fail2banの設定に対するログあれこれ

[DEFAULT]セクションで

bantime.increment = true (段階的BAN):

を有効にした場合。※bantime.increment関連の他の設定は変えずにデフォルトのまま

badbotsは48h(2d)設定が2倍の4dにsshdは10m設定がやはり2倍の20mになっているので、デフォルト設定だと倍々の増え方ということらしい。これが続くと永久追放も同然となる？

[apache-badbots] IP xxx.xxx.xxx.xxx is bad: 1 # last 2026-01-24 17:40:57 - incr 2d to 4d
[apache-badbots] Increase Ban xxx.xxx.xxx.xxx (2 # 4d -> 2026-02-02 10:13:15)
[sshd] IP xxx.xxx.xxx.xxx is bad: 1 # last 2026-01-29 10:08:18 - incr 10m to 20m
2026-01-29 10:25:25,890 fail2ban.observer [268973]: NOTICE [sshd] Increase Ban xxx.xxx.xxx.xxx (2 # 20m -> 2026-01-29 10:45:25)

ubuntu – Fail2ban bantime.increment not working – Server Fault

上記リンクより

Bantime increment facility is released with fail2ban 0.11, so if you see 0.11.x by fail2ban-client --version it must work.

As for the issue, please read the mans attentively (what exactly and where exactly you’ve to specify that).

Anyway you have to set bantime.increment = true in /etc/fail2ban/jail.local (not in /etc/fail2ban/fail2ban.*) for certain jail(s) or even in DEFAULT section, if must be valid for all jails.

(and you don’t need to set bantime.factor and bantime.formula since they seem to be default values).