fail2ban-users

[Fail2ban-users] fail2ban-client output?

[Harold H. <ha...@ha...>]

When I use fail2ban-client to ban a specific IP, I usually see a 0 or 1
response. I have not been able to find the meaning of this in the
documentation. What do these responses mean?

THANKS!

Harold



-- 
Not sent from an iPhone.

Re: [Fail2ban-users] fail2ban-client output?

[Tim B. <ti...@bo...>]

Hello!

Am Montag, dem 12.08.2024 um 15:54 -0700 schrieb Harold Hallikainen
via Fail2ban-users:
> When I use fail2ban-client to ban a specific IP, I usually see a 0
> or 1 response. 

I see those when unbanning a specific address. The answer of "1" means
that the address was found in my ruleset and unbanned. "0" means the
address could not be found and was not unbanned.
Hope this helps!
Cheers,

	tim
-- 
There is no character, howsoever good and fine, but it can be
destroyed by
ridicule, howsoever poor and witless.  Observe the ass, for instance:
his
character is about perfect, he is the choicest spirit among all the
humbler
animals, yet see what ridicule has brought him to.  Instead of feeling
complimented when we are called an ass, we are left in doubt.
		-- Mark Twain, "Pudd'nhead Wilson's Calendar"

Re: [Fail2ban-users] fail2ban-client output?

[Aldo N. <ne...@in...>]

On Tue, August 13, 2024 00:54, Harold Hallikainen via Fail2ban-users wrote:
> When I use fail2ban-client to ban a specific IP, I usually see a 0 or 1
> response. I have not been able to find the meaning of this in the
> documentation. What do these responses mean?
>
> THANKS!
>
> Harold
>
>

Hi,

if you receive a "1" output, the IP is regulairly banned because
it was not banned before, it was not present in the fail2ban's database.

if you receive a "0" output the IP was previously banned and no action is
required.

bye,
Aldo Necci




-----------------------------------------
This email was sent using SquirrelMail.
https://webmail3.inf.uniroma3.it
Web Site: http://www.squirrelmail.org

Re: [Fail2ban-users] fail2ban-client output?

[Harold H. <ha...@ha...>]

On Wed, August 14, 2024 2:17 am, Aldo Necci wrote:
> On Tue, August 13, 2024 00:54, Harold Hallikainen via Fail2ban-users
> wrote:
>> When I use fail2ban-client to ban a specific IP, I usually see a 0 or 1
>> response. I have not been able to find the meaning of this in the
>> documentation. What do these responses mean?
>>
>> THANKS!
>>
>> Harold
>>
>>
>
> Hi,
>
> if you receive a "1" output, the IP is regulairly banned because
> it was not banned before, it was not present in the fail2ban's database.
>
> if you receive a "0" output the IP was previously banned and no action is
> required.
>
> bye,
> Aldo Necci

THANKS! I could not find that in any of the documentation (but I may have
missed it). My server is getting swamped causing a whole lot of php-fpm to
run. I am now running a script every minute that restarts php-fpm if the
server load is over 50%. A major source of the load appears to be
ByteDance, so another daily script blocks all IP addresses with the
ByteDance bot. Next in line appears to be Amazon Web Services. I'm working
on blocking them.

Harold



-- 
Not sent from an iPhone.

Re: [Fail2ban-users] fail2ban-client output?

[L. V. L. <lv...@om...>]

On Wed, 14 Aug 2024, Harold Hallikainen via Fail2ban-users wrote:

> THANKS! I could not find that in any of the documentation (but I may have
> missed it). My server is getting swamped causing a whole lot of php-fpm to
> run.
>
Harold,

Don't forget the old standby:

iptables -I INPUT -s <malicious IP> -j DROP

Block an IP until the next reboot (which will clear any transient rules).
I use regularly when one of our websites is getting sucked by a bot.

	Lee