What this does
Parses a fail2ban jail.local or jail.conf file, entirely in your browser, and flags the specific misconfigurations that quietly make a jail ineffective: a ban time short enough that a persistent scanner simply waits it out, a maxretry so high it barely limits attempts (or so low it risks accidental lockouts), an ignoreip range broad enough to exempt everyone, and jails that parse fine but were never actually enabled.
Why a config that looks fine can still do nothing
fail2ban configuration is INI-style and forgiving to write — a jail section with a typo in enabled, or one that simply never had enabled = true added at all, parses without any syntax error and produces the misleading impression that protection is active when nothing is actually running. This tool exists specifically to catch that gap between "the file parses" and "the jail is doing anything."
FAQ
What counts as too short a bantime?
Under 300 seconds (5 minutes) is flagged — short enough that a persistent automated scanner can simply wait out the ban and resume, which defeats much of the point of banning it in the first place. There's no universally correct value; longer bantimes trade off against the operational cost of a legitimate user accidentally locking themselves out for longer.
Is bantime = -1 a mistake?
Not necessarily — it means a permanent ban that only a manual unban removes, a deliberate and sometimes appropriate choice for high-value systems. It's flagged as informational specifically so it's not applied by accident, since it's easy to type without realizing what it does.
Why does this tool care about ignoreip specifically?
ignoreip is a full exemption list — any address it covers is never banned, full stop, regardless of how many failed attempts come from it. A range like 0.0.0.0/0 (or ::/0 for IPv6) exempts literally everyone, which silently turns an active jail into a no-op.
Does this tool understand multi-line values or the full fail2ban config syntax?
No — it parses single-line key = value settings and [section] headers, which covers the overwhelming majority of real jail.local files. fail2ban does support line continuation for some multi-line values (like a long ignoreip or action list); those aren't reconstructed by this parser.
Should this go in jail.conf or jail.local?
jail.local, not jail.conf — fail2ban ships jail.conf as its own default file and expects local overrides in jail.local (or files under jail.d/) specifically so a package upgrade that replaces jail.conf doesn't wipe out your customizations.
Try it yourself
For how fail2ban fits into a broader logging and intrusion-response strategy, see fail2ban Explained or the complete picture in Linux Security.