The two common methods of reducing fan voltage are by electrical resistance and using semi-conductors. One advantage of the resistance method is that you can vary the fan supply right up to the full 12 volts. Using semi-conductors, you generally lose a volt or two across the transistors so the maximum air-flow of the fan is reduced.
For variable control you use a rheostat, looks a bit like a volume control potentiometer but generally wire-wound to handle the higher currents. Some Cermet-coating potentiometers are also suitable for low-power fans. Usually you need one for each fan, as (a) small ones can't handle much current, and (b) how much voltage they drop depends on the fan's resistance (or to be more accurate, impedance).
To calculate the size needed, you need to know the fan current at 12 volts. To handle two or more fans (wired in parallel) add the currents taken by each. Say it's 200mA, or 0.2A
By Ohm's Law, that makes the resistance of the fan (or fans) 12/0.2 = 60 ohms.
A good rule of thumb is to use a rheostat equal in value to the fan resistance — this will reduce the voltage across the fan to half the supply, 6 volts.
In practice, rheostats come in a very limited range of values, so we pick the nearest, probably a 50-ohm unit.
So if the fan resistance is 60 ohms, and the rheostat is 50 ohms, the fan supply can be dropped to 12 x 60/(60+50) = 6.545v. Near enough.
Using a 100R rheostat, the next common size up, would allow fan volts to be reduced to 4.5v in this situation.
Manufacturers such as Vishay quote a wattage value based on the current-carrying capacity of the rheostat wire or coating, and higher-resistance rheostats in a model range use thinner stuff than the low-resistance ones. So a 5W 50R rheostat is rated to carry 316mA (max. current = √[wattage/resistance]) but a 5W 100R one will only carry 223mA.
Think of it like fuse wire — if just the last turn carries too much current, the rheostat won't be producing 5W of heat, but that bit of wire will melt.
Power rating needed for our 200mA fan system with a 50R rheostat is I²R =2W, based on the current flowing with the fan at full speed. But if we used a 100R rheostat with the same fans the wattage would need to be 4W.
With a single low-power fan drawing 120mA, a 100R rheostat would give 6-12v control and need to be rated at 1.44W, so the Maplin 2W Cermet-type potentiometer is a smaller-sized (but more expensive) option.
It boils down to two simple formulas —
For wire-wound rheostats only, the manufacturer allows some overload when only a fraction of the turns on the rheostat are carrying current — the hot section loses some heat to the unused cold wire by conduction. An overload of 25% max is generally OK, and the only time the rheostat is in danger is when it's very nearly (but not quite) at full speed. As you turn down the speed, the current drops and so does the wire temperature.
Note: Any rheostat needs free air circulation round it to prevent heat build-up.
Rheostat is Maplin's FX97F (50 ohm, 3.5W, £2 with another 50p for a knob). The red* fan lead is cut, with one side of the cut going to the rheostat slider, the other side soldered to one of the rheostat end tags and continuing to the supply connector.
* It still works in the black lead, but speed sensing, if fitted on your fan, won't work at low speeds. The fan ground needs to be at 0v or damage to the motherboard could occur. This applies to all variable-voltage controllers.
As a refinement, the other end tag is joined to the slider tag, so should the slider come off-track (through dust, for example) the fan continues to work at minimum speed.
Test it works, mount the rheostat(s) on a spare drive bay panel, add a knob, that's it.
The bad news is that Maplin have now discontinued their rheostat range and alternatives at places like RS Online are expensive. Good news is that semiconductors are so much more second millennium.
Good news for dinosaurs is that Technology Supplies in the UK do a 50R 5W rheostat code 250-981 at a very good price.