Site Tools


linux:ubuntu:fail2ban

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
Last revisionBoth sides next revision
linux:ubuntu:fail2ban [2018/11/27 09:28] – [Configuration] lunetikklinux:ubuntu:fail2ban [2019/10/29 10:44] lunetikk
Line 31: Line 31:
 port     = 22 port     = 22
 filter   = sshd filter   = sshd
 +#action   = iptables[name=SSH, port=2022, protocol=tcp]
 +#           sendmail-whois-lines[name=SSH, dest="[email protected],[email protected]", [email protected], sendername="Fail2Ban", logpath=/var/log/auth.log]
 logpath  = /var/log/auth.log logpath  = /var/log/auth.log
 maxretry = 3 maxretry = 3
Line 65: Line 67:
 logpath  = /var/log/fail2ban* logpath  = /var/log/fail2ban*
 maxretry = 3 maxretry = 3
 +#findtime is 365 days
 findtime = 31536000 findtime = 31536000
 bantime  = -1 bantime  = -1
  
 </code> </code>
 +
 +===== Abusemails =====
 +
 +Click the following link for more info about abuse automatisation\\
 +[[linux:ubuntu:blocklist|Blocklist]]
  
 ===== Commands ===== ===== Commands =====
Line 92: Line 100:
 Get a list of commands Get a list of commands
 <code>fail2ban-client --help</code> <code>fail2ban-client --help</code>
 +
 +===== Troubleshooting =====
 +
 +==== IP gets banned everytime ====
 +
 +An IP listed in "ignoreip" still gets banned everytime you reload/restart/start your Fail2ban service.\\
 +
 +__Reason:__ \\
 +The IP was banned before you added it to "ignoreip"  \\
 +
 +__Fix:__ \\
 +The IP is added to the file "ip.blocklist.repeatoffender". \\
 +Open the file and remove the IP.
 +
  
linux/ubuntu/fail2ban.txt · Last modified: 2019/10/29 10:45 by lunetikk