Defender banned IPv4 despite being in safelist

[JonBendtsen]

Hi

Defender banned IPv4 despite being in safelist :-(
Running docker.io/drakkan/sftpgo v2.4.2-plugins.

---

podman logs sftp-dmi-sftpgo | grep banned
{"level":"debug","time":"2023-01-10T12:53:38.472","sender":"SSH","message":"connection refused, ip \"10.0.2.100\" is banned"}

cat lib/safelist.json

{
  "addresses": [
    "10.0.2.100"
  ],
  "networks": []
}

jq '.common.defender' some-sftpgo.json

{
  "enabled": true,
  "driver": "memory",
  "ban_time": 2,
  "ban_time_increment": 50,
  "threshold": 4,
  "score_invalid": 2,
  "score_valid": 1,
  "score_limit_exceeded": 3,
  "observation_time": 4,
  "entries_soft_limit": 100,
  "entries_hard_limit": 150,
  "safelist_file": "/var/lib/sftpgo/safelist.json",
  "blocklist_file": "",
  "safelist": [],
  "blocklist": []
}

1. I remove the container and create a fresh new with an empty safelist.json
2. I run my script that gets my IPv4 banned

Great, my IPv4 is banned as expected.

3. remove the container and create a fresh new with a safelist.json that contains the ip address not to block
4. I again run my script that gets my IPv4 banned, and things work as expected, my address do not get banned.

So now I combine it with a post-login-hook that populates the safelist.json whenever a valid user has a successful login.

jq '.data_provider.post_login_hook' some-sftpgo.json 
"/var/lib/sftpgo/bin/post-login-script.sh"

cat lib/bin/post-login-script.sh

#!/bin/bash

activefile="/var/lib/sftpgo/safelist.json"

findes=$( grep -c "${SFTPGO_LOGIND_IP}" ${activefile} )
if [[ 1 -le ${findes} ]]; then
	exit 0
fi

# store backup
backupfile=$( tempfile --suffix .backupfile.post-login-script.sh )
cp -f ${activefile} ${backupfile}

# add new IP to safelist
jq --arg value "${SFTPGO_LOGIND_IP}" '.addresses += [$value]' ${backupfile} > ${activefile}

# test if valid json
jq 'empty' ${activefile} || ( jq 'empty' ${backupfile} && cp -f ${backupfile} ${activefile} )

# cleanup
rm -rf ${backupfile}
# always solid exit
exit 0

5. I log in with a valid user and the safelist.json file is indeed updated containing the IPv4 address you see way above.
6. I once again run my script that should get me banned, but I do not expect to get banned because the safelist.json contains a protected IPv4. HOWEVER, I am indeed banned again. It is as if SFTPGo does not test the safelist.json file

Do I need to send sftpgo a signal or something once I update the safelist.json file?

[drakkan]

From the docs

The lists can be reloaded on demand sending a SIGHUP signal on Unix based systems and a paramchange request to the running service on Windows. An host that is already banned will not be automatically unbanned if you put it inside the safe list, you have to unban it using the REST API.