95 votes

How to Unban an IP properly with Fail2Ban

Example for SSH in interactive mode. type in bash: fail2ban-client -i then in interactive mode type read the status of a jail: status sshd you'll get: Status for the jail: ssh |- Filter | |- ...
Amaroc's user avatar
  • 1,051
76 votes

How to show all banned IP with fail2ban?

Please keep in mind that the fail2ban banning of IP is temporary in nature. The best way to have a look at the full list of IPs that have been blocked would be to check the log file: sudo zgrep 'Ban' /...
NA AE's user avatar
  • 869
38 votes

How to show all banned IP with fail2ban?

Similar to NA AE above with kwaa's comments included, this lists all IPs: sudo zgrep 'Ban' /var/log/fail2ban.log* but that output has so many lines. This counts lines of all logged banned (and ...
Marc Compere's user avatar
36 votes
Accepted

fail2ban's database is too large (over 500mb). How do I get it to a reasonable size?

There is a dbpurgeage parameter in fail2ban.conf, which tells how many days of data to keep in the database. The default is one day (1d), so try do decrease it to a couple of hours: dbpurgeage = 8h ...
Piotr P. Karwasz's user avatar
31 votes

How to protect Apache server from SQL injection

Apache is not subject to an SQL injection, as it is not a database. If you want to protect an application Apache runs which in turn calls a database, you could put a WAF (Web Application Firewall) ...
davidgo's user avatar
  • 6,302
22 votes

How to show all banned IP with fail2ban?

You can use sqlite3 command to do some statistics by querying bips table of /var/lib/fail2ban/fail2ban.sqlite3 database (if your fail2ban version < v0.11.1, change bips to bans). Show all IP ...
Faka's user avatar
  • 321
22 votes
Accepted

Securing linux servers: iptables vs fail2ban

should I use fail2ban or iptables? You use fail2ban in addition to a firewall solution, to extend on-demand those existing firewall rules with rules to block the specific ip-addresses of systems ...
HBruijn's user avatar
  • 80.3k
21 votes

fail2ban's database is too large (over 500mb). How do I get it to a reasonable size?

You can update to 0.11.x (which contains code to do the purge) and then delete the huge database followed by a restart of fail2ban. It will recreate the database. This is the easiest solution with no ...
neingeist's user avatar
  • 375
18 votes

How to protect Apache server from SQL injection

SQL injection is well documented. Fix your applications, not necessarily your web server. CWE-89 categorizes SQL injection in detail. Note how mitigations like parameterization or using a decent ...
John Mahowald's user avatar
17 votes

Modify fail2ban failregex to match failed public key authentications via ssh

No regex hacking is required (at least since fail2ban 0.10.4). In /etc/fail2ban/jail.conf is the following information: [sshd] # To use more aggressive sshd modes set filter parameter "mode" in jail....
Sparhawk's user avatar
  • 271
16 votes

Get Fail2Ban To Check findtime Every X Minutes

As mentioned by Michael Hampton in a couple of comments, the reaction time, how often fail2ban checks the logs, has nothing to do with the findtime parameter. fail2ban is expected to read new log data ...
Alexis Wilke's user avatar
  • 2,276
16 votes

Using fail2ban to manually block an ip for a specific time period

There is a fail2ban client: # fail2ban-client set <JAIL> banip <IP> # fail2ban-client set <JAIL> unbanip <IP> Example: # fail2ban-client set example banip 10.10.1.1 10.10.1....
HTF's user avatar
  • 3,198
15 votes

How to show all banned IP with fail2ban?

To view the complete line of iptables: sudo iptables -L -n | awk '$1=="REJECT" && $4!="0.0.0.0/0"' To view only the IP address: sudo iptables -L -n | awk '$1=="REJECT" && $4!="0.0.0....
cthemudo's user avatar
  • 251
15 votes

How to show all banned IP with fail2ban?

There is the banned command (v0.11.2): fail2ban-client banned Sample output: [{'sshd': []}, {'apache-badbots': []}, {'apache-auth': ['XXX.24.23.164', 'XXX.155.205.108', 'XXX.62.130.158']}]
Spyros's user avatar
  • 151
11 votes

How to Unban an IP properly with Fail2Ban

If you are running version v0.10.2: sudo fail2ban-client unban YOUR_IP_ADDRESS This is from help: unban <IP> ... <IP> unbans <IP> (in all jails and database) ...
kashiraja's user avatar
  • 231
11 votes
Accepted

fail2ban bans IP addresses, yet they still appear in access.log

Docker networking is set up in such a way that it bypasses normal iptables chains. fail2ban uses INPUT chain but to filter docker traffic you need to use its custom DOCKER-USER chain. See the ...
AlexD's user avatar
  • 10.3k
10 votes

In Fail2Ban, How to Change the SSH port number?

I know this is an old thread but this is what pops up on a google search for this subject. I didn't see anyone give the most correct answer (imo) so here it is. To change the Linux named port ...
Fred Flint's user avatar
9 votes

Permanent block of IP after n retries using fail2ban

fail2ban has already a jail to ban recidive. If you watch /etc/fail2ban/jail.conf, you will found : # Jail for more extended banning of persistent abusers # !!! WARNING !!! # Make sure that your ...
user483906's user avatar
9 votes

fail2ban- How to whitelist a big list of IP address to the jail.local file

fail2ban's ignoreip = takes space delimited CIDR blocks. CR's are ignored, but the next line has to start with a space, so you can break up a very long line as: ignoreip = 0.0.0.0/8 10.0.0.0/8 23.135....
gessel's user avatar
  • 231
9 votes

fail2ban: whitelist IPv6 address

ignoreip is space delimited. Delete the comma. Confirm the address is correct by cross referencing all the IPs on the host to allow, with the logs of the service in question. Consider allowing nets of ...
John Mahowald's user avatar
8 votes

Fail2Ban unblock ipaddress

From my experience with Fail2ban, unbanning an IP address directly through IPTABLES will result in the IP being banned again by Fail2ban if the Fail2ban service is restarted within the Ban Time. That ...
Ndianabasi's user avatar
8 votes

How to show all banned IP with fail2ban?

Just an FYI: "Total banned" are the total IPs that have been banned for that jail (and probably have been unbanned). "Currently banned" are the ONLY IPs that are currently banned for that jail (and ...
Rob Pickering's user avatar
8 votes

Securing linux servers: iptables vs fail2ban

should I use fail2ban or iptables? This is somewhat akin to asking "should I use a seatbelt or a car?". First off, remember that fail2ban really is only a tool to automatically detect recurring ...
user's user avatar
  • 4,455
8 votes
Accepted

Fail2ban on Debian Buster - the right way to configure?

You only need to edit one file. To avoid problems during system upgrades, you should always copy jail.conf to jail.local and modify the latter only. The same for all other fail2ban config files. cp /...
Powerriegel's user avatar
8 votes
Accepted

Fail2Ban iptables entries to reject HTTPS not stopping requests to Docker container on Amazon Linux 2

As noted by @tater in the comments above, fail2ban inserts itself into the INPUT chain by default, but traffic to Docker containers is routed using the FORWARD chain, which is routed without touching ...
Graham Lea's user avatar
7 votes

Does fail2ban monitor rotated log files?

One can specify multiple logs in one of two ways (or a combination). You can use file globs (wildcards) to match log files to monitor (i.e.logpath = /var/log/*somefile.log) or a list of logfiles to ...
Troy Morehouse's user avatar
7 votes

Does fail2ban start automatically each time system starts?

Normally it should. To be sure you can check with: ls -al /etc/init.d/fail2ban and ls -al /etc/rc*.d/ | grep fail2ban If you don't see fail2ban listed, you can use the following command to ...
Diamond's user avatar
  • 9,131
7 votes
Accepted

What is the difference between fail2ban and snort?

I would start with fail2ban if I was you. Both can be a drain on your resources if they aren't configured properly, but I suspect the caveats of working with regex will be more familiar to you. ...
iwaseatenbyagrue's user avatar
7 votes

Get the Fail2Ban jail which banned an IP address

The fail2ban-client status JAIL command shows a list of IP addresses currently banned by that jail, but it's a bit laborous to go through every jail like that, and it also won't show you IP addresses ...
Esa Jokinen's user avatar
  • 49.8k

Only top scored, non community-wiki answers of a minimum length are eligible