fail2ban-client(1)

1FAIL2BAN-CLIENT(1)               User Commands              FAIL2BAN-CLIENT(1)
2
3
4

NAME

6       fail2ban-client - configure and control the server
7

SYNOPSIS

9       fail2ban-client [OPTIONS] <COMMAND>
10

DESCRIPTION

12       Fail2Ban  v0.11.1  reads log file that contains password failure report
13       and bans the corresponding IP addresses using firewall rules.
14

OPTIONS

16       -c <DIR>
17              configuration directory
18
19       -s <FILE>
20              socket path
21
22       -p <FILE>
23              pidfile path
24
25       --loglevel <LEVEL>
26              logging level
27
28       --logtarget <TARGET>
29              logging target, use  file-name  or  stdout,  stderr,  syslog  or
30              sysout.
31
32       --syslogsocket auto|<FILE>
33
34       -d     dump configuration. For debugging
35
36       --dp, --dump-pretty
37              dump the configuration using more human readable representation
38
39       -t, --test
40              test configuration (can be also specified with start parameters)
41
42       -i     interactive mode
43
44       -v     increase verbosity
45
46       -q     decrease verbosity
47
48       -x     force execution of the server (remove socket file)
49
50       -b     start server in background (default)
51
52       -f     start server in foreground
53
54       --async
55              start  server in async mode (for internal usage only, don't read
56              configuration)
57
58       --timeout
59              timeout to wait for the server (for internal usage  only,  don't
60              read configuration)
61
62       --str2sec <STRING>
63              convert time abbreviation format to seconds
64
65       -h, --help
66              display this help message
67
68       -V, --version
69              print the version (-V returns machine-readable short format)
70

COMMAND

72              BASIC
73
74       start  starts the server and the jails
75
76       restart
77              restarts the server
78
79       restart [--unban] [--if-exists] <JAIL>
80              restarts  the  jail  <JAIL>  (alias  for  'reload  --restart ...
81              <JAIL>')
82
83       reload [--restart] [--unban] [--all]
84              reloads the configuration without restarting of the server,  the
85              option  '--restart'  activates completely restarting of affected
86              jails, thereby can unban IP addresses (if option '--unban' spec‐
87              ified)
88
89       reload [--restart] [--unban] [--if-exists] <JAIL>
90              reloads  the  jail <JAIL>, or restarts it (if option '--restart'
91              specified)
92
93       stop   stops all jails and terminate the server
94
95       unban --all
96              unbans all IP addresses (in all jails and database)
97
98       unban <IP> ... <IP>
99              unbans <IP> (in all jails and database)
100
101       status gets the current status of the server
102
103       ping   tests if the server is alive
104
105       echo   for internal usage, returns back and outputs a given string
106
107       help   return this output
108
109       version
110              return the server version
111
112              LOGGING
113
114       set loglevel <LEVEL>
115              sets logging level to <LEVEL>.  Levels: CRITICAL,  ERROR,  WARN‐
116              ING,  NOTICE, INFO, DEBUG, TRACEDEBUG, HEAVYDEBUG or correspond‐
117              ing numeric value (50-5)
118
119       get loglevel
120              gets the logging level
121
122       set logtarget <TARGET>
123              sets logging target to <TARGET>.  Can be STDOUT, STDERR,  SYSLOG
124              or a file
125
126       get logtarget
127              gets logging target
128
129       set syslogsocket auto|<SOCKET>
130              sets  the  syslog  socket path to auto or <SOCKET>. Only used if
131              logtarget is SYSLOG
132
133       get syslogsocket
134              gets syslog socket path
135
136       flushlogs
137              flushes the logtarget if a file and reopens it.  For  log  rota‐
138              tion.
139
140              DATABASE
141
142       set dbfile <FILE>
143              set the location of fail2ban persistent datastore. Set to "None"
144              to disable
145
146       get dbfile
147              get the location of fail2ban persistent datastore
148
149       set dbmaxmatches <INT>
150              sets the max number of matches stored in database per ticket
151
152       get dbmaxmatches
153              gets the max number of matches stored in database per ticket
154
155       set dbpurgeage <SECONDS>
156              sets the max age in <SECONDS> that history of bans will be kept
157
158       get dbpurgeage
159              gets the max age in seconds that history of bans will be kept
160
161              JAIL CONTROL
162
163       add <JAIL> <BACKEND>
164              creates <JAIL> using <BACKEND>
165
166       start <JAIL>
167              starts the jail <JAIL>
168
169       stop <JAIL>
170              stops the jail <JAIL>. The jail is removed
171
172       status <JAIL> [FLAVOR]
173              gets the current status  of  <JAIL>,  with  optional  flavor  or
174              extended info
175
176              JAIL CONFIGURATION
177
178       set <JAIL> idle on|off
179              sets the idle state of <JAIL>
180
181       set <JAIL> ignoreself true|false
182              allows the ignoring of own IP addresses
183
184       set <JAIL> addignoreip <IP>
185              adds <IP> to the ignore list of <JAIL>
186
187       set <JAIL> delignoreip <IP>
188              removes <IP> from the ignore list of <JAIL>
189
190       set <JAIL> ignorecommand <VALUE>
191              sets ignorecommand of <JAIL>
192
193       set <JAIL> ignorecache <VALUE>
194              sets ignorecache of <JAIL>
195
196       set <JAIL> addlogpath <FILE> ['tail']
197              adds  <FILE> to the monitoring list of <JAIL>, optionally start‐
198              ing at the 'tail' of the file (default 'head').
199
200       set <JAIL> dellogpath <FILE>
201              removes <FILE> from the monitoring list of <JAIL>
202
203       set <JAIL> logencoding <ENCODING>
204              sets the <ENCODING> of the log files for <JAIL>
205
206       set <JAIL> addjournalmatch <MATCH>
207              adds <MATCH> to the journal filter of <JAIL>
208
209       set <JAIL> deljournalmatch <MATCH>
210              removes <MATCH> from the journal filter of <JAIL>
211
212       set <JAIL> addfailregex <REGEX>
213              adds the regular expression <REGEX> which  must  match  failures
214              for <JAIL>
215
216       set <JAIL> delfailregex <INDEX>
217              removes the regular expression at <INDEX> for failregex
218
219       set <JAIL> addignoreregex <REGEX>
220              adds  the  regular expression <REGEX> which should match pattern
221              to exclude for <JAIL>
222
223       set <JAIL> delignoreregex <INDEX>
224              removes the regular expression at <INDEX> for ignoreregex
225
226       set <JAIL> findtime <TIME>
227              sets the number of seconds <TIME> for which the filter will look
228              back for <JAIL>
229
230       set <JAIL> bantime <TIME>
231              sets  the  number  of  seconds  <TIME> a host will be banned for
232              <JAIL>
233
234       set <JAIL> datepattern <PATTERN>
235              sets the <PATTERN> used to match date/times for <JAIL>
236
237       set <JAIL> usedns <VALUE>
238              sets the usedns mode for <JAIL>
239
240       set <JAIL> attempt <IP> [<failure1> ... <failureN>]
241              manually notify about <IP> failure
242
243       set <JAIL> banip <IP> ... <IP>
244              manually Ban <IP> for <JAIL>
245
246       set <JAIL> unbanip [--report-absent] <IP> ... <IP>
247              manually Unban <IP> in <JAIL>
248
249       set <JAIL> maxretry <RETRY>
250              sets the number of failures <RETRY> before banning the host  for
251              <JAIL>
252
253       set <JAIL> maxmatches <INT>
254              sets  the  max  number of matches stored in memory per ticket in
255              <JAIL>
256
257       set <JAIL> maxlines <LINES>
258              sets the number of <LINES> to buffer for regex search for <JAIL>
259
260       set <JAIL> addaction <ACT>[ <PYTHONFILE> <JSONKWARGS>]
261              adds a new action named  <ACT>  for  <JAIL>.  Optionally  for  a
262              Python  based  action,  a  <PYTHONFILE>  and <JSONKWARGS> can be
263              specified, else will be a Command Action
264
265       set <JAIL> delaction <ACT>
266              removes the action <ACT> from <JAIL>
267
268              COMMAND ACTION CONFIGURATION
269
270       set <JAIL> action <ACT> actionstart <CMD>
271              sets the start command <CMD> of the action <ACT> for <JAIL>
272
273       set <JAIL> action <ACT> actionstop <CMD> sets the stop command <CMD> of
274       the
275              action <ACT> for <JAIL>
276
277       set <JAIL> action <ACT> actioncheck <CMD>
278              sets the check command <CMD> of the action <ACT> for <JAIL>
279
280       set <JAIL> action <ACT> actionban <CMD>
281              sets the ban command <CMD> of the action <ACT> for <JAIL>
282
283       set <JAIL> action <ACT> actionunban <CMD>
284              sets the unban command <CMD> of the action <ACT> for <JAIL>
285
286       set <JAIL> action <ACT> timeout <TIMEOUT>
287              sets  <TIMEOUT> as the command timeout in seconds for the action
288              <ACT> for <JAIL>
289
290              GENERAL ACTION CONFIGURATION
291
292       set <JAIL> action <ACT> <PROPERTY> <VALUE>
293              sets the <VALUE> of <PROPERTY> for the action <ACT> for <JAIL>
294
295       set <JAIL> action <ACT> <METHOD>[ <JSONKWARGS>]
296              calls the <METHOD> with <JSONKWARGS> for the  action  <ACT>  for
297              <JAIL>
298
299              JAIL INFORMATION
300
301       get <JAIL> logpath
302              gets the list of the monitored files for <JAIL>
303
304       get <JAIL> logencoding
305              gets the encoding of the log files for <JAIL>
306
307       get <JAIL> journalmatch
308              gets the journal filter match for <JAIL>
309
310       get <JAIL> ignoreself
311              gets the current value of the ignoring the own IP addresses
312
313       get <JAIL> ignoreip
314              gets the list of ignored IP addresses for <JAIL>
315
316       get <JAIL> ignorecommand
317              gets ignorecommand of <JAIL>
318
319       get <JAIL> failregex
320              gets  the list of regular expressions which matches the failures
321              for <JAIL>
322
323       get <JAIL> ignoreregex
324              gets the list of regular expressions which matches  patterns  to
325              ignore for <JAIL>
326
327       get <JAIL> findtime
328              gets  the  time for which the filter will look back for failures
329              for <JAIL>
330
331       get <JAIL> bantime
332              gets the time a host is banned for <JAIL>
333
334       get <JAIL> datepattern
335              gets the patern used to match date/times for <JAIL>
336
337       get <JAIL> usedns
338              gets the usedns setting for <JAIL>
339
340       get <JAIL> banip [<SEP>|--with-time]
341              gets the list of of banned IP addresses for  <JAIL>.  Optionally
342              the  separator  character  ('<SEP>',  default  is  space) or the
343              option '--with-time' (printing the times of ban) may  be  speci‐
344              fied. The IPs are ordered by end of ban.
345
346       get <JAIL> maxretry
347              gets the number of failures allowed for <JAIL>
348
349       get <JAIL> maxmatches
350              gets  the  max  number of matches stored in memory per ticket in
351              <JAIL>
352
353       get <JAIL> maxlines
354              gets the number of lines to buffer for <JAIL>
355
356       get <JAIL> actions
357              gets a list of actions for <JAIL>
358
359              COMMAND ACTION INFORMATION
360
361       get <JAIL> action <ACT> actionstart
362              gets the start command for the action <ACT> for <JAIL>
363
364       get <JAIL> action <ACT> actionstop
365              gets the stop command for the action <ACT> for <JAIL>
366
367       get <JAIL> action <ACT> actioncheck
368              gets the check command for the action <ACT> for <JAIL>
369
370       get <JAIL> action <ACT> actionban
371              gets the ban command for the action <ACT> for <JAIL>
372
373       get <JAIL> action <ACT> actionunban
374              gets the unban command for the action <ACT> for <JAIL>
375
376       get <JAIL> action <ACT> timeout
377              gets the command timeout in seconds for  the  action  <ACT>  for
378              <JAIL>
379
380              GENERAL ACTION INFORMATION
381
382       get <JAIL> actionproperties <ACT>
383              gets a list of properties for the action <ACT> for <JAIL>
384
385       get <JAIL> actionmethods <ACT>
386              gets a list of methods for the action <ACT> for <JAIL>
387
388       get <JAIL> action <ACT> <PROPERTY>
389              gets the value of <PROPERTY> for the action <ACT> for <JAIL>
390

FILES

392       /etc/fail2ban/*
393

REPORTING BUGS

395       Report bugs to https://github.com/fail2ban/fail2ban/issues
396