xyz.sh adds no telemetry and performs no hidden actions. Read the full source on the page or download it with curl -fsSL xyz.sh/ .sh first; every script has a / .sh.sha256 checksum. Piping a remote script to bash is still a risk — review the source first. It never edits jail.conf; it only adds one jail.d file that is easy to review and remove.

Which operating systems are supported?

Declared support: Debian, Ubuntu, CentOS, Rocky Linux, and AlmaLinux. The script detects the distribution and warns on an unknown one. It was tested in Docker containers of these systems (syntax, --dry-run, and whatever can run in a container; see tests/RESULTS.md); parts that need systemd, kernel modules, or the public internet still need a real VPS.

Yes. Run it as root or via sudo bash; it exits with a message otherwise. --dry-run and --status show what it would do first.

What if I ban myself?

Log in from another IP or your provider's console and run fail2ban-client set sshd unbanip YOUR_IP. Add your own static IP with --ignoreip when installing.

Fail2ban SSH Protection Tutorial

This tutorial shows how to enable Fail2ban auto-banning for SSH on a VPS with xyz.sh/fail2ban.

Prerequisites

Root access; CentOS / Rocky / AlmaLinux need access to EPEL.

sshd managed by systemd (the default on common VPS images).

Steps

Optional: read the source with curl -fsSL xyz.sh/fail2ban.sh and compare xyz.sh/fail2ban.sh.sha256.

Preview: curl -fsSL xyz.sh/fail2ban | bash -s -- --dry-run

Install and enable: curl -fsSL xyz.sh/fail2ban | bash -s -- -y

Customise: --maxretry 3 --bantime 24h --findtime 10m --ignoreip 203.0.113.5

See bans: curl -fsSL xyz.sh/fail2ban | bash -s -- --status

How to verify

Run fail2ban-client status sshd to see failures and banned IPs, or curl -fsSL xyz.sh/fail2ban | bash -s -- --status.

How to undo or uninstall

curl -fsSL xyz.sh/fail2ban | bash -s -- --uninstall -y removes xyz-sshd.local and restarts fail2ban; to remove the package too, run apt-get remove fail2ban or dnf remove fail2ban.