Linux Security

Steps for Recovering from a UNIX or NT System Compromise

http://www.cert.org/tech_tips/win-UNIX-system_compromise.html

Using fail2ban to ban bots for long periods

Note that restarting or reloading fail2ban clears all banned IP addresses.

Use the /etc/fail2ban/filter.d/recidive.conf filter, configuring fail2ban to monitor its own logs. See Filter for fail2ban to long-ban repeat offenders · Issue #19 · fail2ban/fail2ban for discussion.

-- Frank Dean - 22 Apr 2017

Unbanning

$ sudo fail2ban-client status
$ sudo fail2ban-client status $JAIL_NAME
$ sudo fail2ban-client get $JAIL_NAME banned
$ sudo fail2ban-client get $JAIL_NAME bantime
$ sudo fail2ban-client get $JAIL_NAME banip --with-time
$ sudo fail2ban-client unban $IP ... $IP
$ sudo fail2ban-client unban --all

Testing fail2ban Configuration

The following example tests the sshd jail configurations against the systemd journal entries:

$ fail2ban-regex systemd-journal 'sshd[mode=normal]'
$ fail2ban-regex systemd-journal 'sshd[mode=aggressive]'

See the --print-all-missed and --print-all-matched options in the fail2ban-regex man pages.

-- Frank Dean - 28 Jul 2026

-- Frank Dean - 28 Mar 2007

Related Topics: LinuxHintsAndTips