[GH-ISSUE #78] feat: auto-whitelist SSH IP in Fail2Ban and deduplicate entries #3

New issue

Closed

opened 2026-03-02 02:59:16 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 02:59:16 +03:00

Owner

Originally created by @Kuuchuu on GitHub (Nov 19, 2025).
Original GitHub issue: https://github.com/buildplan/du_setup/issues/78

When setting up Fail2Ban, users connecting via SSH risk accidentally locking themselves out if their IP is not on the ignoreip list. Automating the addition of the user's SSH IP to the ignoreip list can help eliminate this possibility while also reducing potential lockout due to a misconfiguration/typo.
Additionally, if IPs are added manually, the ignoreip list can accumulate duplicate entries, making the configuration cluttered and potentially harder to manage.

I propose two enhancements to the Fail2Ban setup process:

Automatic SSH IP Whitelisting:
- The script should detect the IP address of the current SSH session (from the $SSH_CONNECTION variable).
- It should then prompt the user, asking if they want to add this detected IP to the Fail2Ban ignoreip list. This provides a convenient way to prevent accidental lockouts.
ignoreip List Deduplication:
- Before writing the jail.local configuration, the script should process the array of IPs to be ignored and remove any duplicate entries. This ensures the final ignoreip list is always clean.

Originally created by @Kuuchuu on GitHub (Nov 19, 2025). Original GitHub issue: https://github.com/buildplan/du_setup/issues/78 When setting up Fail2Ban, users connecting via SSH risk accidentally locking themselves out if their IP is not on the `ignoreip` list. Automating the addition of the user's SSH IP to the `ignoreip` list can help eliminate this possibility while also reducing potential lockout due to a misconfiguration/typo. Additionally, if IPs are added manually, the `ignoreip` list can accumulate duplicate entries, making the configuration cluttered and potentially harder to manage. I propose two enhancements to the Fail2Ban setup process: 1. Automatic SSH IP Whitelisting: - The script should detect the IP address of the current SSH session (from the `$SSH_CONNECTION` variable). - It should then prompt the user, asking if they want to add this detected IP to the Fail2Ban `ignoreip` list. This provides a convenient way to prevent accidental lockouts. 2. `ignoreip` List Deduplication: - Before writing the jail.local configuration, the script should process the array of IPs to be ignored and remove any duplicate entries. This ensures the final `ignoreip` list is always clean.