{"id":47274,"date":"2026-06-27T22:45:45","date_gmt":"2026-06-27T13:45:45","guid":{"rendered":"https:\/\/raybeam.jp\/docs\/initial-server-setup\/how-to-install-and-configure-fail2ban-to-secure-access-to-your-vps\/"},"modified":"2026-06-27T22:46:11","modified_gmt":"2026-06-27T13:46:11","slug":"%e0%b8%a7%e0%b8%b4%e0%b8%98%e0%b8%b5%e0%b8%95%e0%b8%b4%e0%b8%94%e0%b8%95%e0%b8%b1%e0%b9%89%e0%b8%87%e0%b9%81%e0%b8%a5%e0%b8%b0%e0%b8%81%e0%b8%b3%e0%b8%ab%e0%b8%99%e0%b8%94%e0%b8%84%e0%b9%88%e0%b8%b2-f","status":"publish","type":"docs","link":"https:\/\/raybeam.jp\/th\/docs\/initial-server-setup\/how-to-install-and-configure-fail2ban-to-secure-access-to-your-vps\/","title":{"rendered":"\u0e27\u0e34\u0e18\u0e35\u0e01\u0e32\u0e23\u0e15\u0e34\u0e14\u0e15\u0e31\u0e49\u0e07\u0e41\u0e25\u0e30\u0e01\u0e33\u0e2b\u0e19\u0e14\u0e04\u0e48\u0e32 Fail2Ban \u0e40\u0e1e\u0e37\u0e48\u0e2d\u0e23\u0e31\u0e01\u0e29\u0e32\u0e04\u0e27\u0e32\u0e21\u0e1b\u0e25\u0e2d\u0e14\u0e20\u0e31\u0e22\u0e43\u0e19\u0e01\u0e32\u0e23\u0e40\u0e02\u0e49\u0e32\u0e16\u0e36\u0e07 VPS \u0e02\u0e2d\u0e07\u0e04\u0e38\u0e13"},"content":{"rendered":"\n

Motivation<\/h2>\n\n\n\n

We primarily utilize Fail2Ban to safeguard access to our server through SSH. This tool monitors failed authentication attempts and automatically bans repeat offenders, effectively preventing direct attacks.<\/p>\n\n\n\n

Alternatives<\/h2>\n\n\n\n

DenyHosts and CrowdSec are often cited as good, or even superior, alternatives, but we at Raybeam haven’t particularly tested them.<\/p>\n\n\n\n

Install Fail2Ban<\/h2>\n\n\n\n

Fail2Ban is part of WordOps Stack and can be easily installed with:<\/p>\n\n\n\n

wo stack install --fail2ban<\/code><\/pre>\n\n\n\n
You can also install it in Ubuntu with APT:<\/p>\n\n\n\n
sudo apt update\nsudo apt install fail2ban<\/code><\/pre>\n\n\n\n
Configuring it to send alerts<\/h2>\n\n\n\n
If not configured properly, Fail2Ban can and will lock you outside of your own VPS. So let’s do every step very carefully. Before enabling it, let’s copy the config file into a new one so we can safely edit it:<\/p>\n\n\n\n
sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/code><\/pre>\n\n\n\n
The default settings are robust enough and WordOps also adds some custom filters on Nginx and wp-login.php<\/em>, which are good for our use case. Most settings won’t directly affect our own access since we only login via public key. The only configuration we are doing is changing the mode from normal to aggressive on [sshd]<\/em>:<\/p>\n\n\n\n
mode = aggressive<\/code><\/pre>\n\n\n\n
You can optionally configure email notifications so that you receive alerts from the system whenever some IP gets banned:<\/p>\n\n\n\n
destemail = yo********<\/span>@*****<\/span>le.com<\/span>\nsender = fa***************<\/span>@*****<\/span>le.com<\/span>\nmta = sendmail\naction = %(action_mw)s<\/code><\/pre>\n\n\n\n
After applying your changes, restart the service:<\/p>\n\n\n\n
sudo systemctl restart fail2ban.service<\/code><\/pre>\n\n\n\n
\n
Resources:<\/p>\n\n\n\n