如何显示所有禁止IP与fail2ban？

当我运行这个命令fail2ban-client status sshd我得到这个：

 Status for the jail: sshd |- Filter | |- Currently failed: 1 | |- Total failed: 81 | `- File list: /var/log/auth.log `- Actions |- Currently banned: 2 |- Total banned: 8 `- Banned IP list: 218.65.30.61 116.31.116.7

它只显示两个IP被禁止的IP列表而不是8，就像Total Banned所说的那样。

当我做tail -f /var/log/auth.log我得到这个：

 Mar 29 11:08:40 DBSERVER sshd[29163]: error: maximum authentication attempts exceeded for root from 218.65.30.61 port 50935 ssh2 [preauth] Mar 29 11:08:40 DBSERVER sshd[29163]: Disconnecting: Too many authentication failures [preauth] Mar 29 11:08:40 DBSERVER sshd[29163]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.65.30.61 user=root Mar 29 11:08:40 DBSERVER sshd[29163]: PAM service(sshd) ignoring max retries; 6 > 3 Mar 29 11:08:44 DBSERVER sshd[29165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.65.30.61 user=root Mar 29 11:08:46 DBSERVER sshd[29165]: Failed password for root from 218.65.30.61 port 11857 ssh2 Mar 29 11:09:01 DBSERVER CRON[29172]: pam_unix(cron:session): session opened for user root by (uid=0) Mar 29 11:09:01 DBSERVER CRON[29172]: pam_unix(cron:session): session closed for user root Mar 29 11:10:01 DBSERVER CRON[29226]: pam_unix(cron:session): session opened for user root by (uid=0) Mar 29 11:10:02 DBSERVER CRON[29226]: pam_unix(cron:session): session closed for user root Mar 29 11:10:18 DBSERVER sshd[29238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.122.43.185 user=root Mar 29 11:10:20 DBSERVER sshd[29238]: Failed password for root from 113.122.43.185 port 46017 ssh2 Mar 29 11:10:33 DBSERVER sshd[29238]: message repeated 5 times: [ Failed password for root from 113.122.43.185 port 46017 ssh2] Mar 29 11:10:33 DBSERVER sshd[29238]: error: maximum authentication attempts exceeded for root from 113.122.43.185 port 46017 ssh2 [preauth] Mar 29 11:10:33 DBSERVER sshd[29238]: Disconnecting: Too many authentication failures [preauth] Mar 29 11:10:33 DBSERVER sshd[29238]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.122.43.185 user=root Mar 29 11:10:33 DBSERVER sshd[29238]: PAM service(sshd) ignoring max retries; 6 > 3 Mar 29 11:11:36 DBSERVER sshd[29245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.7 user=root Mar 29 11:11:38 DBSERVER sshd[29245]: Failed password for root from 116.31.116.7 port 24892 ssh2 Mar 29 11:11:43 DBSERVER sshd[29245]: message repeated 2 times: [ Failed password for root from 116.31.116.7 port 24892 ssh2] Mar 29 11:11:43 DBSERVER sshd[29245]: Received disconnect from 116.31.116.7 port 24892:11: [preauth] Mar 29 11:11:43 DBSERVER sshd[29245]: Disconnected from 116.31.116.7 port 24892 [preauth] Mar 29 11:11:43 DBSERVER sshd[29245]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.7 user=root Mar 29 11:12:39 DBSERVER sshd[29247]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.7 user=root Mar 29 11:12:41 DBSERVER sshd[29247]: Failed password for root from 116.31.116.7 port 26739 ssh2 Mar 29 11:12:45 DBSERVER sshd[29247]: message repeated 2 times: [ Failed password for root from 116.31.116.7 port 26739 ssh2] Mar 29 11:12:45 DBSERVER sshd[29247]: Received disconnect from 116.31.116.7 port 26739:11: [preauth] Mar 29 11:12:45 DBSERVER sshd[29247]: Disconnected from 116.31.116.7 port 26739 [preauth] Mar 29 11:12:45 DBSERVER sshd[29247]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.7 user=root Mar 29 11:13:41 DBSERVER sshd[29249]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.7 user=root Mar 29 11:13:43 DBSERVER sshd[29249]: Failed password for root from 116.31.116.7 port 27040 ssh2

禁止IP仍在尝试。

但是，当我检查与sudo iptables -L INPUT -v -n我得到这个：

 Chain INPUT (policy ACCEPT 228 packets, 18000 bytes) pkts bytes target prot opt in out source destination 6050 435K f2b-sshd tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 22

我在这里做错了什么？

我如何显示所有被禁止的IP列表？

提前致谢。

请记住，禁止IP是暂时性的。

查看已被阻止的IP的完整列表的最好方法是检查日志文件：

 sudo zgrep 'Ban:' /var/log/fail2ban.log*

以下命令也可以给你一个干净的input规则列表：

 sudo iptables -L INPUT -v -n | less

只是一个供参考：

“全面禁止”是被监禁的那些IP地址（可能已经被解禁了）。
“目前被禁止”是目前被监禁的唯一IP地址（IP列表证实了这一点）。

希望有所帮助。

这将显示iptables的chain fail2ban-ssh部分中当前被禁止的（REJECT）。

sudo iptables -L fail2ban-ssh -v -n

要查看iptables的完整行：

 # sudo iptables -L -n | awk '$1=="REJECT" && $4!="0.0.0.0/0"'

要仅查看IP地址：

 # sudo iptables -L -n | awk '$1=="REJECT" && $4!="0.0.0.0/0" {print $4}'

你可以通过“DROP”来改变“REJECT”，这取决于你的情况。

如果你想看到禁止的IP列表超时（超时过期，他们被从禁止池中删除），你可以使用：

 ipset list