fail2zig

fail2zig is an open-source host intrusion prevention tool for Linux and a modern alternative to fail2ban. It watches system logs for repeated authentication or service failures, identifies the offending address, and asks the host firewall to ban it. The familiar log to ban model makes it useful for protecting SSH and other internet facing services without adding a broader security platform. Its main design goal is predictable behavior when the input itself may be hostile. Rather than depending on a language runtime and a collection of shell actions, it ships as one static executable written in Zig with explicit limits around parsing, memory, file descriptors, and stored state.

The daemon accepts file and system journal input, evaluates configured jails, and applies policy after a matching address crosses the retry threshold inside the chosen time window. Fifteen service filters are built in, and native JSON rules cover bounded custom matching without executing arbitrary regular expressions or Python extensions. For enforcement, fail2zig supports nftables through direct netlink, plus iptables and ipset through host tools. Its design persists enforcement intent before dispatch and confirms the result by reading state back from the kernel. A log-only policy is also available when an administrator wants to compare decisions before allowing the new daemon to change firewall rules.

State lives in embedded SQLite, so source checkpoints, retry state, active protection owners, unresolved enforcement work, and confirmed history can survive a restart. Resource admission happens before work begins. The default plan allows up to 64 enabled jails, eight file incarnations per jail, and 4,096 live retry subjects across enabled jails, while native memory and file descriptor budgets are configurable. These boundaries don't promise a fixed whole process memory footprint because SQLite, child processes, and kernel resources have separate accounting. They do define how the native work is admitted. If required storage fails, affected ingestion pauses and health is reported as degraded instead of silently dropping critical protection state.

fail2zig is aimed at Linux administrators who want local brute force protection with a small runtime and visible operational boundaries. Prebuilt releases cover x86_64, ARM64, ARMv7, MIPS, and MIPSel, while building from source remains an option. The static executable avoids shared runtime libraries, but that doesn't mean the deployment has no host requirements. It still needs readable logs, writable persistent state, and the permissions required by its selected firewall backend. Journal input needs journalctl, while iptables and ipset modes need their corresponding host tools. The service typically needs network administration capability because changing firewall state is privileged work.

Migration support is thoughtful but deliberately isn't described as a drop-in swap. The tool can inspect a fail2ban configuration, project supported jails into its TOML format, validate the result, and plan a controlled cutover. The version 0.4.0 workflow can transfer supported protection owners, original deadlines, and confirmed history from a schema 4 fail2ban SQLite database. Arbitrary fail2ban regexes, Python filters, mail actions, shell action templates, partial in-memory matches, and the old socket protocol don't transfer. The documentation therefore asks operators to review blockers, compare behavior in log-only mode, preserve a working source installation, and rehearse rollback before changing production protection.

The project stands out for documenting its security and operational boundaries rather than presenting the single binary as magic. The site publishes a threat model, architecture notes, configuration rules, release verification steps, migration continuity details, and qualification scope. It explicitly says fail2zig isn't a SIEM or a web application firewall. It doesn't correlate incidents across hosts or inspect HTTP request bodies. Current live qualification centers on Debian 13 x86_64, while other architectures have cross-build, static inspection, and emulated command evidence. Ubuntu and non-x86 hardware enforcement are listed as untested, which matters for teams deciding how much validation to do themselves.

fail2zig is free to use and its code is licensed under AGPL 3.0 or later. There is no hosted plan or commercial tier presented on the official site. Administrators can download a release, inspect the source, test the live demo, and follow the documentation without creating an account. The tradeoff is ownership. This is system software that needs careful configuration, firewall permissions, monitoring, and a tested recovery path. For an operator comfortable with those duties, it offers a focused way to keep the fail2ban style of protection while reducing runtime dependencies and making resource and durability behavior more explicit.