Why UBAN?
Security tools don't need to be complicated or resource-hungry to be effective. UBAN (Universal Ban Daemon, Github) is a lightweight, open-source Linux security tool inspired by Fail2ban. It monitors application logs for suspicious activity, automatically blocks offending IP addresses through the system firewall, and increases ban durations for repeat offenders.
Designed to be configurable, fast, and economical with system resources, UBAN can protect multiple services without requiring a separate application-specific banning tool for each one.
Core Features
Ultrafast Reaction
Monitors log activity and applies firewall bans within milliseconds of detecting a configured pattern, helping stop repeat requests and subsequent attacks.
Incremental Bans for Repeat Offenders
Automatically increases ban duration for IPs that keep coming back. Administrators can define a custom maximum ban time or configure repeat offenders to be banned permanently.
Extremely Lightweight
Written in C with no heavyweight runtime or language dependencies. Its small memory footprint (often under 2 MB) makes it suitable for everything from modest VPS instances to production servers.
Easy to Manage
Administrators can review status, manage bans, and adjust rules through a single configuration file and straightforward CLI commands.
App Agnostic
Works with any service—Nginx, SSH, WordPress, or custom APIs. All UBAN needs are log files containing an IP addresses and actionable keywords defined by the admin.
Multi-Application Protection
Monitor multiple applications and log files simultaneously, with independent rules and ban policies for different services. Capacity limits can be increased when larger deployments require them.
Direct Integration with nftables
Integrates directly with native Linux nftables. UBAN hands off the ban to the firewall, and nftables automatically handles expiration and unbanning natively in the kernel—saving CPU cycles and keeping system overhead near zero.
Persistent State & Recovery
Preserves ban history and active-ban state across service restarts and system reboots. UBAN restores its recorded state on startup, helping maintain repeat-offender tracking and existing ban policies.
Designed for Safety
Uses careful input handling and configurable log parsing to reduce parsing errors and help prevent log-injection tricks from undermining detection.
Benchmarked Performance
Leak-checked with Valgrind and stress-tested at over 10,000 log lines per second in testing, maintaining low resource consumption on the tested system.
Complete Set of Admin Commands
Inspect active jails, manually ban or unban specific IPs, and reload rules on the fly using simple CLI commands.
Clear Audit & Logging Output
Logs every ban, escalation, and unban event with crisp timestamps, giving admins an unambiguous, transparent trail for security audits and compliance.
Free & Open Source
Fully open software with no hidden costs, locked enterprise features, or vendor lock-in. Source code and installation guides are available on GitHub.
Looking for technical details?
If you are interested in deeper technical insights, please read our Technical Deep Dive, which explains the internal architecture of UBAN in detail—including edge cases, defensive guards against log/token injection, and benchmark comparisons against Fail2ban.