Home / server / Questions / 1079552
In Process
user1907501
Asked: 2021-10-05 13:57:54 +0800 CST

fail2ban unban every ip when the server is shutting down, restoring every ban back again when newrly started

  • 772

I have multiple jails with several thousands of banned IPs. The server was running for about a week non-stop, then when I was restarting it it took quite a long time ~2 mins to shutting down, and when the server was back on the CPU usage was unusually high.

I looked into journalctl and found out that fail2ban was unbanning all the IPs when shutting down, and restoring all of them again when newly started.

What is going on here and how do I prevent this?

fail2ban

1 Answers

  1. Assuming systemd, copy /lib/systemd/system/fail2ban.service to /etc/systemd/system and then edit /etc/systemd/system/fail2ban.service, replacing

    ExecStop=/usr/bin/fail2ban-client stop

    with

    ExecStop=/bin/true

    However, in the future, if you want to stop fail2ban you can't use systemctl and will need to run /usr/bin/fail2ban-client stop

    • 0