Bans legitimate IP address after failed SSH login attempts; exclude certain/valid users?
Author: ChealerCreated Jun 29, 2026Updated Jul 5, 2026
Labelsenhancement
My friend’s server stopped responding 2 days ago. My friend then helped me realized that he had installed Fail2Ban on his server. Version 1.1.0 banned my IP address after I made 5 or 6 attempts to log in via SSH using the wrong password.
Obviously, Fail2Ban is heuristic, but there would be ways to improve for our case, where the reason for using Fail2Ban is saving resources (computation, storage and bandwidth).
Possible solutions/mitigations
Both of the following improvements would help (either in isolation or combined):
- Whitelist IP addresses which successfully opened an SSH connection in the past (I had connected multiple times from that PC)
- Reduce the "reputational cost" of a connection attempt using an incorrect password for certain accounts. For example, an IP address could have a maximum of 5 attempts for account dummy, but 30 for account chealer. This reduction could apply to either:
- any existing user
- or specific whitelisted users
It is probably already possible to achieve 2.2 using ignoreregex, but it's not documented how.
Source: fail2ban/fail2ban