View source for Ubuntu/Configure Fail2Ban for permanent and persistent bans

<div class="mw-parser-output">&nbsp;</div> <div class="mw-parser-output">
= Configure permanent bans =

----

This is the easiest part. Ban time can be set either globally (ie: for all jails), or per jail. It is controlled through the ‘bantime‘ parameter which defines the number of seconds an IP is banned.

To set a permanent ban, simply set the bantime parameter to a value of&nbsp;-1. Edit the&nbsp;jail.conf&nbsp;file, comment out the existing ‘bantime’ line, and set a new bantime to&nbsp;-1&nbsp;:

&nbsp;
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># "bantime" is the number of seconds that a host is banned.</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># bantime&nbsp; = 600</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">&nbsp;</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Permanent ban</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>bantime = -1</code></div> 
&nbsp;

= Configure persistent bans =

----

In order for bans to persist across a service restart, they obviously have to be saved somewhere. No fancy database required, a simple text file will do the trick.

The principle is simple: every time Fail2Ban sets a new ban on an IP, we’ll save the information «&nbsp;jail name and IP address&nbsp;» in a file along the way. Next, upon each Fail2Ban service start, we’ll load this file a re-create the corresponding bans. All it takes is two lines in the right configuration file.

Each ban action is defined in a corresponding configuration file. Within this file, there’s two parameters we’re interested in:

#actionstart&nbsp;: here we can define a list of commands that will be executed only once at the start of Fail2Ban. So we’ll add a custom command loading the file&nbsp;/etc/fail2ban/persistent.bans&nbsp;and re-create the corresponding iptables entries. 
#actionban&nbsp;: here we can defined a list of commands that will be executed when banning an IP. So we’ll add a custom command to save the useful information to the file /etc/fail2ban/persistent.bans. 

The default action in Fail2Ban is iptables-multiport (as defined in the file jail.conf), so we have to edit the&nbsp;action.d/iptables-multiport.conffile and add the following highlighted lines:

&nbsp;
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>[Definition]</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">&nbsp;</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Option:&nbsp; actionstart</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Notes.:&nbsp; command executed once at the start of Fail2Ban.</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Values:&nbsp; CMD</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>#</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>actionstart = iptables -N fail2ban-<name></code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>iptables -A fail2ban-<name> -j RETURN</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>iptables -I <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name></code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code><span style="background-color:#FFFF00;">cat /etc/fail2ban/persistent.bans | awk '/^fail2ban-<name>/ {print $2}' \</span></code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code><span style="background-color:#FFFF00;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></code><code><span style="background-color:#FFFF00;">| while read IP; do iptables -I fail2ban-<name> 1 -s $IP -j <blocktype>; done</span></code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">&nbsp;</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Option:&nbsp; actionstop</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Notes.:&nbsp; command executed once at the end of Fail2Ban</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Values:&nbsp; CMD</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>#</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name></code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>iptables -F fail2ban-<name></code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>iptables -X fail2ban-<name></code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">&nbsp;</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Option:&nbsp; actioncheck</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Notes.:&nbsp; command executed once before each actionban command</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Values:&nbsp; CMD</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>#</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">&nbsp;</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Option:&nbsp; actionban</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Notes.:&nbsp; command executed when banning an IP. Take care that the</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; command is executed with Fail2Ban user rights.</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Tags:&nbsp;&nbsp;&nbsp; See jail.conf(5) man page</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code># Values:&nbsp; CMD</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>#</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype></code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code><span style="background-color:#FFFF00;">echo "fail2ban-<name> <ip>" >> /etc/fail2ban/persistent.bans</span></code></div> 
&nbsp;

Once done, it is required to restart Fail2Ban in order for those change to be applied.

&nbsp;
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>service fail2ban restart</code></div> 
&nbsp;
</div>