{"id":355,"date":"2019-05-14T14:31:09","date_gmt":"2019-05-14T14:31:09","guid":{"rendered":"https:\/\/blog.iabsolute.com\/?p=355"},"modified":"2019-05-14T14:31:09","modified_gmt":"2019-05-14T21:31:09","slug":"troubleshooting-fail2ban","status":"publish","type":"post","link":"https:\/\/blog.iabsolute.com\/?p=355","title":{"rendered":"Troubleshooting fail2ban"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Troubleshooting fail2ban<\/h2>\n\n\n\n<p>One of the best ways of troubleshooting is to use the <strong>fail2ban-regex tool<\/strong>.<\/p>\n\n\n\n<p>Feed this with the log-file you want to watch, and point it to the filter you want applied:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">hostname ~ # <strong>\/usr\/bin\/fail2ban-regex \/var\/log\/messages \/etc\/fail2ban\/filter.d\/sshd.conf<\/strong><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>or try this one \"\/usr\/bin\/fail2ban-client status ssh-iptables\"<\/strong><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\">--<\/pre>\n\n\n\n<p>Extra Fun!<\/p>\n\n\n\n<p>You can use this one-liner to parse through your <strong>\/var\/log\/messages<\/strong> file and totalize the number of<\/p>\n\n\n\n<p>times a specific IP-address has been attempting to access your machine:<\/p>\n\n\n\n<p>awk \u2018($(NF-7) = \/invalid user\/){print $(NF-3)}\u2019 \/var\/log\/messages | sort | uniq -c | sort<\/p>\n\n\n\n<p>Once you have this listing, you can manually add IP-blocks of the form:<\/p>\n\n\n\n<p>iptables -I INPUT -p tcp -s 83.103.96.33 \u2013dport ssh -j REJECT \u2013reject-with tcp-reset<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Troubleshooting fail2ban One of the best ways of troubleshooting is to use the fail2ban-regex tool. Feed this with the log-file you want to watch, and point it to the filter you want applied: hostname ~ # \/usr\/bin\/fail2ban-regex \/var\/log\/messages \/etc\/fail2ban\/filter.d\/sshd.conf or &hellip; <a href=\"https:\/\/blog.iabsolute.com\/?p=355\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-355","post","type-post","status-publish","format-standard","hentry","category-fail2ban"],"_links":{"self":[{"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/posts\/355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=355"}],"version-history":[{"count":1,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/posts\/355\/revisions"}],"predecessor-version":[{"id":356,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/posts\/355\/revisions\/356"}],"wp:attachment":[{"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}