Fail2ban

No entries match these filters. Clear filters

1. 1.1.1 Aug 15, 2026 · issue 047

   Fail2ban 1.1.1 adds file-based IP allowlists, a new OpenVPN jail, CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. firewall action, and extended filter modes for exim and sshd.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.1.1 https://github.com/fail2ban/fail2ban.git
   # already have the repo? check out this version:
   $ git checkout 1.1.1

   └──▷ USE IT
   Maintain a shared allowlist file of trusted IPs and subnets that Fail2ban reloads automatically — useful for dynamic allowlists shared across jails.
   /etc/fail2ban/jail.local copy

   # In jail.local or jail.conf
   [DEFAULT]
   ignoreip = 127.0.0.1/8 ::1 file:///etc/fail2ban/trusted-ips.txt

   Enable aggressive exim filtering to also block connections dropped by ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. rules (e.g. country bans) in addition to normal authentication failures.
   /etc/fail2ban/jail.local copy

   # In jail.local
   [exim]
   enabled = true
   filter  = exim[mode=aggressive]

   • Extends ignoreip with file:... (or file://path/file-with-ip-set) syntax to load ignored IPs, subnets, DNS/FQDN, or raw strings from an external file; the file is read lazily and reloaded dynamically when it changes.
   • Adds filter.d/exim.conf mode more (several rules split out from mode normal) and extends mode aggressive to catch ACL-dropped failures such as ACL: Country is banned.
   • Extends filter.d/sshd.conf modes ddos and aggressive with regex for timeout-before-authentication connections.
   • Adds a new OpenVPN jail (filter.d/openvpn.conf).
   • Adds a new CSF (ConfigServer Firewall) action, comparable to the existing APF action.

   +6 more show less

   • Updates paths-common.conf to change the default mysql_log path (default logpath for the mysqld-auth jail).
   • Adds systemd-journal regex support to filter.d/vsftpd.conf and filter.d/lighttpd-auth.conf.
   • Implements FileIPAddrSet in ipdns.py supporting file-based IP sets with lazy load and dynamic reload on file change; comments after # or ; are ignored.
   • Makes manually added ban attempts inform the observer module, taking the known ban-count of bad IPs into account.
   • Updates OpenRC init script (files/fail2ban-openrc.init.in) to start after nftables in addition to iptables.
   • Debian package now installs and enables a systemd-managed fail2ban.socket (gh-4220).

   11 details in Everything

2. 1.1.0 Apr 25, 2024 · release notes

   Fail2ban 1.1.0 adds fail2ban-client stats and new jail/filter definitions for MikroTik and Dante.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.1.0 https://github.com/fail2ban/fail2ban.git
   # already have the repo? check out this version:
   $ git checkout 1.1.0

   └──▷ USE IT
   Get a quick tabular overview of ban counts across all jails without parsing JSON.
   shell copy

   fail2ban-client stats

   Test filter logic directly using the filter configuration file rather than relying on jail defaults.
   shell copy

   fail2ban-regex /var/log/nginx/error.log filter.d/nginx-forbidden

   • Adds status --all flag to fail2ban-client to display status of all configured jails in one invocation
   • Adds stats, statistic, and statistics subcommands to fail2ban-client to output tabular ban statistics
   • Adds fail2ban-client status --all stats to return a Python dictionary of statistics for all jails
   • Adds fail2ban-regex support for loading filter settings via filter.d/<name> or <name>.conf arguments
   • Adds new action definition action.d/mikrotik.conf for MikroTik RouterOS integration

   +4 more show less

   • Adds new filter definitions filter.d/dante.conf, filter.d/nginx-forbidden.conf, and filter.d/routeros-auth.conf
   • Extends pf action in action.d/pf.conf with support for the protocol=all argument
   • Adds optional TLS support to smtp.py via the ssl argument
   • Sets allowipv6 = auto as the new default for improved IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. detection

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The minimum supported Python version is raised to 3.5
3. advisory CVE-2021-32749 Jul 16, 2021 · issue 128
   • CVE-2021-32749: Possible RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. vulnerability in mailing action using mailutils (mail-whois) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects <= 9.7, <= 10.6, <= 11.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
4. 0.11.2 Nov 23, 2020 · release notes

   Fail2ban 0.11.2 adds GitLab/Grafana/SoftEtherVPN filters, CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. unban via client, and new datepattern tokens

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.11.2 https://github.com/fail2ban/fail2ban.git
   # already have the repo? check out this version:
   $ git checkout 0.11.2

   └──▷ USE IT
   Unban a specific IP range using its CIDR notation via the command line client.
   shell copy

   fail2ban-client set <jail_name> unbanip <cidr_address>

   • Adds filter.d/gitlab.conf and a jail for recognizing failed GitLab application logins
   • Adds filter.d/grafana.conf and a jail for recognizing failed Grafana application logins
   • Adds filter.d/softether.conf and a jail for recognizing failed SoftEtherVPN application logins
   • Fail2ban-client can now unban IP ranges by subnet (CIDR/mask) or hostname (DNS)
   • New datepattern token {UNB} disables word boundaries in regex matching

   +1 more show less

   • New datepattern token {NONE} allows failure detection without datetime in logs, using current time

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Downgrading from v0.11 to v0.10 requires manual removal of the database file /var/lib/fail2ban/fail2ban.sqlite3 due to incompatible schema
5. 0.11.1 Jan 11, 2020 · release notes

   Fail2ban 0.11.1 adds incremental ban enhancement to its service.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.11.1 https://github.com/fail2ban/fail2ban.git
   # already have the repo? check out this version:
   $ git checkout 0.11.1

   • Adds incremental ban logic for enhancing existing bans.

   1 detail in Everything

6. 0.10.5 Jan 10, 2020 · release notes

   Fail2ban 0.10.5 adds <CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network.>/<SUBNET> tags, logtype config, jail attempt reporting, and nftables table isolation.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.10.5 https://github.com/fail2ban/fail2ban.git
   # already have the repo? check out this version:
   $ git checkout 0.10.5

   └──▷ TRY IT
   Manually report a brute-force attempt from a specific IP without waiting for log matches.
   copy

   $ fail2ban-client set myjail attempt 192.0.2.1 'Invalid password'

   • Adds <CIDR> and <SUBNET> failregex replacement tags to match IP addresses with CIDR masks
   • Adds logtype configuration parameter to filters (e.g., logtype=short, logtype=rfc5424) to control prefix handling
   • Adds fail2ban-client set <jail> attempt <ip> command to manually report failure attempts to the daemon
   • Introduces nftables jail action that isolates rules into a dedicated table and chain, replacing nftables-common and deprecating nftables-allports/nftables-multiport in favor of type options

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !action.d/nftables-common is removed; use the new nftables action instead.
   • !action.d/nftables-allports and action.d/nftables-multiport are obsolete; use nftables[type=allports] and nftables[type=multiport] respectively.
7. 0.10.4 Oct 4, 2018 · release notes

   Fail2ban 0.10.4 adds ignorecache option for performance and extends ignorecommand with tag interpolation.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.10.4 https://github.com/fail2ban/fail2ban.git
   # already have the repo? check out this version:
   $ git checkout 0.10.4

   └──▷ USE IT
   Enable caching for IP ignore lists to speed up jail checks.
   config copy

   [DEFAULT]
   ignorecache = true
   ignoreip = 127.0.0.1/8 ::1

   Use dynamic tag interpolation in ignorecommand to handle complex logic.
   config copy

   [sshd]
   ignorecommand = /usr/local/bin/check_whitelist.py <ip-host> F-USER

   Get a machine-readable version string for scripting or CI checks.
   copy

   $ fail2ban-client -V

   • Adds ignorecache option to jail.local to cache ignoreip, ignoreself, and ignorecommand results, improving check performance
   • Extends ignorecommand to support tag interpolation (e.g., <ip-host>, F-USER) for dynamic actions
   • Enables -V flag on fail2ban-client, fail2ban-server, and fail2ban-regex to return version in normalized machine-readable short format without logo info

   3 details in Everything

8. 0.10.3.1 Apr 4, 2018 · release notes

   Fail2ban 0.10.3.1 adds LEPOCH date detection, logtarget padding parameter, and BadIPs category support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.10.3.1 https://github.com/fail2ban/fail2ban.git
   # already have the repo? check out this version:
   $ git checkout 0.10.3.1

   • Adds LEPOCH pattern to the date-detector for parsing milliseconds/microseconds POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. dates.
   • Allows specifying a custom regex-pattern to match epoch date-time via new configuration option.
   • Introduces padding parameter for logging within fail2ban-server controlled by logtarget.
   • Adds support for any ban category in action.d/badips.py to retrieve IPs from all categories with a desired score.

   4 details in Everything

9. 0.10.2 Jan 18, 2018 · release notes

   Fail2ban 0.10.2 adds %k/%l date directives, nginx session blacklisting action, and structured logging parameters

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.10.2 https://github.com/fail2ban/fail2ban.git
   # already have the repo? check out this version:
   $ git checkout 0.10.2

   • Adds action.d/nginx-block-map.conf to enable session-based banning in nginx via a map file.
   • Adds %k and %l date-pattern directives for precise parsing of hours without zero-padding.
   • Adds mode parameter support in jail.local jails that provide an aggressive filter mode.
   • Adds logtarget parameters facility, datetime, and format to the fail2ban-server command-line interface.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The pf-action configuration for jails using banaction pf now requires anchor handling; rewrite in jail.local by overwriting banaction = pf[pfctl="pfctl"] to use obsolete handling.
10. 0.10.1 Oct 12, 2017 · release notes

    Adds --dp / --dump-pretty CLI option to dump configuration in human-readable format.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.10.1 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.10.1

    • Adds --dp and --dump-pretty command-line options to dump the configuration using a more human readable representation.

    1 detail in Everything

11. 0.10.0 Aug 9, 2017 · release notes

    Fail2ban 0.10.0 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.10.0 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.10.0

    • Adds IPv6 support

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Custom filter or action configuration files may be incompatible, requiring manual review after upgrade.
12. 0.9.7 May 11, 2017 · release notes

    Fail2ban 0.9.7 adds Netscaler and Domino SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. filters plus a new MSG log level

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.7 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.9.7

    └──▷ USE IT
    Block attackers directly on a Citrix Netscaler ADC instead of just iptables
    config copy

    # In jail.conf or custom action file, use the new netscaler action
    action = netscaler[iptype=%(banfamily)s]

    • Adds action.d/netscaler action to block IPs on Citrix Netscaler ADC
    • Adds filter.d/domino-smtp filter for IBM Domino SMTP task
    • Introduces new MSG log level (equivalent to INFO-2)

    3 details in Everything

13. 0.9.6 Dec 10, 2016 · release notes

    Fail2ban 0.9.6 adds npf and mongodb filters, jail backend syntax extension, fail2ban-python command

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.6 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.9.6

    └──▷ TRY IT
    Run an external script using the same Python environment as fail2ban to avoid module version mismatches.
    copy

    $ #!/usr/bin/env fail2ban-python
    print("fail2ban modules available")

    • Adds filter.d/mongodb-auth.conf for MongoDB authentication log parsing
    • Adds action.d/npf.conf to support NetBSD's NPF packet filter
    • Extends jail configuration to allow backend-specific options via new syntax (e.g., backend = systemd[journalpath=/...]) in /etc/fail2ban/jail.local or per-jail configs
    • Introduces new command fail2ban-python as a symlink to the Python interpreter used by fail2ban, ensuring consistent module and pickle protocol usage

    4 details in Everything

14. 0.9.5 Jul 15, 2016 · release notes

    Fail2ban 0.9.5 adds firewallcmd rich rules actions, slapd and dovecot LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. filters, and SQLite performance improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.5 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.9.5

    • Adds action.d/firewallcmd-rich-rules and action.d/firewallcmd-rich-logging for new iptables/nftables blocking strategies
    • Adds new slapd filter to ban hosts failing LDAP authentication with error code 49
    • Adds regex filter for dovecot LDAP authentication failures
    • Speeds up SQLite database operations by disabling synchronous writes, using memory journal mode, and keeping temp stores in memory
    • Extends postfix and postfix-sasl filters to match postfix/smtps/smtpd daemon names

    +1 more show less

    • Adds journald journalmatch support for pure-ftpd

    6 details in Everything

15. 0.10.0-alpha Prerelease Jul 14, 2016 · release notes

    Fail2ban 0.10.0-alpha adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, unban commands, abuseipdb integration, and incremental ban times

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.10.0-alpha https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.10.0-alpha

    └──▷ USE IT
    Configure IPv6-only hosts in a specific section of the config file.
    text copy

    [Init?family=inet6]
    # ... configuration for IPv6 only

    Report banned IPs to AbuseIPDB by setting the required category in the action configuration.
    text copy

    [DEFAULT]
    action = %(action_mwl)s
    # Note: abuseipdb categories must be set as per documentation for this version

    Unban a specific IP address across all jails and the database.
    copy

    $ fail2ban-client unban <IP>

    • [Init?family=inet4] and [Init?family=inet6] conditional sections for family-qualified configuration
    • AbuseIPDB reporting integration via new config categories
    • fail2ban-client unban <IP> and unban --all commands to remove bans
    • reload [--restart] [--unban] command for configuration updates with optional jail restart/unban

    4 details in Everything

16. 0.9.4 Mar 8, 2016 · release notes

    Fail2ban 0.9.4 adds nftables actions, openhab/murmur filters, jail interpolation, and split ignoreip syntax.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.4 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.9.4

    └──▷ USE IT
    Exclude multiple IPs in ignoreip using commas instead of creating a long space-separated list.
    config copy

    ignoreip = 127.0.0.1/8 ::1 192.168.1.1,10.0.0.5

    • Adds nftables-multiport and nftables-allports new actions for filtering using the nftables framework
    • Adds new murmur jail that bans TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. from bad hosts on the default murmur port
    • Enables <known/parameter> interpolation syntax to extend parameters of stock filters or actions directly in jail.local
    • Allows splitting ignoreip entries by both comma (,) and space characters
    • Adds fail2ban_agent variable for use as user-agent in actions like badips and blocklist_de

    +1 more show less

    • Adds new date pattern supporting year after day (e.g., Sun Jan 23 2005 21:59:59) to log parsers

    6 details in Everything

17. 0.9.3 Aug 1, 2015 · release notes

    Fail2ban 0.9.3 adds pass2allow operation, <returntype> variable and froxlor-auth filter

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.3 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.9.3

    └──▷ USE IT
    Use the new froxlor-auth filter for Froxlor logs
    config copy

    [froxlor-jail]
    enabled = true
    filter = froxlor-auth
    logpath = /var/log/froxlor.log
    backend = auto

    • Adds <returntype> variable to control the iptables target for bans
    • Adds pass2allow operation type enabling port knocking via Fail2ban
    • Adds pass2allow-ftp jail for allowing FTP traffic after HTTP auth
    • Adds froxlor-auth filter for Froxlor authentication logs
    • Adds apache-pass filter for successful Apache authentication events

    +1 more show less

    • Adds shorewall-ipset-proto6 action using Shorewall proto feature

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !filter.d/roundcube-auth.conf logpath changed from userlogins to errors
18. 0.9.2 Apr 29, 2015 · release notes

    Fail2ban 0.9.2 adds new filters/actions and <<PREF>HOST>> interpolation syntax

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.2 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.9.2

    └──▷ TRY IT
    Check jail status with ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. and geolocation data for banned IPs
    copy

    $ fail2ban-client status <jail> cymru

    • Adds <<PREF>HOST>> recursive embedded substitution to jail config, allowing <IPV4HOST> or direct IP resolution via PREF=<value>
    • Adds %(known/parameter)s interpolation in config readers for extending stock filter/jail regexps without overwriting
    • Adds new action files: firewallcmd-multiport, firewallcmd-allports, sendmail-geoip-lines.conf, and nsupdate
    • Adds new filters: postfix-rbl, apache-fakegooglebot.conf, nginx-botsearch, and drupal-auth
    • Adds optional [flavor] argument to fail2ban-client status <jail> for extended output like cymru

    +1 more show less

    • Flushes log buffer on USR1 signal receipt

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !recidive jail now uses iptables-allports banaction by default instead of the previous default
19. 0.9.1 Oct 28, 2014 · release notes

    Fail2ban 0.9.1 adds apache-shellhock filter, Cloudflare API action, and fail2ban-client version query.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.1 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.9.1

    • Adds apache-shellshock filter to detect Shellshock exploitation attempts in Apache logs
    • Adds Cloudflare API action for automated IP banning via Cloudflare's firewall rules
    • Enables fail2ban-client to fetch the running server version via a new query command
    • Introduces print-all-matched option to fail2ban-regex for detailed regex testing
    • Adds support for Portsentry log parsing in fail2ban filters

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !iptables-common.conf is replaced by iptables-blocktype.conf; existing customizations must be migrated.
20. 0.9.0 Mar 15, 2014 · release notes

    Fail2ban 0.9.0 adds SQLite persistence, systemd journal backend, multi-line filters, and per-jail default actions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.0 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.9.0

    └──▷ USE IT
    Configure a jail to use the systemd journal backend for log matching.
    config copy

    [sshd-journal]
    enabled = true
    filter = sshd
    logpath = %s
    journalmatch = _SYSTEMD_UNIT=ssh.service

    Set a global default action and ban technology for all jails defined in jail.local.
    config copy

    [DEFAULT]
    banaction = iptables-ipset
    action = %(action_)s

    Specify a custom log file encoding for fail2ban to read.
    config copy

    [DEFAULT]
    logencoding = utf-8

    • Adds journalmatch filter parameter to enable the new systemd journal backend
    • Adds support for log file encoding configuration
    • Enables multiple instances of the same action in a single jail via [DEFAULT] block in jail.local using action = %(action_)s and banaction = iptables-ipset
    • Supports multi-line filter patterns in jail configurations
    • Supports custom date formats and timezone-aware date/time log formats in filters

    +1 more show less

    • Adds Guacamole, Kerio, Stunnel, Counter Strike, Squirrelmail, and Tine20 filters

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The jail.conf has been modified extensively to list only the filters; variants with different actions and file paths have been removed
21. 0.8.13 Mar 15, 2014 · release notes

    Fail2ban 0.8.13 adds nagios and sendmail filters plus asterisk syslog support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.13 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.8.13

    └──▷ USE IT
    Add a new jail configuration to detect nagios unauthorized access attempts.
    config copy

    [nagios]
    enabled = true
    filter = nagios
    action = iptables-multiport

    Enable the new sendmail authentication filtering jails.
    config copy

    [sendmail-auth]
    enabled = true
    filter = sendmail-auth
    action = iptables-multiport
    
    [sendmail-reject]
    enabled = true
    filter = sendmail-reject
    action = iptables-multiport

    • Adds nagios jail to detect unauthorized access to the nrpe daemon
    • Adds sendmail-auth and sendmail-reject jails for sendmail log analysis
    • Enables syslog format parsing in the asterisk jail

    3 details in Everything

22. 0.8.12 Jan 21, 2014 · release notes

    Fail2ban 0.8.12 adds flushlogs command, ignorecommand option, and several new filters/actions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.12 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.8.12

    └──▷ TRY IT
    Rotate fail2ban logs via CLI without triggering a full service reload, keeping the daemon state intact.
    copy

    $ fail2ban-client flushlogs

    Configure a jail to dynamically determine if an IP should be ignored using an external script.
    text copy

    [jail]
    ignorecommand = /usr/local/bin/check-ip-whitelist.py %(ip)s

    Switch an existing jail from the old long action name to the new short one.
    text copy

    [sshd]
    action = firewallcmd-new[protocol=all, chain=INPUT]

    • Adds flushlogs command to rotate logs without reloading fail2ban or syncing jail.conf with /etc/logrotate.d/fail2ban
    • Adds ignorecommand option for dynamic IP exclusion logic in jails
    • Adds badips, firewallcmd-ipset, ufw, and blocklist_de new actions
    • Adds solid-pop3d, nsd, openwebmail, horde, freeswitch, squid, and groupoffice new filters
    • Adds HTTP referrer bit support to apache filters for improved detection

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The action name firewall-cmd-direct-new is renamed to firewallcmd-new due to jail name length constraints
    • !The jail name mysqld-syslog-iptables is renamed to mysqld-syslog
23. 0.8.11 Nov 13, 2013 · release notes

    Fail2ban 0.8.11 adds firewalld, OSX ipfw/afctl actions and new filters; renames several existing filters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.11 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.8.11

    • action.d/firewall-cmd-direct-new.conf added for firewalld support
    • filter.d/osx-ipfw.conf action filter for OSX based on random rule numbers
    • action.d/osx-afctl action for OSX
    • fail2ban-regex -D generates debuggex.com URLs for debugging regular expressions
    • filter name lighttpd-fastcgi renamed to suhosin

    +2 more show less

    • filter name sasl renamed to postfix-sasl
    • filter name exim spam catching failregexes split out into exim-spam

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The lighttpd-fastcgi filter is renamed to suhosin, requiring jail.{conf,local} updates.
    • !The sasl filter is renamed to postfix-sasl, requiring jail.{conf,local} updates.
    • !The exim spam catching failregexes are split out into exim-spam, requiring jail.{conf,local} updates.
24. 0.8.9 Jul 3, 2013 · release notes

    Fail2ban 0.8.9 adds routing and IPset actions, new jail.d config support, and several filters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.9 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.8.9

    • Adds iptables-ipsets action allowing bans to target IP sets instead of individual IPs
    • Adds route action allowing bans at the network routing level
    • Adds pf (OpenBSD packet filter) action
    • Adds webmin, Sogo, Roundcube, Exim, and mysqld filters for new log sources
    • Adds interactive shell completions for fail2ban-* commands

    5 details in Everything

25. 0.8.10 Jun 12, 2013 · release notes

    Fail2ban 0.8.10 adds roundcube filter and fixes apache filter regex anchoring

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.10 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.8.10

    • Adds support for Roundcube 0.9+ via filter.d/roundcube-auth.conf

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The blocktype option in action.d/{route,shorewall}.conf must now be defined within the [Init] section.
26. 0.8.8 Dec 6, 2012 · release notes

    Fail2ban 0.8.8 adds the unbanip client command for manual unban.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.8 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.8.8

27. 0.8.7 Jul 31, 2012 · release notes

    Fail2ban 0.8.7 adds pyinotify backend, lighttpd-auth filter, recidive jail, asterisk support, and non-root operation via xt_recent.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.7 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.8.7

    • Adds pyinotify backend for log monitoring (default when backend='auto' and available)
    • Adds lighttpd-auth filter/jail for lighttpd authentication logs
    • Adds recidive filter/jail to ban repeated offenders by monitoring fail2ban.log
    • Adds usedns parameter to jail configurations to disable DNS lookups
    • Adds asterisk support for VoIP failure detection

    +1 more show less

    • Allows running fail2ban as a non-root user via xt_recent (disabled by default)

    6 details in Everything

28. 0.8.6 Nov 28, 2011 · release notes

    Fail2ban 0.8.6 adds Polish month matching, timestamped kernel messages, IPmasq restart rule, Date headers for sendmail actions, and <matches> in action files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.6 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.8.6

    • Enables <matches> tag in action files to provide matched loglines that triggered an action
    • Adds Date: header support for sendmail*.conf actions
    • Improves regex matching for Polish month names and trailing spaces in SASLSASLA framework for plugging authentication mechanisms into network protocols, standardized by the IETF, so a tool can support password, Kerberos, or certificate login without rewriting auth logic per protocol./sshd logs

    3 details in Everything

29. 0.8.4 Sep 7, 2009 · release notes

    Fail2ban 0.8.4 adds Ban IP command, Nagios/ISP reporting actions, and new log filters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.4 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.8.4

    • Ban IP subcommand added to interactively ban an IP address.
    • New lighttpd-fastcgi and php-url-fopen jail filters for parsing specific web server logs.
    • New action plugins to report abuse via ISP, DShield, and myNetWatchman protocols.
    • New nagios script integration for monitoring alerts.

    4 details in Everything

30. 0.8.2 Mar 6, 2008 · release notes

    Fail2ban 0.8.2 adds reload <jail> subcommand and /var/run/fail2ban socket/PID location.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.2 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.8.2

    • reload <jail> subcommand added to fail2ban-client to reload a single jail configuration
    • Mac OS/X startup script included for system integration

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Minimum Python version is now 2.3; Python 2.4 support removed
31. 0.8.1 Aug 14, 2007 · release notes

    fail2ban 0.8.1 adds iptables-allports action, Webmin filter, and named/date format support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.1 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.8.1

    • ignoreregex support in fail2ban-regex CLI tool allows filtering test results by regular expression
    • Adds iptables-allports action for banning all ports via iptables in a single rule
    • Adds webmin authentication filter (filter.d/webmin.conf) to detect Webmin login failures
    • Adds named date format to the built-in date detector and includes a named (bind9) filter file

    4 details in Everything

32. 0.7.7 Feb 8, 2007 · release notes

    Fail2ban 0.7.7 adds signal handling, cacti integration, and IP lists to client status command

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.7 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.7.7

    └──▷ USE IT
    Validate fail2ban configuration in a deployment script before restarting services.
    shell copy

    fail2ban-client -b /etc/fail2ban/jail.local && echo 'Config valid' || echo 'Config invalid'

    • Adds fail2ban-client return codes for invalid configuration, enabling CI/CD validation of jail files
    • Adds cacti script and template for monitoring fail2ban statistics

    2 details in Everything

33. 0.7.6 Jan 4, 2007 · release notes

    Fail2ban 0.7.6 adds Exim4 filter support and flexible date format parsing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.6 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.7.6

    • Adds a pre-configured Exim4 filter for mail server log monitoring
    • Enables the new YYYY-MM-DD HH:MM:SS date format in jail configuration
    • Supports comma-separated values in action options using quote escaping

    3 details in Everything

34. 0.7.5 Dec 7, 2006 · release notes

    Fail2ban 0.7.5 adds ignore regex support, <HOST> tag, and merged maxtime/findtime options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.5 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.7.5

    └──▷ USE IT
    Exclude known safe IPs from being banned by defining an ignore pattern in the jail config.
    text copy

    # Example snippet for fail2ban/jail.local
    
    [sshd]
    ignoreip = 127.0.0.1/8
    ignoreregex = ^.*user=authorized.*$

    Use the new <HOST> tag in a custom filter to correctly extract IP addresses from non-standard log formats.
    text copy

    # Example snippet for fail2ban/filter.d/custom-app.conf
    
    [Definition]
    failregex = ^<HOST> .* error: authentication failure$ .*$

    Configure an action script to use the new dynamic tags for logging or notifications.
    text copy

    # Example snippet for fail2ban/action.d/custom-action.conf
    
    [Definition]
    actionban = echo "Banned <ip> after <failures> failures at <time>" >> /var/log/bans.log

    • Adds ignoreregex option to filter scripts for excluding specific log lines from banning logic
    • Adds <HOST> tag support in failregex patterns to match default IP addresses or hostnames
    • Merges the maxtime option into the existing findtime option, simplifying jail configuration time windows
    • Expands supported tags in action(un)ban scripts to include <ip>, <failures>, and <time> for dynamic action construction

    4 details in Everything

35. 0.7.4 Nov 1, 2006 · release notes

    Adds socket config key and -s CLI flag for Fail2ban socket path specification

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.4 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.7.4

    └──▷ USE IT
    Start Fail2ban service using a custom socket path to avoid permissions or multi-instance conflicts.
    shell copy

    fail2ban-server -s /var/run/fail2ban/fail2ban.sock

    • Added -s command-line option to specify the socket path
    • Added socket configuration option in fail2ban.conf
    • Added backend configuration option in jail.conf

    3 details in Everything

36. 0.7.3 Sep 28, 2006 · release notes

    Fail2ban 0.7.3 adds Gamin monitoring, DNS in ignoreip, wildcard logpath, and man pages

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.3 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.7.3

    • Adds logpath wildcard support to match multiple directories or files
    • Adds Gamin file and directory monitoring backend for real-time log tracking
    • Adds DNS resolution to the ignoreip option in jail configurations
    • Adds man pages documentation for the tool
    • Re-introduces permanent banning capability via banTime < 0

    5 details in Everything

37. 0.7.2 Sep 10, 2006 · release notes

    Fail2ban 0.7.2 adds interactive mode, fail2ban-regex tool, date detector and more get/set commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.2 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.7.2

    └──▷ TRY IT
    Test a regular expression against log files to verify failregex matching
    copy

    $ fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

    Run fail2ban in interactive mode for manual control via CLI
    copy

    $ fail2ban-client -i

    • fail2ban-regex tool added to help finding failregex
    • Adds -i flag for interactive mode
    • Date detector added; timeregex and timepattern are deprecated

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !logpath and maxretry removed from filter templates; they must be defined in jail.conf now
38. 0.7.0 Aug 23, 2006 · release notes

    Fail2ban 0.7.0 introduces client/server architecture, multithreading per jail, and split configuration files.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.0 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.7.0

    └──▷ TRY IT
    Run fail2ban in client/server mode to connect to a remote jail server.
    copy

    $ fail2ban-client -s /var/run/fail2ban/fail2ban.sock ping

    • Adds Client/Server architecture for distributed ban management
    • Introduces multithreading with separate threads for log reading and actions per jail
    • Supports executing several actions per jail event
    • Splits configuration files into multiple readable files instead of a single large config
    • Updates failregex parsing to use named groups (e.g., <host>) for host extraction

    5 details in Everything

39. 0.6.1 Mar 16, 2006 · release notes

    Fail2ban 0.6.1 adds permanent banning, TAI64N timestamp parsing, and shorewall/hosts.deny support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.1 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.6.1

    • ignoreip default no longer excludes 192.168.0.0/16, allowing bans for local network attackers.
    • Added interpolations in fail2ban.conf leveraging Python's ConfigParser module.
    • Added permanent banning capability: set banTime to a negative value (e.g., -1).
    • Added parsing of timestamps in TAI64N format (#1275325).
    • Added support for vsftpd jail configuration.

    +1 more show less

    • Added initial support for hosts.deny and shorewall jail actions.

    6 details in Everything

40. 0.6.0 Nov 20, 2005 · release notes

    Fail2ban 0.6.0 adds configurable mail notification timezone via new option

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.0 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.6.0

    • Adds option to report local time (including timezone) or GMT in mail notifications

    1 detail in Everything

41. 0.5.5 Oct 26, 2005 · release notes

    Fail2ban 0.5.5 adds firewall consistency check, log-level ordering, and email subject parsing keyword

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5.5 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.5.5

    └──▷ USE IT
    Run fail2ban with a custom findtime of 3600 seconds via CLI argument.
    shell copy

    fail2ban-server -f 3600

    • Adds fwcheck option to verify firewall chain consistency and auto-restart on failure
    • Adds -f command-line parameter to configure [findtime]
    • Adds <section> keyword support in email subject and body parsing

    3 details in Everything

42. 0.5.4 Sep 13, 2005 · release notes

    Fail2ban 0.5.4 adds findtime config var and flexible SYSLOG targeting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5.4 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.5.4

    • Adds findtime configuration variable to control the lifetime of caught failed log entries
    • Enhances SYSLOG logging target handling to support any configured target and facility via settings

    2 details in Everything

43. 0.5.2 Aug 6, 2005 · release notes

    Fail2ban 0.5.2 adds per-section config overrides for bantime and maxretry

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5.2 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.5.2

    • maxretry and bantime can be overridden in each section

    1 detail in Everything

44. 0.5.1 Jul 23, 2005 · release notes

    Fail2ban 0.5.1 adds configurable log targets and per-section iptables chains

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5.1 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.5.1

    • Adds log targets in configuration file to specify where logs are read from
    • Removes -l CLI option (requires migration)
    • Creates a separated iptables chain for each jail section

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -l CLI option is removed; use the new logtarget config key instead.
45. 0.5.0 Jul 12, 2005 · release notes

    Fail2ban 0.5.0 adds CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. support in ignoreip, mail notifications, tag replacements, and configurable firewall/init commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5.0 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.5.0

    └──▷ TRY IT
    Exclude an entire subnet using CIDR notation in ignoreip
    copy

    $ ignoreip = 127.0.0.1/8 ::1/128 192.168.1.0/24

    Configure custom startup and shutdown scripts in the config file
    copy

    $ bantime = 600
    findtime = 600
    maxretry = 5
    
    # New configuration options for lifecycle management
    [init]
    start = /path/to/start_script.sh
    end = /path/to/stop_script.sh

    • ignoreip now supports CIDR masks for network range exclusions
    • Mail notification support added via new configuration options
    • Tags replacement feature added to rules definition for variable substitution
    • Custom start and end commands can now be defined in the configuration file
    • Firewall rules can be defined directly in the configuration file

    +1 more show less

    • Initd script provided for RedHat/Fedora systems

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !interface option removed from configuration
    • !firewall option removed from configuration
46. 0.4.1 Jun 30, 2005 · release notes

    Adds Gentoo init.d script and changes default PID lock file path.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4.1 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.4.1

    • Adds initd script for Gentoo Linux system initialization
    • Changes default PID lock file location from /tmp to /var/run

    2 details in Everything

47. 0.3.0 Feb 24, 2005 · release notes

    Fail2ban 0.3.0 adds ipfw-start-rule option and -k flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.3.0 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.3.0

    └──▷ TRY IT
    Start Fail2ban with IPFW firewall rule support enabled
    copy

    $ fail2ban-client -k; fail2ban-server --ipfw-start-rule /etc/fail2ban/ipfw.rules

    • Adds the ipfw-start-rule option to support IPFW firewall integration
    • Adds the -k command-line flag to kill a running Fail2Ban instance

    2 details in Everything

48. 0.1.2 Nov 21, 2004 · release notes

    Fail2ban 0.1.2 adds ipfw/ipfwadm firewall support and a new -e interface flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.2 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.1.2

    └──▷ TRY IT
    Run fail2ban on a specific network interface (e.g., eth0) instead of the default.
    copy

    $ fail2ban-server -e eth0

    • Adds ipfw and ipfwadm support for managing firewall rules, using logic from BlockIt.
    • Adds -e option to set the network interface.

    2 details in Everything

49. 0.1.1 Oct 23, 2004 · release notes

    Adds daemon signal handling, per-instance ban thresholds via -r, SSHd log parsing, and /etc/fail2ban.conf support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.1 https://github.com/fail2ban/fail2ban.git
    # already have the repo? check out this version:
    $ git checkout 0.1.1

    • Add SIGTERM handler in order to exit nicely when in daemon mode
    • Add /etc/fail2ban.conf configuration support
    • Add -r option which allows to set the maximum number of login failures
    • Rewrite log reader to be service centered. Sshd support added. Match Failed password and Illegal user
    • Remove the Metalog class as the log file are not so syslog daemon specific

    5 details in Everything