fail2ban

Whitelist

is the "ignoreip" list in /etc/fail2ban/jail.conf

Test a Filter

 fail2ban-regex -v /var/log/httpd_access /etc/fail2ban/filter.d/oddmuse.conf

Reload filters

 fail2ban-client reload

Status

Get the list of jails:

 fail2ban-client status

 fail2ban-client status ssh-iptables

Ban an IP

 fail2ban-client set ssh-iptables banip 47.54.168.212

Unban an IP

• Find the IP number - for instance failed auths in /var/log/auth
• Grep that IP number in /var/log/fail2ban to find out what jails it is in
• Then for each jail, say the jail is "ssh-iptables-alt" do

 fail2ban-client set ssh-iptables unbanip 47.54.168.212