fail2ban/fail2ban

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

18479 stars · 1497 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Fail2ban is a Python daemon that scans log files for repeated authentication failures and bans offending IP addresses by updating firewall rules for a configurable period. It ships with filters for common services like sshd and Apache and can be configured to monitor arbitrary log files.

Use cases

• block brute-force SSH login attempts
• automatically ban IPs with too many failed logins
• protect a web server from repeated auth errors
• monitor log files and update firewall rules
• reduce bot and attacker traffic on a self-hosted server
• set up intrusion prevention on a Linux VPS

When to choose

• you run an internet-exposed server (SSH, web, mail) and want automatic banning of abusive hosts
• you want a mature, widely packaged tool that works with existing firewall backends
• you need configurable filters for custom log files and error patterns
• you need IPv6 support for banning

When to avoid

• you need to eliminate weak authentication entirely - fail2ban only reduces the rate of bad attempts, so use 2FA or key-based auth as well
• you are on a platform without firewall control or log files it can watch
• you need a full IDS/IPS with deep packet inspection rather than log-based banning

Facets

service · maturity stable

security monitoring logging cli security self-hosted networking bsd python cli intrusion-prevention fail2ban log-parsing firewall brute-force-protection ids ips daemon devops linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="fail2ban/fail2ban")