# LogGraphic 1.20.0 — Find a logged sender and ban its source IP with Fail2ban.

2026-11-04 · Kali amd64 · 1.20.0-20261104002227

LogGraphic 1.20.0 adds a form that accepts a sender email address, finds source IPs in retained logs and lets you register a selected IP with Fail2ban.

## Find sources by email address

Open Actions → Ban by email address…, enter one sender address and choose Search source IPs. The same button is available in ADDRESS FLOW; a selected sender node prefills its address.

## Review the evidence and ban one IP

Candidates are grouped by source IP and logged server. Review host names, queue/rejection record counts, event counts, first/last timestamps (UTC) and the latest supporting log. Select one IP to open the existing Fail2ban confirmation window.

## Matching and search scope

The form matches one ordinary ASCII envelope sender (`from=<...>`) exactly. Only the ASCII domain is case-insensitive; the local part remains case-sensitive. Surrounding spaces and `<user@example.com>` are accepted. Internationalized domains can be entered in punycode.

Search covers all retained analysis logs independently of the main search, event filter and playback position. A zero retention limit disables lookup. Editing the input clears previous results, and the current logs are checked again before proceeding with an action.

## How records are counted

Queue / rejection records are deduplicated by Queue ID generation. NOQUEUE records and records without an identifier each count as one unit. Delivery events for multiple recipients and retries are shown separately; these units are not a guaranteed count of actual messages.

## Settings and the scope of a ban

Configure the target under Settings → SSH settings… and an existing Jail under Settings → Fail2ban settings…. Only valid source IPv4/IPv6 addresses recorded in the logs are used. Recipient/forwarding addresses, delivery relays and DNS lookups are never used to infer a source. Records without a source IP cannot be banned.

The target is the observed source IP associated with the email address. An envelope sender is not proof of identity. A shared or forwarding server IP can affect other senders too. In the final confirmation, review the logged server, actual SSH target, Jail and IP.

## Python extensions in installed Linux packages

The resource lookup now finds the bundled files used to list and run Python extensions when the Linux package is installed under the standard /usr prefix.

## Validation and supported environment

The Kali amd64 build and all 13 automated tests passed. Separate GTK/Xvfb GUI probes verified email input, candidate selection and stale-candidate invalidation, plus Python extensions using the extracted package’s installed layout. Packaged startup, shared-library dependencies, an APT installation simulation and SHA-256 were also verified. No real-server ban was performed. Command completion does not demonstrate packet blocking; the server Jail defines the scope and duration.

## Upgrade instructions

With the LogGraphic APT repository registered, run the commands below and restart the app. apt update refreshes indexes; the second command upgrades the application. Start the GUI from a terminal in the Kali desktop session.

```bash
sudo apt update
sudo apt install --only-upgrade loggraphic
```

SHA-256: `03d983030ba98e71c4056da5577ffbe6026fb318e6b175dd97c64da3781af2fc`