fail2ban keeps saying already banned but it didn't actually ban

Question

I just configured a new server and installed fail2ban as well, but it is not banning me when I keep trying to connect with the wrong password

fail2ban.log:

2018-03-23 12:46:29,363 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:46:30,747 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:46:33,346 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:46:35,515 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:46:36,372 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:47:45,471 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:47:46,820 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:47:49,503 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:47:50,458 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:47:51,893 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:48:49,699 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:48:51,835 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:48:52,531 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:48:54,477 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:48:57,056 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:50:53,240 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:50:53,677 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:50:55,065 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:50:58,253 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:51:00,494 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:51:00,685 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:52:06,119 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:52:08,300 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:52:11,583 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:52:11,773 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:52:13,498 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:53:07,823 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:53:09,712 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:53:09,842 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:53:11,718 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:53:13,696 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:54:37,181 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:54:37,949 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:54:39,092 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:54:40,906 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:54:42,616 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:54:42,955 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:54:52,074 fail2ban.action         [9756]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-sshd[ \t]' -- stdout: ''
2018-03-23 12:54:52,075 fail2ban.action         [9756]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-sshd[ \t]' -- stderr: ''
2018-03-23 12:54:52,075 fail2ban.action         [9756]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-sshd[ \t]' -- returned 1
2018-03-23 12:54:52,075 fail2ban.CommandAction  [9756]: ERROR   Invariant check failed. Trying to restore a sane environment
2018-03-23 12:54:52,180 fail2ban.action         [9756]: ERROR   iptables -w -D INPUT -p tcp -m multiport --dports ssh -j f2b-sshd
iptables -w -F f2b-sshd
iptables -w -X f2b-sshd -- stdout: ''
2018-03-23 12:54:52,181 fail2ban.action         [9756]: ERROR   iptables -w -D INPUT -p tcp -m multiport --dports ssh -j f2b-sshd
iptables -w -F f2b-sshd
iptables -w -X f2b-sshd -- stderr: "iptables v1.4.21: Couldn't load target `f2b-sshd':No such file or directory\n\nTry `iptables -h' or 'iptables --help' for more information.\niptables: No chain/target/match by that name.\niptables: No chain/target/match by that name.\n"
2018-03-23 12:54:52,181 fail2ban.action         [9756]: ERROR   iptables -w -D INPUT -p tcp -m multiport --dports ssh -j f2b-sshd
iptables -w -F f2b-sshd
iptables -w -X f2b-sshd -- returned 1
2018-03-23 12:54:52,181 fail2ban.actions        [9756]: ERROR   Failed to execute unban jail 'sshd' action 'iptables-multiport' info '{'matches': '2018-03-23T11:53:46.707058149-210-194-176.colo.transip.net sshd[27676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip-[my ip].ip.prioritytelecom.net  user=root2018-03-23T11:53:48.733188149-210-194-176.colo.transip.net sshd[27676]: Failed password for root from [my ip] port 31224 ssh22018-03-23T11:54:51.709842149-210-194-176.colo.transip.net sshd[27676]: Failed password for root from [my ip] port 31224 ssh2', 'ip': '[my ip]', 'time': 1521802491.930057, 'failures': 3}': Error stopping action

When I tail the log file, I see my ssh login attempts getting logged, but after the 3rd attempt I just can keep trying; if I use the right password after the 10th attempt, for example, it will log me in.

I also get errors, seen at the end of the log file, every now and then.

my jail.local:

[DEFAULT]
#ban n hosts for one hour:
bantime = 3600

#maxtrys
maxretry = 3

# Override /etc/fail2ban/jail.d/00-firewalld.conf:
banaction = iptables-multiport

[sshd]
enabled = true

Does anyone have a clue why this is happening?

Answer 1

Looks like your iptables configuration does not include a filter chain named f2b-sshd.

First, a mini-primer on iptables.

iptables is both a command and the name of the Linux firewall subsystem. The command is used to set up firewall rules in RAM. The iptables firewall rules are arranged first into tables: there is the default filter table, but also nat, mangle, raw and security tables, for various purposes. fail2ban is doing traffic filtering, so it uses the filter table.

The tables are then further divisible into filter chains. Each table has certain standard chains: for the filter table, the standard chains are INPUT, FORWARD and OUTPUT. The FORWARD chain is only used when the system is configured to route traffic for other systems. The INPUT chain deals with incoming traffic to this system.

If fail2ban added its rules directly to the INPUT chain and wiped that chain clean when all the bans expired, then you would have to turn over full control of your firewall input rules to fail2ban - you could not easily have any custom firewall rules in addition to what fail2ban does. This is clearly not desirable, so fail2ban won't do that.

Instead, fail2ban creates its own filter chain it can fully manage on its own, and adds on start-up a single rule to the INPUT chain to send any matching traffic to be processed through fail2ban's chain.

For example, when configured to protect sshd, fail2ban should be executing these commands at start-up:

iptables -N f2b-sshd
iptables -A f2b-sshd -j RETURN
iptables -I INPUT -p tcp -m multiport --dports <TCP ports configured for sshd protection> -j f2b-sshd

These commands create a f2b-sshd filter chain, set RETURN as its last rule (so that when any fail2ban rules have been processed, the normal processing of INPUT rules will continue as without fail2ban, and finally, add a rule to the beginning of the INPUT table to catch any SSH traffic and send it first to the f2b-sshd chain.

Now, when fail2ban needs to ban an IP address for SSH use, it will just insert a new rule to the f2b-sshd chain.

If you are using firewalld or some other system that manages iptables firewall rules for you, or if you clear all the iptables rules manually, then these initial rules, and possibly the entire f2b-sshd filter chain, may be wiped out. You should make sure that any firewall management tool you might be using maintains that initial rule in the INPUT chain and doesn't touch the f2b-sshd chain at all.

The error messages at the end of your snippet indicate that fail2ban is checking that the initial rules are still there ("invariant check"), and finding that they're not.

Answer 2

the problem was, that the ban was working, but the attacker was using persistent connections so the ban was not in effect right away, as it was still connected and there was no new connection, the only way to do when it was happening restart the mail server

Answer 3

i just had to deal with this. the problem was related to following an exim4 fail2ban tutorial. the jail.d/exim4.conf file had this:

[exim-spam]
port = smtp,ssmtp

where what is actually needed, because exim4 is running on ports 25, 464 and 587, was this:

[exim-spam]
port = smtp,ssmtp,587

that's all it is.

basically, all the filters are correctly set up, everything is working... however:

• the attacks come in on port 587
• and fail2ban is instructed - by the config file - to block ONLY ports 25 and 465

therefore, of course the attacks continue! so, adapt that to the protocol that you're using (sshd in this case).

"netstat -an | more" and "iptables -L -n" and "lsof -i :587" are your friends, here.