I just configured a new server and installed fail2ban as well, but it is not banning me when I keep trying to connect with the wrong password
fail2ban.log:
2018-03-23 12:46:29,363 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:46:30,747 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:46:33,346 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:46:35,515 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:46:36,372 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:47:45,471 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:47:46,820 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:47:49,503 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:47:50,458 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:47:51,893 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:48:49,699 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:48:51,835 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:48:52,531 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:48:54,477 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:48:57,056 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:50:53,240 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:50:53,677 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:50:55,065 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:50:58,253 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:51:00,494 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:51:00,685 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:52:06,119 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:52:08,300 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:52:11,583 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:52:11,773 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:52:13,498 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:53:07,823 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:53:09,712 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:53:09,842 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:53:11,718 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:53:13,696 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:54:37,181 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:54:37,949 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:54:39,092 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:54:40,906 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:54:42,616 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:54:42,955 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:54:52,074 fail2ban.action [9756]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-sshd[ \t]' -- stdout: ''
2018-03-23 12:54:52,075 fail2ban.action [9756]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-sshd[ \t]' -- stderr: ''
2018-03-23 12:54:52,075 fail2ban.action [9756]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-sshd[ \t]' -- returned 1
2018-03-23 12:54:52,075 fail2ban.CommandAction [9756]: ERROR Invariant check failed. Trying to restore a sane environment
2018-03-23 12:54:52,180 fail2ban.action [9756]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports ssh -j f2b-sshd
iptables -w -F f2b-sshd
iptables -w -X f2b-sshd -- stdout: ''
2018-03-23 12:54:52,181 fail2ban.action [9756]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports ssh -j f2b-sshd
iptables -w -F f2b-sshd
iptables -w -X f2b-sshd -- stderr: "iptables v1.4.21: Couldn't load target `f2b-sshd':No such file or directory\n\nTry `iptables -h' or 'iptables --help' for more information.\niptables: No chain/target/match by that name.\niptables: No chain/target/match by that name.\n"
2018-03-23 12:54:52,181 fail2ban.action [9756]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports ssh -j f2b-sshd
iptables -w -F f2b-sshd
iptables -w -X f2b-sshd -- returned 1
2018-03-23 12:54:52,181 fail2ban.actions [9756]: ERROR Failed to execute unban jail 'sshd' action 'iptables-multiport' info '{'matches': '2018-03-23T11:53:46.707058149-210-194-176.colo.transip.net sshd[27676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip-[my ip].ip.prioritytelecom.net user=root2018-03-23T11:53:48.733188149-210-194-176.colo.transip.net sshd[27676]: Failed password for root from [my ip] port 31224 ssh22018-03-23T11:54:51.709842149-210-194-176.colo.transip.net sshd[27676]: Failed password for root from [my ip] port 31224 ssh2', 'ip': '[my ip]', 'time': 1521802491.930057, 'failures': 3}': Error stopping action
When I tail the log file, I see my ssh login attempts getting logged, but after the 3rd attempt I just can keep trying; if I use the right password after the 10th attempt, for example, it will log me in.
I also get errors, seen at the end of the log file, every now and then.
my jail.local:
[DEFAULT]
#ban n hosts for one hour:
bantime = 3600
#maxtrys
maxretry = 3
# Override /etc/fail2ban/jail.d/00-firewalld.conf:
banaction = iptables-multiport
[sshd]
enabled = true
Does anyone have a clue why this is happening?
vi iptables-multiport
on the location where fail2ban expects it to be or?