日志流（journald / 日志文件）
                        │
                        ▼
   ┌──────────  jail（监狱：逻辑单元）──────────┐
   │  绑定 filter（匹配规则）+ action（处置动作）  │
   │  参数：maxretry / findtime / bantime /      │
   │        ignoreip / ignoreself / backend      │
   └──────────────┬──────────────┬───────────────┘
                  │              │
        ┌─────────▼──────┐   ┌───▼──────────────┐
        │  filter 正则   │   │  action 封禁命令  │
        │  (sshd.conf)   │   │ (iptables-multiport│
        │  failregex     │   │  firewallcmd 等)  │
        │  ignoreregex   │   │                  │
        └────────────────┘   └──────────────────┘

/etc/fail2ban/
├── action.d/                  # 封禁动作定义目录
│   ├── iptables-multiport.conf # iptables 多端口动作（Ubuntu 实测生效动作）
│   ├── iptables-common.conf    # iptables 动作公共参数（chain/blocktype 等）
│   ├── iptables-ipset-proto4.conf
│   ├── firewallcmd-ipset.conf  # firewalld+ipset 动作（Ubuntu 亦随包提供）
│   ├── systemd.conf            # 用 systemd 自身的"封禁"（如 ssh 源）
│   └── ... 共 40+ 个动作模板
├── fail2ban.conf              # 主配置：socket/pidfile/dbfile/loglevel/logtarget
├── fail2ban.d/                # 主配置片段目录（默认空）
├── filter.d/                  # 日志匹配正则目录
│   ├── sshd.conf              # OpenSSH 匹配规则（本文核心，见 5.3）
│   ├── sshd-ddos.conf
│   ├── common.conf            # 公共前缀（__prefix_line）定义
│   └── ... 共 80+ 个服务模板
├── jail.conf                  # jail 默认定义（包提供，不要直接修改）
├── jail.d/
│   └── defaults-debian.conf   # Debian/Ubuntu 自带：默认启用 [sshd] jail
├── jail.local                 # 用户自定义 jail（优先级最高，本文创建）
├── paths-arch.conf            # 发行版日志路径（Arch）
├── paths-common.conf          # 通用日志路径宏（sshd_log、syslog_authpriv 等）
├── paths-debian.conf          # Debian 系路径
└── paths-opensuse.conf        # openSUSE 路径

apt-get install -y openssh-server

Reading package lists...
Building dependency tree...
Reading state information...
The following NEW packages will be installed:
  openssh-server openssh-sftp-server
0 upgraded, 2 newly installed, 0 to remove and 7 not upgraded.
Need to get 495 kB of archives.
After this operation, 1707 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 openssh-sftp-server amd64 1:8.9p1-3ubuntu0.17 [38.0 kB]
Get:2 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 openssh-server amd64 1:8.9p1-3ubuntu0.17 [457 kB]
debconf: delaying package configuration, since apt-utils is not installed
Fetched 495 kB in 1s (321 kB/s)
Selecting previously unselected package openssh-sftp-server.
(Reading database ... 7037 files and directories currently installed.)
Preparing to unpack .../openssh-sftp-server_1%3a8.9p1-3ubuntu0.17_amd64.deb ...
Unpacking openssh-sftp-server (1:8.9p1-3ubuntu0.17) ...
Selecting previously unselected package openssh-server.
Preparing to unpack .../openssh-server_1%3a8.9p1-3ubuntu0.17_amd64.deb ...
Unpacking openssh-server (1:8.9p1-3ubuntu0.17) ...
Setting up openssh-sftp-server (1:8.9p1-3ubuntu0.17) ...
Setting up openssh-server (1:8.9p1-3ubuntu0.17) ...
Created symlink /etc/systemd/system/multi-user.target.wants/ssh.service → /lib/systemd/system/ssh.service.
/usr/sbin/policy-rc.d returned 101, not running 'start rescue-ssh.target ssh.service'
/usr/sbin/policy-rc.d returned 101, not running 'start ssh.socket'
Processing triggers for ufw (0.36.1-4ubuntu0.1) ...
Processing triggers for libc-bin (2.35-0ubuntu3.14) ...

systemctl enable --now ssh

Synchronizing state of ssh.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable ssh

systemctl status ssh --no-pager

● ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2026-10-06 05:28:32 UTC; 8h ago
       Docs: man:sshd(8)
             man:sshd_config(5)
   Main PID: 191459 (sshd)
      Tasks: 1 (limit: 5753)
     Memory: 2.3M
        CPU: 512ms
     CGroup: /system.slice/.../ssh.service
             └─191459 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"

apt-get install -y fail2ban

Reading package lists...
Building dependency tree...
Reading state information...
The following additional packages will be installed:
  python3-pyinotify python3-systemd whois
Suggested packages:
  mailx system-log-daemon monit sqlite3 python-pyinotify-doc
The following NEW packages will be installed:
  fail2ban python3-pyinotify python3-systemd whois
0 upgraded, 4 newly installed, 0 to remove and 10 not upgraded.
Need to get 512 kB of archives.
After this operation, 2684 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu jammy/universe amd64 fail2ban all 0.11.2-6 [394 kB]
Get:2 http://archive.ubuntu.com/ubuntu jammy/main amd64 python3-pyinotify all 0.9.6-1.3 [24.8 kB]
Get:3 http://archive.ubuntu.com/ubuntu jammy/main amd64 python3-systemd amd64 234-3ubuntu2 [39.6 kB]
Get:4 http://archive.ubuntu.com/ubuntu jammy/main amd64 whois amd64 5.5.13 [53.4 kB]
debconf: delaying package configuration, since apt-utils is not installed
Fetched 512 kB in 2s (283 kB/s)
Selecting previously unselected package fail2ban.
(Reading database ... 6971 files and directories currently installed.)
Preparing to unpack .../fail2ban_0.11.2-6_all.deb ...
Unpacking fail2ban (0.11.2-6) ...
Selecting previously unselected package python3-pyinotify.
Preparing to unpack .../python3-pyinotify_0.9.6-1.3_all.deb ...
Unpacking python3-pyinotify (0.9.6-1.3) ...
Selecting previously unselected package python3-systemd.
Preparing to unpack .../python3-systemd_234-3ubuntu2_amd64.deb ...
Unpacking python3-systemd (234-3ubuntu2) ...
Selecting previously unselected package whois.
Preparing to unpack .../whois_5.5.13_amd64.deb ...
Unpacking whois (5.5.13) ...
Setting up whois (5.5.13) ...
Setting up fail2ban (0.11.2-6) ...
invoke-rc.d: policy-rc.d denied execution of start.
Setting up python3-pyinotify (0.9.6-1.3) ...
Setting up python3-systemd (234-3ubuntu2) ...

systemctl enable --now fail2ban

Synchronizing state of fail2ban.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable fail2ban
Created symlink /etc/systemd/system/multi-user.target.wants/fail2ban.service → /lib/systemd/system/fail2ban.service.

systemctl status fail2ban --no-pager

● fail2ban.service - Fail2Ban Service
     Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2026-10-06 04:59:34 UTC; 122ms ago
       Docs: man:fail2ban(1)
   Main PID: 1611 (fail2ban-server)
      Tasks: 4 (limit: 5753)
     Memory: 10.7M
        CPU: 106ms
     CGroup: /system.slice/.../fail2ban.service
             └─1611 /usr/bin/python3 /usr/bin/fail2ban-server -xf start

2026-10-06 04:59:04,790 fail2ban                [1510]: ERROR   Failed to access socket path: /var/run/fail2ban/fail2ban.sock. Is fail2ban running?

fail2ban-client version

0.11.2

fail2ban-client status

Status
|- Number of jail:      1
`- Jail list:   sshd

fail2ban-client -t

OK: configuration test is successful

dpkg -l fail2ban

+++-==============-============-============-===================================================
ii  fail2ban       0.11.2-6     all          ban hosts that cause multiple authentication errors

apt-cache depends fail2ban

fail2ban
  Depends: <python3:any>
    python3
  Depends: lsb-base
 |Recommends: nftables
  Recommends: iptables
  Recommends: whois
  Recommends: python3-pyinotify
  Recommends: python3-systemd
  Suggests: <mailx>
    bsd-mailx
    mailutils
  Suggests: <system-log-daemon>
    syslog-ng-core
    busybox-syslogd
    inetutils-syslogd
    socklog-run
    rsyslog
  Suggests: monit
  Suggests: sqlite3

cd /tmp

apt-get download fail2ban

Get:1 http://archive.ubuntu.com/ubuntu jammy/universe amd64 fail2ban all 0.11.2-6 [394 kB]
Fetched 394 kB in 2s (253 kB/s)

cd /tmp && apt-get download fail2ban python3-pyinotify python3-systemd whois

Get:1 http://archive.ubuntu.com/ubuntu jammy/main amd64 python3-pyinotify all 0.9.6-1.3 [24.8 kB]
Get:2 http://archive.ubuntu.com/ubuntu jammy/main amd64 python3-systemd amd64 234-3ubuntu2 [39.6 kB]
Get:3 http://archive.ubuntu.com/ubuntu jammy/main amd64 whois amd64 5.5.13 [53.4 kB]
Fetched 118 kB in 2s (74.1 kB/s)

-rw-r--r-- 1 root root 386K Mar 22  2022 /tmp/fail2ban_0.11.2-6_all.deb
-rw-r--r-- 1 root root  25K Nov  2  2020 /tmp/python3-pyinotify_0.9.6-1.3_all.deb
-rw-r--r-- 1 root root  39K Mar 17  2022 /tmp/python3-systemd_234-3ubuntu2_amd64.deb
-rw-r--r-- 1 root root  53K Apr  8  2022 /tmp/whois_5.5.13_amd64.deb

dpkg -i /tmp/python3-pyinotify_0.9.6-1.3_all.deb

dpkg -i /tmp/python3-systemd_234-3ubuntu2_amd64.deb

dpkg -i /tmp/whois_5.5.13_amd64.deb

dpkg -i /tmp/fail2ban_0.11.2-6_all.deb

systemctl enable --now fail2ban

fail2ban-client -t

fail2ban-client version

jail.conf  <  jail.d/*.conf  <  jail.local

[sshd]
enabled = true

[DEFAULT]
bantime  = 10m
findtime = 10m
maxretry = 5
backend  = systemd
ignoreself = false

[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

[sshd]

# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
#mode   = normal
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

# "bantime" is the number of seconds that a host is banned.
bantime  = 10m

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 10m

# "maxretry" is the number of failures before a host get banned.
maxretry = 5

default_backend = %(default/backend)s
syslog_authpriv = /var/log/auth.log
syslog_backend = %(default_backend)s
sshd_log = %(syslog_authpriv)s
sshd_backend = %(default_backend)s

fail2ban-client status sshd

Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

fail2ban-client get sshd logpath

No file is currently monitored

# Fail2Ban filter for openssh
#
# If you want to protect OpenSSH from being bruteforced by password
# authentication then get public key authentication working before disabling
# PasswordAuthentication in sshd_config.
#
#
# "Connection from <HOST> port \d+" requires LogLevel VERBOSE in sshd_config
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[DEFAULT]

_daemon = sshd

# optional prefix (logged from several ssh versions) like "error: ", "error: PAM: " or "fatal: "
__pref = (?:(?:error|fatal): (?:PAM: )?)?
# optional suffix (logged from several ssh versions) like " [preauth]"
#__suff = (?: port \d+)?(?: \[preauth\])?\s*
__suff = (?: (?:port \d+|on \S+|\[preauth\])){0,3}\s*
__on_port_opt = (?: (?:port \d+|on \S+)){0,2}
# close by authenticating user:
__authng_user = (?: (?:invalid|authenticating) user <F-USER>\S+|.*?</F-USER>)?

# for all possible (also future) forms of "no matching (cipher|mac|MAC|compression method|key exchange method|host key type) found",
# see ssherr.c for all possible SSH_ERR_..._ALG_MATCH errors.
__alg_match = (?:(?:\w+ (?!found\b)){0,2}\w+)

# PAM authentication mechanism, can be overridden, e. g. `filter = sshd[__pam_auth='pam_ldap']`:
__pam_auth = pam_[a-z]+

[Definition]

prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID>%(__pref)s<F-CONTENT>.+</F-CONTENT>$

cmnfailre = ^[aA]uthentication (?:failure|error|failed) for <F-USER>.*</F-USER> from <HOST>( via \S+)?%(__suff)s$
            ^User not known to the underlying authentication module for <F-USER>.*</F-USER> from <HOST>%(__suff)s$
            <cmnfailre-failed-pub-<publickey>>
            ^Failed <cmnfailed> for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
            ^<F-USER>ROOT</F-USER> LOGIN REFUSED FROM <HOST>
            ^[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> from <HOST>%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because not listed in AllowUsers%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because listed in DenyUsers%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because not in any group%(__suff)s$
            ^refused connect from \S+ \(<HOST>\)
            ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*3: .*: Auth fail%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because a group is listed in DenyGroups%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because none of user's groups are listed in AllowGroups%(__suff)s$
            ^<F-NOFAIL>%(__pam_auth)s\(sshd:auth\):\s+authentication failure;</F-NOFAIL>(?:\s+(?:(?:logname|e?uid|tty)=\S*)){0,4}\s+ruser=<F-ALT_USER>\S*</F-ALT_USER>\s+rhost=<HOST>(?:\s+user=<F-USER>\S*</F-USER>)?%(__suff)s$
            ^maximum authentication attempts exceeded for <F-USER>.*</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> not allowed because account is locked%(__suff)s
            ^<F-MLFFORGET>Disconnecting</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+</F-USER> <HOST>%(__on_port_opt)s:\s*Change of username or service not allowed:\s*.*\[preauth\]\s*$
            ^Disconnecting: Too many authentication failures(?: for <F-USER>\S+|.*?</F-USER>)?%(__suff)s$
            ^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>%(__on_port_opt)s:\s*11:
            <mdre-<mode>-other>
            ^<F-MLFFORGET><F-MLFGAINED>Accepted \w+</F-MLFGAINED></F-MLFFORGET> for <F-USER>\S+</F-USER> from <HOST>(?:\s|$)

cmnfailed-any = \S+
cmnfailed-ignore = \b(?!publickey)\S+
cmnfailed-invalid = <cmnfailed-ignore>
cmnfailed-nofail = (?:<F-NOFAIL>publickey</F-NOFAIL>|\S+)
cmnfailed = <cmnfailed-<publickey>>

mdre-normal =
# used to differentiate "connection closed" with and without `[preauth]` (fail/nofail cases in ddos mode)
mdre-normal-other = ^<F-NOFAIL><F-MLFFORGET>(Connection closed|Disconnected)</F-MLFFORGET></F-NOFAIL> (?:by|from)%(__authng_user)s <HOST>(?:%(__suff)s|\s*)$

mdre-ddos = ^Did not receive identification string from <HOST>
            ^kex_exchange_identification: (?:[Cc]lient sent invalid protocol identifier|[Cc]onnection closed by remote host)
            ^Bad protocol version identification '.*' from <HOST>
            ^<F-NOFAIL>SSH: Server;Ltype:</F-NOFAIL> (?:Authname|Version|Kex);Remote: <HOST>-\d+;[A-Z]\w+:
            ^Read from socket failed: Connection <F-MLFFORGET>reset</F-MLFFORGET> by peer
# same as mdre-normal-other, but as failure (without <F-NOFAIL>) and [preauth] only:
mdre-ddos-other = ^<F-MLFFORGET>(Connection (?:closed|reset)|Disconnected)</F-MLFFORGET> (?:by|from)%(__authng_user)s <HOST>%(__on_port_opt)s\s+\[preauth\]\s*$

mdre-extra = ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*14: No(?: supported)? authentication methods available
            ^Unable to negotiate with <HOST>%(__on_port_opt)s: no matching <__alg_match> found.
            ^Unable to negotiate a <__alg_match>
            ^no matching <__alg_match> found:
# part of mdre-ddos-other, but user name is supplied (invalid/authenticating) on [preauth] phase only:
mdre-extra-other = ^<F-MLFFORGET>Disconnected</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+|.*?</F-USER> <HOST>%(__on_port_opt)s \[preauth\]\s*$

mdre-aggressive = %(mdre-ddos)s
                  %(mdre-extra)s
# mdre-extra-other is fully included within mdre-ddos-other:
mdre-aggressive-other = %(mdre-ddos-other)s

# Parameter "publickey": nofail (default), invalid, any, ignore
publickey = nofail
# consider failed publickey for invalid users only:
cmnfailre-failed-pub-invalid = ^Failed publickey for invalid user <F-USER>(?P<cond_user>\S+)|(?:(?! from ).)*?</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
# consider failed publickey for valid users too (don't need RE, see cmnfailed):
cmnfailre-failed-pub-any =
# same as invalid, but consider failed publickey for valid users too, just as no failure (helper to get IP and user-name only, see cmnfailed):
cmnfailre-failed-pub-nofail = <cmnfailre-failed-pub-invalid>
# don't consider failed publickey as failures (don't need RE, see cmnfailed):
cmnfailre-failed-pub-ignore =

cfooterre = ^<F-NOFAIL>Connection from</F-NOFAIL> <HOST>

failregex = %(cmnfailre)s
            <mdre-<mode>>
            %(cfooterre)s

# Parameter "mode": normal (default), ddos, extra or aggressive (combines all)
# Usage example (for jail.local):
#   [sshd]
#   mode = extra
#   # or another jail (rewrite filter parameters of jail):
#   [sshd-aggressive]
#   filter = sshd[mode=aggressive]
#
mode = normal

#filter = sshd[mode=aggressive]

ignoreregex =

maxlines = 1

journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd

# Fail2Ban configuration file
#
# Author: Cyril Jaquier
# Modified by Yaroslav Halchenko for multiport banning
#

[INCLUDES]

before = iptables-common.conf

[Definition]

# Option:  actionstart
# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
# Values:  CMD
#
actionstart = <iptables> -N f2b-<name>
              <iptables> -A f2b-<name> -j <returntype>
              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>

# Option:  actionstop
# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
# Values:  CMD
#
actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
             <actionflush>
             <iptables> -X f2b-<name>

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>

[Init]

chain = INPUT
name = default
port = ssh
protocol = tcp
blocktype = REJECT --reject-with icmp-port-unreachable
returntype = RETURN
iptables = iptables <lockingopt>
lockingopt = -w

iptables -N f2b-sshd

iptables -A f2b-sshd -j RETURN

iptables -I INPUT -p tcp -m multiport --dports 22 -j f2b-sshd

iptables -I f2b-sshd 1 -s 127.0.0.1/32 -j REJECT --reject-with icmp-port-unreachable

<iptables> -I f2b-sshd 1 -s <ip> -j <blocktype>

fail2ban-client version

0.11.2

fail2ban-client -V

0.11.2

fail2ban-client ping

Server replied: pong

fail2ban-client -t

OK: configuration test is successful

Usage: fail2ban-client [OPTIONS] <COMMAND>

Fail2Ban v0.11.2 reads log file that contains password failure report
and bans the corresponding IP addresses using firewall rules.

Options:
    -c, --conf <DIR>        configuration directory
    -s, --socket <FILE>     socket path
    -p, --pidfile <FILE>    pidfile path
    --pname <NAME>          name of the process (main thread) to identify instance (default fail2ban-server)
    --loglevel <LEVEL>      logging level
    --logtarget <TARGET>    logging target, use file-name or stdout, stderr, syslog or sysout.
    --syslogsocket auto|<FILE>
    -d                      dump configuration. For debugging
    --dp, --dump-pretty     dump the configuration using more human readable representation
    -t, --test              test configuration (can be also specified with start parameters)
    -i                      interactive mode
    -v                      increase verbosity
    -q                      decrease verbosity
    -x                      force execution of the server (remove socket file)
    -b                      start server in background (default)
    -f                      start server in foreground
    --async                 start server in async mode (for internal usage only, don't read configuration)
    --timeout               timeout to wait for the server (for internal usage only, don't read configuration)
    --str2sec <STRING>      convert time abbreviation format to seconds
    -h, --help              display this help message
    -V, --version           print the version (-V returns machine-readable short format)

Command:
                                             BASIC
    start                                    starts the server and the jails
    restart                                  restarts the server
    restart [--unban] [--if-exists] <JAIL>   restarts the jail <JAIL> (alias
                                             for 'reload --restart ... <JAIL>')
    reload [--restart] [--unban] [--all]     reloads the configuration without
                                             restarting of the server, the
                                             option '--restart' activates
                                             completely restarting of affected
                                             jails, thereby can unban IP
                                             addresses (if option '--unban'
                                             specified)
    reload [--restart] [--unban] [--if-exists] <JAIL>
                                             reloads the jail <JAIL>, or
                                             restarts it (if option '--restart'
                                             specified)
    stop                                     stops all jails and terminate the
                                             server
    unban --all                              unbans all IP addresses (in all
                                             jails and database)
    unban <IP> ... <IP>                      unbans <IP> (in all jails and
                                             database)
    banned                                   return jails with banned IPs as
                                             dictionary
    banned <IP> ... <IP>]                    return list(s) of jails where
                                             given IP(s) are banned
    status                                   gets the current status of the
                                             server
    ping                                     tests if the server is alive
    echo                                     for internal usage, returns back
                                             and outputs a given string
    help                                     return this output
    version                                  return the server version

                                             LOGGING
    set loglevel <LEVEL>                     sets logging level to <LEVEL>.
                                             Levels: CRITICAL, ERROR, WARNING,
                                             NOTICE, INFO, DEBUG, TRACEDEBUG,
                                             HEAVYDEBUG or corresponding
                                             numeric value (50-5)
    get loglevel                             gets the logging level
    set logtarget <TARGET>                   sets logging target to <TARGET>.
                                             Can be STDOUT, STDERR, SYSLOG or a
                                             file
    get logtarget                            gets logging target
    set syslogsocket auto|<SOCKET>           sets the syslog socket path to
                                             auto or <SOCKET>. Only used if
                                             logtarget is SYSLOG
    get syslogsocket                         gets syslog socket path
    flushlogs                                flushes the logtarget if a file
                                             and reopens it. For log rotation.

                                             DATABASE
    set dbfile <FILE>                        set the location of fail2ban
                                             persistent datastore. Set to
                                             "None" to disable
    get dbfile                               get the location of fail2ban
                                             persistent datastore
    set dbmaxmatches <INT>                   sets the max number of matches
                                             stored in database per ticket
    get dbmaxmatches                         gets the max number of matches
                                             stored in database per ticket
    set dbpurgeage <SECONDS>                 sets the max age in <SECONDS> that
                                             history of bans will be kept
    get dbpurgeage                           gets the max age in seconds that
                                             history of bans will be kept

                                             JAIL CONTROL
    add <JAIL> <BACKEND>                     creates <JAIL> using <BACKEND>
    start <JAIL>                             starts the jail <JAIL>
    stop <JAIL>                              stops the jail <JAIL>. The jail is
                                             removed
    status <JAIL> [FLAVOR]                   gets the current status of <JAIL>,
                                             with optional flavor or extended
                                             info

                                             JAIL CONFIGURATION
    set <JAIL> idle on|off                   sets the idle state of <JAIL>
    set <JAIL> ignoreself true|false         allows the ignoring of own IP
                                             addresses
    set <JAIL> addignoreip <IP>              adds <IP> to the ignore list of
                                             <JAIL>
    set <JAIL> delignoreip <IP>              removes <IP> from the ignore list
                                             of <JAIL>
    set <JAIL> ignorecommand <VALUE>         sets ignorecommand of <JAIL>
    set <JAIL> ignorecache <VALUE>           sets ignorecache of <JAIL>
    set <JAIL> addlogpath <FILE> ['tail']    adds <FILE> to the monitoring list
                                             of <JAIL>, optionally starting at
                                             the 'tail' of the file (default
                                             'head').
    set <JAIL> dellogpath <FILE>             removes <FILE> from the monitoring
                                             list of <JAIL>
    set <JAIL> logencoding <ENCODING>        sets the <ENCODING> of the log
                                             files for <JAIL>
    set <JAIL> addjournalmatch <MATCH>       adds <MATCH> to the journal filter
                                             of <JAIL>
    set <JAIL> deljournalmatch <MATCH>       removes <MATCH> from the journal
                                             filter of <JAIL>
    set <JAIL> addfailregex <REGEX>          adds the regular expression
                                             <REGEX> which must match failures
                                             for <JAIL>
    set <JAIL> delfailregex <INDEX>          removes the regular expression at
                                             <INDEX> for failregex
    set <JAIL> addignoreregex <REGEX>        adds the regular expression
                                             <REGEX> which should match pattern
                                             to exclude for <JAIL>
    set <JAIL> delignoreregex <INDEX>        removes the regular expression at
                                             <INDEX> for ignoreregex
    set <JAIL> findtime <TIME>               sets the number of seconds <TIME>
                                             for which the filter will look
                                             back for <JAIL>
    set <JAIL> bantime <TIME>                sets the number of seconds <TIME>
                                             a host will be banned for <JAIL>
    set <JAIL> datepattern <PATTERN>         sets the <PATTERN> used to match
                                             date/times for <JAIL>
    set <JAIL> usedns <VALUE>                sets the usedns mode for <JAIL>
    set <JAIL> attempt <IP> [<failure1> ... <failureN>]
                                             manually notify about <IP> failure
    set <JAIL> banip <IP> ... <IP>           manually Ban <IP> for <JAIL>
    set <JAIL> unbanip [--report-absent] <IP> ... <IP>
                                             manually Unban <IP> in <JAIL>
    set <JAIL> maxretry <RETRY>              sets the number of failures
                                             <RETRY> before banning the host
                                             for <JAIL>
    set <JAIL> maxmatches <INT>              sets the max number of matches
                                             stored in memory per ticket in
                                             <JAIL>
    set <JAIL> maxlines <LINES>              sets the number of <LINES> to
                                             buffer for regex search for <JAIL>
    set <JAIL> addaction <ACT>[ <PYTHONFILE> <JSONKWARGS>]
                                             adds a new action named <ACT> for
                                             <JAIL>. Optionally for a Python
                                             based action, a <PYTHONFILE> and
                                             <JSONKWARGS> can be specified,
                                             else will be a Command Action
    set <JAIL> delaction <ACT>               removes the action <ACT> from
                                             <JAIL>

                                             COMMAND ACTION CONFIGURATION
    set <JAIL> action <ACT> actionstart <CMD>
                                             sets the start command <CMD> of
                                             the action <ACT> for <JAIL>
    set <JAIL> action <ACT> actionstop <CMD> sets the stop command <CMD> of the
                                             action <ACT> for <JAIL>
    set <JAIL> action <ACT> actioncheck <CMD>
                                             sets the check command <CMD> of
                                             the action <ACT> for <JAIL>
    set <JAIL> action <ACT> actionban <CMD>  sets the ban command <CMD> of the
                                             action <ACT> for <JAIL>
    set <JAIL> action <ACT> actionunban <CMD>
                                             sets the unban command <CMD> of
                                             the action <ACT> for <JAIL>
    set <JAIL> action <ACT> timeout <TIMEOUT>
                                             sets <TIMEOUT> as the command
                                             timeout in seconds for the action
                                             <ACT> for <JAIL>

                                             GENERAL ACTION CONFIGURATION
    set <JAIL> action <ACT> <PROPERTY> <VALUE>
                                             sets the <VALUE> of <PROPERTY> for
                                             the action <ACT> for <JAIL>
    set <JAIL> action <ACT> <METHOD>[ <JSONKWARGS>]
                                             calls the <METHOD> with
                                             <JSONKWARGS> for the action <ACT>
                                             for <JAIL>

                                             JAIL INFORMATION
    get <JAIL> banned                        return banned IPs of <JAIL>
    get <JAIL> banned <IP> ... <IP>]         return 1 if IP is banned in <JAIL>
                                             otherwise 0, or a list of 1/0 for
                                             multiple IPs
    get <JAIL> logpath                       gets the list of the monitored
                                             files for <JAIL>
    get <JAIL> logencoding                   gets the encoding of the log files
                                             for <JAIL>
    get <JAIL> journalmatch                  gets the journal filter match for
                                             <JAIL>
    get <JAIL> ignoreself                    gets the current value of the
                                             ignoring the own IP addresses
    get <JAIL> ignoreip                      gets the list of ignored IP
                                             addresses for <JAIL>
    get <JAIL> ignorecommand                 gets ignorecommand of <JAIL>
    get <JAIL> failregex                     gets the list of regular
                                             expressions which matches the
                                             failures for <JAIL>
    get <JAIL> ignoreregex                   gets the list of regular
                                             expressions which matches patterns
                                             to ignore for <JAIL>
    get <JAIL> findtime                      gets the time for which the filter
                                             will look back for failures for
                                             <JAIL>
    get <JAIL> bantime                       gets the time a host is banned for
                                             <JAIL>
    get <JAIL> datepattern                   gets the patern used to match
                                             date/times for <JAIL>
    get <JAIL> usedns                        gets the usedns setting for <JAIL>
    get <JAIL> banip [<SEP>|--with-time]     gets the list of of banned IP
                                             addresses for <JAIL>. Optionally
                                             the separator character ('<SEP>',
                                             default is space) or the option '
                                             --with-time' (printing the times
                                             of ban) may be specified. The IPs
                                             are ordered by end of ban.
    get <JAIL> maxretry                      gets the number of failures
                                             allowed for <JAIL>
    get <JAIL> maxmatches                    gets the max number of matches
                                             stored in memory per ticket in
                                             <JAIL>
    get <JAIL> maxlines                      gets the number of lines to buffer
                                             for <JAIL>
    get <JAIL> actions                       gets a list of actions for <JAIL>

                                             COMMAND ACTION INFORMATION
    get <JAIL> action <ACT> actionstart      gets the start command for the
                                             action <ACT> for <JAIL>
    get <JAIL> action <ACT> actionstop       gets the stop command for the
                                             action <ACT> for <JAIL>
    get <JAIL> action <ACT> actioncheck      gets the check command for the
                                             action <ACT> for <JAIL>
    get <JAIL> action <ACT> actionban        gets the ban command for the
                                             action <ACT> for <JAIL>
    get <JAIL> action <ACT> actionunban      gets the unban command for the
                                             action <ACT> for <JAIL>
    get <JAIL> action <ACT> timeout          gets the command timeout in
                                             seconds for the action <ACT> for
                                             <JAIL>

                                             GENERAL ACTION INFORMATION
    get <JAIL> actionproperties <ACT>        gets a list of properties for the
                                             action <ACT> for <JAIL>
    get <JAIL> actionmethods <ACT>           gets a list of methods for the
                                             action <ACT> for <JAIL>
    get <JAIL> action <ACT> <PROPERTY>       gets the value of <PROPERTY> for
                                             the action <ACT> for <JAIL>

Report bugs to https://github.com/fail2ban/fail2ban/issues

fail2ban-client start

2026-10-06 14:03:05,346 fail2ban                [338097]: ERROR   Server already running

fail2ban-client stop

rm -f /var/run/fail2ban/fail2ban.sock

systemctl restart fail2ban

fail2ban-client ping

Server replied: pong

fail2ban-client reload

OK

fail2ban-client status

Status
|- Number of jail:      1
`- Jail list:   sshd

fail2ban-client status

Status
|- Number of jail:      1
`- Jail list:   sshd

fail2ban-client status sshd

Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

fail2ban-client get sshd bantime

600

fail2ban-client get sshd maxretry

5

fail2ban-client get sshd findtime

600

fail2ban-client get sshd ignoreip

No IP address/network is ignored

fail2ban-client get sshd logpath

No file is currently monitored

fail2ban-client get sshd usedns

warn

fail2ban-client get sshd actions

The jail sshd has the following actions:
iptables-multiport

fail2ban-client get sshd journalmatch

Current match filter:
_SYSTEMD_UNIT=sshd.service + _COMM=sshd

fail2ban-client get sshd banned

['127.0.0.1']

fail2ban-client get sshd banip --with-time

127.0.0.1       2026-10-06 13:59:35 + 600 = 2026-10-06 14:09:35

fail2ban-client get loglevel

Current logging level is 'INFO'

fail2ban-client set loglevel DEBUG

Current logging level is 'DEBUG'

fail2ban-client get loglevel

Current logging level is 'DEBUG'

fail2ban-client set loglevel INFO

Current logging level is 'INFO'

fail2ban-client get dbfile

Current database file is:
`- /var/lib/fail2ban/fail2ban.sqlite3

fail2ban-client get dbpurgeage

Current database purge age is:
`- 86400seconds

fail2ban-client set sshd bantime 600

600

fail2ban-client get sshd bantime

600

fail2ban-client set sshd maxretry 3

3

fail2ban-client get sshd maxretry

3

fail2ban-client set sshd maxretry 5

5

fail2ban-client set sshd findtime 600

600

fail2ban-client set sshd addignoreip 10.0.0.0/8

These IP addresses/networks are ignored:
`- 10.0.0.0/8

fail2ban-client get sshd ignoreip

These IP addresses/networks are ignored:
`- 10.0.0.0/8

fail2ban-client set sshd delignoreip 10.0.0.0/8

No IP address/network is ignored

fail2ban-client set sshd banip 192.168.99.99

1

fail2ban-client get sshd banned

['192.168.99.99']

fail2ban-client set sshd unbanip 192.168.99.99

1

fail2ban-client get sshd banned

[]

fail2ban-client unban 127.0.0.1

1

fail2ban-client unban --all

0

fail2ban-client banned

[{'sshd': []}]

fail2ban-client restart

Shutdown successful
2026-10-06 05:31:15,346 fail2ban                [222749]: ERROR   Could not start server. Maybe an old socket file is still present. Try to remove /var/run/fail2ban/fail2ban.sock. If you used fail2ban-client to start the server, adding the -x option will do it

rm -f /var/run/fail2ban/fail2ban.sock

systemctl restart fail2ban

fail2ban-client ping

Server replied: pong

fail2ban-server -h

Usage: fail2ban-server [OPTIONS]

Fail2Ban v0.11.2 reads log file that contains password failure report
and bans the corresponding IP addresses using firewall rules.

Options:
    -c, --conf <DIR>        configuration directory
    -s, --socket <FILE>     socket path
    -p, --pidfile <FILE>    pidfile path
    --pname <NAME>          name of the process (main thread) to identify instance (default fail2ban-server)
    --loglevel <LEVEL>      logging level
    --logtarget <TARGET>    logging target, use file-name or stdout, stderr, syslog or sysout.
    --syslogsocket auto|<FILE>
    -d                      dump configuration. For debugging
    --dp, --dump-pretty     dump the configuration using more human readable representation
    -t, --test              test configuration (can be also specified with start parameters)
    -i                      interactive mode
    -v                      increase verbosity
    -q                      decrease verbosity
    -x                      force execution of the server (remove socket file)
    -b                      start server in background (default)
    -f                      start server in foreground
    --async                 start server in async mode (for internal usage only, don't read configuration)
    --timeout               timeout to wait for the server (for internal usage only, don't read configuration)
    --str2sec <STRING>      convert time abbreviation format to seconds
    -h, --help              display this help message
    -V, --version           print the version (-V returns machine-readable short format)

Report bugs to https://github.com/fail2ban/fail2ban/issues

Usage: /usr/bin/fail2ban-regex [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]

Fail2Ban  reads log file that contains password failure report
and bans the corresponding IP addresses using firewall rules.

This tools can test regular expressions for "fail2ban".

LOG:
  string                a string representing a log line
  filename              path to a log file (/var/log/auth.log)
  systemd-journal       search systemd journal (systemd-python required),
                        optionally with backend parameters, see `man jail.conf`
                        for usage and examples (systemd-journal[journalflags=1]).

REGEX:
  string                a string representing a 'failregex'
  filter                name of filter, optionally with options (sshd[mode=aggressive])
  filename              path to a filter file (filter.d/sshd.conf)

IGNOREREGEX:
  string                a string representing an 'ignoreregex'
  filename              path to a filter file (filter.d/sshd.conf)

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  -c CONFIG, --config=CONFIG
                        set alternate config directory
  -d DATEPATTERN, --datepattern=DATEPATTERN
                        set custom pattern used to match date/times
  --timezone=TIMEZONE, --TZ=TIMEZONE
                        set time-zone used by convert time format
  -e ENCODING, --encoding=ENCODING
                        File encoding. Default: system locale
  -r, --raw             Raw hosts, don't resolve dns
  --usedns=USEDNS       DNS specified replacement of tags <HOST> in regexp
                        ('yes' - matches all form of hosts, 'no' - IP
                        addresses only)
  -L MAXLINES, --maxlines=MAXLINES
                        maxlines for multi-line regex.

fail2ban-regex /var/log/auth.log "sshd.*Failed password"

Running tests
=============

Use   failregex line : sshd.*Failed password
ERROR: No failure-id group in 'sshd.*Failed password'

fail2ban-regex /var/log/auth.log "^Failed password for .* from <HOST>"

Results
=======

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [12] {^LN-BEG}(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
`-

Lines: 12 lines, 0 ignored, 0 matched, 12 missed
[processed in 0.00 sec]

|- Missed line(s):
|  Oct 06 05:29:08 b3d88cde7ef0 sshd[194644]: Failed password for root from 127.0.0.1 port 36650 ssh2
|  Oct 06 05:29:10 b3d88cde7ef0 sshd[195414]: Failed password for root from 127.0.0.1 port 36660 ssh2
|  Oct 06 05:29:14 b3d88cde7ef0 sshd[196881]: Failed password for root from 127.0.0.1 port 36662 ssh2
|  Oct 06 05:29:16 b3d88cde7ef0 sshd[197762]: Failed password for root from 127.0.0.1 port 36668 ssh2
|  Oct 06 05:29:18 b3d88cde7ef0 sshd[198177]: Failed password for root from 127.0.0.1 port 48892 ssh2
|  Oct 06 05:29:47 b3d88cde7ef0 sshd[205277]: Failed password for root from 127.0.0.1 port 52102 ssh2
|  Oct 06 06:14:16 b3d88cde7ef0 sshd[271841]: Failed password for root from 127.0.0.1 port 49574 ssh2
|  Oct 06 06:14:20 b3d88cde7ef0 sshd[271845]: Failed password for root from 127.0.0.1 port 58864 ssh2
|  Oct 06 06:14:24 b3d88cde7ef0 sshd[271849]: Failed password for root from 127.0.0.1 port 58872 ssh2
|  Oct 06 06:14:28 b3d88cde7ef0 sshd[271853]: Failed password for root from 127.0.0.1 port 58874 ssh2
|  Oct 06 06:14:32 b3d88cde7ef0 sshd[271857]: Failed password for root from 127.0.0.1 port 51106 ssh2
|  Oct 06 06:14:38 b3d88cde7ef0 sshd[271885]: Failed password for root from 127.0.0.1 port 51122 ssh2
`-

fail2ban-regex /var/log/auth.log "Failed password for .* from <HOST>"

Lines: 12 lines, 0 ignored, 12 matched, 0 missed
[processed in 0.00 sec]

fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

Running tests
=============

Use   failregex filter file : sshd, basedir: /etc/fail2ban
Use         maxlines : 1
Use      datepattern : {^LN-BEG} : Default Detectors
Use         log file : /var/log/auth.log
Use         encoding : UTF-8


Results
=======

Prefregex: 12 total
|  ^(?P<mlfid>(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?)(?:(?:error|fatal): (?:PAM: )?)?(?P<content>.+)$
`-

Failregex: 12 total
|-  #) [# of hits] regular expression
|   4) [12] ^Failed (?:<F-NOFAIL>publickey</F-NOFAIL>|\S+) for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>(?: (?:port \d+|on \S+)){0,2}(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [12] {^LN-BEG}(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
`-

Lines: 12 lines, 0 ignored, 12 matched, 0 missed
[processed in 0.01 sec]

fail2ban-client stop sshd

Jail stopped

fail2ban-client status

Status
|- Number of jail:      0
`- Jail list:

fail2ban-client start sshd

2026-10-06 14:01:42,149 fail2ban                [318438]: ERROR   NOK: ('sshd',)
Sorry but the jail 'sshd' does not exist

fail2ban-client reload

OK

fail2ban-client help

2026-10-06 14:03:13,595 fail2ban                [341785]: ERROR   NOK: ('Invalid command',)
Invalid command

fail2ban-client --str2sec 1h

3600

systemctl is-active ssh

active

systemctl is-active fail2ban

active

fail2ban-client status sshd

Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

apt-get install -y sshpass

Reading package lists...
Building dependency tree...
Reading state information...
sshpass is already the newest version (1.09-1).
0 upgraded, 0 newly installed, 0 to remove and 7 not upgraded.

sshpass -V

sshpass 1.09
(C) 2006-2011 Lingnu Open Source Consulting Ltd.
(C) 2015-2016, 2021 Shachar Shemesh
This program is free software, and can be distributed under the terms of the GPL
See the COPYING file for more information.

Using "assword" as the default password prompt indicator.

for i in $(seq 1 6); do echo "== 第${i}次错误密码登录 =="; sshpass -p wrong$(date +%s) ssh -o StrictHostKeyChecking=no -o ConnectTimeout=3 root@127.0.0.1 exit 2>&1; done

== 第1次错误密码登录 ==
Permission denied, please try again.
== 第2次错误密码登录 ==
Permission denied, please try again.
== 第3次错误密码登录 ==
Permission denied, please try again.
== 第4次错误密码登录 ==
Permission denied, please try again.
== 第5次错误密码登录 ==
Permission denied, please try again.
== 第6次错误密码登录 ==
ssh: connect to host 127.0.0.1 port 22: Connection refused

fail2ban-client status sshd

Status for the jail: sshd
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     12
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
   |- Currently banned: 1
   |- Total banned:     2
   `- Banned IP list:   127.0.0.1

fail2ban-client get sshd banned

['127.0.0.1']

fail2ban-client get sshd banip --with-time

127.0.0.1       2026-10-06 13:59:35 + 600 = 2026-10-06 14:09:35

tail -8 /var/log/fail2ban.log

2026-10-06 13:59:25,548 fail2ban.filter         [224422]: INFO    [sshd] Found 127.0.0.1 - 2026-10-06 13:59:25
2026-10-06 13:59:27,338 fail2ban.filter         [224422]: INFO    [sshd] Found 127.0.0.1 - 2026-10-06 13:59:26
2026-10-06 13:59:29,046 fail2ban.filter         [224422]: INFO    [sshd] Found 127.0.0.1 - 2026-10-06 13:59:28
2026-10-06 13:59:31,543 fail2ban.filter         [224422]: INFO    [sshd] Found 127.0.0.1 - 2026-10-06 13:59:31
2026-10-06 13:59:35,338 fail2ban.filter         [224422]: INFO    [sshd] Found 127.0.0.1 - 2026-10-06 13:59:35
2026-10-06 13:59:35,533 fail2ban.actions        [224422]: NOTICE  [sshd] Ban 127.0.0.1
2026-10-06 13:59:38,088 fail2ban.filter         [224422]: INFO    [sshd] Found 127.0.0.1 - 2026-10-06 13:59:37

journalctl -u ssh --no-pager --since "2026-10-06 13:59:00" --until "2026-10-06 14:00:30"

Oct 06 13:59:25 b3d88cde7ef0 sshd[273818]: Failed password for root from 127.0.0.1 port 38840 ssh2
Oct 06 13:59:26 b3d88cde7ef0 sshd[273818]: Failed password for root from 127.0.0.1 port 38840 ssh2
Oct 06 13:59:26 b3d88cde7ef0 sshd[273818]: Connection closed by authenticating user root 127.0.0.1 port 38840 [preauth]
Oct 06 13:59:28 b3d88cde7ef0 sshd[273823]: Failed password for root from 127.0.0.1 port 57170 ssh2
Oct 06 13:59:29 b3d88cde7ef0 sshd[273823]: Connection closed by authenticating user root 127.0.0.1 port 57170 [preauth]
Oct 06 13:59:31 b3d88cde7ef0 sshd[273828]: Failed password for root from 127.0.0.1 port 57184 ssh2
Oct 06 13:59:33 b3d88cde7ef0 sshd[273828]: Connection closed by authenticating user root 127.0.0.1 port 57184 [preauth]
Oct 06 13:59:35 b3d88cde7ef0 sshd[273833]: Failed password for root from 127.0.0.1 port 57200 ssh2
Oct 06 13:59:35 b3d88cde7ef0 sshd[273833]: Connection closed by authenticating user root 127.0.0.1 port 57200 [preauth]
Oct 06 13:59:37 b3d88cde7ef0 sshd[273838]: Failed password for root from 127.0.0.1 port 57214 ssh2
Oct 06 13:59:55 b3d88cde7ef0 sshd[275330]: Failed password for root from 127.0.0.1 port 60882 ssh2
Oct 06 13:59:55 b3d88cde7ef0 sshd[275330]: Connection closed by authenticating user root 127.0.0.1 port 60882 [preauth]
Oct 06 14:00:07 b3d88cde7ef0 sshd[273838]: Connection closed by authenticating user root 127.0.0.1 port 57214 [preauth]

iptables -S | grep -i f2b

-N f2b-sshd
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A f2b-sshd -s 127.0.0.1/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -j RETURN

fail2ban-client unban 127.0.0.1

1

fail2ban-client status sshd

Status for the jail: sshd
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     12
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
   |- Currently banned: 0
   |- Total banned:     2
   `- Banned IP list:

sshpass -p wrong$(date +%s) ssh -o StrictHostKeyChecking=no -o ConnectTimeout=3 root@127.0.0.1 exit 2>&1

Permission denied, please try again.

iptables -S | grep -i f2b

-N f2b-sshd
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A f2b-sshd -j RETURN

systemctl enable --now fail2ban

systemctl start fail2ban

systemctl stop fail2ban

systemctl restart fail2ban

systemctl reload fail2ban

systemctl status fail2ban --no-pager

systemctl is-active fail2ban

systemctl is-enabled fail2ban

systemctl disable fail2ban

journalctl -u fail2ban --no-pager -n 50

journalctl -u fail2ban -f

systemctl enable --now ssh

systemctl start ssh

systemctl stop ssh

systemctl restart ssh

systemctl status ssh --no-pager

systemctl is-active ssh

journalctl -u ssh --no-pager -n 20

[Unit]
Description=Fail2Ban Service
Documentation=man:fail2ban(1)
After=network.target iptables.service firewalld.service ip6tables.service ipset.service nftables.service
PartOf=firewalld.service

[Service]
Type=simple
Environment="PYTHONNOUSERSITE=1"
ExecStart=/usr/bin/fail2ban-server -xf start
# if should be logged in systemd journal, use following line or set logtarget to sysout in fail2ban.local
# ExecStart=/usr/bin/fail2ban-server -xf --logtarget=sysout start
ExecStop=/usr/bin/fail2ban-client stop
ExecReload=/usr/bin/fail2ban-client reload
RuntimeDirectory=fail2ban
PIDFile=/run/fail2ban/fail2ban.pid
Restart=on-failure
RestartPreventExitStatus=0 255
Environment="PYTHONNOUSERSITE=yes"

[Install]
WantedBy=multi-user.target

fail2ban-client status sshd

fail2ban-client get sshd logpath

fail2ban-client get sshd journalmatch

Current match filter:
_SYSTEMD_UNIT=sshd.service + _COMM=sshd

fail2ban-client set sshd addignoreip 10.0.0.0/8

These IP addresses/networks are ignored:
`- 10.0.0.0/8

fail2ban-client set sshd delignoreip 10.0.0.0/8

No IP address/network is ignored

ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8 192.168.0.0/16

apt-get purge --dry-run fail2ban

Reading package lists...
Building dependency tree...
Reading state information...
The following packages were automatically installed and are no longer required:
  python3-pyinotify python3-systemd whois
Use 'apt autoremove' to remove them.
The following packages will be REMOVED:
  fail2ban*
0 upgraded, 0 newly installed, 1 to remove and 7 not upgraded.
Purg fail2ban [0.11.2-6]

systemctl stop fail2ban

systemctl disable fail2ban

apt-get purge -y fail2ban

apt-get autoremove -y

rm -rf /etc/fail2ban

rm -f /var/log/fail2ban.log

rm -rf /var/lib/fail2ban

rm -f /var/run/fail2ban/fail2ban.sock

iptables -F f2b-sshd

iptables -D INPUT -p tcp -m multiport --dports 22 -j f2b-sshd

iptables -X f2b-sshd

dpkg -l fail2ban 2>/dev/null | tail -1