1

I'm trying to configure fail2ban to block ssh from a local hosts. Fail2ban is install on CentOS 7 with firewall (Linux 3.10.0-229.4.2.el7.x86_64 x86_64 ). I have copied the jail.conf to jail.local i have change the following parameters in jail.local:

banaction = firewallcmd-new
[sshd]
enabled = true
maxretry = 5
port = ssh
logpath = /var/log/secure
action = firewallcmd-ipset

And i have no results. Any idea ?

Some log info:

2ban.filter         [2489]: INFO    Added logfile = /var/log/secure
2015-06-23 07:21:33,439 fail2ban.filter         [2489]: INFO    Set maxRetry = 3
2015-06-23 07:21:33,440 fail2ban.filter         [2489]: INFO    Set jail log file encoding to UTF-8
2015-06-23 07:21:33,441 fail2ban.actions        [2489]: INFO    Set banTime = 86400
2015-06-23 07:21:33,442 fail2ban.filter         [2489]: INFO    Set findtime = 600
2015-06-23 07:21:33,442 fail2ban.filter         [2489]: INFO    Set maxlines = 10
2015-06-23 07:21:33,501 fail2ban.server         [2489]: INFO    Jail sshd is not a JournalFilter instance
2015-06-23 07:21:33,599 fail2ban.jail           [2489]: INFO    Jail 'sshd' started

And SELinux is disabled.

action.d/firewallcmd-ipset.conf file

[INCLUDES]

before = iptables-common.conf

[Definition]

actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>

actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
             ipset flush fail2ban-<name>
             ipset destroy fail2ban-<name>

actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist

actionunban = ipset del fail2ban-<name> <ip> -exist

[Init]

# Option:  chain
# Notes    specifies the iptables chain to which the fail2ban rules should be
#          added
# Values:  [ STRING ]
#
chain = INPUT_direct

# Option: bantime
# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
# Values:  [ NUM ]  Default: 600

bantime = 600


# DEV NOTES:
#
# Author: Edgar Hoch and Daniel Black
# firewallcmd-new / iptables-ipset-proto6 combined for maximium goodness
0

I'm guessing here a bit because I don't have enough info to know what's going on. But I would try something like this:

fail2ban-regex --print-all-missed /var/log/secure /etc/fail2ban/filter.d/sshd.conf

to see if it finds something or what lines it might be missing. I'm assuming /var/log/secure is where sshd is printing out it's login failures. It's /var/log/auth.log on my debian based system.

Also I have a bantime and findtime in my jail.local

bantime  = 86400
findtime = 86400

Maybe you are not getting anything because you haven't told it the window of time to look in?

  • Hi Michael thanks for answer, from "fail2ban-regex --print-all-missed" i have the following output when i test ssh access (Jun 25 19:19:26 localhost sshd[3143]: Connection closed by 172.16.45.1 [preauth]) but there is no action from the firewall to block this ip address. I'm testing this on virtual machine with 172.x.x.x. ip. This virtual machine is on my laptop with 192.168.0.x ip using the VMware i have install the fial2ban on centos with 172.xxxx ip. – user3523605 Jun 25 '15 at 23:22
  • Are there other lines that the filter.d/sshd.conf finds, maybe it's not finding enough lines to ban (6)? Is it able to find ipset command? – Michael Grant Jun 26 '15 at 1:28
  • In the sshd.conf file i was not able to find ipset command ... – user3523605 Jun 27 '15 at 17:28
  • No, sorry, that's confusing. Look at your action that you stated above, you have "action = firewallcmd-ipset". This action uses the file named "action.d/firewallcmd-ipset.conf" (relative to your fail2ban conf directory). This conf file uses the ipset command to tweak the firewall. Is fail2ban able to execute the ipset command? Can you execute it from the command line? Is there anything in the fail2ban log file that might give a clue as to why it's not doing anything? – Michael Grant Jun 28 '15 at 20:19
  • I have edit the question with the context of the file firewallcmd-ipset.conf ... im not quite sure what command to execute and what to change. – user3523605 Jun 29 '15 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.