This guide explains how to add PureFTPd service to Fail2ban on Ubuntu, so that repeated failed login attempts against your FTP server automatically get blocked instead of left open to brute-force attacks. If you’re running Pure-FTPd on a public-facing Ubuntu server, this is one of the simplest, highest-value hardening steps you can take \u2014 and it takes only a few minutes to set up.<\/p>\n\n\n\n
Fail2ban works by scanning log files for patterns that indicate malicious activity \u2014 like repeated failed login attempts \u2014 and automatically banning the offending IP address for a configurable period of time, usually by adding a temporary firewall rule. By default, Fail2ban ships with filters for many common services, but FTP protection via Pure-FTPd isn’t always enabled out of the box, which is exactly what this guide walks through fixing.<\/p>\n\n\n\n
By the end of this post, Fail2ban will be actively monitoring your Pure-FTPd logs and automatically banning IPs that repeatedly fail to authenticate.<\/p>\n\n\n\n
Before you add PureFTPd service to Fail2ban on Ubuntu, make sure you have:<\/p>\n\n\n\n
If Fail2ban isn’t installed yet, follow our guide on installing Fail2ban on Ubuntu before continuing with the steps below.<\/p>\n\n\n\n
Before making changes, it helps to understand what’s actually happening under the hood. Fail2ban is made up of two main components that work together for each protected service:<\/p>\n\n\n\n
Fail2ban ships with a pre-built filter for Pure-FTPd ( Fail2ban includes a default filter definition for Pure-FTPd, but under a slightly different filename than what we’ll reference in the jail configuration. Copy it to a new filename for clarity and consistency with the jail name we’ll use:<\/p>\n\n\n\n Note:<\/strong> This step is mostly about naming consistency \u2014 you could reference Open Fail2ban’s local jail configuration file. Using Add the following block:<\/p>\n\n\n\n Here’s what each line configures:<\/p>\n\n\n\n Tip:<\/strong> You can also add a The If you see recent Pure-FTPd log entries, the path is correct. If not, check your Pure-FTPd configuration for a custom log path \u2014 commonly Apply the new configuration by restarting the Fail2ban service:<\/p>\n\n\n\n Confirm that Fail2ban picked up the new jail:<\/p>\n\n\n\n You should see This shows the filter and log file in use, along with any currently banned IP addresses.<\/p>\n\n\n\n It’s worth confirming the jail actually works rather than assuming it does. From a separate machine (not one you rely on for legitimate access, in case something goes wrong), attempt to log in to the FTP server with an incorrect password several times in a row \u2014 enough to exceed the Then check the jail status again:<\/p>\n\n\n\n You should see the test IP address listed under “Banned IP list.” If it isn’t showing up, double-check the log path from Step V and confirm Pure-FTPd is actually logging failed attempts in the format Fail2ban’s filter expects.<\/p>\n\n\n\n If you ever need to manually remove a ban \u2014 for example, after confirming a legitimate user was mistakenly blocked \u2014 use:<\/p>\n\n\n\n Replace The pureftpd jail doesn’t appear in Fail2ban restarts successfully but never bans anything:<\/strong> This almost always comes down to the This command shows exactly how many lines matched the filter pattern, which is useful for confirming whether the issue is the log path or the filter itself.<\/p>\n\n\n\n Legitimate users are getting banned too easily:<\/strong> Consider raising By default, Fail2ban bans IPs using firewall rules (via Send an email notification on ban:<\/strong><\/p>\n\n\n\n Fail2ban can notify you whenever a ban occurs, which is useful for keeping an eye on attack patterns without manually checking status output. This requires a working mail setup on your server, then adding an action like:<\/p>\n\n\n\n The Increase ban time for repeat offenders:<\/strong><\/p>\n\n\n\n Newer versions of Fail2ban support “recidive” jails, which specifically watch Fail2ban’s own log for IPs that get banned repeatedly across any jail, and apply a much longer ban the second time around. This is a more advanced setup, but worth exploring once your basic PureFTPd jail is confirmed working, since it meaningfully raises the cost of persistent attackers without added maintenance once configured.<\/p>\n\n\n\n Beyond checking jail status, Fail2ban keeps its own log file that records every ban, unban, and filter match \u2014 useful for auditing activity over time or diagnosing why a particular IP wasn’t banned when you expected it to be.<\/p>\n\n\n\n Watching this file live while intentionally triggering a few failed logins (as in the testing step above) is one of the most reliable ways to confirm the entire pipeline \u2014 from log line, to filter match, to ban action \u2014 is working end to end.<\/p>\n\n\n\n You can also filter the log for just PureFTPd-related entries:<\/p>\n\n\n\n This shows a clean history of every match and ban action taken specifically by this jail, which is helpful when you want to confirm the jail has actually been active over time, not just enabled in configuration.<\/p>\n\n\n\n A few additional steps worth considering alongside this Fail2ban configuration:<\/p>\n\n\n\n Adding Pure-FTPd to Fail2ban on Ubuntu is a quick, high-value change: copy the filter, define a jail with a sensible For more background on Fail2ban’s configuration options and available filters, see the official Fail2ban documentation.<\/p>\n\n\n\n Does Fail2ban work with FTPS or only plain FTP?<\/strong> Fail2ban itself works at the log-monitoring level, so it can protect FTPS the same way, as long as Pure-FTPd’s failed-login log format matches what the filter expects. The How long should I set the ban time for?<\/strong> There’s no universal answer, but many admins use anywhere from 1 hour to 24 hours for a first offense, with some Fail2ban configurations supporting escalating ban times for repeat offenders. Longer bans meaningfully deter automated attacks with minimal impact on real users, who rarely need to retry logins that many times.<\/p>\n\n\n\n Can I protect multiple services with Fail2ban at the same time?<\/strong> Yes \u2014 Fail2ban supports running many independent jails simultaneously, each targeting a different service (SSH, FTP, a web application login form, etc.), all defined in the same What happens if I ban my own IP address by accident during testing?<\/strong> Use the Why does my jail show as enabled but never actually bans any IPs, even during a real attack?<\/strong> This is almost always a mismatch between what the filter’s regex expects and what your Pure-FTPd version actually writes to the log. Log formats can differ slightly between Pure-FTPd versions and configurations (for example, whether it logs via syslog, a dedicated log file, or a custom format string). Running Hardening your server against brute-force attacks? Our team can help with firewall configuration, server hardening, and ongoing security monitoring.<\/p>\n\n\n\n Connect with our technology experts.<\/a><\/p>\n\n\n\npure-ftpd.conf<\/code>), but it isn’t enabled by default. The steps below activate it by creating a matching jail configuration.<\/p>\n\n\n\nIII. Copy the Pure-FTPd Filter File<\/h3>\n\n\n\n
cp \/etc\/fail2ban\/filter.d\/pure-ftpd.conf \/etc\/fail2ban\/filter.d\/pureftpd.conf\n<\/pre>\n\n\n\n
\n
pure-ftpd<\/code> directly in your jail configuration instead and skip the copy. Renaming it to pureftpd<\/code> here just keeps the filter name matching the jail name we’ll define next, which makes the configuration easier to read and maintain later.<\/p>\n<\/blockquote>\n\n\n\nIV. Configure the PureFTPd Jail<\/h3>\n\n\n\n
jail.local<\/code> instead of editing jail.conf<\/code> directly is important \u2014 jail.conf<\/code> gets overwritten on Fail2ban updates, while jail.local<\/code> is preserved and takes precedence:<\/p>\n\n\n\nvi \/etc\/fail2ban\/jail.local\n<\/pre>\n\n\n\n
[pureftpd]\nenabled = true\nport = ftp\nfilter = pureftpd\nlogpath = \/var\/log\/syslog\nmaxretry = 3\n<\/pre>\n\n\n\n
Setting<\/th> Purpose<\/th><\/tr><\/thead> enabled<\/code><\/td>Turns this jail on<\/td><\/tr> port<\/code><\/td>The service port to apply firewall bans against ( ftp<\/code> maps to port 21)<\/td><\/tr>filter<\/code><\/td>The filter file to use for pattern matching (references pureftpd.conf<\/code> from Step III)<\/td><\/tr>logpath<\/code><\/td>The log file Fail2ban monitors for failed login patterns<\/td><\/tr> maxretry<\/code><\/td>The number of failed attempts allowed before an IP is banned<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n \n
bantime<\/code> setting (in seconds) to control how long an IP stays banned, and findtime<\/code> to control the window of time maxretry<\/code> failures need to occur within. If omitted, Fail2ban uses the defaults defined elsewhere in your configuration (commonly a 10-minute ban with Fail2ban’s out-of-the-box defaults, though this varies by version and prior configuration).<\/p>\n<\/blockquote>\n\n\n\nV. Verify the Log Path Matches Your System<\/h3>\n\n\n\n
logpath<\/code> value above assumes Pure-FTPd logs to \/var\/log\/syslog<\/code>, which is common on Ubuntu when Pure-FTPd is configured to log via syslog. However, this can vary depending on how Pure-FTPd was installed and configured. Confirm the actual log location before restarting Fail2ban:<\/p>\n\n\n\nsudo grep -i pure-ftpd \/var\/log\/syslog | tail -5\n<\/pre>\n\n\n\n
\/var\/log\/pure-ftpd\/<\/code> \u2014 and update the logpath<\/code> value in your jail configuration to match.<\/p>\n\n\n\nVI. Restart Fail2ban<\/h3>\n\n\n\n
sudo systemctl restart fail2ban\n<\/pre>\n\n\n\n
VII. Verify the PureFTPd Jail Is Active<\/h3>\n\n\n\n
fail2ban-client status\n<\/pre>\n\n\n\n
pureftpd<\/code> listed among the active jails. For more detail on that specific jail \u2014 including how many IPs are currently banned \u2014 run:<\/p>\n\n\n\nfail2ban-client status pureftpd\n<\/pre>\n\n\n\n
VIII. Test the Configuration<\/h3>\n\n\n\n
maxretry<\/code> value you configured.<\/p>\n\n\n\nfail2ban-client status pureftpd\n<\/pre>\n\n\n\n
IX. Unban an IP (If Needed)<\/h3>\n\n\n\n
sudo fail2ban-client set pureftpd unbanip <IP_ADDRESS>\n<\/pre>\n\n\n\n
<IP_ADDRESS><\/code> with the actual banned address.<\/p>\n\n\n\nX. Common Troubleshooting Issues<\/h3>\n\n\n\n
fail2ban-client status<\/code>:<\/strong> Double-check that enabled = true<\/code> is actually set under the [pureftpd]<\/code> block, and confirm there are no syntax errors elsewhere in jail.local<\/code> \u2014 a single misplaced line can sometimes prevent the entire file from loading correctly.<\/p>\n\n\n\nlogpath<\/code> not matching where Pure-FTPd is actually writing its logs, or the filter’s regex pattern not matching your specific Pure-FTPd log format\/version. Re-check Step V, and consider testing the filter directly with fail2ban-regex<\/code>:<\/p>\n\n\n\nfail2ban-regex \/var\/log\/syslog \/etc\/fail2ban\/filter.d\/pureftpd.conf\n<\/pre>\n\n\n\n
maxretry<\/code> slightly, or increasing findtime<\/code> so that occasional typos don’t trigger a ban as quickly as a genuine brute-force attempt would.<\/p>\n\n\n\nXI. Customizing Ban Actions<\/h3>\n\n\n\n
iptables<\/code>, nftables<\/code>, or firewalld<\/code>, depending on your system configuration), which simply drops traffic from the offending address. But Fail2ban’s “actions” are configurable, and it’s worth knowing what else is available:<\/p>\n\n\n\n[pureftpd]\nenabled = true\nport = ftp\nfilter = pureftpd\nlogpath = \/var\/log\/syslog\nmaxretry = 3\naction = %(action_mw)s\n<\/pre>\n\n\n\n
action_mw<\/code> action bans the IP and sends an email with a whois<\/code> report about it \u2014 useful context for understanding whether an attack is coming from a known hosting provider, residential ISP, or a known malicious range.<\/p>\n\n\n\nXII. Reviewing Fail2ban Logs<\/h3>\n\n\n\n
sudo tail -f \/var\/log\/fail2ban.log\n<\/pre>\n\n\n\n
sudo grep pureftpd \/var\/log\/fail2ban.log\n<\/pre>\n\n\n\n
XIII. Best Practices for FTP and Fail2ban Security<\/h3>\n\n\n\n
\n
bantime<\/code>.<\/strong> A longer ban time (hours, rather than minutes) meaningfully raises the cost of a brute-force attempt without much downside for legitimate users, who rarely fail login three times in a row anyway.<\/li>\n\n\n\nfail2ban-client status pureftpd<\/code> occasionally can reveal patterns \u2014 like the same IP range attacking repeatedly \u2014 that might warrant a broader firewall rule.<\/li>\n\n\n\nXIV. Conclusion<\/h3>\n\n\n\n
maxretry<\/code> threshold, confirm the log path matches your actual Pure-FTPd configuration, and restart the service. Once verified with a real test, Fail2ban will automatically block IP addresses that repeatedly fail to authenticate \u2014 cutting down on brute-force login attempts without requiring any ongoing manual effort.<\/p>\n\n\n\n
\n\n\n\nFrequently Asked Questions<\/h2>\n\n\n\n
port<\/code> setting in your jail may need adjusting if FTPS uses a different port than standard FTP in your configuration.<\/p>\n\n\n\njail.local<\/code> file as separate [jail-name]<\/code> blocks.<\/p>\n\n\n\nfail2ban-client set <jail-name> unbanip <IP_ADDRESS><\/code> command from Step IX to remove the ban immediately, assuming you still have another way to access the server (like a separate SSH session or your hosting provider’s console) while it’s in effect.<\/p>\n\n\n\nfail2ban-regex<\/code> against your actual log file, as shown in the troubleshooting section, is the fastest way to confirm whether the filter is matching anything at all \u2014 if it reports zero matches against lines you know represent failed logins, the filter pattern itself likely needs adjusting for your specific Pure-FTPd version.<\/p>\n\n\n\n
\n\n\n\nTalk to Our Technology Experts<\/h2>\n\n\n\n
Related Articles<\/h2>\n\n\n\n