59 votes

Delete all fail2ban bans in Ubuntu Linux

Updated answer As of version 0.10.0 fail2ban-client features the unban command that can be used in two ways: unban --all unbans all IP addresses (in all ...
ph0t0nix's user avatar
  • 1,147
20 votes

Delete all fail2ban bans in Ubuntu Linux

The best way to unban all IPs, is to set the bantime to 1 second, then all the IP will be freed right away. fail2ban-client set JailName bantime 1 After that you can set the proper ban time back. ...
Philip's user avatar
  • 201
12 votes
Accepted

How to automatically permanently ban IP addresses?

fail2ban can be configured for permanent bans by setting bantine to -1 In jail.conf bantime = -1 These will be lost on a reboot, but that's not necessarily a bad thing because so many attempts ...
Stephen Harris's user avatar
9 votes

creating an alternate jail in fail2ban for manual banning

Here's how I did this.. I added this to jail.local: [manban] enabled = true filter = manban action = iptables[name=HTTP, port="80,443,110,995,25,465,143,585,993,587,21,22", protocol=tcp] ...
Trent Three's user avatar
8 votes

Delete all fail2ban bans in Ubuntu Linux

The latest fail2ban-client (0.10) has a unban -all command. Jails can also be individually "restarted", effectively clearing the bans. If you have an older version, this trick might work for ...
Rolf's user avatar
  • 749
8 votes

How to configure fail2ban with systemd journal?

There is an Issue with the config files. I had jail.conf and jail.d/defaults-debian.conf The content of the latter one was: [sshd] enabled = true Because of backend not being set here the default ...
southz rgw's user avatar
7 votes

Delete all fail2ban bans in Ubuntu Linux

Stopping the service will clean all rules added by fail2ban service fail2ban stop If you do not have any other iptables rules, you can flush it iptables -F Be careful: this will erase any other ...
RASG's user avatar
  • 221
7 votes
Accepted

fail2ban keeps saying already banned but it didn't actually ban

Looks like your iptables configuration does not include a filter chain named f2b-sshd. First, a mini-primer on iptables. iptables is both a command and the name of the Linux firewall subsystem. The ...
telcoM's user avatar
  • 94.6k
7 votes
Accepted

Large fail2ban database, normal?

I just discovered this issue on my own servers. My dbpurgeage is also set to the default 24 hours, yet my fail2ban.sqlite3 grew to 400MB and has 800,000 bans from the last 2 years. It turns out ...
Nicolás's user avatar
  • 185
6 votes
Accepted

How does fail2ban protect against DDoS?

It's hard to "protect" against DDoS attacks, but one can mitigate them by avoiding useless costly computation. fail2ban can limit the number of attempts that each participant in the DDoS attack can ...
Matthieu Moy's user avatar
6 votes

Server being attacked with key exchange attempts. Not being added to ban list by fail2ban

Normally fail2ban don't act on these kind of attacks, to make fail2ban act on these, you need to set the mode to aggressive in your jail in /etc/fail2ban/jail.local like this: [sshd] # To use more ...
Jos Bunt's user avatar
5 votes
Accepted

Why are there both printf and print in this command?

The first printf is to append the character # to each line of the input file which in awk is represented by $0 and then the modified line (with # added before) is printed out to the console using the ...
Inian's user avatar
  • 12.7k
5 votes
Accepted

Fail2ban logging to systemd

You have to install the module, as stated here: https://lists.freedesktop.org/archives/systemd-devel/2015-July/033443.html The Module can be found here: https://github.com/systemd/python-systemd If ...
Stefan M's user avatar
  • 1,616
5 votes
Accepted

fail2ban applying ban but is not blocking the connection

In the config, port = ssh had to be changed to the custom SSH port. I had assumed Linux would know what the SSH port was defined to and fail2ban would follow that system configuration, I was wrong.
Zeno's user avatar
  • 263
5 votes

Fail2ban multiple actions

You can't use the same action name twice in the same jail. Here it's "iptables". Note that name= is the parameter name which is action oriented (action runtime parameter, in case of iptables ...
Hardoman's user avatar
  • 151
5 votes
Accepted

Fail2ban Regex help for banning sshd connection attempts

For latest versions of fail2ban it would be enough to set: [sshd] mode = aggressive enabled = true in your /etc/fail2ban/jail.local. For some older version it depends. Anyway I'd start with updating ...
sebres's user avatar
  • 280
4 votes

Delete all fail2ban bans in Ubuntu Linux

Save iptable config to file $ iptables-save > iptables.conf Edit it with any editor you like Than load config back to iptables $ iptables-restore < iptables.conf Do not forget to store ...
Subdigger's user avatar
  • 141
4 votes
Accepted

Fail2ban-Regex test always tells no host in group

OK, abort mission. I'm the stupid one.. Got a Typo in my parameters... it is actually smtp_auth.conf not smtp-auth.conf Sorry! Close this one and burry it deep -.-'
mike.b93's user avatar
  • 293
4 votes
Accepted

fail2ban is running but no fail2ban.log log file exists for it

The location of the log depends on your syslog implementation and configuration. /var/log/messages is the most common place. Note that troubleshooting fail2ban is not an easy task unless you make a ...
Julie Pelletier's user avatar
4 votes
Accepted

SSH "kex_exchange_identification: read: Connection reset by peer"

Long story short, my problem had nothing to do with a network issue and was fixed by examining the syslog. In details: I noticed that none of the webapps (via LAMP or MERN stacks) while up and ...
PYG's user avatar
  • 171
4 votes

fail2ban - have more than one regex in same filter file

https://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Configuration The documentation URL is for v0.8, but the syntax has not significantly changed. The short answer is 'yes', you can place more than one ...
ender.qa's user avatar
  • 341
3 votes

Delete all fail2ban bans in Ubuntu Linux

heres a simple oneliner to unban the whole fail2ban jail the proper way: iptables -L f2b-recidive -n | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | grep -v 0.0.0.0 | xargs -n 1 ...
Vedran B's user avatar
3 votes

How can I teach fail2ban to detect and block attacks from a whole network block?

The easiest way to add this magic /24 (some might like even /22) to the iptables commands for all jails is to add two files: /etc/fail2ban/action.d/iptables-multiport.local /etc/fail2ban/action.d/...
Alexander Shcheblikin's user avatar
3 votes
Accepted

fail2ban ip blocked, yet still login attempts

You should try setting port = ssh to the port you really use. (I assume that even with running ssh on a non-standard port, you're not changing the value in /etc/services, and you probably ...
Ulrich Schwarz's user avatar
3 votes
Accepted

Fail2Ban monitor HTPasswd/HTAccess

I monitored fail2ban log to watch for entries for banned IP's. By not seeing my IP I knew something was wrong. To monitor log: tail -f /var/log/fail2ban.log I monitored the log fail2ban was ...
FreeSoftwareServers's user avatar
3 votes

fail2ban is running but no fail2ban.log log file exists for it

If you want your Fail2ban to write logs to: /var/log/fail2ban.log Open the /etc/fail2ban/fail2ban.conf file Change the line: logtarget = SYSLOG to logtarget = /var/log/fail2ban.log restart fail2ban ...
NCode's user avatar
  • 31
3 votes
Accepted

fail2ban has banned my Ip but I can still login using SSH

The reason was the port. I changed into my jail.local, inside the section [sshd] the port port = ssh into port = 26522 And reloaded sudo /etc/init.d/fail2ban reload It worked immediately !
realtebo's user avatar
  • 917
3 votes

How to prevent unban in fail2ban?

A ban is always temporary , because mistake , ip are allocated in dynamic manner . So i recommend to you : 1) modify the bantime This command will extract the current configuration of sshd jail ...
EchoMike444's user avatar
  • 3,135
2 votes

Delete all fail2ban bans in Ubuntu Linux

Because of the way fail2ban works, there are only two possible solutions: Make a firewall configuration script that includes fail2ban jails and restart the firewall. Remove the firewall rules ...
Julie Pelletier's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible