Skip to main content

Licensing Fail2Ban

A license buys blocking​

There are no editions or tiers: a license either covers this service or it does not. The console's License page lists the one capability it buys, Blocking addresses (its feature column reads manage): a jail's ban writes a firewall rule. Nothing else is gated.

Never refused, licensed or not:

  • Reading the jails, the bans, the status and the log
  • Writing, replacing and removing jails, and changing the global options
  • Reloading the daemon
  • Lifting a ban, above all

A server whose license has lapsed must still be able to let its own administrator back in.

Because nothing else is refused, an unlicensed installation can be set up completely - jails tuned, options set - and starts protecting the moment a license arrives.

StateWhat the service does
Unlicensed (no license, or one that does not validate)Every jail runs and detects, and each ban it decides on is written to the log as WOULD BAN. No firewall rule is written, and a ban by hand answers the same way
LicensedBans write firewall rules into the chain you chose
Lapsed (expired, removed, refused by the license server, or out of its check-in window)Within 30 seconds every jail is switched to detecting only and every current ban is lifted, once, and the SMTP page's recipients are mailed. The configuration is kept. See An unlicensed service detects, and blocks nothing

Getting and keeping a license​

Where to buyantelao.io
Bound toOne host. A license is activated for the hardware challenge shown on the License page, which is why the compose file mounts /etc/machine-id: without it every recreated container looks like a different machine. A license bound to another machine is refused
ActivationOn the License page, Activate online with the license key and the e-mail address it was issued to, or Install a license file with the .lic file you were sent. A license file that has never been activated works for 14 days from the moment it is first seen, so the service blocks while activation is arranged
Check-inThe service re-reads its license every hour, and checks in with the Antelao license server once a day and straight after a license is installed. It needs outbound internet access for that
When a check-in failsThe service keeps working on its last successful check-in for 14 days, unless the license states another period, and then runs unlicensed until a check-in gets through: every ban is lifted, as on any lapse
Offline useNot available in the container. A license issued for a machine with no route to the license server needs attested TPM hardware, and the container has no TPM, so such a license is refused

Perpetual and offline licenses​

  • A perpetual license applies only once it is activated. The 14 days a license file gets while activation is arranged do not apply to it: activate it on the license portal before you update the service, or the service stops being licensed after the update.
  • An offline license is not supported. It needs a machine whose TPM proves itself to the service, and the service's container has none. Use a license that checks in with the license server.

Moving a license to another host​

A license runs on as many installations as it allows, one unless it says otherwise. The console has no move of its own: Remove on the License page deletes the license file on this host, and the installation keeps its place with the Antelao license server. Activating the license on another host while that place is taken is refused as already in use, so write to support@antelao.io with the license key to move it.

Recreating the container is not a move. With /etc/machine-id mounted, as in the compose file, a recreated container is the same machine and keeps its license.

An unlicensed service detects, and blocks nothing​

Without a license every jail keeps running and keeps matching, but it is pointed at an action that writes no firewall rule. Each ban it decides on is written to the log as WOULD BAN instead, so the log never claims a protection the host does not have, and the status says the service is detecting only. Banning an address by hand answers the same way: the request succeeds as a WOULD BAN and reports that the address is not blocked.

fail2ban.actions   [ohm-login] WOULD BAN 203.0.113.7 in jail ohm-login (not licensed: no firewall rule was written; fail2ban said: Ban 203.0.113.7)

Every other number - jails configured, addresses banned - looks the same whether or not a packet is being dropped, so GET /status carries licensed and an enforcementNote, and the console shows a banner on the Dashboard and the Bans page.

When a license lapses, the configuration is kept exactly as it is, and every current ban is lifted, once: addresses that were blocked can reach the host again. Rules left in the firewall would otherwise go on blocking people with nothing in the product able to remove them.

Because that is also what a removed license looks like when nobody meant to remove it, the service mails the recipients on the SMTP page that every ban was lifted and the host is blocking nothing, with how many bans went and where to look: the License page, and the Audit log for who removed it. It is sent when a licensed installation goes unlicensed or bans were lifted, never on every start of one that has no license.

Installing a license puts blocking back within 30 seconds. Bans lifted while unlicensed are not restored; the jails detect again from that moment.

Inside the Odoo Host Manager​

When Fail2Ban runs as the ohm-fail2ban container, its licensing is sponsored by that product. Running the container is never restricted, but blocking is: it comes with the Community, Professional and Provider editions. On the Developer edition and on an unregistered server the jails detect and log, and each ban is written to the log as WOULD BAN instead of to the firewall. That product's manual describes its editions and its side of this service: see Related.

When that product's license stops carrying automatic attack blocking - a lower edition, or a subscription that ended - it withdraws its sponsorship. To this service that is a lapse like any other: every current ban is lifted, once, and the jails go on detecting only. The manager offers the sponsorship again by itself when its license carries blocking again, and blocking resumes; bans lifted in between are not restored. It also takes its recipients off this service's ban notices while its license does not carry them. While the manager merely cannot reach its own license server, nothing is withdrawn.

Managing the license​

On the console's License page, or through GET/POST/DELETE /license and POST /license/activate.

No license change needs a restart. A license installed or activated on the License page or through the API, or installed by restoring a backup, applies at once, and the service brings the jails in line within 30 seconds: blocking starts, or, after a removal, stops and every ban is lifted.

The start-up log says how the service is licensed: by its own license, sponsored by the product that offered it (a sponsorship is kept on the volume and holds across restarts), or running unlicensed with the reason - a sponsorship that no longer holds, or the last offer that was refused.

Last updated on