Brute-force mitigation with fail2ban: jails, backends, status, and unbanning your own address

Goal

Enable a fail2ban jail against a service's authentication log, check its live status, unban an address, and protect the addresses used for administration from being banned by mistake.

Prerequisites

Root privileges; fail2ban installed and its service running; a log source fail2ban's filter for that service can parse (e.g. the sshd log via journald or a log file).

Steps

1. Never edit jail.conf directly — jail.conf(5) lists jail.conf/jail.d/*.conf (packaged, overwritten on upgrade) separately from jail.local/jail.d/*.local (local overrides that persist). Create /etc/fail2ban/jail.local or a file under /etc/fail2ban/jail.d/.
2. Enable a jail and choose how it watches the log: [sshd] section with enabled = true, and backend = systemd when the service logs only to the journal (no /var/log/auth.log or /var/log/secure, as on Debian 12 and later without rsyslog). The documented default is backend = auto, which "will try 'pyinotify', 'systemd' before 'polling'"; with a file-based backend the jail refuses to start if its log file does not exist.
3. Protect management addresses before enabling anything else: add ignoreip = 203.0.113.0/24 198.51.100.10 to the [DEFAULT] section; jail.conf(5) defines ignoreip as the "list of IPs not to ban," accepting CIDR ranges.
4. Check the configuration with fail2ban-client -t, then reload it: fail2ban-client reload sshd (or fail2ban-client reload for all jails). A jail that sets its own ignoreip replaces the [DEFAULT] list rather than adding to it.
5. Check live state at any time: fail2ban-client status sshd, which reports the jail's current ban list and counters.
6. If a legitimate address gets banned, remove the ban immediately: fail2ban-client unban 203.0.113.5, documented as unbanning the given IP "(in all jails and database)"; fail2ban-client unban --all clears every ban.

Expected result

fail2ban-client status sshd shows increasing failure counts for real brute-force attempts and, once the threshold is reached, the offending address under "Banned IP list"; addresses in ignoreip never appear there.

Limits and test basis

A log-source mismatch (a file backend watching a file the service no longer writes, or a filter that does not match the current log format) can leave the jail running without ever counting a failure — confirm with fail2ban-client status <jail> that the failure counter increases during a deliberate test from a non-ignoreip address. To undo a jail, set enabled = false in the local override and fail2ban-client reload; no reboot is needed for any of these steps, only a reload of the fail2ban service. Bans are enforced as firewall rules; a restart of fail2ban may re-apply bans stored in its database.