{"slug": "fail2ban", "name": "fail2ban", "category": "security", "category_name": "Security and passwords", "description": "Open-source daemon that scans logs and bans IPs showing malicious behavior via firewall rules.", "recommenders": 6, "commenters": 10, "warners": 1, "score": 5.177, "rising": -0.64, "first": "2026-01-16", "latest": "2026-09-01", "why": "HN commenters use it to temporarily ban IPs that brute-force SSH or probe web servers for forbidden URLs, usually alongside rate limiting, geoblocking or WAF rules.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 6, "neutral": 1, "compare": 2, "warn": 1}, "spark": [0, 0, 1, 1, 0, 0, 0, 0, 3, 1, 0, 0], "listed": true, "loved": ["Web log banning", "Layered defense"], "caveat": "Tuning effort", "short_quote": "I use fail2ban to parse HTTP logs and temporarily ban IPs for N hours", "icon": true, "domain": null, "github_repo": null, "official_url": "https://github.com/fail2ban/fail2ban", "pricing": "open source", "aliases": ["fail2ban", "Fail2ban", "Fail2Ban"], "verdict": [{"text": "HN commenters use it to temporarily ban IPs that brute-force SSH or probe web servers for forbidden URLs,", "cites": [{"id": 750336400, "item_id": 46896025, "url": "https://news.ycombinator.com/item?id=46896025", "by": "tim-tday", "date": "2026-02-04", "stance": "recommend", "quote": "Fail2ban also helps block repeated attempts like that.", "excerpt": "They probably mean leaving ssh open to all ips. Take a look at your auth failure logs to see the thousands of daily attempts to compromise your server using default passwords. Most of those are low effort and low risk. Sometimes the bots will try password stuffing. Disabling password auth in sshd config is good practice. Fail2ban also helps block repeated attempts like that. There\u2019s also the risk of a zero day RCE vu", "context": "", "use_case": "blocking SSH brute force", "switched_from": "", "story": "Ask HN: Is Connecting via SSH Risky?"}, {"id": 788924272, "item_id": 49307767, "url": "https://news.ycombinator.com/item?id=49307767", "by": "topspin", "date": "2026-08-14", "stance": "recommend", "quote": "I use both on one port 22 host.", "excerpt": "> Geoblocking, fail2ban I use both on one port 22 host. Not much actually touches the server: maybe 5 hosts a day get banned. Meanwhile, China and the Netherlands are forever getting blocked and logged by geoblocking. I check the 24h log window by country most business days. Some days China leads, other days the Netherlands pulls ahead. Almost never are any other countries close to those two.", "context": "", "use_case": "banning abusive SSH hosts", "switched_from": "", "story": "I close SSH port 22 (and what I use instead)"}, {"id": 785216544, "item_id": 49076034, "url": "https://news.ycombinator.com/item?id=49076034", "by": "exiguus", "date": "2026-07-27", "stance": "recommend", "quote": "I use fail2ban to parse HTTP logs and temporarily ban IPs for N hours", "excerpt": "In my view, if blocking is necessary, whitelisting is generally more effective than blacklisting. And if whitelisting isn't feasible, this might be a poor solution. On the other hand, tools like Cloudflare and Anubis can create serous accessibility issues; some more than others. I prefer rate limiting; it's elegant and avoids accessibility problems. For temporary issues, short-term IP bans can also work well. Persona", "context": "", "use_case": "banning abusive IPs", "switched_from": "", "story": "How to Block Some of the Bots"}, {"id": 785003520, "item_id": 49062720, "url": "https://news.ycombinator.com/item?id=49062720", "by": "billfor", "date": "2026-07-26", "stance": "recommend", "quote": "I just use fail2ban and it seems to do a pretty good job", "excerpt": "I just use fail2ban and it seems to do a pretty good job, but you do need to pay attention for the first couple of months, to tune it to your situation. I use one filter that is really just failregex = ^<HOST> - \\S+ \\[\\] \".*?\" 40[034], and then if that catches something I add it to another more specific list. So far I have about 80 specific regex's and it has stopped all of the traffic. I haven't had anything fallthr", "context": "", "use_case": "blocking bots", "switched_from": "", "story": "How to Block Some of the Bots"}]}, {"text": " usually alongside rate limiting, geoblocking or WAF rules.", "cites": [{"id": 784898177, "item_id": 49056136, "url": "https://news.ycombinator.com/item?id=49056136", "by": "wanderingpixel", "date": "2026-07-26", "stance": "recommend", "quote": "an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban", "excerpt": "It depends on what you define as unwanted traffic. Personally I do not have an issue with bots as long as they behave and are not straight up malicious, so I rely on a combination of rate limiting, a fine-tuned OWASP CRS ruleset and an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban, 2 bans and you get banned for 30 days). My sites also make extensive use of static elements and caching.", "context": "", "use_case": "banning abusive clients", "switched_from": "", "story": "Ask HN: Protecting your Sites/Services from Unwanted Traffic?"}, {"id": 788924272, "item_id": 49307767, "url": "https://news.ycombinator.com/item?id=49307767", "by": "topspin", "date": "2026-08-14", "stance": "recommend", "quote": "I use both on one port 22 host.", "excerpt": "> Geoblocking, fail2ban I use both on one port 22 host. Not much actually touches the server: maybe 5 hosts a day get banned. Meanwhile, China and the Netherlands are forever getting blocked and logged by geoblocking. I check the 24h log window by country most business days. Some days China leads, other days the Netherlands pulls ahead. Almost never are any other countries close to those two.", "context": "", "use_case": "banning abusive SSH hosts", "switched_from": "", "story": "I close SSH port 22 (and what I use instead)"}, {"id": 785216544, "item_id": 49076034, "url": "https://news.ycombinator.com/item?id=49076034", "by": "exiguus", "date": "2026-07-27", "stance": "recommend", "quote": "I use fail2ban to parse HTTP logs and temporarily ban IPs for N hours", "excerpt": "In my view, if blocking is necessary, whitelisting is generally more effective than blacklisting. And if whitelisting isn't feasible, this might be a poor solution. On the other hand, tools like Cloudflare and Anubis can create serous accessibility issues; some more than others. I prefer rate limiting; it's elegant and avoids accessibility problems. For temporary issues, short-term IP bans can also work well. Persona", "context": "", "use_case": "banning abusive IPs", "switched_from": "", "story": "How to Block Some of the Bots"}]}, {"text": " Caveats include months of tuning, trouble behind load balancers and a false sense of security,", "cites": [{"id": 785003520, "item_id": 49062720, "url": "https://news.ycombinator.com/item?id=49062720", "by": "billfor", "date": "2026-07-26", "stance": "recommend", "quote": "I just use fail2ban and it seems to do a pretty good job", "excerpt": "I just use fail2ban and it seems to do a pretty good job, but you do need to pay attention for the first couple of months, to tune it to your situation. I use one filter that is really just failregex = ^<HOST> - \\S+ \\[\\] \".*?\" 40[034], and then if that catches something I add it to another more specific list. So far I have about 80 specific regex's and it has stopped all of the traffic. I haven't had anything fallthr", "context": "", "use_case": "blocking bots", "switched_from": "", "story": "How to Block Some of the Bots"}, {"id": 779593152, "item_id": 48724572, "url": "https://news.ycombinator.com/item?id=48724572", "by": "jasongill", "date": "2026-06-29", "stance": "warn", "quote": "right behind \"we use fail2ban to protect us\" as the #1 clue", "excerpt": "I've been in the industry for a long, long time, and I would say that use of bastion hosts ranks #2 on my list of things that tell me your environment is not secure (right behind \"we use fail2ban to protect us\" as the #1 clue). I've bought a bunch of companies and seriously evaluated hundreds of them, and the ones where people had a bastion host set up commonly seemed to act as if it protected them from everything, t", "context": "has bought companies and evaluated hundreds of them", "use_case": "", "switched_from": "", "story": "JumpServer: Open-Source Privileged Access Management"}]}, {"text": " and some prefer alternatives such as sshguard or PAM/nftables rate limiting.", "cites": [{"id": 767352144, "item_id": 47959509, "url": "https://news.ycombinator.com/item?id=47959509", "by": "c0l0", "date": "2026-04-30", "stance": "compare", "quote": "an (imo) better approach than fail2ban parsing your logs to deal with the problem", "excerpt": "I recommend https://johannes.truschnigg.info/writing/2025-02-simple_effective_ssh_ratelimiting_pam_nftables/ as an (imo) better approach than fail2ban parsing your logs to deal with the problem.", "context": "", "use_case": "SSH brute-force mitigation", "switched_from": "", "story": "Who Is That Knocking at My (SSH) Door?"}, {"id": 792313154, "item_id": 49519572, "url": "https://news.ycombinator.com/item?id=49519572", "by": "jech", "date": "2026-09-01", "stance": "compare", "quote": "it's a drop-in replacement for fail2ban", "excerpt": "> https://fail2zig.com Thanks. I've had a quick look, and it looks like it's a drop-in replacement for fail2ban (it claims to parse fail2ban's configuration files unchanged), except that it doesn't require a Python runtime. I haven't tried it, since I'm currently happy with sshguard. I'm keeping the link handy in case I find I need more features than what sshguard provides.", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: Alternatives to Fail2ban?"}]}], "praise": [{"label": "Web log banning", "summary": "Parses HTTP logs to ban IPs that hit forbidden paths or trigger error codes.", "quotes": [{"id": 785216544, "item_id": 49076034, "url": "https://news.ycombinator.com/item?id=49076034", "by": "exiguus", "date": "2026-07-27", "stance": "recommend", "quote": "I use fail2ban to parse HTTP logs and temporarily ban IPs for N hours", "excerpt": "In my view, if blocking is necessary, whitelisting is generally more effective than blacklisting. And if whitelisting isn't feasible, this might be a poor solution. On the other hand, tools like Cloudflare and Anubis can create serous accessibility issues; some more than others. I prefer rate limiting; it's elegant and avoids accessibility problems. For temporary issues, short-term IP bans can also work well. Persona", "context": "", "use_case": "banning abusive IPs", "switched_from": "", "story": "How to Block Some of the Bots"}, {"id": 785003520, "item_id": 49062720, "url": "https://news.ycombinator.com/item?id=49062720", "by": "billfor", "date": "2026-07-26", "stance": "recommend", "quote": "I just use fail2ban and it seems to do a pretty good job", "excerpt": "I just use fail2ban and it seems to do a pretty good job, but you do need to pay attention for the first couple of months, to tune it to your situation. I use one filter that is really just failregex = ^<HOST> - \\S+ \\[\\] \".*?\" 40[034], and then if that catches something I add it to another more specific list. So far I have about 80 specific regex's and it has stopped all of the traffic. I haven't had anything fallthr", "context": "", "use_case": "blocking bots", "switched_from": "", "story": "How to Block Some of the Bots"}, {"id": 784898177, "item_id": 49056136, "url": "https://news.ycombinator.com/item?id=49056136", "by": "wanderingpixel", "date": "2026-07-26", "stance": "recommend", "quote": "an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban", "excerpt": "It depends on what you define as unwanted traffic. Personally I do not have an issue with bots as long as they behave and are not straight up malicious, so I rely on a combination of rate limiting, a fine-tuned OWASP CRS ruleset and an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban, 2 bans and you get banned for 30 days). My sites also make extensive use of static elements and caching.", "context": "", "use_case": "banning abusive clients", "switched_from": "", "story": "Ask HN: Protecting your Sites/Services from Unwanted Traffic?"}]}, {"label": "Layered defense", "summary": "Commenters pair it with geoblocking, rate limiting, OWASP CRS rules or self-hosted apps.", "quotes": [{"id": 788924272, "item_id": 49307767, "url": "https://news.ycombinator.com/item?id=49307767", "by": "topspin", "date": "2026-08-14", "stance": "recommend", "quote": "I use both on one port 22 host.", "excerpt": "> Geoblocking, fail2ban I use both on one port 22 host. Not much actually touches the server: maybe 5 hosts a day get banned. Meanwhile, China and the Netherlands are forever getting blocked and logged by geoblocking. I check the 24h log window by country most business days. Some days China leads, other days the Netherlands pulls ahead. Almost never are any other countries close to those two.", "context": "", "use_case": "banning abusive SSH hosts", "switched_from": "", "story": "I close SSH port 22 (and what I use instead)"}, {"id": 784898177, "item_id": 49056136, "url": "https://news.ycombinator.com/item?id=49056136", "by": "wanderingpixel", "date": "2026-07-26", "stance": "recommend", "quote": "an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban", "excerpt": "It depends on what you define as unwanted traffic. Personally I do not have an issue with bots as long as they behave and are not straight up malicious, so I rely on a combination of rate limiting, a fine-tuned OWASP CRS ruleset and an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban, 2 bans and you get banned for 30 days). My sites also make extensive use of static elements and caching.", "context": "", "use_case": "banning abusive clients", "switched_from": "", "story": "Ask HN: Protecting your Sites/Services from Unwanted Traffic?"}, {"id": 746361985, "item_id": 46647624, "url": "https://news.ycombinator.com/item?id=46647624", "by": "barishnamazov", "date": "2026-01-16", "stance": "recommend", "quote": "I use a self hosted HedgeDoc with Fail2Ban to deal with this.", "excerpt": "I use a self hosted HedgeDoc with Fail2Ban to deal with this. A cheap VPS + Coolify makes life so much better. Separately, be cautious of people putting illegal content on your platform.", "context": "", "use_case": "abuse protection", "switched_from": "", "story": "Show HN: mdto.page \u2013 Turn Markdown into a shareable webpage instantly"}]}, {"label": "Tunable bans", "summary": "Custom regex filters and ban durations let users set aggressive or temporary bans.", "quotes": [{"id": 784898177, "item_id": 49056136, "url": "https://news.ycombinator.com/item?id=49056136", "by": "wanderingpixel", "date": "2026-07-26", "stance": "recommend", "quote": "an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban", "excerpt": "It depends on what you define as unwanted traffic. Personally I do not have an issue with bots as long as they behave and are not straight up malicious, so I rely on a combination of rate limiting, a fine-tuned OWASP CRS ruleset and an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban, 2 bans and you get banned for 30 days). My sites also make extensive use of static elements and caching.", "context": "", "use_case": "banning abusive clients", "switched_from": "", "story": "Ask HN: Protecting your Sites/Services from Unwanted Traffic?"}, {"id": 785003520, "item_id": 49062720, "url": "https://news.ycombinator.com/item?id=49062720", "by": "billfor", "date": "2026-07-26", "stance": "recommend", "quote": "I just use fail2ban and it seems to do a pretty good job", "excerpt": "I just use fail2ban and it seems to do a pretty good job, but you do need to pay attention for the first couple of months, to tune it to your situation. I use one filter that is really just failregex = ^<HOST> - \\S+ \\[\\] \".*?\" 40[034], and then if that catches something I add it to another more specific list. So far I have about 80 specific regex's and it has stopped all of the traffic. I haven't had anything fallthr", "context": "", "use_case": "blocking bots", "switched_from": "", "story": "How to Block Some of the Bots"}, {"id": 785216544, "item_id": 49076034, "url": "https://news.ycombinator.com/item?id=49076034", "by": "exiguus", "date": "2026-07-27", "stance": "recommend", "quote": "I use fail2ban to parse HTTP logs and temporarily ban IPs for N hours", "excerpt": "In my view, if blocking is necessary, whitelisting is generally more effective than blacklisting. And if whitelisting isn't feasible, this might be a poor solution. On the other hand, tools like Cloudflare and Anubis can create serous accessibility issues; some more than others. I prefer rate limiting; it's elegant and avoids accessibility problems. For temporary issues, short-term IP bans can also work well. Persona", "context": "", "use_case": "banning abusive IPs", "switched_from": "", "story": "How to Block Some of the Bots"}]}, {"label": "SSH brute-force", "summary": "Helps block repeated SSH login attempts on exposed hosts.", "quotes": [{"id": 750336400, "item_id": 46896025, "url": "https://news.ycombinator.com/item?id=46896025", "by": "tim-tday", "date": "2026-02-04", "stance": "recommend", "quote": "Fail2ban also helps block repeated attempts like that.", "excerpt": "They probably mean leaving ssh open to all ips. Take a look at your auth failure logs to see the thousands of daily attempts to compromise your server using default passwords. Most of those are low effort and low risk. Sometimes the bots will try password stuffing. Disabling password auth in sshd config is good practice. Fail2ban also helps block repeated attempts like that. There\u2019s also the risk of a zero day RCE vu", "context": "", "use_case": "blocking SSH brute force", "switched_from": "", "story": "Ask HN: Is Connecting via SSH Risky?"}, {"id": 788924272, "item_id": 49307767, "url": "https://news.ycombinator.com/item?id=49307767", "by": "topspin", "date": "2026-08-14", "stance": "recommend", "quote": "I use both on one port 22 host.", "excerpt": "> Geoblocking, fail2ban I use both on one port 22 host. Not much actually touches the server: maybe 5 hosts a day get banned. Meanwhile, China and the Netherlands are forever getting blocked and logged by geoblocking. I check the 24h log window by country most business days. Some days China leads, other days the Netherlands pulls ahead. Almost never are any other countries close to those two.", "context": "", "use_case": "banning abusive SSH hosts", "switched_from": "", "story": "I close SSH port 22 (and what I use instead)"}]}, {"label": "Effective once tuned", "summary": "One user says about 80 specific regexes have stopped all of the unwanted traffic.", "quotes": [{"id": 785003520, "item_id": 49062720, "url": "https://news.ycombinator.com/item?id=49062720", "by": "billfor", "date": "2026-07-26", "stance": "recommend", "quote": "I just use fail2ban and it seems to do a pretty good job", "excerpt": "I just use fail2ban and it seems to do a pretty good job, but you do need to pay attention for the first couple of months, to tune it to your situation. I use one filter that is really just failregex = ^<HOST> - \\S+ \\[\\] \".*?\" 40[034], and then if that catches something I add it to another more specific list. So far I have about 80 specific regex's and it has stopped all of the traffic. I haven't had anything fallthr", "context": "", "use_case": "blocking bots", "switched_from": "", "story": "How to Block Some of the Bots"}]}], "caveats": [{"label": "Tuning effort", "summary": "You need to watch and tune it for the first couple of months.", "quotes": [{"id": 785003520, "item_id": 49062720, "url": "https://news.ycombinator.com/item?id=49062720", "by": "billfor", "date": "2026-07-26", "stance": "recommend", "quote": "I just use fail2ban and it seems to do a pretty good job", "excerpt": "I just use fail2ban and it seems to do a pretty good job, but you do need to pay attention for the first couple of months, to tune it to your situation. I use one filter that is really just failregex = ^<HOST> - \\S+ \\[\\] \".*?\" 40[034], and then if that catches something I add it to another more specific list. So far I have about 80 specific regex's and it has stopped all of the traffic. I haven't had anything fallthr", "context": "", "use_case": "blocking bots", "switched_from": "", "story": "How to Block Some of the Bots"}]}, {"label": "Load balancers", "summary": "It becomes a pain when traffic is handled through a load balancer.", "quotes": [{"id": 785003520, "item_id": 49062720, "url": "https://news.ycombinator.com/item?id=49062720", "by": "billfor", "date": "2026-07-26", "stance": "recommend", "quote": "I just use fail2ban and it seems to do a pretty good job", "excerpt": "I just use fail2ban and it seems to do a pretty good job, but you do need to pay attention for the first couple of months, to tune it to your situation. I use one filter that is really just failregex = ^<HOST> - \\S+ \\[\\] \".*?\" 40[034], and then if that catches something I add it to another more specific list. So far I have about 80 specific regex's and it has stopped all of the traffic. I haven't had anything fallthr", "context": "", "use_case": "blocking bots", "switched_from": "", "story": "How to Block Some of the Bots"}]}, {"label": "False security", "summary": "One evaluator of companies treats relying on fail2ban for protection as a sign of an insecure environment.", "quotes": [{"id": 779593152, "item_id": 48724572, "url": "https://news.ycombinator.com/item?id=48724572", "by": "jasongill", "date": "2026-06-29", "stance": "warn", "quote": "right behind \"we use fail2ban to protect us\" as the #1 clue", "excerpt": "I've been in the industry for a long, long time, and I would say that use of bastion hosts ranks #2 on my list of things that tell me your environment is not secure (right behind \"we use fail2ban to protect us\" as the #1 clue). I've bought a bunch of companies and seriously evaluated hundreds of them, and the ones where people had a bastion host set up commonly seemed to act as if it protected them from everything, t", "context": "has bought companies and evaluated hundreds of them", "use_case": "", "switched_from": "", "story": "JumpServer: Open-Source Privileged Access Management"}]}, {"label": "Alternatives preferred", "summary": "Some prefer PAM/nftables rate limiting or sshguard over log parsing.", "quotes": [{"id": 767352144, "item_id": 47959509, "url": "https://news.ycombinator.com/item?id=47959509", "by": "c0l0", "date": "2026-04-30", "stance": "compare", "quote": "an (imo) better approach than fail2ban parsing your logs to deal with the problem", "excerpt": "I recommend https://johannes.truschnigg.info/writing/2025-02-simple_effective_ssh_ratelimiting_pam_nftables/ as an (imo) better approach than fail2ban parsing your logs to deal with the problem.", "context": "", "use_case": "SSH brute-force mitigation", "switched_from": "", "story": "Who Is That Knocking at My (SSH) Door?"}, {"id": 792313154, "item_id": 49519572, "url": "https://news.ycombinator.com/item?id=49519572", "by": "jech", "date": "2026-09-01", "stance": "compare", "quote": "it's a drop-in replacement for fail2ban", "excerpt": "> https://fail2zig.com Thanks. I've had a quick look, and it looks like it's a drop-in replacement for fail2ban (it claims to parse fail2ban's configuration files unchanged), except that it doesn't require a Python runtime. I haven't tried it, since I'm currently happy with sshguard. I'm keeping the link handy in case I find I need more features than what sshguard provides.", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: Alternatives to Fail2ban?"}]}, {"label": "Python runtime", "summary": "It needs a Python runtime, which a drop-in replacement avoids.", "quotes": [{"id": 792313154, "item_id": 49519572, "url": "https://news.ycombinator.com/item?id=49519572", "by": "jech", "date": "2026-09-01", "stance": "compare", "quote": "it's a drop-in replacement for fail2ban", "excerpt": "> https://fail2zig.com Thanks. I've had a quick look, and it looks like it's a drop-in replacement for fail2ban (it claims to parse fail2ban's configuration files unchanged), except that it doesn't require a Python runtime. I haven't tried it, since I'm currently happy with sshguard. I'm keeping the link handy in case I find I need more features than what sshguard provides.", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: Alternatives to Fail2ban?"}]}], "who": [], "tags": ["for web servers", "for SSH hardening", "for self-hosters", "for Linux servers"], "use_cases": ["banning abusive ssh hosts", "banning abusive ips", "blocking bots", "banning abusive clients", "securing linux server", "ssh brute-force mitigation"], "compared": [{"slug": "sshguard", "name": "sshguard", "co": 5, "switched_from": 0, "switched_to": 2}, {"slug": "fail2zig", "name": "fail2zig", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49060945", "title": "How to Block Some of the Bots", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49477766", "title": "Ask HN: Alternatives to Fail2ban?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49248388", "title": "I close SSH port 22 (and what I use instead)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49054859", "title": "Ask HN: Protecting your Sites/Services from Unwanted Traffic?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48945241", "title": "AWS: Inaccurate Estimated Billing Data - $1.7 BILLION", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48723677", "title": "JumpServer: Open-Source Privileged Access Management", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {"recommend": 1}, "2026-02": {"recommend": 1}, "2026-03": {}, "2026-04": {"compare": 1}, "2026-05": {}, "2026-06": {"warn": 1}, "2026-07": {"neutral": 1, "recommend": 3}, "2026-08": {"recommend": 1}, "2026-09": {"compare": 1}, "2026-10": {}}, "quotes": [{"id": 792313154, "item_id": 49519572, "url": "https://news.ycombinator.com/item?id=49519572", "by": "jech", "date": "2026-09-01", "stance": "compare", "quote": "it's a drop-in replacement for fail2ban", "excerpt": "> https://fail2zig.com Thanks. I've had a quick look, and it looks like it's a drop-in replacement for fail2ban (it claims to parse fail2ban's configuration files unchanged), except that it doesn't require a Python runtime. I haven't tried it, since I'm currently happy with sshguard. I'm keeping the link handy in case I find I need more features than what sshguard provides.", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: Alternatives to Fail2ban?"}, {"id": 788924272, "item_id": 49307767, "url": "https://news.ycombinator.com/item?id=49307767", "by": "topspin", "date": "2026-08-14", "stance": "recommend", "quote": "I use both on one port 22 host.", "excerpt": "> Geoblocking, fail2ban I use both on one port 22 host. Not much actually touches the server: maybe 5 hosts a day get banned. Meanwhile, China and the Netherlands are forever getting blocked and logged by geoblocking. I check the 24h log window by country most business days. Some days China leads, other days the Netherlands pulls ahead. Almost never are any other countries close to those two.", "context": "", "use_case": "banning abusive SSH hosts", "switched_from": "", "story": "I close SSH port 22 (and what I use instead)"}, {"id": 785216544, "item_id": 49076034, "url": "https://news.ycombinator.com/item?id=49076034", "by": "exiguus", "date": "2026-07-27", "stance": "recommend", "quote": "I use fail2ban to parse HTTP logs and temporarily ban IPs for N hours", "excerpt": "In my view, if blocking is necessary, whitelisting is generally more effective than blacklisting. And if whitelisting isn't feasible, this might be a poor solution. On the other hand, tools like Cloudflare and Anubis can create serous accessibility issues; some more than others. I prefer rate limiting; it's elegant and avoids accessibility problems. For temporary issues, short-term IP bans can also work well. Persona", "context": "", "use_case": "banning abusive IPs", "switched_from": "", "story": "How to Block Some of the Bots"}, {"id": 785003520, "item_id": 49062720, "url": "https://news.ycombinator.com/item?id=49062720", "by": "billfor", "date": "2026-07-26", "stance": "recommend", "quote": "I just use fail2ban and it seems to do a pretty good job", "excerpt": "I just use fail2ban and it seems to do a pretty good job, but you do need to pay attention for the first couple of months, to tune it to your situation. I use one filter that is really just failregex = ^<HOST> - \\S+ \\[\\] \".*?\" 40[034], and then if that catches something I add it to another more specific list. So far I have about 80 specific regex's and it has stopped all of the traffic. I haven't had anything fallthr", "context": "", "use_case": "blocking bots", "switched_from": "", "story": "How to Block Some of the Bots"}, {"id": 784898177, "item_id": 49056136, "url": "https://news.ycombinator.com/item?id=49056136", "by": "wanderingpixel", "date": "2026-07-26", "stance": "recommend", "quote": "an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban", "excerpt": "It depends on what you define as unwanted traffic. Personally I do not have an issue with bots as long as they behave and are not straight up malicious, so I rely on a combination of rate limiting, a fine-tuned OWASP CRS ruleset and an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban, 2 bans and you get banned for 30 days). My sites also make extensive use of static elements and caching.", "context": "", "use_case": "banning abusive clients", "switched_from": "", "story": "Ask HN: Protecting your Sites/Services from Unwanted Traffic?"}, {"id": 783182049, "item_id": 48948878, "url": "https://news.ycombinator.com/item?id=48948878", "by": "ButlerianJihad", "date": "2026-07-17", "stance": "neutral", "quote": "I put fail2ban and I filtered a lot of ports", "excerpt": "For a while I had a portion of my \"homelab\" on AWS. I was an educator in a classroom where the students were learning cloud stuff, and the instructor was encouraging the students to stand-up cloud environments for learning, so I figured that I would do the same. I used AWS' free tier, of course, and I enjoyed the initial setup in EC2, and I did a LAMP-stack MediaWiki installation. It wasn't too difficult, but two thi", "context": "", "use_case": "securing Linux server", "switched_from": "", "story": "AWS: Inaccurate Estimated Billing Data - $1.7 BILLION"}, {"id": 779593152, "item_id": 48724572, "url": "https://news.ycombinator.com/item?id=48724572", "by": "jasongill", "date": "2026-06-29", "stance": "warn", "quote": "right behind \"we use fail2ban to protect us\" as the #1 clue", "excerpt": "I've been in the industry for a long, long time, and I would say that use of bastion hosts ranks #2 on my list of things that tell me your environment is not secure (right behind \"we use fail2ban to protect us\" as the #1 clue). I've bought a bunch of companies and seriously evaluated hundreds of them, and the ones where people had a bastion host set up commonly seemed to act as if it protected them from everything, t", "context": "has bought companies and evaluated hundreds of them", "use_case": "", "switched_from": "", "story": "JumpServer: Open-Source Privileged Access Management"}, {"id": 767352144, "item_id": 47959509, "url": "https://news.ycombinator.com/item?id=47959509", "by": "c0l0", "date": "2026-04-30", "stance": "compare", "quote": "an (imo) better approach than fail2ban parsing your logs to deal with the problem", "excerpt": "I recommend https://johannes.truschnigg.info/writing/2025-02-simple_effective_ssh_ratelimiting_pam_nftables/ as an (imo) better approach than fail2ban parsing your logs to deal with the problem.", "context": "", "use_case": "SSH brute-force mitigation", "switched_from": "", "story": "Who Is That Knocking at My (SSH) Door?"}, {"id": 750336400, "item_id": 46896025, "url": "https://news.ycombinator.com/item?id=46896025", "by": "tim-tday", "date": "2026-02-04", "stance": "recommend", "quote": "Fail2ban also helps block repeated attempts like that.", "excerpt": "They probably mean leaving ssh open to all ips. Take a look at your auth failure logs to see the thousands of daily attempts to compromise your server using default passwords. Most of those are low effort and low risk. Sometimes the bots will try password stuffing. Disabling password auth in sshd config is good practice. Fail2ban also helps block repeated attempts like that. There\u2019s also the risk of a zero day RCE vu", "context": "", "use_case": "blocking SSH brute force", "switched_from": "", "story": "Ask HN: Is Connecting via SSH Risky?"}, {"id": 746361985, "item_id": 46647624, "url": "https://news.ycombinator.com/item?id=46647624", "by": "barishnamazov", "date": "2026-01-16", "stance": "recommend", "quote": "I use a self hosted HedgeDoc with Fail2Ban to deal with this.", "excerpt": "I use a self hosted HedgeDoc with Fail2Ban to deal with this. A cheap VPS + Coolify makes life so much better. Separately, be cautious of people putting illegal content on your platform.", "context": "", "use_case": "abuse protection", "switched_from": "", "story": "Show HN: mdto.page \u2013 Turn Markdown into a shareable webpage instantly"}]}