3

It is possible to run fail2ban in some kind of "simulation mode" so it does not ban but log somewhere who it would have ban?

Running fail2ban on Ubuntu 12.04.

6

If you look in jail.conf you'll see a line that says this:

# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define
# action_* variables. Can be overriden globally or per
# section within jail.local file
banaction = iptables-multiport

All the actions are in /etc/action.d/

You could make one that just sends mail.. there are quite a few actions there already that may do what you want.

0

Ironically fail2ban does not possess a method for performing a "dry-runor "no-ops" running of the actions defined within. Your only options are to temporarily change thebanaction` that's defined for a specific jail by overriding it for a given jail or do override the actions themselves.

In newer versions of fail2ban you can create overrides quite easily by making identically named files with the suffix .local instead of .conf. You also have access to the actions.d and jail.d sub-directories where you can put overriding configuration files for a specific jail so that you can redefine values for variables that were previously set, such as banaction.

So say your jail.conf or jail.local had this in it:

[sshd]

port    = ssh
logpath = %(sshd_log)s
banaction = iptables-multiport

You could override this jail like so, by creating a new file under jail.d with the following within it:

[sshd]

port    = ssh
logpath = %(sshd_log)s
banaction = iptables-multiport-debug

You'd then need to create a corresponding file under action.d called, iptables-multiport-debug.conf. You could also forgo doing this and simply override the banaction file itself in the action.d directory. Simply copy the pre-existing iptables-multipart.conf file to iptables-multipart.local.

NOTE: Be careful in doing the 2nd options, since you'll be overriding the banaction for any jail that may use it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.