0

I have Fedora installed on one our servers and installed fail2ban on it. in jail.conf, I have added the below text, but iptables -L still wont show the fail2ban-ssh. Am I missing something? Thank you.

text added in jail.conf

[ssh]

enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 6

iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination   

Update

Current file :

enter image description here

changing to sshd.conf gives following error :

2018-02-22 08:45:14,029 fail2ban.actions        [10124]: ERROR   Failed to start jail 'ssh' action 'firewallcmd-ipset': Error starting action
1

There is a misconfiguration of your default banaction. Here's how I would try to fix it:

  1. Edit /etc/fail2ban/jail.conf file and change the line

    banaction = firewallcmd-ipset
    

    to

    banaction = iptables-allports
    

    If you reload your fail2ban-client it should start correctly now, but …

As I suggest not to change the default jail.conf file at all, I would instead create a separate jail.local config file and add custom options in there.

  1. Edit /etc/fail2ban/jail.conf file and remove the manually added [ssh] jail section.

  2. Create separate config file /etc/fail2ban/jail.local and in this file add:

    [DEFAULT]
    banaction = iptables-allports
    
    [sshd]
    enabled = true
    

    That's it. This will set the correct banaction and also activate the default sshd jail (as seen in jail.conf). This sshd jail will look for a filter file /etc/fail2ban/filter.d/sshd.conf because we did not specify any other filter file. And, as long as you don't have any special configuration, the default sshd.conf filter file should work fine.

  • This worked nicely with jail.local. On a side note, any ideas why whenever I try service fail2ban restart, it fails, but when I run /usr/bin/fail2ban-client start/stop, it works fine. Thanks. :D – We are Borg Feb 26 '18 at 10:19
  • Glad to hear it worked! Regarding your restart issue, I could only guess what might cause this without any further information. May I ask you to create separate question for this issue and provide more information/error messages/log/config? – Bob Feb 27 '18 at 11:37
1

First of all check is your fail2ban service is running. If it is, check if you have a filter ssh.conf in filter.d dir.

You can activate the log for fail2ban in fail2ban.conf : loglevel = DEBUG logtarget = path_to_log

restart fail2ban after editing. And there are always the potability nothing was baned cos no one tried to acsses more than 6 times whit the wrong Permissions.

  • I don't have ssh.conf in filter. but I have sshd-aggressive.conf, sshd.conf and ssdh-ddos.conf. Fail2ban is running. Thank you. – We are Borg Feb 22 '18 at 9:55
  • then try [ sshd.conf ] Or create ssh filter. depending on what you are trying to achieve. – matisa Feb 22 '18 at 10:35
  • I reinstalled fail2ban without any changes, no luck. Any way to reconfigure fail2ban entirely? Please check updated post. Thank you. :-) – We are Borg Feb 22 '18 at 11:39
  • Is your firewalld service running? – Raman Sailopal Feb 22 '18 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.