1

OK: so I have fail2ban installed on a Debian 8.7 machine: I have a iptables that looks like this:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N fail2ban-ssh-daily
-N fail2ban-ssh-permaban
-N fail2ban-ssh-yearban

-N fail2ban-sshd
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-sshd
-A fail2ban-sshd -j RETURN

THIS

-N fail2ban-sshd
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-sshd
-A fail2ban-sshd -j RETURN

where it defaults to fail2ban.sshd - I want the rules to be named:

  • -N fail2ban-ssh-daily ( for default fail2ban-sshd bans)
  • -N fail2ban-ssh-permaban (for permanent bans)
  • -N fail2ban-ssh-yearban (for yearly bans)

I want the default config to stop adding fail2ban.sshd, and I want to use fail2ban to set up jails that will allow me to:

  1. Set up a Daily Ban Chain - Daily Bans are deleted after 24 hours (I also want the ips logged, but the /etc/fail2ban/ip.blocklist.name is NOT logging any bans - It won't even make the file, and when I touch it, it stays at zero - I want 3 logs - Daily, yearly and permaban - so that when the proper threshold is reached, the ip is banned, placing it in the right chain (Daily, permaban, yearban) and then it would make an ip.blocklist.ssh-daily, ip.blocklist.ssh-yearban and ip.blocklist.ssh-permaban) But I can't get rid of the fail2ban.sshd chain - I would like to see the Daily Bans in 'fail2ban-ssh-daily' How do I do that, and keep the chains I specify?) I also want to be sure that the iptables rules are correct as well.
  2. Set up a Yearly Ban Chain: Yearly Bans are for those that would try to continually try to get into my server and they keep trying every day. These users would be placed in fail2ban-ssh-yearban and then their IP logged and loaded into the ip.blocklist.yearban. These users would be banned for 1 year after like 100 attempts against my server.
  3. Set Up a PERMABAN Chain: PERMA Bans are those who keep trying attacks against my server, or for those IPs that are on a list of the worst: China, India, etc. These IPs would be placed in fail2ban-ssh-PERMABAN, have their IPs logged, placed in hosts.deny, and then reported to badips.com or whatever the site name is. I think I have it set for 500 attampts against my server for this one.

The Problem is: I only see vanilla responses to questions relating to fail2ban: I have to setup the action.d/iptables-multiport file, and any filters that are needed, but I want to configure an iptables-ssh-daily, iptables-ssh-yearban, and iptables-ssh-permaban config files for each instance, but I have tried and failed miserably.

I also get a lot of junk in the /var/log/fail2ban.log, errors telling me that it didn't ban an address for some reason I cannot figure out - it breaks fail2ban unless I just start it up and don't change anything - otherwise it won't add ips to the blocklists, whether or NOT they exist, and it just doesn't filter properly - It will Mail me that an IP has been banned, but then in the failtoban log, I get 6-7 of the same IP being banned, and it is not logged or banned.

Does anyone know how to do what I am wanting to do? I want to keep track of these attempts, but the system does NOT want to work right unless I leave it stock.

How do I change fail2ban so that I get the following chain names and have the system add bans to the proper chains Daily, Yearly and Permaban?

They were all crossed out in red and fail2ban.sshd is still there. The edits in GREEN were not helpful and did not answer the questions I asked:

  1. I want rules that will use: -N fail2ban-ssh-daily ( for default fail2ban-sshd bans) -N fail2ban-ssh-permaban (for permanent bans) -N fail2ban-ssh-yearban (for yearly bans) (It added -N Fail2ban.sshd and that's the only place IPs go)
  2. I want to configure the iptables files for EACH bantype, and have a ip.blocklist for the chain in question ip.blocklist.daily, ip.blocklist.yearly and ipblocklist.permaban
  3. I need a little help with the iptables so that the ban goes to the right chain. I will put the jail.local file below for my jails I want to use:

    [ssh-daily]
    enabled  = false
    filter   = sshd
    action   = iptables-ssh-daily[name=ssh-daily]
               sendmail-whois[name=SSH-Daily, dest=root@localhost, sender=root@localhost]
    logpath  = %(sshd_log)s
    maxretry = 10
    findtime = 600
    bantime  = 86400
    
    [ssh-yearban]
    enabled  = false
    filter   = sshd
    action   = iptables-ssh-yearban[name=ssh-yearban]
               sendmail-whois[name=SSH-Yearban, dest=root@localhost, sender=root@localhost]
    logpath  = %(sshd_log)s
    maxretry = 35
    findtime = 3153600
    bantime  = 3153600
    
    [ssh-permaban]
    enabled  = true
    filter   = sshd
    action   = iptables-ssh-permaban[name=ssh-permaban]
               sendmail-whois[name=SSH-PermaBan dest=root@localhost, sender=root@localhost]
    logpath  = %(sshd_log)s
    maxretry = 100
    findtime = -3153600
    bantime  = -3153600
    

The jails should work, but I need to make sure that for each stanza, it is adding IPs to the Daily, Yearly and Permaban chains and blocklists. It just errors out all over the place and I have a bunch of junk in /var/log/fail2ban.log - I want to customize the setup, but I cannot get it to behave.

Now, Can someone please tell me what I would have to do to edit the iptables with the right rules, and help me to make sure that the action line works?

  • 3
    Your question was not edited in an attempt to answer it. It was edited to fix the formatting. This is how Stack Exchange is meant to work, please don't revert that kind of change. – Philip Kendall Apr 1 '17 at 17:45
  • It was not meant to be an attack: I simply did not know why it was edited and why my question (most of it) was crossed out and not answered - The red and green markings are confusing and I was expecting a way to communicate privately with the user but there seems to be no way to do this – Brian Baker Apr 1 '17 at 18:16
  • I still get errors in my jails unless I just start up fail2ban and don't make any config changes at all - I may need someone to help me fix that – Brian Baker Apr 1 '17 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.