--- a/mod_firewall/marks.lib.lua	Sun May 24 10:49:09 2026 +0100
+++ b/mod_firewall/marks.lib.lua	Sun May 24 18:50:41 2026 +0100
@@ -45,3 +45,89 @@
 	end
 	return true;
 end, -1);
+
+module:add_item("shell-command", {
+	section = "firewall";
+	section_desc = "mod_firewall commands";
+	name = "mark";
+	desc = "Add a firewall mark to a user account";
+	args = {
+		{ name = "user_jid", type = "string" };
+		{ name = "mark_name", type = "string" };
+	};
+	host_selector = "user_jid";
+	handler = function(self, user_jid, mark_name) --luacheck: ignore 212/self 212/host
+		local username, host = jid.split(user_jid);
+		if not username or not hosts[host] then
+			return nil, "Invalid JID supplied";
+		elseif not idsafe(mark_name) then
+			return nil, "Invalid characters in mark name";
+		end
+		if not module:fire_event("firewall/marked/user", {
+			username = session.username;
+			mark = mark_name;
+			timestamp = os.time();
+		}) then
+			return nil, "Failed to set mark";
+		end
+		return true, "Marked";
+	end;
+});
+
+module:add_item("shell-command", {
+	section = "firewall";
+	section_desc = "mod_firewall commands";
+	name = "unmark";
+	desc = "Remove a firewall mark from a user account";
+	args = {
+		{ name = "user_jid", type = "string" };
+		{ name = "mark_name", type = "string" };
+	};
+	host_selector = "user_jid";
+	handler = function(self, user_jid, mark_name) --luacheck: ignore 212/self 212/host
+		local username, host = jid.split(user_jid);
+		if not username or not hosts[host] then
+			return nil, "Invalid JID supplied";
+		elseif not idsafe(mark_name) then
+			return nil, "Invalid characters in mark name";
+		end
+		if not module:fire_event("firewall/unmarked/user", {
+			username = session.username;
+			mark = mark_name;
+			timestamp = os.time();
+		}) then
+			return nil, "Failed to remove mark";
+		end
+		return true, "Unmarked";
+	end;
+});
+
+module:add_item("shell-command", {
+	section = "firewall";
+	section_desc = "mod_firewall commands";
+	name = "marked";
+	desc = "List all user accounts with a specific firewall mark";
+	args = {
+		{ name = "host", type = "string" };
+		{ name = "mark_name", type = "string" };
+	};
+	host_selector = "host";
+	handler = function(self, host, mark_name) --luacheck: ignore 212/self 212/host
+		if not idsafe(mark_name) then
+			return nil, "Invalid characters in mark name";
+		end
+		local users = mark_storage:get_key_from_all(mark_name);
+		local usernames = {};
+		for username in it.keys(users) do
+			table.insert(usernames, username);
+		end
+		table.sort(usernames, function (a, b)
+			return users[a] < users[b];
+		end);
+		for _, username in ipairs(usernames) do
+			self.session.print(username, os.date("%Y-%m-%d %R:%s", users[username]);
+		end
+		return true, ("Showing %d users"):format(#usernames);
+	end;
+});
+