I know what fail2ban does; it monitors the firewall logs and finds ip addresses that have too many failed logins to ssh; and then tells the firewall to drop packets from those addresses.
So is fail2ban an IPS?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Before categorising anything, it's important to understand the taxonomy first. That way you don't get bogged down in words that could have different meanings.
An IPS or an IDS is defined as a network-level detection control. A Host-Based IPS (HIPS) will also look at internal data but primarily looks at the network.
Given this differentiation, no, fail2ban is not a HIDS because it does not inspect the network (it looks at logs).
If you try to expand the taxonomy beyond its intent, then any host-based control could be considered a HIDS, like anti-virus or an OS-level account lockout on too many failed login attempts.