Are you familiar with jail.local? jail.local is the admin‑controlled Fail2Ban configuration file that defines what to protect, how to detect attacks, and what actions to take — loaded at startup and overriding all defaults. Please note that the information applies to servers that use Fail2Ban directly (e.g., Debian, Ubuntu, CentOS without WHM). cPanel/WHM servers use CSF/LFD instead of Fail2Ban, so jail.local does not apply there. For WHM, use csf.ignore to whitelist IPs and adjust LFD settings for ban logic.
WHO
Admins (you) create or edit jail.local. Fail2Ban never edits it automatically.
WHAT
jail.local is the override configuration file for Fail2Ban. It overrides jail.conf and is the correct place to put customizations.
WHEN
Fail2Ban reads jail.local:
* at service startup
* on reload (systemctl reload fail2ban)
* when restarting a jail (fail2ban-client reload )
Changes do not apply until Fail2Ban is reloaded or restarted.
WHERE
Location on most systems: /etc/fail2ban/jail.local
If it doesn’t exist, you create it: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local [1]
WHY
Fail2Ban uses jail.local so you can:
* customize jails safely
* avoid modifying the default jail.conf
* preserve settings during updates
* define your own filters and ban logic
* whitelist your IP ranges
* harden specific services (SSH, dovecot, cPanel, WHM, Apache, etc.)
It’s the persistent, admin‑controlled configuration file.
HOW
Fail2Ban loads jails from jail.local using this logic:
* Read jail.conf (defaults)
* Read jail.local (override)
* Merge settings
* Start jails
* Monitor logs
* Apply filters
* Execute ban actions
[1] It’s a copy command:
* cp = copy
* /etc/fail2ban/jail.conf = the original Fail2Ban configuration file
* /etc/fail2ban/jail.local = a new file that overrides the original
So the command literally means: “Make a copy of jail.conf and name it jail.local.”
[spoiler title=”jail.local”][DEFAULT]
banaction = csf
backend = systemd
findtime = 1
bantime = 86400
# SSH – (SFTP/SSH authentication failures)
[sshd]
enabled = true
port = 22,7822
logpath = /var/log/secure
maxretry = 1
# Exim (SMTP authentication failures)
[exim]
enabled = true
filter = exim
logpath = /var/log/exim_mainlog
maxretry = 1
# Dovecot (IMAP/POP authentication failures)
[dovecot]
enabled = true
filter = dovecot
logpath = /var/log/maillog
maxretry = 1
# Pure-FTPd (FTP authentication failures)
[pure-ftpd]
enabled = true
filter = pure-ftpd
logpath = /var/log/messages
maxretry = 1
# cPanel (cPanel authentication failures)
[cpanel]
enabled = true
filter = cpanel
logpath = /usr/local/cpanel/logs/login_log
maxretry = 1
# WHM (WHM authentication failures)
[whm]
enabled = true
filter = whm
logpath = /usr/local/cpanel/logs/login_log
maxretry = 1
# Webmail (Roundcube authentication failures)
[roundcube]
enabled = true
filter = roundcube-auth
logpath = /var/log/maillog
maxretry = 1[/spoiler]
