I just installed and configured fail2ban. I want to make sure it is working. I don't want to block myself from the server so I can't just login (poorly) a bunch of times. How do I see that fail2ban is working?
For a first fast check, look whether fail2ban has added some iptable rules:
sudo iptables -L f2b-sshd
This is what I got as result:
target prot opt source destination REJECT all -- mgt.pnu.ac.th anywhere reject-with icmp-port-unreachable REJECT all -- plex1.domin8.media anywhere reject-with icmp-port-unreachable REJECT all -- 22.214.171.124 anywhere reject-with icmp-port-unreachable REJECT all -- 126.96.36.199 anywhere reject-with icmp-port-unreachable REJECT all -- promote.cache-dns.local anywhere reject-with icmp-port-unreachable RETURN all -- anywhere anywhere
Seems my server attracts some interest. ;)
Just make port 22 available to the internet (of course, after hardening the public key) and you will see the logs getting filled.
Now, I would recommend to use an proxy/tunnel to test this, just forward the ssh connection through this proxy and fail to log in a couple of time. It should be enough.
Don't do this from your own system!
You can be locked outside with the keys inside the car.
Use fail2ban-client (requires root privileges):
The above command will list the configured jails. You can then use this to get information about each jail, e.g.:
fail2ban-client get sshd banned
This will give you a list of currently banned IP addresses for your sshd jail.
You can also display configuration details about each jail. E.g.:
fail2ban-client get sshd bantime
fail2ban-client -h and
man fail2ban-client for full details. See also the fail2ban webpage.