Thanks for the report, the regex can not handle CIDR notation, only single IPs.
Can be fixed with this regex ^([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+(/[0-9]+)?|[0-9a-f:]*:[0-9a-f:]*(/[0-9]+)?)$
But maybe the message needs to be modified to Fail2Ban status : X ban(s), since a ban in CIDR notation would be now considered as one IP.
Thanks for the report, the regex can not handle CIDR notation, only single IPs.
Can be fixed with this regex ^([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+(/[0-9]+)?|[0-9a-f:]*:[0-9a-f:]*(/[0-9]+)?)$
But maybe the message needs to be modified to Fail2Ban status : X ban(s), since a ban in CIDR notation would be now considered as one IP.
@dpfan1947
Since subnets are (AFAIK) never banned automatically by failed logins, but only manually via fail2ban-client, it would be probably clearer to split things:
Counts individual IPs like before, and use only these for highlight/alert message coloring.
Count subnet bans separately, and do not let them affect coloring/severity of the message, since it does not say anything about whether there are many unauthorized login attempts or not.
The message could then say “X banned IP(s), Y banned subnets”, with the subnet part added only if its number is above zero.
Does this make sense for you, or is it overkill? And is my assumption correct that there are no jails that apply whole subnet bans, or are there native mechanisms for that, like X bans from within a subnet over Y time => ban whole subnet?
You should probably run this by other fail2ban users. This new dietpi-banner option caught my eye and wanted to check it out, but I already have a home-made mechanism for monitoring access attempts and probably won’t use this new option.
@dpfan1947
Since subnets are (AFAIK) never banned automatically by failed logins, but only manually via fail2ban-client, it would be probably clearer to split things:
Counts individual IPs like before, and use only these for highlight/alert message coloring.
Count subnet bans separately, and do not let them affect coloring/severity of the message, since it does not say anything about whether there are many unauthorized login attempts or not.
The message could then say “X banned IP(s), Y banned subnets”, with the subnet part added only if its number is above zero.
Does this make sense for you, or is it overkill? And is my assumption correct that there are no jails that apply whole subnet bans, or are there native mechanisms for that, like X bans from within a subnet over Y time => ban whole subnet?
The question is basically whether you would find it beneficial, if subnet bans are shown/counted separately, or just like any other ban. And whether you apply subnet mans manually, of have some mechanism which automates this somehow.
Sorry. I will not be using the new dietpi-banner option but yes, it would be beneficial to anyone who manually bans sub-nets and wants to know about new ip bans. By having separate counts, they would know when fail2ban had automatically banned an ip and it was time to manually unban the ip and ban the sub-net instead. I have internet-facing vpn and ssh dietpi systems and currently ban 33 sub-nets. If I banned only ip’s, the count would be much higher.
I am not aware of a fail2ban option that will automatically ban sub-nets. My manual banning of sub-nets is automated hourly… journalctl -u fail2ban, grep, and a python program generate ban sub-net commands that get executed. The commands also append to a file that can be executed one time whenever a new system is installed from scratch. Sometimes, multiple /24 sub-nets are manually merged into one /16 sub-net. Very primitive compared to the stuff you guys write, but this works for me.
The question is basically whether you would find it beneficial, if subnet bans are shown/counted separately, or just like any other ban. And whether you apply subnet mans manually, of have some mechanism which automates this somehow.
| 
|