Scott: /* TRAVEL SCENARIO: I banned myself */

2026-07-02T22:55:32Z

TRAVEL SCENARIO: I banned myself

← Older revision		Revision as of 22:55, 2 July 2026
Line 55:		Line 55:
	Symptoms: SSH connects then drops instantly, or times out, from one specific location — while the VPN or another network works fine.		Symptoms: SSH connects then drops instantly, or times out, from one specific location — while the VPN or another network works fine.

	# Get in another way (~~UCI~~ VPN, IPMI console, or another host).		# Get in another way (VPN, IPMI console, or another host).
	# <code>sudo fail2ban-client status sshd</code> → confirm your IP is listed.		# <code>sudo fail2ban-client status sshd</code> → confirm your IP is listed.
	# <code>sudo fail2ban-client set sshd unbanip <your-ip></code>		# <code>sudo fail2ban-client set sshd unbanip <your-ip></code>

Scott: Created page with "= fail2ban Cheat Sheet = Config: `/etc/fail2ban/jail.local` (jails) · `/etc/fail2ban/fail2ban.local` (daemon) Backend: '''systemd journal''' (not log files) · Ban action: '''nftables''' Jail: `sshd` · maxretry 4 · findtime 10m · bantime 1h Bans trigger on '''auth failures''', not connection counts. == Status & inspection == # Daemon alive? sudo systemctl status fail2ban sudo fail2ban-client ping..."

2026-07-02T22:48:10Z

Created page with "= fail2ban Cheat Sheet = Config: <code>/etc/fail2ban/jail.local</code> (jails) · <code>/etc/fail2ban/fail2ban.local</code> (daemon) Backend: '''systemd journal''' (not log files) · Ban action: '''nftables''' Jail: <code>sshd</code> · maxretry 4 · findtime 10m · bantime 1h Bans trigger on '''auth failures''', not connection counts. == Status & inspection == <syntaxhighlight lang="bash"> # Daemon alive? sudo systemctl status fail2ban sudo fail2ban-client ping..."

New page

= fail2ban Cheat Sheet =

Config: <code>/etc/fail2ban/jail.local</code> (jails) · <code>/etc/fail2ban/fail2ban.local</code> (daemon)

Backend: '''systemd journal''' (not log files) · Ban action: '''nftables'''

Jail: <code>sshd</code> · maxretry 4 · findtime 10m · bantime 1h

Bans trigger on '''auth failures''', not connection counts.

== Status & inspection ==

<syntaxhighlight lang="bash">
# Daemon alive?
sudo systemctl status fail2ban
sudo fail2ban-client ping # should answer "pong"

# Which jails are running?
sudo fail2ban-client status

# The sshd jail: current bans, totals, failure counts
sudo fail2ban-client status sshd

# Watch fail2ban's own log live
sudo journalctl -u fail2ban -f

# See the auth failures fail2ban is reading (same source it uses)
sudo journalctl -u ssh --since "1 hour ago" | grep -i fail
</syntaxhighlight>

== Bans: check / remove / add ==

<syntaxhighlight lang="bash">
# Is a specific IP banned? (listed under "Banned IP list")
sudo fail2ban-client status sshd

# UNBAN an address (the "I locked myself out" fix — run from IPMI console)
sudo fail2ban-client set sshd unbanip <ip>

# Unban everything in the jail
sudo fail2ban-client unban --all

# Manually ban an address
sudo fail2ban-client set sshd banip <ip>
</syntaxhighlight>

The actual block lives in nftables — verify with:

<syntaxhighlight lang="bash">
sudo nft list ruleset | grep -A5 f2b
</syntaxhighlight>

== TRAVEL SCENARIO: I banned myself ==

Symptoms: SSH connects then drops instantly, or times out, from one specific location — while the VPN or another network works fine.

# Get in another way (UCI VPN, IPMI console, or another host).
# <code>sudo fail2ban-client status sshd</code> → confirm your IP is listed.
# <code>sudo fail2ban-client set sshd unbanip <your-ip></code>
# Fix whatever failed auth 4× in 10 min (wrong key? stale agent? password typos?). Otherwise you'll be banned again in minutes.
# Worst case, do nothing: bantime is '''1 hour''', then it clears itself.

Note: with the minimal <code>ignoreip</code>, your travel IPs are NOT exempt. Four bad auth attempts from the hotel wifi = 1-hour ban. Use keys, and check <code>ssh -v</code> output before retrying blindly.

== Config changes ==

<syntaxhighlight lang="bash">
# Test config without applying
sudo fail2ban-client -t

# Reload after editing jail.local (keeps existing bans by default)
sudo fail2ban-client reload

# Full restart (re-reads everything; bans are restored from the
# persistent sqlite DB at /var/lib/fail2ban/fail2ban.sqlite3)
sudo systemctl restart fail2ban
</syntaxhighlight>

== Interaction with nftables ==

* Any <code>nft flush ruleset</code> / <code>systemctl reload nftables</code> '''wipes the f2b ban sets'''. fail2ban still ''thinks'' they're banned. Fix: <code>sudo systemctl restart fail2ban</code> after firewall reloads.
* Ban actions: <code>nftables-multiport</code> (per-jail ports), <code>nftables-allports</code> for allports bans.

== Current policy notes (jail.local) ==

* <code>ignoreip</code> — keep minimal: loopback + witchetty's /32 (backup source). Anything listed here can brute-force sshd forever without a ban.
* Consider <code>bantime.increment = true</code> in <code>[DEFAULT]</code> for escalating bans on repeat offenders.
* <code>allowipv6 = auto</code> lives in '''fail2ban.local''' <code>[Definition]</code>, not jail.local (daemon setting, silences the startup warning).

== Quick triage flowchart ==

<pre>
Can't SSH in?
├─ Works from VPN but not current IP?
│ ├─ IP not in $ssh_nets_v4 → nft issue (see nft sheet: temp rule)
│ └─ IP in allowed range → probably banned → unbanip
├─ Works from nowhere?
│ ├─ nftables ruleset empty/broken → nft sheet, IPMI console
│ └─ sshd itself down → journalctl -u ssh -b
└─ Connects but auth fails? → not a firewall problem; check keys/PAM
</pre>

[[Category:Sysadmin]]
[[Category:Cheat sheets]]

Fail2ban - Revision history

Scott: /* TRAVEL SCENARIO: I banned myself */