Fail2Ban & SSH Hardening

Beyond the firewall (see Firewall & SSH), the Security page has two more layers: Fail2Ban and SSH hardening, both on the same page per server.

Fail2Ban

Fail2Ban watches for repeated failed logins and temporarily bans the offending IP — the single biggest win against SSH brute-force bots.

• Install & enable with one click if it isn't already on the server.
• Each active jail (SSH being the main one) shows currently-banned and all-time-banned counts, plus the live list of banned IPs.
• Unban any IP individually with one click.
• Tuning: adjust bantime (how long a ban lasts), findtime (the window failures are counted in), and maxretry (failures allowed before a ban) — applies to all jails and makes sure the SSH jail specifically is on.

Enlarge

SSH hardening

Three independent checkboxes, applied together when you click Apply hardening:

• Disable root login — blocks logging in as root directly; you'd use a regular sudo user instead. Nearly always safe.
• Disable password auth (keys only) — only your SSH key can log in from then on, even a correctly-guessed password won't work. Real lockout risk if this server doesn't have a working key yet, so DeployOS shows an explicit warning banner when this is checked.
• Disable X11 forwarding — turns off a rarely-used feature almost nobody needs on a server. Safe to disable.

Checking either of the first two risky options triggers a confirmation dialog before anything runs.

The admin-user safety net

You can't disable root login while DeployOS is connected as root — that would lock the app itself out, so the checkbox is disabled until there's a safe account to fall back to. The Admin user card handles this:

• Create a sudo user — DeployOS creates a new user on the server, copies your SSH key to it, grants passwordless sudo, and switches DeployOS to connecting as that user, all in one action.
• Switch to an existing user — if the server already has a non-root sudo user with an SSH key set up, DeployOS detects it and offers a one-click switch instead of creating a new one.

Once connected as a non-root user, the root-login checkbox unlocks automatically.

Enlarge

💡 Tip — do the admin-user step first, confirm you can still reach the server, and only then disable root login. DeployOS orders the UI this way on purpose.