# Fail2ban

Published articles for Fail2ban.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Keeping AI crawlers off my Forgejo server

DevFeed: [Keeping AI crawlers off my Forgejo server](<https://devfeed.tech/articles/keeping-ai-crawlers-off-my-forgejo-server-38540.md>)

Original publisher: [Read original article](<https://msfjarvis.dev/posts/keeping-ai-crawlers-off-my-forgejo-server/>)

Author: Harsh Shandilya

Published: 2026-06-29T04:53:18Z

Content type: article

Language: en

Sources: [Posts on Harsh Shandilya](<https://devfeed.tech/sources/posts-on-harsh-shandilya.md>)

Topics: [forgejo](<https://devfeed.tech/topics/forgejo.md>), [AI Bots](<https://devfeed.tech/topics/ai-bots.md>), [Cloudflare](<https://devfeed.tech/topics/cloudflare.md>), [Security](<https://devfeed.tech/topics/security.md>), [Fail2ban](<https://devfeed.tech/topics/fail2ban.md>), [Server](<https://devfeed.tech/topics/server.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ai-crawlers](<https://devfeed.tech/tags/ai-crawlers.md>), [cloudflare](<https://devfeed.tech/tags/cloudflare.md>), [crawlers](<https://devfeed.tech/tags/crawlers.md>), [fail2ban](<https://devfeed.tech/tags/fail2ban.md>), [forgejo](<https://devfeed.tech/tags/forgejo.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>)

### AI overview

A developer describes mitigating AI crawler traffic against a Forgejo instance using fail2ban, Caddy configuration, and Cloudflare rules. The measures reduced some traffic but also exposed client-IP handling and availability issues, while IP bans approached Cloudflare's access-rule limit.

### Source excerpt

The short and bumbling journey to finally giving my tiny VPS some respite

## Configurar Fail2Ban para proteger servicios

DevFeed: [Configurar Fail2Ban para proteger servicios](<https://devfeed.tech/articles/configurar-fail2ban-para-proteger-servicios-34051.md>)

Original publisher: [Read original article](<https://tengoping.com/blog/configurar-fail2ban-proteger-servicios/>)

Author: Antonio Pérez

Published: 2026-01-28T00:00:00Z

Content type: tutorial

Language: es

Sources: [tengoping.com](<https://devfeed.tech/sources/tengoping-com.md>)

Topics: [Fail2ban](<https://devfeed.tech/topics/fail2ban.md>), [OpenSSH](<https://devfeed.tech/topics/openssh.md>), [nginx](<https://devfeed.tech/topics/nginx.md>), [Debian](<https://devfeed.tech/topics/debian.md>), [Ubuntu](<https://devfeed.tech/topics/ubuntu.md>), [rhel 9](<https://devfeed.tech/topics/rhel-9.md>)

Tags: [debian](<https://devfeed.tech/tags/debian.md>), [error](<https://devfeed.tech/tags/error.md>), [fail2ban](<https://devfeed.tech/tags/fail2ban.md>), [internet](<https://devfeed.tech/tags/internet.md>), [ip](<https://devfeed.tech/tags/ip.md>), [login](<https://devfeed.tech/tags/login.md>), [logs](<https://devfeed.tech/tags/logs.md>), [nginx](<https://devfeed.tech/tags/nginx.md>), [rhel](<https://devfeed.tech/tags/rhel.md>), [rhel-9](<https://devfeed.tech/tags/rhel-9.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [ubuntu](<https://devfeed.tech/tags/ubuntu.md>)

### AI overview

A practical guide to installing and configuring Fail2Ban to protect SSH, Nginx, and other services from brute-force attacks. It covers jail configuration, custom Nginx filters, nftables and iptables actions, status checks, and manually unbanning IP addresses.

### Source excerpt

Guía práctica para instalar y configurar Fail2Ban: protege SSH, Nginx y otros servicios contra ataques de fuerza bruta.

## Hardening básico de servidores Linux

DevFeed: [Hardening básico de servidores Linux](<https://devfeed.tech/articles/hardening-basico-de-servidores-linux-34061.md>)

Original publisher: [Read original article](<https://tengoping.com/blog/hardening-basico-servidores-linux/>)

Author: Antonio Pérez

Published: 2026-01-22T00:00:00Z

Content type: tutorial

Language: es

Sources: [tengoping.com](<https://devfeed.tech/sources/tengoping-com.md>)

Topics: [Linux](<https://devfeed.tech/topics/linux.md>), [Firewall](<https://devfeed.tech/topics/firewall.md>), [ssh](<https://devfeed.tech/topics/ssh.md>), [Fail2ban](<https://devfeed.tech/topics/fail2ban.md>), [OpenSSH](<https://devfeed.tech/topics/openssh.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>)

Tags: [fail2ban](<https://devfeed.tech/tags/fail2ban.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [hardening](<https://devfeed.tech/tags/hardening.md>), [hash](<https://devfeed.tech/tags/hash.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [linux](<https://devfeed.tech/tags/linux.md>), [ssh](<https://devfeed.tech/tags/ssh.md>)

### AI overview

This Spanish tutorial presents a basic hardening checklist for Linux servers and explains why the measures should be applied in a specific order. It covers system updates, SSH, firewall configuration, user policies, sudo restrictions, kernel parameters, unnecessary services, Fail2ban, auditing, and final verification.

### Source excerpt

Checklist de hardening en el orden correcto: SSH, firewall, usuarios, kernel, AIDE, chrony y verificación final con Lynis.

## Firewalld, UFW y nftables en Linux

DevFeed: [Firewalld, UFW y nftables en Linux](<https://devfeed.tech/articles/firewalld-ufw-y-nftables-en-linux-34057.md>)

Original publisher: [Read original article](<https://tengoping.com/blog/firewalld-nftables-seguridad-red-linux/>)

Author: Antonio Pérez

Published: 2026-01-21T00:00:00Z

Content type: tutorial

Language: es

Sources: [tengoping.com](<https://devfeed.tech/sources/tengoping-com.md>)

Topics: [Firewall](<https://devfeed.tech/topics/firewall.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [centos](<https://devfeed.tech/topics/centos.md>), [Debian](<https://devfeed.tech/topics/debian.md>), [Fail2ban](<https://devfeed.tech/topics/fail2ban.md>)

Tags: [centos](<https://devfeed.tech/tags/centos.md>), [debian](<https://devfeed.tech/tags/debian.md>), [fail2ban](<https://devfeed.tech/tags/fail2ban.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [linux](<https://devfeed.tech/tags/linux.md>), [rate-limiting](<https://devfeed.tech/tags/rate-limiting.md>), [ssh](<https://devfeed.tech/tags/ssh.md>)

### AI overview

A practical Spanish-language guide to managing Linux firewall rules with firewalld, UFW, and nftables. It explains runtime versus permanent rules, rich rules and NAT, rate limiting, SSH protection, and persistence after reboot, with warnings about avoiding lockout during remote administration.

### Source excerpt

Firewalld, UFW y nftables: reglas permanentes vs runtime, rate limiting, persistencia tras reinicio y migración desde iptables.

## Cómo configurar un servidor SSH seguro en Linux

DevFeed: [Cómo configurar un servidor SSH seguro en Linux](<https://devfeed.tech/articles/como-configurar-un-servidor-ssh-seguro-en-linux-34052.md>)

Original publisher: [Read original article](<https://tengoping.com/blog/configurar-servidor-ssh-seguro-linux/>)

Author: Antonio Pérez

Published: 2026-01-01T00:00:00Z

Content type: tutorial

Language: es

Sources: [tengoping.com](<https://devfeed.tech/sources/tengoping-com.md>)

Topics: [OpenSSH](<https://devfeed.tech/topics/openssh.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Fail2ban](<https://devfeed.tech/topics/fail2ban.md>)

Tags: [fail2ban](<https://devfeed.tech/tags/fail2ban.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [hardening](<https://devfeed.tech/tags/hardening.md>), [linux](<https://devfeed.tech/tags/linux.md>), [openssh](<https://devfeed.tech/tags/openssh.md>)

### AI overview

A step-by-step guide to securing an OpenSSH server on Linux. It covers layered protections including non-standard ports, public-key authentication, hardened ciphers, two-factor authentication, and fail2ban, along with configuration and verification guidance.

### Source excerpt

Guía paso a paso para configurar y securizar un servidor SSH en cualquier servidor Linux, incluyendo autenticación por clave, fail2ban y mejores prácticas.

## SSH Hardening to Prevent Brute-Force Attacks

DevFeed: [SSH Hardening to Prevent Brute-Force Attacks](<https://devfeed.tech/articles/ssh-hardening-to-prevent-brute-force-attacks-29870.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/ssh-hardening-to-prevent-brute-force-attacks/>)

Author: info@goteleport.com (Robert Watson)

Published: 2022-01-14T00:00:00Z

Content type: tutorial

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [ssh](<https://devfeed.tech/topics/ssh.md>), [Security](<https://devfeed.tech/topics/security.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [remote access](<https://devfeed.tech/topics/remote-access.md>), [Regular expression](<https://devfeed.tech/topics/regular-expression.md>), [Library](<https://devfeed.tech/topics/library.md>)

Tags: [article](<https://devfeed.tech/tags/article.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [email](<https://devfeed.tech/tags/email.md>), [expression](<https://devfeed.tech/tags/expression.md>), [fail2ban](<https://devfeed.tech/tags/fail2ban.md>), [filter](<https://devfeed.tech/tags/filter.md>), [hardening](<https://devfeed.tech/tags/hardening.md>), [ip](<https://devfeed.tech/tags/ip.md>), [limit](<https://devfeed.tech/tags/limit.md>), [protection](<https://devfeed.tech/tags/protection.md>), [reduce](<https://devfeed.tech/tags/reduce.md>), [remote-access](<https://devfeed.tech/tags/remote-access.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>), [server-logs](<https://devfeed.tech/tags/server-logs.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [tcp](<https://devfeed.tech/tags/tcp.md>)

### AI overview

This tutorial presents four ways to harden SSH servers against brute-force attacks: limiting authentication attempts, using Fail2ban, and restricting SSH access with TCP wrappers. It also explains how Fail2ban filters server logs and responds to suspicious activity.

### Source excerpt

In this article, we explore and explain four ways to harden SSH from brute-force attacks to help improve security.

## fail2ban - block wp-login.php brute force attacks

DevFeed: [fail2ban - block wp-login.php brute force attacks](<https://devfeed.tech/articles/fail2ban-block-wp-login-php-brute-force-attacks-27628.md>)

Original publisher: [Read original article](<https://gagor.pro/2015/12/fail2ban-block-wp-login-php-brute-force-attacks/>)

Author: Tom

Published: 2015-12-31T00:00:00Z

Content type: tutorial

Language: en

Sources: [Tomasz Gągor](<https://devfeed.tech/sources/tomasz-gagor.md>)

Topics: [WordPress](<https://devfeed.tech/topics/wordpress.md>), [nginx](<https://devfeed.tech/topics/nginx.md>), [Firewall](<https://devfeed.tech/topics/firewall.md>), [Code](<https://devfeed.tech/topics/code.md>), [HTTP](<https://devfeed.tech/topics/http.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [fail2ban](<https://devfeed.tech/tags/fail2ban.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [http](<https://devfeed.tech/tags/http.md>), [linux](<https://devfeed.tech/tags/linux.md>), [nginx](<https://devfeed.tech/tags/nginx.md>), [php](<https://devfeed.tech/tags/php.md>), [windows](<https://devfeed.tech/tags/windows.md>), [wordpress](<https://devfeed.tech/tags/wordpress.md>)

### AI overview

A tutorial explaining how to use Fail2ban with nginx and a firewall to block source IPs involved in brute-force attempts against WordPress's wp-login.php endpoint.

### Source excerpt

Lately I had a lot of brute force attacks on my WordPress blog. I used basic auth to /wp-admin part in nginx configuration to block this and as a better solution I wan't to block source IPs at all on firewall. To do this, place this filter code in /etc/fail2ban/filter.d/wp-login.conf: # WordPress brute force wp-login.php filter: # # Block IPs trying to authenticate in WordPress blog # # Matches e.g. # 178.218.54.109 - - [31/Dec/2015:10:39:34 +0100] "POST /wp-login.php HTTP/1.1" 401 188 "-" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" # [Definition] failregex = ^<HOST> .* "POST /wp-login.php ignoreregex = Then edit your /etc/fail2ban/jail.local and add:

## fail2ban - regułki dla dovecot'a

DevFeed: [fail2ban - regułki dla dovecot'a](<https://devfeed.tech/articles/fail2ban-regu-ki-dla-dovecot-a-27503.md>)

Original publisher: [Read original article](<https://gagor.pro/2011/11/fail2ban-regulki-dla-dovecota/>)

Author: Tom

Published: 2011-11-28T00:00:00Z

Content type: tutorial

Language: pl

Sources: [Tomasz Gągor](<https://devfeed.tech/sources/tomasz-gagor.md>)

Topics: [Authentication](<https://devfeed.tech/topics/authentication.md>)

Tags: [auth](<https://devfeed.tech/tags/auth.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [debian](<https://devfeed.tech/tags/debian.md>), [fail2ban](<https://devfeed.tech/tags/fail2ban.md>), [filter](<https://devfeed.tech/tags/filter.md>), [linux](<https://devfeed.tech/tags/linux.md>), [login](<https://devfeed.tech/tags/login.md>), [mail](<https://devfeed.tech/tags/mail.md>), [port](<https://devfeed.tech/tags/port.md>), [security](<https://devfeed.tech/tags/security.md>)

### AI overview

This tutorial explains how to configure fail2ban on Debian to block repeated authentication failures against Dovecot POP3 and IMAP mailboxes. It provides a custom Dovecot filter with a failregex, a jail configuration for POP3/IMAP ports, log path, retry limit, and optional timing values, followed by restarting fail2ban.

### Source excerpt

Domyślna konfiguracja fail2ban'a (na Debianie) nie zawiera reguł pozwalających na blokowanie prób włamań na skrzynki POP/IMAP dla dovecota (no chyba że korzystamy z saslauthd). Można szybko utworzyć własny zestaw filtrów co przedstawię poniżej. Tworzymy plik: /etc/fail2ban/filter.d/dovecot.conf [Definition] failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed|Aborted login \(\d+ authentication attempts).*rip=(?P<host>\S*),.* ignoreregex = Później dopisujemy na końcu pliku: /etc/fail2ban/jail.conf [dovecot] enabled = true filter = dovecot port = pop3,pop3s,imap,imaps logpath = /var/log/mail.log maxretry = 20 # te dwa poniżej wedle uznania - ja mam dobrze ustawione default'y #findtime = 1200 #bantime = 1200 Zostało zrestartować fail2ban'a:

## Ochrona usług przed atakami brute force z fail2ban'em

DevFeed: [Ochrona usług przed atakami brute force z fail2ban'em](<https://devfeed.tech/articles/ochrona-us-ug-przed-atakami-brute-force-z-fail2ban-em-27501.md>)

Original publisher: [Read original article](<https://gagor.pro/2011/10/ochrona-uslug-przed-atakami-brute-force-z-fail2banem/>)

Author: Tom

Published: 2011-10-03T00:00:00Z

Content type: tutorial

Language: pl

Sources: [Tomasz Gągor](<https://devfeed.tech/sources/tomasz-gagor.md>)

Topics: [Fail2ban](<https://devfeed.tech/topics/fail2ban.md>), [Logging](<https://devfeed.tech/topics/logging.md>), [ssh](<https://devfeed.tech/topics/ssh.md>)

Tags: [admin](<https://devfeed.tech/tags/admin.md>), [apache](<https://devfeed.tech/tags/apache.md>), [debian](<https://devfeed.tech/tags/debian.md>), [fail2ban](<https://devfeed.tech/tags/fail2ban.md>), [linux](<https://devfeed.tech/tags/linux.md>), [postfix](<https://devfeed.tech/tags/postfix.md>), [sasl](<https://devfeed.tech/tags/sasl.md>), [security](<https://devfeed.tech/tags/security.md>), [spam](<https://devfeed.tech/tags/spam.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [syslog](<https://devfeed.tech/tags/syslog.md>)

### AI overview

This Polish article explains how Fail2ban can monitor authentication failures in syslog and protect publicly accessible services from brute-force attacks and other abusive activity. It discusses basic configuration, supported services, modular filters and actions, performance considerations, and installation on Debian.

### Source excerpt

Bardzo często konfigurując usługi dostępne publicznie poświęca się sporo czasu na maksymalne zwiększenie bezpieczeństwa przez "dopieszczanie" konfiguracji (certyfikaty z mocnym szyfrowaniem, ochronę pewnych stron hasłem, dostęp do SSH tylko kluczami, itd.) ale całkowicie pomija się przygotowanie systemu aktywnie monitorującego błędne próby autoryzacji. Oczywiście nie można umniejszać wagi pierwszego z wymienionych etapów ale zdecydowanie nie powinno pomijać się też tego drugiego. Przecież każdy admin chciałby wiedzieć gdy ktoś próbuje włamać się na jego serwer (FTP, HTTP, SSH, itp.) - tylko ilu z Nas zadaje sobie trud by uruchomić taki system?