Are you familiar with jail.local? jail.local is the admin‑controlled Fail2Ban configuration file that defines what to protect, how to detect attacks, and what actions to take — loaded at startup and overriding all defaults
WHO
Admins (you) create or edit jail.local. Fail2Ban never edits it automatically.
WHAT
jail.local is the override configuration file for Fail2Ban. It overrides jail.conf and is the correct place to put customizations.
WHEN
Fail2Ban reads jail.local:
* at service startup
* on reload (systemctl reload fail2ban)
* when restarting a jail (fail2ban-client reload )
Changes do not apply until Fail2Ban is reloaded or restarted.
WHERE
Location on most systems: /etc/fail2ban/jail.local
If it doesn’t exist, you create it: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
WHY
Fail2Ban uses jail.local so you can:
* customize jails safely
* avoid modifying the default jail.conf
* preserve settings during updates
* define your own filters and ban logic
* whitelist your IP ranges
* harden specific services (SSH, dovecot, cPanel, WHM, Apache, etc.)
It’s the persistent, admin‑controlled configuration file.
HOW
Fail2Ban loads jails from jail.local using this logic:
* Read jail.conf (defaults)
* Read jail.local (override)
* Merge settings
* Start jails
* Monitor logs
* Apply filters
* Execute ban actions
Example jail: # SSH – (SFTP/SSH authentication failures) # Exim (SMTP authentication failures) # Dovecot (IMAP/POP authentication failures) # Pure-FTPd (FTP authentication failures) # cPanel (cPanel authentication failures) # WHM (WHM authentication failures) # Webmail (Roundcube authentication failures)
jail.local
[DEFAULT]
banaction = csf
backend = systemd
findtime = 1
bantime = 86400
[sshd]
enabled = true
port = 22,7822
logpath = /var/log/secure
maxretry = 1
[exim]
enabled = true
filter = exim
logpath = /var/log/exim_mainlog
maxretry = 1
[dovecot]
enabled = true
filter = dovecot
logpath = /var/log/maillog
maxretry = 1
[pure-ftpd]
enabled = true
filter = pure-ftpd
logpath = /var/log/messages
maxretry = 1
[cpanel]
enabled = true
filter = cpanel
logpath = /usr/local/cpanel/logs/login_log
maxretry = 1
[whm]
enabled = true
filter = whm
logpath = /usr/local/cpanel/logs/login_log
maxretry = 1
[roundcube]
enabled = true
filter = roundcube-auth
logpath = /var/log/maillog
maxretry = 1
