Fail2Ban can automatically block repeated, recognizable attacks against Apache on Ubuntu. It watches Apache access or error logs, applies a jail’s regular-expression filter, and asks a firewall action to ban an IP after maxretry failures inside findtime. The protection is reactive: it only responds to events Apache logs accurately and the selected filter can identify.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
A dependable setup therefore has four parts: install the Ubuntu package, configure a local jail without editing vendor files, select filters that match your actual logs, and test both matching and firewall bans before relying on the service.
As an Amazon Associate I earn from qualifying purchases.
What Fail2Ban protects—and what it does not
Fail2Ban is a log-driven control that limits repeated or recognizable failures. A running jail reads a configured log source, evaluates each line with a filter, counts failures for each source address, and invokes a ban action when the threshold is reached. The ban normally inserts a temporary firewall rule; the exact mechanism depends on the action configured on your Ubuntu host.
This makes Fail2Ban useful against repeated Apache authentication failures, known bot signatures, malformed requests, and alerts emitted by ModSecurity. It does not repair an Apache vulnerability, replace strong credentials, provide TLS, or create a complete firewall policy. Keep Ubuntu and Apache patched, use secure authentication, and restrict exposed services independently.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Install the Ubuntu package and inspect its components
Install the distribution package, then confirm that the service and diagnostic utilities are present:
sudo apt update
sudo apt install fail2ban
systemctl status fail2ban --no-pager
command -v fail2ban-server
command -v fail2ban-client
command -v fail2ban-regex
ls -l /etc/fail2ban/jail.confUbuntu’s package supplies the Fail2Ban server, client, regular-expression tester, and the stock jail.conf. A newly installed service may be running with no Apache jail enabled; installation alone does not protect Apache.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Before changing anything, check that Apache is writing logs and identify their locations:
sudo apachectl -S
sudo ls -l /var/log/apache2/
sudo tail -n 20 /var/log/apache2/access.log
sudo tail -n 20 /var/log/apache2/error.logVirtual hosts can use separate access and error files. Record the file that actually contains the failures you want to count rather than assuming every site uses the default names.
Keep vendor configuration intact
Do not edit /etc/fail2ban/jail.conf. Ubuntu’s jail manual recommends leaving *.conf files unchanged so package upgrades can replace them safely. Put local policy in /etc/fail2ban/jail.local or in one or more files under /etc/fail2ban/jail.d/.
A single local file is convenient on a small server:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo editor /etc/fail2ban/jail.localSeparate files make it easier to enable and disable site-specific policies. For example:
sudo editor /etc/fail2ban/jail.d/apache-local.localFiles ending in .local are intended for overrides. Preserve the stock filter definitions in /etc/fail2ban/filter.d/ unless you have a deliberate, tested reason to create a local filter override.
Choose an Apache jail by the event in your logs
There is no universally correct “Apache jail.” Select one whose filter signature describes an event that really appears in your logs. Compare the log source, event type, false-positive risk, thresholds, and firewall action before enabling it.
| Jail | What it is intended to detect | Typical log source | Selection guidance |
|---|---|---|---|
apache-auth |
Authentication or access-denial failures | Apache error log | Best first choice when the error log records failed authentication or configuration denials |
apache-badbots |
Known bad-bot signatures | Usually an Apache access log, as defined by the installed configuration | Use only when the user-agent or request signatures in your traffic match the filter |
apache-noscript |
Requests associated with attempts to execute or locate scripts | Apache access log | Enable after verifying that the filter’s patterns describe hostile requests rather than normal application routes |
apache-overflows |
Malformed or oversized request patterns | Apache error or access log, according to the installed jail | Useful for clear overflow signatures; inspect matches carefully to avoid blocking unusual but valid clients |
apache-nohome |
Requests for home-directory paths that match the filter | Apache access or error log, according to the installed jail | Choose only if those path probes are present and unwanted on your server |
apache-botsearch |
Search or crawl behavior identified by the filter | Apache access log | Validate user-agent and request patterns before enforcement |
apache-fakegooglebot |
Clients falsely identifying themselves as Googlebot | Apache access log | Appropriate only when the installed signature matches the requests you observe |
apache-modsecurity |
ModSecurity alerts recorded by Apache | ModSecurity or Apache error log | Use when ModSecurity is enabled and its alert format matches the filter |
apache-shellshock |
Shellshock-style request signatures | Apache access or error log, according to the installed jail | Enable when the signature is relevant to the traffic and Apache log format |
The maintained configuration defines the HTTP and HTTPS ports and the relevant Apache log variables for these jails, but values can change with package updates. Inspect the installed files on your host instead of copying a setting from another distribution.
Recommended Free Tools
Start with authentication failures
apache-auth is the narrowest starting point when Apache’s error log contains authentication or access-denial failures. Its maintained filter recognizes messages such as client denied by server configuration
and client used wrong authentication scheme
. It supports normal and aggressive modes. Aggressive matching can catch more variants, but it also deserves more scrutiny because broader signatures can increase false positives.
Do not enable every jail
Enabling all Apache jails multiplies overlapping filters and can ban legitimate crawlers, monitoring systems, or application clients. Add a second jail only after you have inspected representative matches and know which additional event it covers.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Create a minimal Apache jail
Use the real Apache log path, the ports Apache serves, and conservative thresholds. This example enables only the authentication jail; adjust the path to your host:
[apache-auth]
enabled = true
port = http,https
logpath = /var/log/apache2/error.log
bantime = 1h
findtime = 10m
maxretry = 5
ignoreip = 127.0.0.1/8 ::1 203.0.113.10Replace 203.0.113.10 with a trusted administrative address or network, and remove the example address if it is not yours. Never put a broad public range in ignoreip merely to make testing easier. If administrators connect through more than one fixed address, list each trusted address or CIDR deliberately.
Some installations write Apache events to journald rather than a conventional file. In that case, use the documented systemd backend and configure the journal source appropriate to your Ubuntu release. Do not specify a nonexistent file path and expect the jail to discover journal entries automatically.
Make client IP logging trustworthy
Fail2Ban bans the address it sees in the log line. If Apache is behind a reverse proxy or load balancer and the proxy’s address is logged as the client, Fail2Ban can ban the proxy instead of the attacker. That can disconnect every visitor arriving through the proxy.
Verify one request from a known test address and inspect the corresponding access or error entry. Configure Apache’s proxy and forwarded-address handling so the logged client address is accurate, and ensure that only trusted proxy networks can supply forwarded headers. Then repeat the test through the real traffic path before enabling enforcement.
Tune bantime, findtime, and maxretry
The three values describe different decisions:
maxretry: how many filter matches an address may produce.findtime: the period in which those matches must occur.bantime: how long the action blocks the address.
Choose them according to the event. A failed-password event may justify several attempts in a short interval; a distinctive exploit signature may warrant a lower retry count. The stock configuration is not a universal policy. For example, the maintained apache-badbots jail uses a 48-hour ban and one retry, while other Apache jails use different defaults. Treat those values as starting points and inspect the installed configuration before adopting them.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Long bans increase the cost of a false positive. Short bans may allow a persistent scanner to return quickly. Begin with a moderate duration, observe the match quality and ban list, and adjust one variable at a time. Keep trusted operator addresses in ignoreip before testing so a mistaken rule cannot lock you out.
Validate filters before turning on enforcement
A jail can be active while matching nothing. Test the selected filter against a copy or representative sample of the relevant Apache log with fail2ban-regex:
sudo cp /var/log/apache2/error.log /tmp/apache-error-sample.log
sudo chmod 600 /tmp/apache-error-sample.log
sudo fail2ban-regex /tmp/apache-error-sample.log /etc/fail2ban/filter.d/apache-auth.confFor an access-log jail, substitute the access-log sample and its filter file. The report should show which lines matched and which did not. Confirm all of the following:
- Intended authentication denials, bot signatures, malformed requests, or ModSecurity alerts match.
- Ordinary successful requests do not match.
- The timestamp format and timezone are understood by the filter.
- The source address extracted from a match is the real client address.
- The tested log path is the same path configured in the jail.
If your Apache format differs from the one expected by the stock filter, do not lower thresholds to compensate. First select a different maintained filter or create a carefully tested local filter that reflects your format.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsEnable, reload, and inspect the jail
After saving local configuration, validate the service and restart or reload it:
sudo fail2ban-client -t
sudo systemctl restart fail2ban
sudo systemctl enable fail2ban
sudo fail2ban-client ping
sudo fail2ban-client status
sudo fail2ban-client status apache-authThe configuration test should complete without syntax errors. The general status lists active jails; the jail-specific status shows its filter, currently failed addresses, and currently banned addresses. Use the exact jail name you enabled.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Inspect service diagnostics when a jail does not appear or fails to start:
sudo journalctl -u fail2ban --since today --no-pager
sudo systemctl status fail2ban --no-pagerBefore declaring the setup complete, verify the configured action is compatible with the firewall framework installed on the server. Check that a test ban appears in the expected firewall rules and that an unban removes it. Perform this from an out-of-band console or with a trusted address in ignoreip so a mistake cannot terminate your administrative session.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Why an active Apache jail may not ban anyone
The jail is not actually enabled
fail2ban-client status is authoritative for the running process. A section written in a local file but absent from this list was not loaded. Check spelling, file names, and the service journal for parser errors, then restart after correcting the file.
The log path is wrong or unreadable
Confirm that the configured file exists, receives new entries, and is readable by the Fail2Ban process. Rotated logs can expose a path mistake: Apache may be writing to a per-virtual-host file while the jail watches the unused default file. Follow a live file while producing a known test event and compare its timestamp with the jail’s configured source.
The filter does not match your Apache format
Run fail2ban-regex against current lines. Zero matches means changing maxretry will not help. Check whether the event is in the error log rather than the access log, whether a proxy has changed the address field, and whether the installed filter expects a different message wording.
The threshold has not been crossed
Fail2Ban counts matches per address inside findtime. A slow sequence, requests split across multiple addresses, or an address listed in ignoreip will not reach the ban threshold. Review the jail status for current failures and compare the observed timing with the configured values.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The firewall action cannot apply the ban
A matching filter can record failures without successfully installing a firewall rule. Inspect the Fail2Ban journal for action errors, verify that the selected action matches the host firewall, and confirm that required firewall commands are installed. Test both ban and unban operations before increasing enforcement.
A proxy address is being banned
If every log entry shows the same load balancer or reverse-proxy address, stop and correct client-IP preservation. Banning that address can deny service to every user behind it. Re-test the complete request path after fixing the logging chain.
Quick Recap
Operate the protection safely
- Keep a documented list of administrative and monitoring addresses in
ignoreip; review it when staff, VPN endpoints, or providers change. - Monitor the ban list and investigate recurring addresses instead of assuming every match is malicious.
- Use the narrowest jail that identifies the event. Add bot, noscript, overflow, nohome, botsearch, fakegooglebot, ModSecurity, or Shellshock jails only when their signatures are present in your traffic.
- Review local files after Fail2Ban package upgrades because vendor filters and defaults can evolve even when your local policy remains unchanged.
- Rotate and retain Apache logs according to your incident-response needs. A log gap is also a detection gap.
- Keep Apache, Ubuntu, authentication components, and the firewall maintained. Fail2Ban is an additional response layer, not a substitute for patching or secure configuration.
Practical completion checklist
- Install Fail2Ban and confirm the server, client, regex tester, and service are present.
- Leave
jail.confunchanged; place policy injail.localorjail.d/*.local. - Identify the exact Apache access, error, ModSecurity, or journald source containing the event.
- Select only the jail whose filter signatures match that event.
- Verify that Apache logs the real client address through any proxy or load balancer.
- Set
bantime,findtime,maxretry, and a preciseignoreiplist. - Run
fail2ban-regexand confirm both intended matches and ordinary non-matches. - Restart or reload Fail2Ban and verify the jail with
fail2ban-client status. - Test the firewall action, ban visibility, and unban behavior from a safe administrative path.
- Watch the journal and ban list after deployment, then tune only when observed traffic justifies a change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
