It is possible to run
fail2ban in some kind of "simulation mode" so it does not ban but log somewhere who it would have ban?
Running fail2ban on Ubuntu 12.04.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
If you look in jail.conf you'll see a line that says this:
# Default banning action (e.g. iptables, iptables-new, # iptables-multiport, shorewall, etc) It is used to define # action_* variables. Can be overriden globally or per # section within jail.local file banaction = iptables-multiport
All the actions are in /etc/action.d/
You could make one that just sends mail.. there are quite a few actions there already that may do what you want.
fail2ban does not possess a method for performing a "dry-run
or "no-ops" running of the actions defined within. Your only options are to temporarily change thebanaction` that's defined for a specific jail by overriding it for a given jail or do override the actions themselves.
In newer versions of
fail2ban you can create overrides quite easily by making identically named files with the suffix
.local instead of
.conf. You also have access to the
jail.d sub-directories where you can put overriding configuration files for a specific jail so that you can redefine values for variables that were previously set, such as
So say your
jail.local had this in it:
[sshd] port = ssh logpath = %(sshd_log)s banaction = iptables-multiport
You could override this jail like so, by creating a new file under
jail.d with the following within it:
[sshd] port = ssh logpath = %(sshd_log)s banaction = iptables-multiport-debug
You'd then need to create a corresponding file under
iptables-multiport-debug.conf. You could also forgo doing this and simply override the
banaction file itself in the
action.d directory. Simply copy the pre-existing
iptables-multipart.conf file to
NOTE: Be careful in doing the 2nd options, since you'll be overriding the
banaction for any jail that may use it.