Topic: Fail2Ban Panel doesn't display Blocked Hosts

[BossHog]

Howdy,
sorry for raising this issue in the forums!
As soon as Bugzilla stops being...buggy, I will post a bug.

Current  server is SME11RC1 as of recent updates.
I can see in fail2ban logs IP addresses being blocked and found and unbanned as is expected.
However, the Server Manager Panel for Fail2Ban has NOT displayed any of the active bans.
This seems buggy to me.
Joe

P.S. - My bad, this should be in the Contribs Forum *

[bunkobugsy]

Please confirm that banned hosts show up in old SM1 panel still available at /server-manager/cgi-bin/fail2ban

[bunkobugsy]

not confirmed https://bugs.koozali.org/show_bug.cgi?id=13611#c1

[BossHog]

Howdy,
my server does NOT show banned IPs in either of the Server Manager Panels.
(Bunko', is Bugzilla up at this time? I am still getting 403 error.)
I cannot see what the bug you linked yet.
Joe

[Jean-Philippe Pialasse]

we are dealing with an attack on bz and remediate by banning more cidr than what we want to keep services up. 
sorry for the impact on you. 

[bunkobugsy]

Please check "systemctl status fail2ban" first, then show contents of jails with "/usr/bin/sfail2ban" on command line.

[BossHog]

Howdy,
as requested by Bunko':

[root@sme11 ~]# systemctl status fail2ban
● fail2ban.service - Fail2Ban Service
   Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2026-06-17 23:26:06 EDT; 8h ago
     Docs: man:fail2ban(1)
 Main PID: 1721 (fail2ban-server)
    Tasks: 33 (limit: 100586)
   Memory: 28.3M
   CGroup: /system.slice/fail2ban.service
           └─1721 /usr/bin/python3.6 -s /usr/bin/fail2ban-server -xf start

Jun 18 01:27:05 sme11.local esmith::event[6018]: adjust-services=action|Event|fail2ban-update|Action|adjust-services|Start|1781760425 143374|End|1781760425 557133|Elapsed|0.413759
Jun 18 01:57:04 sme11.local /sbin/e-smith/smeserver-fail2ban[6572]: /home/e-smith/db/fail2ban: DELETE ua1naitmqk09ayq=ban|BanTimestamp|1781760424|Host|45.79.102.191|Port|80,443|Protocol|tcp|UnbanTimest>
Jun 18 01:57:04 sme11.local esmith::event[6573]: Processing event: fail2ban-update
Jun 18 01:57:04 sme11.local esmith::event[6573]: Running event handler: /etc/e-smith/events/actions/generic_template_expand
Jun 18 01:57:04 sme11.local esmith::event[6573]: expanding /etc/rc.d/init.d/masq
Jun 18 01:57:04 sme11.local esmith::event[6573]: generic_template_expand=action|Event|fail2ban-update|Action|generic_template_expand|Start|1781762224 281981|End|1781762224 385090|Elapsed|0.103109
Jun 18 01:57:04 sme11.local esmith::event[6573]: Running event handler: /etc/e-smith/events/actions/adjust-services
Jun 18 01:57:04 sme11.local esmith::event[6573]: adjusting non-supervised masq (start)
Jun 18 01:57:04 sme11.local esmith::event[6573]: adjusting non-supervised masq (adjust)
Jun 18 01:57:04 sme11.local esmith::event[6573]: adjust-services=action|Event|fail2ban-update|Action|adjust-services|Start|1781762224 385253|End|1781762224 788964|Elapsed|0.403711

and this;

[root@sme11 ~]# cat /usr/bin/sfail2ban
#!/bin/bash
for SERVI in $(fail2ban-client status|grep 'Jail list'|cut -d':' -f2|sed 's/, / /g'| sed -e 's/^[ \t]*//')
do
fail2ban-client status $SERVI |grep -E 'IP list|Status for the jail'|sed 'N;s/\n/:/'|cut -d: -f2,4
done

Joe

[bunkobugsy]

run  /usr/bin/sfail2ban  on command line to see contents of jails
it should show banned hosts as SM1 and SM2 panels do

[ReetP]

Some scripts here:

https://wiki.koozali.org/Fail2ban#Use_Fail2ban

[BossHog]

Ok Bunko'
sorry for misunderstanding.

[root@sme11 ~]# /usr/bin/sfail2ban
 http-auth:
 http-badbots:
 http-fakegooglebot:
 http-noscript:
 http-overflows:
 http-scan:
 http-shellshock:
 imap:
 nextcloud:
 pam-generic:
 qpsmtpd:
 recidive:
 smanager:
 ssh:
 ssh-ddos:
[root@sme11 ~]#

Hopefully this is better.

Joe

[bunkobugsy]

my server does NOT show banned IPs in either of the Server Manager Panels.

Because there's nothing to show.
Try accessing a few times yourpublicip/smanager from another device/phone to see its IP banned in a short while.
I can confirm this works for me.

[Jean-Philippe Pialasse]

honestly fail2ban is starting to be useless. 
nowadays you will encounter mostbiot devices starting with smart tv where you can find in their EULA or in the EULA of the appa you add, or in the EULA of the SDK the apps use the right o reuse your internet connection to sell the usage to client.  Some will buy that to ddos.


this leads to attacks so distributed that you have no way to ban an ip or event a network. 

search for Bright SDK or Honeygain SDK as an examples

[bunkobugsy]

F2B can't cope with botnets, will block legitimate users who changed their password and forgot to update on their phone.
"Crowdsec is proactive and fail2ban is reactive."
"I use free on over a dozen servers. I find it enough"
Crowdsec community collections: https://app.crowdsec.net/hub
However this probably should be handled in a pro firewall.

[Jean-Philippe Pialasse]

both have their place.  as long as you understand their roles. 

also something like suricata is a must.