fail2ban

Whitelist

is the "ignoreip" list in /etc/fail2ban/jail.conf

Test a Filter

 fail2ban-regex -d /var/log/http_access /etc/fail2ban/filter.d/oddmuse.conf

Reload filters

 fail2ban-client reload

Ban an IP

 fail2ban-client set ssh-iptables banip 47.54.168.212

Unban an IP

• Find the IP number - for instance failed auths in /var/log/auth
• Grep that IP number in /var/log/fail2ban to find out what jails it is in
• Then for each jail, say the jail is "ssh-iptables-alt" do

 fail2ban-client set ssh-iptables unbanip 47.54.168.212