1

I am creating a bash alias (or possibly a script) to ban and unban IP addresses with fail2ban on Ubuntu 20.04.

The bash syntax I am using to unban IP address is:

fail2ban-client set YOURJAILNAMEHERE unbanip IPADDRESSHERE

and the syntax I'm using to ban IP addresses is:

fail2ban-client set YOURJAILNAMEHERE banip IPADDRESSHERE

so my corresponding bash alias syntax for unbanning an ip address would be:

alias unbanip='sudo fail2ban-client set YOURJAILNAMEHERE unbanip'

and my corresponding bash alias syntax for banning an ip address would be:

alias banip='sudo fail2ban-client set YOURJAILNAMEHERE banip'

Then, the actual bash alias for unbanning an ip address would be:

alias unbanip='sudo fail2ban-client set sshd unbanip'

and the actual bash alias syntax for banning an ip address would be:

alias banip='sudo fail2ban-client set sshd banip'

The resulting actual bash commands (using the aliases) would look something like this:

# Unban a specific IP
unbanip 123.456.78.90

# Ban a specific IP
banip 123.456.78.90

The problem with all of this, is that you can't really create a true command or bash alias to directly ban a specified IP, because:

1) For unbanning, you have to first look up the corresponding jail that banned the ip in the first place, and input that jail into the bash command.

2) For banning, you have to specify all jails in one command to ban an IP accross all jails.

What I would like to do, is

1) come up with one single command for banning an IP (without having to specify a jail), where the command automatically bans the IP accross all jails, and

2) come up with one single command for unbanning an IP without having to look up which jail/jails that IP ban belongs to. Essentially, the unban command would look up which jail the specified IP belongs to, and then automatically input that into the YOURJAILNAMEHERE part of the syntax, for one or several jails.

Anyone have some bash skills that might be able to come up with a command (with a corresponding bash alias) or script to do this? Any help is much appreciated!

1 Answer 1

2

For modern versions of fail2ban (e.g. v0.11.2) you can unban one or more IPs without knowing which jail(s) generated the ban:

fail2ban-client unban <IP> ... <IP>

Fail2ban can't itself initiate a ban of IP(s) across all jails, mainly because it would not normally be desirable (i.e. assuming the action for all jails is an IP ban blocking all ports, one ban is sufficient). But you can create a little bash script which uses a loop to do it like this:

#!/bin/bash
# Fail2ban All-Jail IP Banner
if [[ -z $1 || $1 == "-h" ]]; then
  echo "$(basename "$0"): Fail2ban All-Jail IP Banner"
  echo "Usage: $(basename "$0") <IP> ... <IP>"
  echo "Advisory: this immediately bans the specified IPs across all fail2ban jails - use with care!"
  exit 0
fi
while read -r JAIL; do
  echo -n "$JAIL banning IP(s): "
  fail2ban-client set $JAIL banip $*
done < <(fail2ban-client status|sed -n '/Jail list:/{s/^.*list:\s*//;s/, /\n/g;p}')
4
  • Thank you so much for this answer. This is excellent! I will test this (the script and the modern command) out tomorrow when I have server access, and get back to you! Hopefully everything works!
    – DanRan
    Jul 16, 2023 at 4:27
  • Thank you so much! This is excellent! Your first command for unban works great! I have tested Fail2ban All-Jail IP Banner, and it also works great! One question though, when running Fail2ban All-Jail IP Banner, it prints "1" for each jail it bans the IP in. I was wondering if there is a way to also print a "JAIL_NAME" next to the "1" in the script? If not, it's not the end of the world, but it would be a nice touch for it to print jail names alongside the 1. @gogoud
    – DanRan
    Jul 18, 2023 at 3:50
  • @DanRan I've added a line to do what you want. The '1' indicates the number of IPs banned. If you're happy please can you accept this as the answer?
    – gogoud
    Jul 19, 2023 at 17:46
  • Thankyou so much! You are amazing! I have accepted this as the answer and appreciate it alot!
    – DanRan
    Jul 20, 2023 at 7:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .