1

I done a fresh new install of fail2ban on a Debian 9.8

I copied /etc/fail2ban/jail.conf as jail.local.

And in my jail.local in added enabled=true under [ssh]

Tailing fail2ban's log I can see what happens when I try to login to SSH using a wrong username/password pair

2019-03-13 17:03:55,751 fail2ban.filter         [3328]: INFO    [sshd] Found 192.168.229.1
2019-03-13 17:03:55,753 fail2ban.filter         [3328]: INFO    [sshd] Found 192.168.229.1
2019-03-13 17:03:57,534 fail2ban.filter         [3328]: INFO    [sshd] Found 192.168.229.1
2019-03-13 17:04:00,630 fail2ban.filter         [3328]: INFO    [sshd] Found 192.168.229.1
2019-03-13 17:04:00,633 fail2ban.filter         [3328]: INFO    [sshd] Found 192.168.229.1
2019-03-13 17:04:00,635 fail2ban.actions        [3328]: NOTICE  [sshd] Ban 192.168.229.1

I supposed it was ok, but I can still try to login. I got

2019-03-13 17:07:59,245 fail2ban.actions        [3328]: NOTICE  [sshd] 192.168.229.1 already banned

And I see my Ip into iptables

 sudo iptables-save | grep 192.
-A f2b-sshd -s 192.168.229.1/32 -j REJECT --reject-with icmp-port-unreachable

So, why I can still try to login? I can also, of course, do a successful login using right name/pwd pair.

I am using the port 26522 instead of standard 22 for ssh. Must I precise it in someway?

1

The reason was the port.

I changed into my jail.local, inside the section [sshd] the port

port = ssh

into

port = 26522

And reloaded

sudo /etc/init.d/fail2ban reload

It worked immediately !

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.