It is possible to save and use _already banned IP's in fail2ban after restart (fail2ban or the whole server)?
As of 2016, this is actually the default. It was probably added around 2011 or 2012, though. So you have nothing to do now.
The ban database is defined in
fail2ban.conf with two variables:
# Options: dbfile # Notes.: Set the file for the fail2ban persistent data to be stored. # A value of ":memory:" means database is only stored in memory # and data is lost when fail2ban is stopped. # A value of "None" disables the database. # Values: [ None :memory: FILE ] Default: /var/lib/fail2ban/fail2ban.sqlite3 dbfile = /var/lib/fail2ban/fail2ban.sqlite3 # Options: dbpurgeage # Notes.: Sets age at which bans should be purged from the database # Values: [ SECONDS ] Default: 86400 (24hours) dbpurgeage = 86400
To avoid the persistence, now that this is the default, edit the
fail2ban.conf file and then change the
dbfile = <path> with:
dbfile = None
I'm not too sure what the difference between
:memory: is, either way, those two will prevent the IPs from being re-added to your firewall on a restart or a reboot.
Not that I'm aware of. My recomendation is to either ban for a somewhat short amount of time, or perma-ban. I configure my servers to dump a list of the perma-banned IPs to a configuration file ever 6 hours and at shutdown; then auto load that file at startup.
I have my rules setup so the perma-ban jails are very touchy, for instance 2 different invalid usernames when logging into the webmail portal will trigger it. The jails for common things like correct username/wrong password get triggered after 10 and only bans for a short time.