Install Fail2ban on your VPS
Infraa installs fail2ban on your VPS from the distro apt repository and writes a managed jail drop-in. The SSH jail is on the moment it's installed — it ships with the fail2ban package itself. An nginx bot jail is available too, off by default: turn it on and fail2ban bans IPs that repeatedly get rate-limited or blocked (429, 403, 444) on your Infraa-managed app vhosts.
- Versions
- fail2ban 0.11 or 1.0, from the distro apt repository
- Works on
- Ubuntu 22.04, Ubuntu 24.04, and Debian 12
- Package source
- Distro apt repository
What does the Fail2ban install do?
- Installs fail2ban from the stock apt repo — no third-party repository or signing key.
- Writes a jail drop-in (/etc/fail2ban/jail.d/infraa.local) plus a custom filter matching Infraa's nginx access-log format, without touching the distro's default SSH jail.
- Leaves the SSH jail on (fail2ban's own default) and the nginx bot jail off, so nothing new starts blocking traffic until you opt in.
- Enables and starts the fail2ban systemd unit.
How do I install Fail2ban with Infraa?
Connect your server
Run the Infraa install one-liner (curl install.infraa.sh | sh) on your VPS. The agent registers over an outbound connection in about 30 seconds — no inbound ports, no SSH keys to share.
Pick the service
Choose it from the one-click catalog in the dashboard, or just ask in chat. Infraa turns your request into a concrete, reviewable plan.
Review and approve
Read exactly what will run, then approve. The agent executes only the approved, cryptographically signed steps and streams progress live.
What happens after the install?
Infraa checks the fail2ban service every 60 seconds and flags it in your dashboard if it stops running. If you turn on the nginx bot jail, a new app domain is picked up automatically the next time fail2ban restarts, since it watches the app access-log path by glob.
Fail2ban on Infraa — common questions
01Does installing fail2ban block SSH access I still need?
No — the default SSH jail only bans an IP after repeated failed login attempts, and the threshold and ban time are fail2ban's own conservative defaults. It doesn't touch a working login flow.
02What does the nginx bot jail actually ban?
It's opt-in, off by default. Once enabled, it watches your Infraa-managed app vhosts' access logs and bans an IP that racks up repeated 429 (rate-limited), 403 (blocked by the bot filter), or 444 (dropped-connection) responses — with a high default threshold (100 requests) so ordinary shared/NAT'd traffic isn't caught.
03What happens if I uninstall the fail2ban module?
Infraa removes only its own jail and filter drop-ins and restarts the service — it does not remove the fail2ban package or the distro's default SSH jail, so SSH brute-force protection keeps running.
Connect a server in 30 seconds, then install Fail2ban from the catalog or just ask in chat.
