fail2ban banned me
I do security for a living. I harden other people's estates, I write the reports, I tell clients to layer their controls. So when I set up the VPS behind my app, I did it properly: keys, MFA on top, and fail2ban watching the auth logs, ready to ban any IP that kept getting authentication wrong.
Then one evening the IP that kept getting authentication wrong was mine.
What actually happened
A run of failed MFA attempts — the ordinary kind of human fumbling, a stale code here, a mistyped one there — landed in the same log stream fail2ban was watching for brute force. To the jail, a legitimate operator having a clumsy minute and an attacker grinding through codes look identical: repeated failures from one address inside the window. It did exactly what I configured it to do, on the box I needed to be on.
The remediation
- Count what you mean to count. Stack MFA on top of key auth and one human retry can emit several logged failures. Thresholds tuned for password brute force get sprinted straight through.
- Test the failure path. I had tested that logins worked. I had never tested what happened when they didn't — the only scenario fail2ban exists for.
- Know your side door before you need it. Provider console access is the plan, not a nice-to-have. Verify it while you're calm.
- Allowlists cut both ways. Pinning your own address feels like the fix until your address changes and the entry is quietly worthless.
The lesson isn't that fail2ban is bad. fail2ban was flawless — it enforced my specification precisely. The problem was the gap between what I specified and what I intended, which is where most security failures live. Your config file is a contract, and it will be honoured to the letter, including against you.