{"id":47274,"date":"2026-06-27T22:45:45","date_gmt":"2026-06-27T13:45:45","guid":{"rendered":"https:\/\/raybeam.jp\/docs\/initial-server-setup\/how-to-install-and-configure-fail2ban-to-secure-access-to-your-vps\/"},"modified":"2026-06-27T22:46:11","modified_gmt":"2026-06-27T13:46:11","slug":"how-to-install-and-configure-fail2ban-to-secure-access-to-your-vps","status":"publish","type":"docs","link":"https:\/\/raybeam.jp\/ko\/docs\/initial-server-setup\/how-to-install-and-configure-fail2ban-to-secure-access-to-your-vps\/","title":{"rendered":"VPS\uc5d0 \ub300\ud55c \ubcf4\uc548 \uc561\uc138\uc2a4\ub97c \uc704\ud574 Fail2Ban\ub97c \uc124\uce58 \ubc0f \uad6c\uc131\ud558\ub294 \ubc29\ubc95"},"content":{"rendered":"\n<h2 id=\"motivation\" class=\"wp-block-heading\">Motivation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We primarily utilize Fail2Ban to safeguard access to our server through SSH. This tool monitors failed authentication attempts and automatically bans repeat offenders, effectively preventing direct attacks.<\/p>\n\n\n\n<h2 id=\"alternatives\" class=\"wp-block-heading\">Alternatives<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">DenyHosts and CrowdSec are often cited as good, or even superior, alternatives, but we at Raybeam haven&#8217;t particularly tested them.<\/p>\n\n\n\n<h2 id=\"install-fail2ban\" class=\"wp-block-heading\">Install Fail2Ban<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fail2Ban is part of WordOps Stack and can be easily installed with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wo stack install --fail2ban<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can also install it in Ubuntu with APT:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt install fail2ban<\/code><\/pre>\n\n\n\n<h2 id=\"configuring-it-to-send-alerts\" class=\"wp-block-heading\">Configuring it to send alerts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If not configured properly, Fail2Ban can and will lock you outside of your own VPS. So let&#8217;s do every step very carefully. Before enabling it, let&#8217;s copy the config file into a new one so we can safely edit it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The default settings are robust enough and WordOps also adds some custom filters on Nginx and <em>wp-login.php<\/em>, which are good for our use case. Most settings won&#8217;t directly affect our own access since we only login via public key. The only configuration we are doing is changing the mode from normal to aggressive on <em>[sshd]<\/em>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mode = aggressive<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can optionally configure email notifications so that you receive alerts from the system whenever some IP gets banned:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>destemail = <span \n                data-original-string='6628kjVdfJ0B3lNLiOYw\/w==a66L0cfalgclK8YSlRmupWtZF1fsBObYX\/1EMVIGtCmJUI='\n                class='apbct-email-encoder'\n                title='This contact has been encoded by Anti-Spam by CleanTalk. Click to decode. To finish the decoding make sure that JavaScript is enabled in your browser.'>yo<span class=\"apbct-blur\">********<\/span>@<span class=\"apbct-blur\">*****<\/span>le.com<\/span>\nsender = <span \n                data-original-string='nCDlb+52dRcJaIKZdWjwXg==a66qBNYU4jmuhs9cy4fiN81se8D31fnY2nCcg+oVz5Eo\/U='\n                class='apbct-email-encoder'\n                title='This contact has been encoded by Anti-Spam by CleanTalk. Click to decode. To finish the decoding make sure that JavaScript is enabled in your browser.'>fa<span class=\"apbct-blur\">***************<\/span>@<span class=\"apbct-blur\">*****<\/span>le.com<\/span>\nmta = sendmail\naction = %(action_mw)s<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">After applying your changes, restart the service:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart fail2ban.service<\/code><\/pre>\n\n\n\n<div class=\"wp-block-group has-small-font-size has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\">\n<p class=\"wp-block-paragraph\">Resources:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/bornoe.org\/blog\/2023\/09\/basic-fail2ban-commands\/\">https:\/\/bornoe.org\/blog\/2023\/09\/basic-fail2ban-commands\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/gist.github.com\/pixelchrome\/49266231ac17215745a8297fffd74d46\">https:\/\/gist.github.com\/pixelchrome\/49266231ac17215745a8297fffd74d46<\/a><\/li>\n<\/ul>\n<\/div>\n","protected":false},"featured_media":0,"parent":47233,"menu_order":2,"comment_status":"open","ping_status":"closed","template":"","meta":{"pmpro_default_level":"","nav_title":"","positive":"","negative":"","footnotes":""},"docs_category":[],"class_list":["post-47274","docs","type-docs","status-publish","hentry","pmpro-has-access"],"_links":{"self":[{"href":"https:\/\/raybeam.jp\/ko\/wp-json\/wp\/v2\/docs\/47274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/raybeam.jp\/ko\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/raybeam.jp\/ko\/wp-json\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/raybeam.jp\/ko\/wp-json\/wp\/v2\/comments?post=47274"}],"version-history":[{"count":1,"href":"https:\/\/raybeam.jp\/ko\/wp-json\/wp\/v2\/docs\/47274\/revisions"}],"predecessor-version":[{"id":47275,"href":"https:\/\/raybeam.jp\/ko\/wp-json\/wp\/v2\/docs\/47274\/revisions\/47275"}],"up":[{"embeddable":true,"href":"https:\/\/raybeam.jp\/ko\/wp-json\/wp\/v2\/docs\/47233"}],"wp:attachment":[{"href":"https:\/\/raybeam.jp\/ko\/wp-json\/wp\/v2\/media?parent=47274"}],"wp:term":[{"taxonomy":"docs_category","embeddable":true,"href":"https:\/\/raybeam.jp\/ko\/wp-json\/wp\/v2\/docs_category?post=47274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}