fail2ban Locked You Out of Your Own Server

fail2ban did its job — on you. You have two escape routes: a console/serial console from your provider, or a second allowed IP. Then whitelist yourself before it happens again.

What you'll see

Root causes

Repeated auth failures from your IP

Wrong key, agent forwarding quirks, or a CI deploy script with a bad password tripping maxretry in quick succession — especially findtime-windowed.

Overly strict jail: maxretry too low / regex matching normal lines

A jail banning on 2-3 failures with a broad filter catches legitimate clients. Check the jail's config and the actual log lines it matched.

Fix it

  1. Get in via an out-of-band console (provider web console / IPMI / cloud 'serial console')
    # from console: sudo fail2ban-client set sshd unbanip <your-ip>   # or: sudo iptables -D f2b-sshd -s <your-ip> -j DROP
  2. If you have a second allowed IP, unban from there
    ssh user@server 'sudo fail2ban-client set sshd unbanip <banned-ip>'
  3. Whitelist yourself permanently before it recurs
    # /etc/fail2ban/jail.local: [sshd] ignoreip = 127.0.0.1/8 <your-stable-ip>/32   then: sudo fail2ban-client reload
  4. Fix the source of the failures
    sudo zgrep 'Failed password' /var/log/auth.log* | tail   # or journalctl -u ssh | tail — see what fail2ban actually saw

Field note

Before a lockout ever happens, add ignoreip for your stable egress IP AND configure the provider's serial console access — test it once. Moving between networks (laptop, mobile) defeats static whitelists; use a small VPN/jump host with a fixed IP as your entry point.

Common questions

Will fail2ban unban me automatically?

Yes, after the jail's bantime expires (often 10m to 1d). If you set bantime=-1 (permanent) or a findtime-based incremental policy, it won't — that's why out-of-band access matters.

Why did my IP get banned when I only failed once?

findtime windows stack failures: retries from your deploy tooling, forgotten SSH agents, or a shared office NAT count together. Check the matched log lines in fail2ban-client status sshd or the fail2ban log before loosening rules.

Related fixes

Ship it right the first time

Our most-documented failures, packaged as ready-to-ship starter kits: Docker, Kubernetes, and Terraform.

Browse the template store →

One-time. Yours to modify. Instant download from the NinjaOps template store.