15

I just installed and configured fail2ban. I want to make sure it is working. I don't want to block myself from the server so I can't just login (poorly) a bunch of times. How do I see that fail2ban is working?

2
  • 2
    try this sudo fail2ban-client status Apr 15, 2017 at 17:50
  • You should consider selecting a correct answer.
    – Jay
    Dec 30, 2019 at 0:51

5 Answers 5

10

Just type:

/etc/init.d/fail2ban start

and then to know the status of fail2ban type:

/etc/init.d/fail2ban status

as we know all services are available in /etc/init.d/.

3
  • 2
    This shows whether the service is running. It doesn't show whether it does what it is supposed to do.
    – Jenny D
    Mar 14, 2014 at 10:11
  • 1
    True that this command just shows that the service is running. But, this is also useful. The title Does say "Check that fail2ban is running?". Rather than downvote this answer, maybe suggest that OP changes the title of the question.
    – Charlie
    Dec 25, 2015 at 20:30
  • systemctl status fail2ban appears to produce the same information, for those of us in the habit of using systemctl. Nov 7, 2018 at 13:40
3

For a first fast check, look whether fail2ban has added some iptable rules:

sudo iptables -L f2b-sshd

This is what I got as result:

target     prot opt source               destination
REJECT     all  --  mgt.pnu.ac.th        anywhere             reject-with icmp-port-unreachable
REJECT     all  --  plex1.domin8.media   anywhere             reject-with icmp-port-unreachable
REJECT     all  --  218.92.0.197         anywhere             reject-with icmp-port-unreachable
REJECT     all  --  223.68.10.247        anywhere             reject-with icmp-port-unreachable
REJECT     all  --  promote.cache-dns.local  anywhere             reject-with icmp-port-unreachable
RETURN     all  --  anywhere             anywhere

Seems my server attracts some interest. ;)

1

Just make port 22 available to the internet (of course, after hardening the public key) and you will see the logs getting filled.

Now, I would recommend to use an proxy/tunnel to test this, just forward the ssh connection through this proxy and fail to log in a couple of time. It should be enough.

Don't do this from your own system!

You can be locked outside with the keys inside the car.

1
  • 1
    yup, once your standard ssh-port is publicly available bots will come knocking. Let it run a few hours and check the fail2ban logfile, i am pretty sure you will have (mostly Chinese) addresses inthere by then.
    – Jake
    Jul 8, 2015 at 20:39
0

Get a friend to try logging in, or use a smartphone, or go to a public hotspot and try from there, or leach the internet of your neighbours, or just wait until some scriptkiddo tries to log in.

There are many ways, but they all involve "just do it"...

0

Use fail2ban-client (requires root privileges):

fail2ban-client status

The above command will list the configured jails. You can then use this to get information about each jail, e.g.:

fail2ban-client get sshd banned

This will give you a list of currently banned IP addresses for your sshd jail.

You can also display configuration details about each jail. E.g.:

fail2ban-client get sshd bantime

Use fail2ban-client -h and man fail2ban-client for full details. See also the fail2ban webpage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.