4

It is possible to save and use _already banned IP's in fail2ban after restart (fail2ban or the whole server)?

3

As of 2016, this is actually the default. It was probably added around 2011 or 2012, though. So you have nothing to do now.

The ban database is defined in fail2ban.conf with two variables:

# Options: dbfile
# Notes.: Set the file for the fail2ban persistent data to be stored.
#         A value of ":memory:" means database is only stored in memory 
#         and data is lost when fail2ban is stopped.
#         A value of "None" disables the database.
# Values: [ None :memory: FILE ] Default: /var/lib/fail2ban/fail2ban.sqlite3
dbfile = /var/lib/fail2ban/fail2ban.sqlite3

# Options: dbpurgeage
# Notes.: Sets age at which bans should be purged from the database
# Values: [ SECONDS ] Default: 86400 (24hours)
dbpurgeage = 86400

To avoid the persistence, now that this is the default, edit the fail2ban.conf file and then change the dbfile = <path> with:

dbfile = None

I'm not too sure what the difference between None and :memory: is, either way, those two will prevent the IPs from being re-added to your firewall on a restart or a reboot.

4
  • 1
    As far as I can tell it was added in fail2ban 0.9. – Michael Hampton Oct 23 '16 at 20:29
  • 1
    I'm using v0.8.13 and it's already working like this (persisting banned ip) – Leonardo Oct 26 '16 at 12:55
  • How can one disable it? – Ivan Velichko Dec 14 '16 at 17:15
  • 1
    @IvanVelichko, I updated my answer to include the two variables used by fail2ban to handle its database. – Alexis Wilke Dec 15 '16 at 3:25
1

Not that I'm aware of. My recomendation is to either ban for a somewhat short amount of time, or perma-ban. I configure my servers to dump a list of the perma-banned IPs to a configuration file ever 6 hours and at shutdown; then auto load that file at startup.

I have my rules setup so the perma-ban jails are very touchy, for instance 2 different invalid usernames when logging into the webmail portal will trigger it. The jails for common things like correct username/wrong password get triggered after 10 and only bans for a short time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy