1

I recently set up Fail2Ban (v0.9.4 on Debian Jessie). I only use it for SSH.
By default my main jail bans after 5 failed attempts in 10 minutes for a day. This setting has worked well for me however some bots just continue after they are unbaned.
So I set up 2 more jails with a longer findtime and more maxtries which then ban the IP for a longer time. The second tier also sends me a email (using action = %(action_mwl)s) and the third and final tier reports the IP using action = %(action_xarf)s. The configs themself are working and fail2ban has already found several canidates for the last tier.

But sometimes (about 50% of the time) it fails with an error message like this (tier 3 is called sshd-bot):

2016-03-31 10:59:44,849 fail2ban.actions        [30358]: NOTICE  [sshd-bot] Ban 95.59.143.167
2016-03-31 10:59:44,979 fail2ban.action         [30358]: ERROR   oifs=${IFS}; IFS=.;SEP_IP=( 95.59.143.167 ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs}
2016-03-31 10:59:44,980 fail2ban.action         [30358]: ERROR   oifs=${IFS}; IFS=.;SEP_IP=( 95.59.143.167 ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs}
2016-03-31 10:59:44,980 fail2ban.action         [30358]: ERROR   oifs=${IFS}; IFS=.;SEP_IP=( 95.59.143.167 ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs}
2016-03-31 10:59:44,981 fail2ban.actions        [30358]: ERROR   Failed to execute ban jail 'sshd-bot' action 'xarf-login-attack' info 'CallingMap({'ipfailures': <function Actions.__checkBan.<locals>.<lambda> at 0x6a07f4acc268>, 'ipmatches': <function Actions.__checkBan.<locals>.<lambda> at 0x6a07f4acc158>, 'failures': 1588, 'ipjailmatches': <function Actions.__checkBan.<locals>.<lambda> at 0x6a07f4acc1e0>, 'time': 1459414784.8492236, 'matches': '  Long string containing all matches  ', 'ipjailfailures': <function Actions.__checkBan.<locals>.<lambda> at 0x6a07f4acc2f0>, 'ip': '95.59.143.167'})': local variable 'popen' referenced before assignment

There also have been other error messages but this is the most common one.

Edit:

Here are the configs for all 3 jails:

[sshd]

enabled = true

bantime = 86400 ; 1 day
findtime = 600 ; 10 minutes
maxretry = 5

port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

action = %(action_)s


[sshd-repeat]

enabled = true

bantime = 2628000 ; 1 month
findtime = 604800 ; 1 week
maxretry = 20

filter  = sshd
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

action = %(action_mwl)s


[sshd-bot]

enabled = true

bantime = 315400000 ; 10 years
findtime = 31540000 ; 1 year
maxretry = 200

filter  = sshd
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

action = %(action_xarf)s

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.