how to see a list of banned ip addresses and get its unban time? I know two methods to get list banned ip addresses.
Via fail2ban client:
sudo fail2ban-client status <jail name> Via iptables:
sudo iptables --list --line-numbers --numeric But both commands show only ban list. I need to know when this created iptables rules will be deleted.
1 Answer
- Fail2ban since version 0.11.1 supports new command which would provide you the list of banned-IPs and its times, see man or for details.
- Otherwise fail2ban since version 0.9 has a sqlite-database where you also could obtain this information:
sqlite3 -header -column 'file:/var/lib/fail2ban/fail2ban.sqlite3?mode=ro' \ "select * from bans where jail='<JAIL>' order by timeofban desc limit 10" For instance this could be the statement to get all active bans:
select datetime(timeofban, 'unixepoch', 'localtime') as startofban, datetime(timeofban + bantime, 'unixepoch', 'localtime') as endofban, ip, jail, bantime, bancount, data from bips where endofban > datetime('now', 'localtime') order by jail, endofban limit 10 Depending on version it can miss bantime field, then you have to replace it with static integer bantime set for the related jail in your configuration.
- If you have some development background, it would be also possible using fail2ban python API
