win2ban

Initiate win2ban-shell  at the root of the installation directory and issue the command below (example jail win2ban-network-logon):

$ fail2ban-client status win2ban-network-logon

Status for the jail: win2ban-network-logon

|- Filter

Initiate win2ban-shell  at the root of the installation directory 

Command to unban specific addresses:

fail2ban-client unban ip-address ip-address ...

Command to unban all IP-addresses:

fail2ban-client unban --all

• Protecting Copssh against brute force attacks is enabled as default. 

• Start services win2ban_winlogbeat and win2ban_fail2ban 

Sample /var/log/fail2ban.log: 

• Protecting RDP/Network logins against brute force attacks is enabled as default. 

• Start services win2ban_winlogbeat and win2ban_fail2ban

Sample /var/log/fail2ban.log: 

 Try to append the option tail to the logpath parameter of your jail definition. Win2ban will then start to read from the end of the file instead of from the beginnning. Visit Fail2ban man page https://www.systutorials.com/docs/linux/man/5-jail.conf and search for tail for more information.