anti-Spam by CleanTalk. Click to decode. To finish the decoding make sure that JavaScript is enabled in your browser.'>fa<span class=\"apbct-blur\">***************<\/span>@<span class=\"apbct-blur\">*****<\/span>le.com<\/span>\nmta = sendmail\naction = %(action_mw)s<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">After applying your changes, restart the service:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart fail2ban.service<\/code><\/pre>\n\n\n\n<div class=\"wp-block-group has-small-font-size has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\">\n<p class=\"wp-block-paragraph\">Resources:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/bornoe.org\/blog\/2023\/09\/basic-fail2ban-commands\/\">https:\/\/bornoe.org\/blog\/2023\/09\/basic-fail2ban-commands\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/gist.github.com\/pixelchrome\/49266231ac17215745a8297fffd74d46\">https:\/\/gist.github.com\/pixelchrome\/49266231ac17215745a8297fffd74d46<\/a><\/li>\n<\/ul>\n<\/div>\n","protected":false},"featured_media":0,"parent":47233,"menu_order":2,"comment_status":"open","ping_status":"closed","template":"","meta":{"pmpro_default_level":"","nav_title":"","positive":"","negative":"","footnotes":""},"docs_category":[],"class_list":["post-47274","docs","type-docs","status-publish","hentry","pmpro-has-access"],"_links":{"self":[{"href":"https:\/\/raybeam.jp\/ja\/wp-json\/wp\/v2\/docs\/47274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/raybeam.jp\/ja\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/raybeam.jp\/ja\/wp-json\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/raybeam.jp\/ja\/wp-json\/wp\/v2\/comments?post=47274"}],"version-history":[{"count":1,"href":"https:\/\/raybeam.jp\/ja\/wp-json\/wp\/v2\/docs\/47274\/revisions"}],"predecessor-version":[{"id":47275,"href":"https:\/\/raybeam.jp\/ja\/wp-json\/wp\/v2\/docs\/47274\/revisions\/47275"}],"up":[{"embeddable":true,"href":"https:\/\/raybeam.jp\/ja\/wp-json\/wp\/v2\/docs\/47233"}],"wp:attachment":[{"href":"https:\/\/raybeam.jp\/ja\/wp-json\/wp\/v2\/media?parent=47274"}],"wp:term":[{"taxonomy":"docs_category","embeddable":true,"href":"https:\/\/raybeam.jp\/ja\/wp-json\/wp\/v2\/docs_category?post=47274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}