fail2ban config

fail2ban-client status

Shows the status of fail2ban jails, verifying brute-force protection for host services.

Run it when you want to verify that brute-force protection is active: fail2ban-client status shows the configured jails — sshd, apache, etc. — and their state: the ban files, the currently banned IPs, and the actions taken. It's the day-to-day check: the sshd jail with hundreds of banned IPs is proof that the protection works (and the attack history). In hardening, fail2ban is the automatic response layer to brute force: the service that fails N times gets banned for the configured time. The status verifies that the jails are active and working.

Don't use it as complete protection: fail2ban mitigates brute force by IP, but it's not a deep defense — botnets with many IPs, distributed sprays, and slow attacks evade it; password policy, key-based authentication, and the rest of hardening are the foundation. Misconfigured jails (low thresholds) have banned legitimate IPs (proxies, jumps): the configuration is calibrated. And watch out: fail2ban acts at the application level (iptables/firewalld) — an attacker with host access can stop it or clear the bans; detecting fail2ban itself being stopped is part of monitoring. In environments with WAF or centralized authentication, the layers are combined.