Server

Fail2ban

fail2ban watches logs for repeated failed logins (SSH by default) and bans the offending IPs for a while. The Fail2ban page shows what it's doing and lets you step in.

What's on the page

• Totals: IPs banned now, bans since fail2ban started, IPs currently failing, active jails.
• Your IP: the address you're connecting from, with a one-click Whitelist my IP so you can't lock yourself out.
• Jails: each jail's rules (failures allowed, time window, ban length) and its banned IPs. Per IP you can Unban, Whitelist (unban and never ban again) or look it up. Clear jail unbans everyone in that jail; Unban everyone clears every jail.
• Ban an IP: manually block an address in a jail (the panel refuses to ban your own IP).
• Recent activity: the latest Ban, Unban and Found events from the fail2ban log. The full log is under Logs → System → fail2ban.

The whitelist

Add addresses or CIDR ranges (e.g. 203.0.113.7, 10.0.0.0/24, 2001:db8::/32) with an optional note. The list is saved to /etc/fail2ban/jail.d/sm-whitelist.local as ignoreip and fail2ban reloads. Adding an address that's currently banned releases it immediately. 127.0.0.1/8 and ::1 are always included.