| docs

Appearance

Fail2Ban Settings ​

Fail2Ban is one page with six tabs. The Settings tab holds the global parameters: how long a ban lasts, how failures are counted, who is notified, which firewall the bans are written to, and how much the service logs.

Fail2Ban settings

Overview ​

URL: /admin/settings/fail2ban-settings

Open it from Settings > Security > Fail2Ban in the sidebar, then pick the Settings tab.

The six tabs are the whole of Fail2Ban in the panel:

TabWhat it holds
FiltersThe patterns that recognise an offending log line. See Fail2Ban Filters.
ActionsWhat happens to a banned address. See Fail2Ban Actions.
JailsA log file, a filter, thresholds, and an action, tied into one active rule. See Fail2Ban Jails.
BansThe addresses currently banned. See Banned IPs.
WhitelistsThe addresses that are never banned. See Whitelist IPs.
SettingsThis page.

Filters, Actions, Jails, and Whitelists carry a counter in the tab, so you can see how many of each exist without opening them.

Service status ​

Above the form, a banner states whether the Fail2Ban service is running. Check Service Status re-reads it.

Under Service Controls, Restart restarts the service after a settings change, and Refresh reloads the live status into the Terminal Output panel below it. The log panel stays empty until you refresh it.

Since panel 1.9.3, Fail2Ban keeps running next to Imunify360 and CPGuard. On a server with Imunify360, the page subheading says that Imunify360 protects SSH logins and blocks the addresses of FTP brute force attacks, while mail (IMAP, POP3, SMTP), webmail, and panel logins are not covered by it, so Fail2Ban keeps protecting them with its jails. On a server with CPGuard, the subheading asks you to keep Fail2Ban enabled, because CPGuard works together with it. When Fail2Ban is stopped on an Imunify360 server, Health says that these logins have no brute force protection.

Settings ​

Ban and detection ​

  • Ban Time (seconds) - how long a banned address stays banned. Default: 7200.
  • Find Time (seconds) - the window in which failures are counted. Default: 600.
  • Max Retry - how many failures inside that window trigger a ban. Default: 5.

Notifications ​

  • Destination Email - where ban notifications are sent.
  • Sender Email - the address they are sent from.
  • Mail Transfer Agent - sendmail, postfix, or exim.

Firewall and protocol ​

  • Ban Action - iptables-multiport or nftables-multiport.
  • Protocol - tcp, udp, or all.
  • Firewall Chain - INPUT, OUTPUT, or FORWARD.

Logging ​

  • Log Level - CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG, or TRACE.
  • Log Target Path - the file Fail2Ban writes to. Default: /var/log/fail2ban.log.

Save changes at the bottom applies the form. Restart the service afterwards for the new values to take effect.

When the server refuses a change ​

Since panel 1.9.3 the settings are saved only once Fail2Ban runs them. When the server refuses the change, a Save Fail2Ban settings notification stays on screen with "Nothing was saved, because the change was not applied to Fail2Ban.", the cause, and a correlation ID to give support. Nothing is stored, and the form keeps your edits, so you can correct the cause and save again. A field Fail2Ban rejects is marked on the field, and nothing is stored then either.

Where the Fail2Ban log lives ​

The service log itself is not on this page. It is a tab of the Logs centre, at /admin/logs?area=system&tab=fail2ban.