3

Fail2ban is doing it's job and fail2ban-client status is showing me they're all working fine and offending addresses get blocked.

When an address is blocked I like to receive a mail. That's working for all jails except for one. Why?

Here are the relevant parts of /etc/fail2ban/jail.local:

# My own domain is here, not example.com, obviously.
sender = Fail2Ban@example.com

banaction = iptables-multiport
mta = sendmail

action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
               %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"]

action = %(action_mwl)s

# This one is working. Others are as well.
[postfix]
enabled  = true
port     = smtp,ssmtp,submission
filter   = postfix
logpath  = /var/log/mail.log

# This one is not working.
[recidive]
enabled  = true
filter   = recidive
logpath  = /var/log/fail2ban.log
bantime  = 604800  ; 1 week
findtime = 86400   ; 1 day
maxretry = 5

Here is the output of fail2ban-client status recidive (a bit anonymized):

Status for the jail: recidive
|- filter
|  |- File list:        /var/log/fail2ban.log
|  |- Currently failed: 34
|  `- Total failed:     270
`- action
   |- Currently banned: 9
   |  `- IP list:       195.154.237.*** 91.200.12.*** 195.154.255.***
   `- Total banned:     12

Postfix:

Status for the jail: postfix
|- filter
|  |- File list:        /var/log/mail.log
|  |- Currently failed: 0
|  `- Total failed:     1058
`- action
   |- Currently banned: 0
   |  `- IP list:
   `- Total banned:     162

postfix.conf:

[INCLUDES]
before = common.conf
[Definition]

_daemon = postfix/smtpd

failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
            ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
            ^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$
            ^%(__prefix_line)simproper command pipelining after \S+ from [^[]*\[<HOST>\]:?$
            ^%(__prefix_line)sNOQUEUE: reject: RCPT from (.*)\[<HOST>\]: 454 4\.7\.1\.*
ignoreregex =

recidive.conf:

[INCLUDES]
before = common.conf

[Definition]
_daemon = fail2ban\.actions
_jailname = recidive

failregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions%(__pid_re)s?:\s+)WARNING\s+\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+<HOST>\s*$

From /var/log/fail2ban.log:

2016-12-15 08:01:52,620 fail2ban.actions[18430]: WARNING [wordpress-soft] Unban 160.202.163.***
2016-12-15 08:01:59,649 fail2ban.actions[18430]: WARNING [wordpress-soft] Ban 160.202.163.***
2016-12-15 08:02:00,610 fail2ban.actions[18430]: WARNING [recidive] Ban 160.202.163.***
2016-12-15 08:12:00,587 fail2ban.actions[18430]: WARNING [wordpress-soft] Unban 160.202.163.***

So I am positive Fail2ban's mail function is working. And all jails are working. There seems to be no difference between recidive and the other jails. What am I missing?

2

I had the same problem. I have 2 jails going, the ssh and recidive. The ssh jail was sending me emails perfectly, but nothing from recidive. I am running:

Fail2Ban v0.8.13

My relevant global config is identical to what you posted:

 banaction = iptables-multiport
 mta = sendmail

 action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
                   %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"]

 action = %(action_mwl)s

My initial recidive jail config (which was not sending emails):

[recidive]

enabled  = true
filter   = recidive
logpath  = /var/log/fail2ban.log
#action   = iptables-allports[name=recidive]
#           sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log]

bantime  = 604800  ; 1 week
findtime = 604800
#findtime = 86400   ; 1 day
maxretry = 3

Note that I had commented out the default recidive action. At least for me, that was what came as the default. I did this because I wanted the recidive emails to work like the ssh, which also used the default action. With this config... I got nothing. Crickets. But the recidive jail did work. I don't know exactly what the issue was, but I knew I had to fix it. So, I first tried uncommenting the action. Then, it still worked, but no emails. Or, so I thought. Turned out the emails were going to the local root account. I found them in the /var/mail/[user] mailbox, which I had root mail forwarded to. So, then I realized that was because destemail was not being used in this default action. So, what I ended up doing was just copying the global default action_mwl & tweaked it to take the port out.

So my final recidive jail config, which worked:

enabled  = true
filter   = recidive
logpath  = /var/log/fail2ban.log
#action   = iptables-allports[name=recidive]
#           sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log]
action = %(banaction)s[name=%(__name__)s, protocol="%(protocol)s", chain="%(chain)s"]
               %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"]

Perhaps this is all by design or an old bug - I don't know. But this is how I got it to work. This may be too late to help you, but maybe it will help the next one in the same boat...

  • This worked for me, thank you. The Recidive jail just mailed me its first notification :) Glad to see the problem was not caused by me not reading the man files well enough ;) – Forkbeard Mar 25 '17 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.