1

I'm running:

  • Fail2Ban v0.9.6
  • on Debian 9.4 (4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64 GNU/Linux)

This is my F2B directory:

$ la -al /etc/fail2ban 
total 72K
drwxr-xr-x   6 root root 4,0K juil. 17 14:03 .
drwxr-xr-x 121 root root  12K juil. 15 15:12 ..
drwxr-xr-x   2 root root 4,0K juil. 15 11:56 action.d
-rw-r--r--   1 root root 2,3K déc.   9  2016 fail2ban.conf
drwxr-xr-x   2 root root 4,0K avril 17  2017 fail2ban.d
drwxr-xr-x   3 root root 4,0K juil. 15 11:56 filter.d
-rw-r--r--   1 root root  21K juil. 15 14:05 jail.conf
drwxr-xr-x   2 root root 4,0K juil. 17 14:12 jail.d
-rw-r--r--   1 root root 2,4K déc.   9  2016 paths-common.conf
-rw-r--r--   1 root root  640 juil. 15 13:01 paths-debian.conf
-rw-r--r--   1 root root  975 déc.   9  2016 paths-opensuse.conf

I just want to be sure where I have to my own configuration files, is it in: /etc/fail2ban/jail.d/?

In this case it seems I have to create my jail-debian.conf:

jail.d
├── defaults-debian.conf
└── jail-debian.conf

But how can I be sure that jail-debain.conf will be read as my own configuration ?

I'm nearly sure that I'm right because I've created a jail for sshd, change the port, and then I've tested my jail, by few mistake and I was banned.

And if I'm using fail2ban-client, it show:

$ sudo fail2ban-client status sshd   
Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed: 0
|  `- File list:    /var/log/auth.log
`- Actions
   |- Currently banned: 0
   |- Total banned: 0
   |- Banned IP list:

So I'm wondering how F2B decide wich conf files to use betwen :

jail.d
├── defaults-debian.conf
└── jail-debian.conf

Because if I searching include with grep there is nowhere to tell where to read my conf file:

$ sudo grep -r include /etc/fail2ban

And if I change something in jail-debain.conf as a mistake like no header for a section and reload , then I've an error.

So I'm sure my file is reading but I don't know where it's tell to F2B.

1 Answer 1

0

After a bit of digging it turns out it's actually explained in the man page (man jail.conf):

You actually don't specify which file(s) you want to use, they simply are all processed, in the following order or precedence:

  • jail.conf
  • jail.d/*.conf (all files, in alphabetical order)
  • jail.local
  • jail.d/*.local (all files, in alphabetical order)

The files are all read in sequence, and any option set in a file overrides the same option (same section, same name) in the previous ones.

In your case, the files would be processed in the following order:

  • jail.conf
  • jail.d/defaults-debian.conf
  • jail.d/jail-debian.conf

The name of the last file doesn't have to be jail-debian.conf. It could really be anything, as long as it ends with .conf or .local and comes after defaults-debian.conf in alphabetical order.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.