Example jail configuration

# /etc/fail2zig/config.toml
# ---------------------------------------------------------------
# Example production config: SSH + nginx basic auth + postfix.
# ---------------------------------------------------------------
 
[global]
# Operational logging. "info" is production; bump to "debug" when
# investigating specific match / ban decisions.
log_level         = "info"
 
# Where the daemon writes its process artifacts. Defaults are fine
# for any distribution using systemd conventions; only change if you
# are running under runit / s6 / OpenRC with different FHS layouts.
pid_file          = "/run/fail2zig/fail2zig.pid"
socket_path       = "/run/fail2zig/fail2zig.sock"
state_file        = "/var/lib/fail2zig/state.bin"
 
# Hard memory ceiling — enforced at the allocator level, not a target.
# 64 MB is generous for a single-host deployment. Drop to 32 on a
# memory-constrained VPS; raise only if you run >50 jails or pull from
# multi-GB log streams with long findtime windows.
memory_ceiling_mb = 64
 
# Prometheus metrics. Bind localhost only — the endpoint is read-only
# but leaks operational telemetry (jail names, ban rates, memory use)
# that is needlessly useful to a reconnaissance attacker.
metrics_bind      = "127.0.0.1"
metrics_port      = 9100
 
# ---------------------------------------------------------------
# Defaults that apply to every jail unless it overrides them.
# ---------------------------------------------------------------
 
[defaults]
# 10-minute first-offense ban, 10-minute sliding window, 5 failures
# required to trigger. Matches fail2ban's long-standing defaults so
# operators coming from there do not get surprised.
bantime   = 600
findtime  = 600
maxretry  = 5
 
# nftables is the preferred backend on any modern kernel (>= 3.13).
# The daemon falls back to iptables / ipset / log-only automatically
# if nftables is not available — setting this explicitly is a
# documentation choice, not a requirement.
banaction = "nftables"
 
# Never ban these sources, regardless of log content.
#  - Loopback: never reachable externally.
#  - Internal 10.0.0.0/8: your network; do not accidentally fence
#    yourself out during an incident.
#  - Ansible control host: the operator's own tooling is not an
#    attacker even when its retry policy looks like one.
ignoreip = [
    "127.0.0.1/8",
    "::1",
    "10.0.0.0/8",
    "192.168.1.50/32",
]
 
# Recidive escalation. A persistent attacker on the same IP hits
# longer and longer bans without any per-jail tuning required.
#   offense 1:  10 minutes
#   offense 2:  20 minutes
#   offense 3:  40 minutes
#   offense 4:  80 minutes
#   offense 5:  ~2.7 hours
#   offense 6+: eventually capped at 14 days
# Exponential is the right shape for this — linear lets a patient
# attacker probe forever without accumulating meaningful cost.
bantime_increment_enabled     = true
bantime_increment_formula     = "exponential"
bantime_increment_multiplier  = 1
bantime_increment_factor      = 2
bantime_increment_max_bantime = 1209600   # 14 days in seconds
 
# ---------------------------------------------------------------
# SSH is the highest-value surface on most servers. Tighten the
# threshold and extend the first-offense ban accordingly.
# ---------------------------------------------------------------
 
[jails.sshd]
enabled  = true
filter   = "sshd"
logpath  = [
    "/var/log/auth.log",  # Debian / Ubuntu convention
    "/var/log/secure",    # RHEL / Fedora / CentOS convention
]
 
# 3 failures instead of the default 5. Real users rarely miss their
# password three times in ten minutes; credential-stuffing botnets do
# so in under a second.
maxretry = 3
 
# 1-hour first-offense ban. Recidive escalation still applies on top
# of this, so a returning IP hits 2h / 4h / 8h / ... next.
bantime  = 3600
 
# ---------------------------------------------------------------
# nginx HTTP basic auth. Defaults are fine here — the surface is
# lower-value than SSH and legitimate users do sometimes fat-finger
# a password a few times.
# ---------------------------------------------------------------
 
[jails.nginx-http-auth]
enabled = true
filter  = "nginx-http-auth"
logpath = ["/var/log/nginx/error.log"]
# Inherits maxretry = 5, findtime = 600, bantime = 600 from [defaults].
 
# ---------------------------------------------------------------
# Postfix SASL. Tuned slightly longer than the default — mail
# auth failures are almost always automated, and a 30-minute ban
# costs real attackers meaningfully more than the stock 10-minute.
# ---------------------------------------------------------------
 
[jails.postfix]
enabled  = true
filter   = "postfix"
logpath  = [
    "/var/log/mail.log",   # Debian / Ubuntu
    "/var/log/maillog",    # RHEL / Fedora / CentOS
]
maxretry = 5
bantime  = 1800

sudo fail2zig --validate-config --config /etc/fail2zig/config.toml

config: OK (3 jail(s) configured)