Fail2Ban

Fail2Ban scans log files such as /var/log/auth.log and updates firewall rules to reject connections from IP addresses that trigger too many failed login attempts. It curbs repeated authentication abuse against services like sshd and Apache, with configurable ban times and log sources.

It reads standard system logs out of the box and can be pointed at any other logs and error patterns you define. Since v0.10 it can match IPv6 addresses. A fail2ban-client command manages and queries the running daemon, so jails can be reloaded, banned IPs unbanned, and status checked live.

It runs as a lightweight daemon on Linux, BSD, and macOS, packaged in most distributions. Ban filters and actions are fully customizable, letting you tune detection thresholds and choose how offenders are blocked across firewall back ends.