1

When I started with an Ubuntu home server, fail2ban was a lifesaver - alerting me to multiple attempts at unauthorized SSH access to my server. Recently, after moving to a way off port, the only thing fail2ban bans is me. Specifically, whenever I use FileZilla for SFTP to try to download multiple items off my home server, I get banned right away, even though I correctly entered my password.

It looks like I'm not the only one who has been affected by this issue: http://sourceforge.net/p/fail2ban/mailman/message/32194650/ - but this thread ends with no solution, and I'm not sure how fail2ban-regex will help anything.

Is there a way to permanently whitelist a certain local IP address as a fail2ban exception? Or, better yet, get fail2ban to stop banning legitimate use that was properly authenticated? (Or is this a bug with f2b or filezilla?)

My home server runs Ubuntu 12.04, with fail2ban 0.8.6-3wheezy3build0.12.04.1

My clients run a variety of operating systems, but the one that's been getting banned most often recently is running FileZilla 3.10.3 on Windows, but this has also affected other clients.

3

I don't have a solution for your particular problem but to answer one of your questions: yes, you can permanently whitelist an IP address. Open your /etc/fail2ban/jail.local (if you don't have it, I suggest you create it by copying /etc/fail2ban/jail.conf - it's better than modifying jail.conf directly; restart fail2ban afterwards) and search for ignoreip. This option takes space separated list of IP addresses:

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1/8
3
  • Thanks, I will check this out today! Is using a space separator the only way to define multiple addresses? Or can I "cherry-pick" addresses like 192.168.1.2 and 192.168.1.252 but nothing else? – drkokandy Apr 6 '15 at 17:03
  • As for the space, this is the only separator specified by the author in the default jail.conf so I don't know if any other separator is supported. I'm afraid I don't understand your second question. – tmt Apr 6 '15 at 20:35
  • My question didn't make sense because I was not thinking about what I was asking. :) I can answer what I was asking for anyone else's future benefit: To select just 198.168.1.2 and 192.168.1.252, I would just add that to ignore IP. IE: ignoreip = 127.0.0.1/8 192.168.1.2 192.168.1.252 – drkokandy Apr 6 '15 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.