HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials

HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials (http://www.howtoforge.com/forums/index.php)
-   Tips/Tricks/Mods (http://www.howtoforge.com/forums/forumdisplay.php?f=29)
-   -   How to manually unban ip blocked by fail2ban (http://www.howtoforge.com/forums/showthread.php?t=51366)

drewb0y 10th February 2011 16:09

How to manually unban ip blocked by fail2ban
 
I ran into an issue today where my office router somehow got blocked by fail2ban. I searched high and low to find an answer to unblock it so I did not have to wait for the ban to expire.

Here is what I found:

when I executed
Code:

iptables -L
I saw that my IP was in the jail named postfix-spamers550

to remove it I executed the following command

Code:

fail2ban-client get postfix-spamers550 actionunban 111.222.333.444
Success

cbj4074 6th April 2012 00:10

I am trying to do the same (manually un-ban a single IP address), but when I issue the command you cited, I receive the following in fail2ban's log:

Code:

fail2ban-client get sasl actionunban XXX.XXX.XXX.XXX
Code:

2012-04-05 14:50:48,671 fail2ban.comm  : WARNING Invalid command: ['get', 'sasl', 'actionunban', 'XXX.XXX.XXX.XXX']
(Note: the XXXs represent an actual IP address)

To make matters more confusing, according to the fail2ban Wiki ( http://www.fail2ban.org/wiki/index.php/Features ), manual actions, including un-banning, are not possible in version 0.8 (these features are on the road-map for 0.9):

Quote:

Manual control of ban list (ban, unban, reset). You currently have to restart the daemon to unban.
Yet, the "fail2ban-client --help" output corroborates the availability of this command:

Quote:

get <JAIL> actionunban <ACT> gets the unban command for the
action <ACT> for <JAIL>
I am using fail2ban 0.8.6.

I know the jail name ("sasl") is correct, because the client throws a different error (e.g., "Sorry but the jail 'fail2ban-sasl' does not exist") when the jail name is incorrect.

Am I missing the "unban" action in fail2ban's "action.d" directory? If so, from where did you acquire that file? And do you mind sharing it?

Any thoughts? Thanks in advance.

ehansen 8th April 2012 23:34

Quote:

Originally Posted by drewb0y (Post 250780)
I ran into an issue today where my office router somehow got blocked by fail2ban. I searched high and low to find an answer to unblock it so I did not have to wait for the ban to expire.

Here is what I found:

when I executed
Code:

iptables -L
I saw that my IP was in the jail named postfix-spamers550

to remove it I executed the following command

Code:

fail2ban-client get postfix-spamers550 actionunban 111.222.333.444
Success

Another option, though may not be for the best, is:
Code:

iptables -D <chain> <chain number>
The information can be found by running this: iptables -L --line-numbers

cbj4074 9th April 2012 17:47

Thank you for the reply, ehansen.

My concern with that approach is that fail2ban will attempt to restore iptables rules whenever it is restarted.

In other words, if I were to remove the banned IP address directly, and then fail2ban had to be restarted for any reason, the IP address would again be added to the blacklist.

ehansen 9th April 2012 17:49

fail2ban doesn't start/stop the firewall as far as I know. Even if it did, however, as long as the firewall rules are saved (iptables-save) before a shutdown the restore will just load up the most recent saved rules.

cbj4074 9th April 2012 17:56

Right; I don't think that fail2ban starts or stops the firewall either.

But as far as I know, fail2ban does re-parse logs when it is started, and adds any qualifying entries to the iptables rules (if not already present).

If this is, in fact, how fail2ban behaves, wouldn't it re-add the IP address in question as soon as fail2ban is restarted?

ehansen 9th April 2012 18:07

Quote:

Originally Posted by cbj4074 (Post 277012)
Right; I don't think that fail2ban starts or stops the firewall either.

But as far as I know, fail2ban does re-parse logs when it is started, and adds any qualifying entries to the iptables rules (if not already present).

If this is, in fact, how fail2ban behaves, wouldn't it re-add the IP address in question as soon as fail2ban is restarted?

I wouldn't think so but I don't know the inner workings of fail2ban. I mean I've had my server restarted after fail2ban put in some IPs and seemed like only the rules themselves were loaded. Someone who is more familiar with how it works wil probably be able to better answer it though.

till 11th April 2012 08:08

As far as I know, fail2ban will not reload the rules and the firewall creates new rules based on its config files and not based on the iptables rules before the reboot. So when you unban a IP with iptables -D, it will not be added again after reboot automatically.

yucktoufoo 8th May 2012 21:32

Quote:

Originally Posted by ehansen (Post 277013)
I wouldn't think so but I don't know the inner workings of fail2ban. I mean I've had my server restarted after fail2ban put in some IPs and seemed like only the rules themselves were loaded. Someone who is more familiar with how it works wil probably be able to better answer it though.

You are correct, restarting iptables clears out anything added by fail2ban, in fact thats how I used to unban myself :)

cbj4074 9th May 2012 19:27

I checked with the fail2ban mailing list and here's the official word from Yaroslav Halchenko (current project maintainer, I believe):

Quote:

there is no explicit guaranteed rebanning upon restart in place ATM

if your original scanned logs still happen to have those entries
within findtime from now, they should get banned upon restart

relevant (the oldest open) issue on github:
https://github.com/fail2ban/fail2ban/issues/2
So, there is the potential for IP addresses to be re-banned after service stop/start/restart.

I believe that this behavior was introduced in version 0.8.6.


All times are GMT +2. The time now is 21:24.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.