Prevent blocking with fail2ban

[tcooper]

Since the feature is fairly new and may fly in under the radar for many cluster admins it might be nice to add something to the usersguide explaining how to prevent lockout from selected hosts/networks.

Per the fail2ban documentation this is most easily accomplished by adding something like the following...

# mkdir -m 755 /etc/fail2ban/jail.d
# cat > /etc/fail2ban/jail.d/jail.local << EOT
[DEFAULT]
bantime = 3600
[ssh-iptables]
enabled = true
ignoreip = 127.0.0.1/8 10.1.0.0/24 <ip_or_net_to_never_ban>
EOT

...obviously replacing <ip_or_net_to_never_ban> with the IP or Network to not ban.

[lclementi]

PS: as a side note, I also automatically add the private network to the ignoreip now.

Luca