Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #198860

Re: Fail2Ban Question: Can I do this without restarting the service?

Show all headers | View raw

On 8/16/2018 1:45 PM, cyaiplexys wrote:
> On 08/16/2018 02:36 AM, john doe wrote:
>> On 8/16/2018 3:29 AM, cyaiplexys wrote:
>>> I have a list of IP addresses I want to ban and I put them in 
>>> /etc/fail2ban/action.d/iptables-multiport.conf as so:
>>>
>>> cat /etc/fail2ban/ip.blacklist.perm | while read IP; do iptables -I 
>>> fail2ban-<name> 1 -s $IP -j DROP; done
>>>
>>> (that was supposed to be all on one line, of course)
>>>
>>> So, I have read that when you do things this way, you MUST restart 
>>> fail2ban (sudo service fail2ban restart).
>>>
>>> Is there a better way to do this? I have a cron job that gathers IP 
>>> addresses that get more than 1,000 hits from the apache log file and 
>>> that gets put in the ip.blacklist.perm file.
>>>
>>> I know *nothing* about fail2ban. I just read of this technique via 
>>> Google. But when using Google, I can't find another way to do this 
>>> that doesn't require a restart of the service.
>>>
>>> Any ideas on other ways to do this?
>>>
>>
>> I would use ipset.
>> Googling "fail2ban ipset" gives some interesting stuff.
>>
> 
> Thank you for the magic search term. :) I tried it and found at least 3 
> articles I bookmarked for reading.
> 
To query the status and start/stop/restart the service fail2ban, 
beginning with Debian 8 you would use 'systemd':
$ systemctl status/start/restart/stop fail2ban


Also increasing log verbosity when setting up fail2ban might not hurt.

https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04

-- 
John Doe

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Fail2Ban Question: Can I do this without restarting the service? cyaiplexys <cyaiplexys@sitesplace.net> - 2018-08-16 03:40 +0200
  Re: Fail2Ban Question: Can I do this without restarting the service? john doe <johndoe65534@mail.com> - 2018-08-16 08:40 +0200
    Re: Fail2Ban Question: Can I do this without restarting the service? cyaiplexys <cyaiplexys@sitesplace.net> - 2018-08-16 13:50 +0200
      Re: Fail2Ban Question: Can I do this without restarting the service? john doe <johndoe65534@mail.com> - 2018-08-16 16:00 +0200
        Re: Fail2Ban Question: Can I do this without restarting the service? cyaiplexys <cyaiplexys@sitesplace.net> - 2018-08-16 16:40 +0200
  Re: Fail2Ban Question: Can I do this without restarting the service? Dave Sherohman <dave@sherohman.org> - 2018-08-16 19:10 +0200
    Re: Fail2Ban Question: Can I do this without restarting the service? cyaiplexys <cyaiplexys@sitesplace.net> - 2018-08-16 20:10 +0200
      Re: Fail2Ban Question: Can I do this without restarting the service? Brian <ad44@cityscape.co.uk> - 2018-08-16 21:40 +0200
      Re: Fail2Ban Question: Can I do this without restarting the service? Dave Sherohman <dave@sherohman.org> - 2018-08-17 17:00 +0200
        Re: Fail2Ban Question: Can I do this without restarting the service? cyaiplexys <cyaiplexys@sitesplace.net> - 2018-08-17 19:00 +0200
          Re: Fail2Ban Question: Can I do this without restarting the service? john doe <johndoe65534@mail.com> - 2018-08-17 19:20 +0200
            Re: Fail2Ban Question: Can I do this without restarting the service? Brian <ad44@cityscape.co.uk> - 2018-08-17 19:40 +0200
              Re: Fail2Ban Question: Can I do this without restarting the service? john doe <johndoe65534@mail.com> - 2018-08-18 18:00 +0200
                Re: Fail2Ban Question: Can I do this without restarting the service? Reco <recoverym4n@gmail.com> - 2018-08-18 19:30 +0200
                Re: Fail2Ban Question: Can I do this without restarting the service? Brian <ad44@cityscape.co.uk> - 2018-08-18 20:10 +0200
            Re: Fail2Ban Question: Can I do this without restarting the service? Brian <ad44@cityscape.co.uk> - 2018-08-17 20:00 +0200
              Re: Fail2Ban Question: Can I do this without restarting the service? cyaiplexys <cyaiplexys@sitesplace.net> - 2018-08-17 20:40 +0200
            Re: Fail2Ban Question: Can I do this without restarting the service? cyaiplexys <cyaiplexys@sitesplace.net> - 2018-08-17 20:00 +0200
          Re: Fail2Ban Question: Can I do this without restarting the service? Brian <ad44@cityscape.co.uk> - 2018-08-17 20:10 +0200
          Re: Fail2Ban Question: Can I do this without restarting the service? Dave Sherohman <dave@sherohman.org> - 2018-08-17 23:00 +0200
            Re: Fail2Ban Question: Can I do this without restarting the service? cyaiplexys <cyaiplexys@sitesplace.net> - 2018-08-17 23:30 +0200
              Re: Fail2Ban Question: Can I do this without restarting the service? Dave Sherohman <dave@sherohman.org> - 2018-08-18 11:00 +0200

csiph-web