5

There are a lot of reasons why someone want to know the jail that banned an IP address, but I do not find a fail2ban-client command to tell me this. There should be a get command that doesn't require <JAIL>, but instead outputs it.

I am aware that starting with version v0.10.2 I can unban an IP with:

fail2ban-client unban 192.0.2.138

My Question is not how to unban the IP. I ask how can I find out the jail that banned the IP.

Improve this question

2 Answers 2

Reset to default
5

Newer versions (0.10.6/0.11.2) of fail2ban can handle this using fail2ban-client banned <IP>, see RFE 2725.
This would return list of jails where given IP is currently banned.

Improve this answer
4
  • Hm. I guess that the Ubuntu maintainers ought to keep fail2ban up to date, then. It's mid-January 2021 and Ubuntu 20.04.1 is stuck with 0.11.1. Oh well.
    – Gwyneth Llewelyn
    Jan 12, 2021 at 14:05
  • 1
    @GwynethLlewelyn: 20.04 is a long-term support version. It's normal that it doesn't always have the newest features, as it focuses on stability.
    – Esa Jokinen
    Jan 12, 2021 at 15:03
  • @EsaJokinen — aye, you're quite right. I actually asked for an update from the package manager; he suggested that I'd do my own backport and put it on a PPA 😅 I'll think about it...
    – Gwyneth Llewelyn
    Jan 15, 2021 at 23:25
  • Good news, Ubuntu 22.04 LTS already has updated fail2ban to version 0.11.2, and the command above certainly works!
    – Gwyneth Llewelyn
    Jul 9, 2022 at 18:34
7

The fail2ban-client status JAIL command shows a list of IP addresses currently banned by that jail, but it's a bit laborous to go through every jail like that, and it also won't show you IP addresses that are already released from the jail.

The best way to gather the knowledge you need is to search for the IP address from the Fail2Ban logs:

# grep "192.0.2.138" /var/log/fail2ban.log
fail2ban.actions  [388]: NOTICE  [sshd] Ban 192.0.2.138
fail2ban.actions  [388]: NOTICE  [sshd] Unban 192.0.2.138
fail2ban.filter   [388]: INFO    [sshd] Found 192.0.2.138 - 2020-12-24 10:52:42
fail2ban.filter   [388]: INFO    [sshd] Found 192.0.2.138 - 2020-12-24 10:52:43
fail2ban.filter   [388]: INFO    [sshd] Found 192.0.2.138 - 2020-12-24 10:52:47
fail2ban.filter   [388]: INFO    [sshd] Found 192.0.2.138 - 2020-12-24 10:52:51
fail2ban.filter   [388]: INFO    [sshd] Found 192.0.2.138 - 2020-12-24 10:52:56
fail2ban.actions  [388]: NOTICE  [sshd] Ban 192.0.2.138

This will not only show which jail banned the IP but also why – with all the timestamps you can use to find the corresponding events from the logs Fail2Ban is monitoring.

Improve this answer
9
  • 3
    Because it had some typos, formatting and language problems. It's a normal practice here to fix those kind of things.
    – Esa Jokinen
    Dec 25, 2020 at 8:33
  • Take also in account that machines, not only humans, are reading ServerFault. They have a far more limited ability to deal with typos and bad grammar than humans. For example, writing baned instead of banned means that search engines might not be able to tag this question correctly, and that means that fewer people will find it. It also means that automatic translation will fail — it's hard enough to translate correct spelling & grammar. These are also perfectly valid reasons for doing some spelling corrections here and there.
    – Gwyneth Llewelyn
    Jan 12, 2021 at 14:05
  • 1
    @MaxMuster - anyone with enough points can edit anyone's question and answer. When you have enough points, you can reject someone's edit. Some have enough points to close and delete your question.
    – John Hanley
    May 12, 2021 at 21:23
  • @MaxMuster I'm not sure if you ever published anything through a respectable publisher, but for the sake of the argument, I'll assume you have. When the publisher accepts your manuscript, or draft publication, an editor will go through it, word by word. And they will flag common mistakes, grammar errors, poor style, or ask for clarification when a sentence is obscure. That's the editor's prerrogative; by accepting to submit a publication through their service, you abide by whatever silly rules the editor imposes, in order to get published. If you disagree, you go to a different one, right?
    – Gwyneth Llewelyn
    Jul 9, 2022 at 18:17
  • @MaxMuster StackExchange does not have one editor, but the principle is the same. By participating in this community, you accept its own rules, guidelines, principles, and so forth. Editing a question for clarity is, indeed, common procedure — because it will be helpful to anyone else with the same question. You are not 'forced' to accept SO's rules and guidelines. You are always entitled to ask your question on any other help community out there — that's your prerrogative and privilege. However, if you want to do it here, you have to accept those rules, even if you don't like them.
    – Gwyneth Llewelyn
    Jul 9, 2022 at 18:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .