About

Imported from terminalskills/skills (skills/fail2ban/SKILL.md). Install upstream with npx skills add terminalskills/skills --skill fail2ban. Copyright stays with the author (Apache-2.0).

Fail2Ban

Name: fail2ban
Author: terminalskills

Overview

Fail2Ban monitors log files for failed authentication attempts and bans offending IPs using iptables/nftables. Protects SSH, Nginx, Apache, Postfix, and any service with log-based authentication.

Instructions

Step 1: Install

sudo apt install fail2ban
sudo systemctl enable fail2ban

Step 2: Configure

# /etc/fail2ban/jail.local — Custom configuration (never edit jail.conf)
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5
banaction = iptables-multiport

[sshd]
enabled = true
port = ssh
maxretry = 3
bantime = 24h

[nginx-http-auth]
enabled = true
port = http,https
maxretry = 5

[nginx-botsearch]
enabled = true
port = http,https
maxretry = 2
bantime = 7d

Step 3: Monitor

sudo fail2ban-client status               # list active jails
sudo fail2ban-client status sshd           # show banned IPs
sudo fail2ban-client set sshd unbanip 1.2.3.4   # unban
sudo fail2ban-client set sshd banip 5.6.7.8     # manual ban

Guidelines

Always create jail.local — jail.conf gets overwritten on updates.
Start conservative: 5 retries, 1h ban. Adjust based on logs.
For modern alternative with community threat sharing, consider CrowdSec.
Use fail2ban-regex to test custom filters before deploying.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/terminalskills-skills-fail2ban/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

terminalskills-skills-fail2ban.ocm.jsonjson

{
  "ocm": "1",
  "id": "terminalskills-skills-fail2ban",
  "kind": "skill",
  "name": "fail2ban",
  "description": "Protect servers from brute force attacks with Fail2Ban. Use when a user asks to block repeated failed login attempts, protect SSH, secure web servers from brute force, or ban malicious IPs automatically.",
  "publisher": "terminalskills",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "fail2ban",
      "brute-force",
      "ssh",
      "security",
      "firewall",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Protect servers from brute force attacks with Fail2Ban. Use when a user asks to block repeated failed login attempts, protect SSH, secure web servers from brute force, or ban malicious IPs automatically."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/terminalskills/skills",
      "path": "skills/fail2ban/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/terminalskills/skills/blob/HEAD/skills/fail2ban/SKILL.md",
      "key": "terminalskills/skills/skills/fail2ban/SKILL.md"
    },
    "compatibility": "Linux",
    "license": "Apache-2.0"
  },
  "instructions": "# Fail2Ban\n\n## Overview\n\nFail2Ban monitors log files for failed authentication attempts and bans offending IPs using iptables/nftables. Protects SSH, Nginx, Apache, Postfix, and any service with log-based authentication.\n\n## Instructions\n\n### Step 1: Install\n\n```bash\nsudo apt install fail2ban\nsudo systemctl enable fail2ban\n```\n\n### Step 2: Configure\n\n```ini\n# /etc/fail2ban/jail.local — Custom configuration (never edit jail.conf)\n[DEFAULT]\nbantime = 1h\nfindtime = 10m\nmaxretry = 5\nbanaction = iptables-multiport\n\n[sshd]\nenabled = true\nport = ssh\nmaxretry = 3\nbantime = 24h\n\n[nginx-http-auth]\nenabl",
  "cost": {
    "context_tokens": 320
  }
}

Fetch it by URL: GET /api/v1/registry/terminalskills-skills-fail2ban/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.