fail2ban/fail2ban

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

18788 stars · 1508 forks observed · 2026-10-14

What it is AI-extracted, prompt v1, taxonomy v1, 2026-10-19, confidence 0.99

Fail2Ban is a daemon that monitors log files for repeated authentication failures and automatically updates firewall rules to block offending IP addresses. It is configurable for many services and supports both IPv4 and IPv6.

Use cases

• block IPs after multiple failed SSH login attempts
• prevent brute‑force attacks on web servers by banning abusive clients
• automatically ban hosts that trigger repeated authentication errors in any service
• protect mail servers from credential‑stuffing attacks
• enforce temporary bans for repeated failed login attempts across multiple applications

When to choose

• You need a lightweight, configurable solution to block abusive IPs based on log patterns.
• Your environment runs on Linux, macOS, or BSD and you can modify firewall rules.
• You prefer an open‑source tool with a large community and many ready‑made filters.

When to avoid

• You require a cloud‑native, managed security service with built‑in threat intelligence.
• Your infrastructure does not expose firewall rules or uses a non‑standard OS.
• You need real‑time, packet‑level intrusion detection beyond simple log‑based bans.

Facets

service · maturity active

security security bsd fail2ban ban-hosts ip-blocking log-monitoring firewall-integration devops linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="fail2ban/fail2ban")