Site Tools


linux:ubuntu:fail2ban

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
linux:ubuntu:fail2ban [2019/02/12 10:27] lunetikklinux:ubuntu:fail2ban [2019/10/29 10:45] (current) lunetikk
Line 31: Line 31:
 port     = 22 port     = 22
 filter   = sshd filter   = sshd
 +#action   = iptables[name=SSH, port=2022, protocol=tcp]
 +#           sendmail-whois-lines[name=SSH, dest="[email protected],[email protected]", [email protected], sendername="Fail2Ban", logpath=/var/log/auth.log]
 logpath  = /var/log/auth.log logpath  = /var/log/auth.log
 maxretry = 3 maxretry = 3
Line 70: Line 72:
  
 </code> </code>
 +
 +===== Abusemails =====
 +
 +Click the following link for more info about abuse automatisation\\
 +[[linux:ubuntu:blocklist|Blocklist]]
  
 ===== Commands ===== ===== Commands =====
Line 80: Line 87:
 fail2ban-client set ssh unbanip 192.168.178.1  fail2ban-client set ssh unbanip 192.168.178.1 
 </code> </code>
- 
-click the following link for more info on abuse automatisation 
-[[linux:ubuntu:blocklist]] 
  
 ==== Ban ==== ==== Ban ====
Line 96: Line 100:
 Get a list of commands Get a list of commands
 <code>fail2ban-client --help</code> <code>fail2ban-client --help</code>
 +
 +===== Troubleshooting =====
 +
 +==== IP gets banned everytime ====
 +
 +An IP listed in "ignoreip" still gets banned everytime you reload/restart/start your Fail2ban service.\\
 +
 +__Reason:__ \\
 +The IP was banned before you added it to "ignoreip"  \\
 +
 +__Fix:__ \\
 +The IP is added to the file "ip.blocklist.repeatoffender". \\
 +Open the file and remove the IP.
 +
  
linux/ubuntu/fail2ban.1549963664.txt.gz · Last modified: 2019/02/12 10:27 by lunetikk