1

I'm running:

  • Fail2Ban v0.9.6
  • on Debian 9.4 (4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64 GNU/Linux)

This is my F2B directory:

$ la -al /etc/fail2ban 
total 72K
drwxr-xr-x   6 root root 4,0K juil. 17 14:03 .
drwxr-xr-x 121 root root  12K juil. 15 15:12 ..
drwxr-xr-x   2 root root 4,0K juil. 15 11:56 action.d
-rw-r--r--   1 root root 2,3K déc.   9  2016 fail2ban.conf
drwxr-xr-x   2 root root 4,0K avril 17  2017 fail2ban.d
drwxr-xr-x   3 root root 4,0K juil. 15 11:56 filter.d
-rw-r--r--   1 root root  21K juil. 15 14:05 jail.conf
drwxr-xr-x   2 root root 4,0K juil. 17 14:12 jail.d
-rw-r--r--   1 root root 2,4K déc.   9  2016 paths-common.conf
-rw-r--r--   1 root root  640 juil. 15 13:01 paths-debian.conf
-rw-r--r--   1 root root  975 déc.   9  2016 paths-opensuse.conf

I just want to be sure where I have to my own configuration files, is it in: /etc/fail2ban/jail.d/?

In this case it seems I have to create my jail-debian.conf:

jail.d
├── defaults-debian.conf
└── jail-debian.conf

But how can I be sure that jail-debain.conf will be read as my own configuration ?

I'm nearly sure that I'm right because I've created a jail for sshd, change the port, and then I've tested my jail, by few mistake and I was banned.

And if I'm using fail2ban-client, it show:

$ sudo fail2ban-client status sshd   
Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed: 0
|  `- File list:    /var/log/auth.log
`- Actions
   |- Currently banned: 0
   |- Total banned: 0
   |- Banned IP list:

So I'm wondering how F2B decide wich conf files to use betwen :

jail.d
├── defaults-debian.conf
└── jail-debian.conf

Because if I searching include with grep there is nowhere to tell where to read my conf file:

$ sudo grep -r include /etc/fail2ban

And if I change something in jail-debain.conf as a mistake like no header for a section and reload , then I've an error.

So I'm sure my file is reading but I don't know where it's tell to F2B.

1 Answer 1

0

After a bit of digging it turns out it's actually explained in the man page (man jail.conf):

You actually don't specify which file(s) you want to use, they simply are all processed, in the following order or precedence:

  • jail.conf
  • jail.d/*.conf (all files, in alphabetical order)
  • jail.local
  • jail.d/*.local (all files, in alphabetical order)

The files are all read in sequence, and any option set in a file overrides the same option (same section, same name) in the previous ones.

In your case, the files would be processed in the following order:

  • jail.conf
  • jail.d/defaults-debian.conf
  • jail.d/jail-debian.conf

The name of the last file doesn't have to be jail-debian.conf. It could really be anything, as long as it ends with .conf or .local and comes after defaults-debian.conf in alphabetical order.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .