Fail2Ban
Block hosts after repeated authentication errors with Fail2Ban, a daemon for monitoring failed logins.
About Fail2Ban
Fail2Ban is a daemon that scans log files, such as /var/log/auth.log, for failed login attempts. When an IP address makes too many failed attempts, it bans that address by updating system firewall rules to reject new connections from it for a configurable amount of time.
It includes support for standard log files such as those for sshd and Apache, and it can be configured to read other log files and match other error patterns. The README notes that Fail2Ban reduces the rate of incorrect authentication attempts but cannot eliminate the risk posed by weak authentication, and it recommends two-factor or public/private key authentication for services that need stronger protection.
Key features
- Scans log files such as /var/log/auth.log for failed login attempts
- Bans offending IP addresses by updating system firewall rules
- Ban duration is configurable
- Ships with support for standard logs such as sshd and Apache
- Can be configured to read custom log files and match custom errors
- Supports matching of IPv6 addresses since version 0.10
Best for: System administrators running Linux servers that receive repeated remote login attempts and want automatic temporary blocking of offending addresses.
Good for
- Works with many standard log files without additional setup
- Can be configured to read any log file and error pattern
- The README describes it as free software under the GNU General Public License
Watch out for
- Cannot eliminate the risk presented by weak authentication
- The init or service script is not installed automatically
- Requires Python 3.5 or newer, or PyPy3
Fail2Ban at a glance
- Website
- github.com/fail2ban/fail2ban
- Category
- Privacy & Security › Security Tools
- Type
- Open-source project
- Pricing
- Not confirmed. Check the site
- Open source
- Not stated
- Language
- English
- Last checked
- Oct 6, 2026 · Online when checked
- Listed
- Oct 5, 2026
Guides for Security Tools
Fail2Ban alternatives
Tools and sites you could use instead, ranked by how closely they match.
Browse community-maintained materials and plugins for the Ghidra reverse engineering framework.
Agentic Radar scans agent workflows for security issues and helps developers review potential risks.
Open source
24 alternatives
GitHub Advisory Database catalogs CVEs and GitHub-originated security advisories affecting open-source software.
AndroGuard provides tools for reverse engineering and penetration testing Android applications.
Open source
24 alternatives
GitDorker searches GitHub for exposed secrets using a collection of search patterns.
Find community-provided plugins for the Binary Ninja reverse engineering platform.
Open source
24 alternativesPopular in Security Tools
Well-known listings from the same topic.
Online Password Hash Crackonlinehashcrack.comOTP Authapps.apple.com/app/otp-auth/id659877384MD5 reverse lookupmd5.gromweb.comMozilla SSLssl-config.mozilla.orgchallenges.rechallenges.reGoPlus Locker V3gopluslabs.io
Fail2Ban FAQ
How does Fail2Ban block an IP address?
It updates the system firewall rules to reject new connections from the address for a configurable amount of time.
Which logs does Fail2Ban read by default?
It comes ready to read many standard log files, such as those for sshd and Apache. It can also be set up to read any log file you choose.
Does Fail2Ban start automatically after installation?
Not by default. The README says the init script is not installed automatically. To enable it as a service, copy the script for your distribution from the files directory to /etc/init.d.
Is something wrong or out of date?
Tell us and an editor will check it.
Own this website?
Claim this listing
Claim the listing and suggest updates yourself. An editor checks every claim first.