Simple definition
Fail2ban analyzes service logs and temporarily blocks sources exhibiting repeated suspicious authentication failures.
Purpose and use
Fail2ban reduces some repeated attempts by triggering a blocking action from patterns found in logs.
How does it work?
A jail connects a log source, filter, thresholds and an action, often involving the firewall.
Example and verification
Verify that a test event reaches the correct log and actually matches the configured filter.
Points to watch
IP blocking does not replace strong authentication. Proxies and shared addresses can create false positives.
In short
Effectiveness depends on the observed log, matching filter and action actually applied.