The services behind the signals

Your services.
A shared defense.

Connect the logs you already have to a consistent ban policy. Find the supported events, check the input format, and follow the configuration guide.

11 service & sensor entries15 external-service filters1 internal recidive filter
Scan detection / connect since 0.4.3, stealth since 0.4.7

PortSentry detects.
fail2zig enforces.

Turn scan events from PortSentry’s history file into durable bans, in connect mode or stealth mode with pcap. PortSentry runs as a sensor with response actions disabled; fail2zig owns the ban policy and enforcement.

Qualified recipe PortSentry v2.0.7 · Debian 13 · IPv4 + IPv6 · TCP + UDP
Set up PortSentry →
From a connection attempt to a host ban
  1. 01
    PortSentryTCP-connect sensor · response disabled
  2. 02
    History file/var/log/portsentry.log · ISO 8601
  3. 03
    fail2zigportsentry filter · jail policy · durable state
  4. 04
    Host firewallSource ban across host ports and protocols

Ban, blocking while banned, expiry and restored connectivity were tested with nftables in connect mode and in stealth mode (TCP SYN, FIN, NULL and XMAS scans, and UDP). Legacy 1.2, other 2.x versions and alternate log envelopes are unqualified.

Each entry describes supported log patterns. Check your actual format with fail2zig rule-test; a matching sample alone does not establish live ingestion or packet enforcement.

SSH

Authentication and protocol failures at the front door.

OpenSSH

Authentication failures, invalid users, PAM failures and selected SSH protocol errors.

sshd
Log source
Supported SSH file logs or a trusted journald origin.
Coverage note
Match your message format and journal executable profile; distribution-wide support is not implied.
Configuration & examples for OpenSSH

Web servers

Act on the failures and probes your web server records.

Mail

Separate supported authentication and rejection events from ordinary traffic.

Postfix

Selected SMTP rejections, SASL authentication failures and lost-connection-after-AUTH patterns.

postfix
Log source
Postfix messages in the mail log.
Coverage note
Tune rejection thresholds for legitimate mail traffic; not every rejection establishes abuse.
Configuration & examples for Postfix

Dovecot

IMAP/POP3 authentication failures and selected PAM failures.

dovecot
Log source
Supported Dovecot messages in the mail log.
Coverage note
Ordinary disconnects without authentication attempts are not failure events.
Configuration & examples for Dovecot

Courier

Selected login and mail authentication failures.

courier
Log source
Courier authentication messages in the configured syslog file.
Coverage note
Coverage is limited to documented message forms; verify your actual logging destination.
Configuration & examples for Courier

Database

Built-in matching for existing access-denied log patterns.

MySQL log patterns

Supported access-denied messages containing a source address.

mysqld-auth
Log source
MySQL error-log patterns shown in the filter reference.
Coverage note
Not a blanket MySQL/MariaDB version guarantee or a new database qualification in 0.4.3.
Configuration & examples for MySQL log patterns

DNS

Apply policy to selected denied and refused queries.

BIND

Selected denied/refused DNS query events.

named-refused
Log source
Supported named messages in a file log.
Coverage note
Legitimate resolver misconfiguration can generate refusals; review thresholds and trusted sources.
Configuration & examples for BIND

FTP

Recognize supported login and security failures.

ProFTPD

Selected failed-login and security-violation events.

proftpd
Log source
Supported ProFTPD file-log forms.
Coverage note
Custom log layouts and other upstream versions require checking actual samples.
Configuration & examples for ProFTPD
Across your jails

Repeat offenders leave a history.

The sixteenth built-in filter, recidive, consumes confirmed bans inside fail2zig. Use it to apply repeat-offender policy across services.

Configure recidive →
Have a different log format?

Check the rule contract.

Bounded native JSON rules support documented custom patterns and offline evaluation. Arbitrary Fail2ban regexes and executable plugins are outside that contract.

Explore custom rules →

Find the signal. Set the policy.

Start with a real log sample, select its timestamp contract, and verify source readiness and enforcement on your host.

Build your configuration →Explore features