What is Fail2Ban?

Fail2Ban is a software framework that protects computer servers from brute-force attacks.  The security tool has been implemented by Plesk for many years, however it isn’t installed by default on older versions.

With the introduction of Plesk Obsidian, Fail2Ban, has been installed by default.

Fail2Ban works by monitoring log files (e.g. /var/log/auth.log, /var/log/apache/access.log, etc.) for selected entries and running scripts based on them.

The most commons use for Fail2Ban is to block selected IP addresses that may be trying to breach the system’s security. It can ban any host IP address that makes too many login attempts or performs any other unwanted action within a time frame as defined by the administrator of the VPS or Server.

Optionally longer bans can be custom-configure for “recidivist” abusers that keep coming back. Fail2Ban is normally set up to unban a blocked host within a certain period, this helps prevent “lock out” of any genuine connections that may have been temporarily misconfigured. An unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, this will also reduce the likelihood of a successful dictionary attack.

If you have an older version of Plesk and don’t want to upgrade (or cannot) to Plesk Obsidian, check out our guide showing how to install Fail2Ban on a Plesk server.

Fail2Ban needs to be enabled to start protecting specific services (daemons) of your server, so follow these steps to enable it.

Get in touch

If you have more questions about Fail2Ban, we’re here to help.

Call us on 0333 247 0222: Monday – Friday, 9am – 5.30pm.

Chat with us on LiveChat: Monday – Friday, 9am – 5.30pm.

Write to us: Send us a support ticket from your Simply portal and we’ll get back to you as soon as we can.

If you don’t have an account with Simply Hosting yet, you can also send our Sales team an enquiry and we’ll get back to you between 9am and 5.30pm, Monday to Friday.