How do I check whether Fail2Ban blocked a legitimate administrator?
Fail2Ban can temporarily block a source IP after matching configured authentication or application failures. Diagnose the exact jail and source address before lifting a ban. A successful unban does not correct a wrong password, wrong SSH key or automated job that repeatedly fails.
Before you start
- Console access or another authorised session.
- Independent verification of the legitimate administrator’s public source IP.
Instructions
1. Inspect active jails
Use the jail names returned by the server. sshd is a common name but is not guaranteed. Review counts and the current banned-address list.
sudo fail2ban-client status
sudo fail2ban-client status sshdDisplays overall status and details of the example SSH jail.
2. Resolve the cause first
Confirm the client is using the correct account, key and port. Check a narrow authentication-log interval and stop any stale client job that continues failing. Do not publish raw login logs with personal or infrastructure details.
3. Lift only the confirmed mistaken ban
Substitute the verified address and actual jail. This operation should be used for an authorised client whose underlying authentication problem has been corrected.
sudo fail2ban-client set sshd unbanip 198.51.100.20
sudo fail2ban-client status sshdRemoves one address from one jail and rechecks the jail status.
Check the result
- The selected address is no longer banned and a fresh authorised login succeeds.
- The jail remains active and the address is not immediately banned again.
Troubleshooting
- The same IP is banned again
- Find the continuing failed-login source or misconfigured automation. Repeatedly unbanning or excluding a broad network would conceal the unresolved problem.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.