Skip to main content
emisar

fail2ban

v0.2.0

fail2ban inventory + per-jail banned-IP listings plus operator mutators for incident response: ban an IP into a jail, unban a false positive, reload jail filters from disk.

6 allowed by default 2 need approval by default
Pack ID
fail2ban
Vendor
emisar
OS
linux
Actions
8
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
fail2ban-client

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install fail2ban --hash sha256:4b2e89ec83ae1b80c3a9d3e27628ded3bc207f5421d3fb471938064e4a1d657c

Setup

Operates on the local runner host — no credentials needed.

Host access

Run these commands yourself on the runner host. Emisar shows and copies setup recipes; it never runs them.

Connect to the Fail2ban control socket.

f2b.statusf2b.versionf2b.jail_statusf2b.banned_ipsf2b.unban_ipf2b.banipf2b.reload

Debian and Ubuntu — default emisar service user

Grant access 
sudo apt-get install -y acl
sudo install -d -m 0755 /etc/systemd/system/fail2ban.service.d
printf '%s\n' '[Service]' "ExecStartPost=-/usr/bin/timeout 10 /bin/sh -c 'until [ -S /run/fail2ban/fail2ban.sock ]; do sleep 0.1; done; exec /usr/bin/setfacl -m u:emisar:rw /run/fail2ban/fail2ban.sock'" | sudo tee /etc/systemd/system/fail2ban.service.d/emisar-access.conf >/dev/null
sudo systemctl daemon-reload
sudo systemctl restart fail2ban
Verify access 
sudo -u emisar fail2ban-client status

Impact: Any process running as emisar can control Fail2ban through its socket. Every listed read and mutating action gains that authority. The bounded systemd hook reapplies the ACL whenever Fail2ban recreates the socket; the verification command reports a failed grant without taking Fail2ban down.

Read /var/log/fail2ban.log.

f2b.log_tail

Debian and Ubuntu — default emisar service user

Grant access 
sudo usermod -aG adm emisar
sudo systemctl restart emisar
Verify access 
sudo -u emisar test -r /var/log/fail2ban.log

Impact: The emisar service identity can read every host log granted to the adm group, not only Fail2ban. The group membership survives Fail2ban log rotation and host restarts.

Verify it works

Runs f2b.status, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify fail2ban

Install and configure a pack walks through the whole sequence on a host.

Actions 8 total

View on GitHub
  • f2b.banip exec high High — service-affecting

    fail2ban-client set <jail> banip <ip>

    Add an IP to a jail's banlist manually. Use during an active attack when log-based detection is too slow. Banned IPs hit the configured action (typically iptables DROP).

    View source on GitHub
  • f2b.banned_ips exec low Low — read-only or trivially reversible

    get <jail> banip

    List currently banned IPs in one jail.

    View source on GitHub
  • f2b.jail_status exec low Low — read-only or trivially reversible

    fail2ban-client status <jail>

    Show one jail's filter + actions + currently banned counts.

    View source on GitHub
  • f2b.log_tail exec medium Medium — changes state, easily reversible

    tail /var/log/fail2ban.log

    Tail the last N lines of fail2ban.log.

    View source on GitHub
  • f2b.reload exec high High — service-affecting

    fail2ban-client reload [jail]

    Reload fail2ban config. Without a jail, reloads everything. With a jail, reloads that jail only (its filter, action, and settings). Existing bans are preserved.

    View source on GitHub
  • f2b.status exec low Low — read-only or trivially reversible

    fail2ban-client status

    List all configured jails + currently-active count.

    View source on GitHub
  • f2b.unban_ip exec medium Medium — changes state, easily reversible

    set <jail> unbanip <ip>

    Remove one IP's or subnet's ban from one jail. Counter is reset; the address may be banned again on next failure.

    View source on GitHub
  • f2b.version exec low Low — read-only or trivially reversible

    fail2ban-client version

    Show the fail2ban daemon version.

    View source on GitHub
← Back to registry
Pack reference  Publish your own