1

I'm right now building my first Linux Server using Fedora 36. I activated ssh and realized that bots are trying to connect to my server. After a bit of research, I found fail2ban and installed it. It worked fine, so I thought problem solved, but even after a few tries AND after fail2ban blocks them they are still attacking. I read that they are using persistent connection? Is there a way to counter that or do I have a different problem?

Here is my setup:

/etc/fail2ban/jail.local

[DEFAULT]
banaction = iptables-allports

[sshd]
enabled = true
port = all
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = -1

/var/log/auth.log actually doesn't exist, so I don't know where it gets its data, but it reads something and bans people

/var/log/fail2ban.log of someone still being able to attack and not being banned after 3 tries

2022-08-19 23:40:18,366 fail2ban.server         [2588]: INFO    Reload jail 'sshd'
2022-08-19 23:40:18,367 fail2ban.filter         [2588]: INFO      maxLines: 1
2022-08-19 23:40:18,369 fail2ban.filtersystemd  [2588]: INFO    [sshd] Added journal match for: '_SYSTEMD_UNIT=sshd.service + _COMM=sshd'
2022-08-19 23:40:18,369 fail2ban.filter         [2588]: INFO      maxRetry: 3
2022-08-19 23:40:18,369 fail2ban.filter         [2588]: INFO      findtime: 600
2022-08-19 23:40:18,369 fail2ban.actions        [2588]: INFO      banTime: -1
2022-08-19 23:40:18,369 fail2ban.filter         [2588]: INFO      encoding: UTF-8
2022-08-19 23:40:18,370 fail2ban.server         [2588]: INFO    Jail 'sshd' reloaded
2022-08-19 23:40:18,371 fail2ban.server         [2588]: INFO    Reload finished.
2022-08-19 23:43:07,478 fail2ban.filter         [2588]: INFO    [sshd] Found 79.232.107.204 - 2022-08-19 23:43:07
2022-08-19 23:43:07,480 fail2ban.filter         [2588]: INFO    [sshd] Found 79.232.107.204 - 2022-08-19 23:43:07
2022-08-19 23:43:09,228 fail2ban.filter         [2588]: INFO    [sshd] Found 79.232.107.204 - 2022-08-19 23:43:08
2022-08-19 23:43:09,229 fail2ban.filter         [2588]: INFO    [sshd] Found 79.232.107.204 - 2022-08-19 23:43:08
2022-08-19 23:43:09,350 fail2ban.actions        [2588]: NOTICE  [sshd] Ban 79.232.107.204
2022-08-19 23:49:04,030 fail2ban.filter         [2588]: INFO    [sshd] Found 1.117.78.189 - 2022-08-19 23:49:03
2022-08-19 23:49:04,030 fail2ban.filter         [2588]: INFO    [sshd] Found 1.117.78.189 - 2022-08-19 23:49:03
2022-08-19 23:49:04,031 fail2ban.filter         [2588]: INFO    [sshd] Found 1.117.78.189 - 2022-08-19 23:49:03
2022-08-19 23:49:04,031 fail2ban.filter         [2588]: INFO    [sshd] Found 1.117.78.189 - 2022-08-19 23:49:03
2022-08-19 23:49:04,032 fail2ban.filter         [2588]: INFO    [sshd] Found 1.117.78.189 - 2022-08-19 23:49:03
2022-08-19 23:49:04,032 fail2ban.filter         [2588]: INFO    [sshd] Found 1.117.78.189 - 2022-08-19 23:49:03
2022-08-19 23:49:04,032 fail2ban.filter         [2588]: INFO    [sshd] Found 1.117.78.189 - 2022-08-19 23:49:03
2022-08-19 23:49:04,033 fail2ban.filter         [2588]: INFO    [sshd] Found 1.117.78.189 - 2022-08-19 23:49:03
2022-08-19 23:49:04,353 fail2ban.actions        [2588]: NOTICE  [sshd] Ban 1.117.78.189
2022-08-19 23:49:06,478 fail2ban.filter         [2588]: INFO    [sshd] Found 1.117.78.189 - 2022-08-19 23:49:06
2022-08-19 23:49:06,479 fail2ban.filter         [2588]: INFO    [sshd] Found 1.117.78.189 - 2022-08-19 23:49:06
...

iptables -L -nv

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
13336  897K f2b-sshd   all  --  *      *       0.0.0.0/0            0.0.0.0/0
12829  859K f2b-sshd   all  --  *      *       0.0.0.0/0            0.0.0.0/0
13026  874K f2b-sshd   all  --  *      *       0.0.0.0/0            0.0.0.0/0
13170  888K f2b-sshd   all  --  *      *       0.0.0.0/0            0.0.0.0/0
16162 1358K f2b-sshd   all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain f2b-sshd (5 references)
 pkts bytes target     prot opt in     out     source               destination
  507 38384 REJECT     all  --  *      *       1.117.78.0/24        0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       79.232.107.0/24      0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       94.131.132.0/24      0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       82.65.33.0/24        0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       82.157.143.0/24      0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       76.186.2.0/24        0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       61.177.173.0/24      0.0.0.0/0            reject-with icmp-port-unreachable
...

I also set some stuff in

/etc/sysctl.conf

net.ipv4.icmp_echo_ignore_all = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1

I also set them to ban the entire network using /24, but I don't remember where I put that.

If someone knows what my problem is or you need more information, please tell me

Thank you

Improve this question
1
  • "even after a few tries AND after fail2ban blocks them they are still attacking" I don't see this in the log segment you included. Remember that f2b only blocks for a period of time (search for Ban and Unban entries)
    – roaima
    Aug 21, 2022 at 13:11

2 Answers 2

Reset to default
0

Take a look at this: https://www.linuxcapable.com/how-to-install-fail2ban-with-firewalld-on-fedora-35/

Doesn't fedora use firewalld over iptables? You should use either one of them, don't mix these two.

To make sure, check: systemctl status firewalld and systemctl is-enabled firewalld. If it is, reconfigure fail2ban to use firewalld.

Improve this answer
1
  • firewalld was active, so I reinstalled fail2ban using the directions from your link. I think the situation has improved, but I still see people trying to connect even if they are already banned, and it still takes more than 3 retries until they are banned.
    – Raistlin
    Aug 20, 2022 at 22:22
0

Enable the recidive section in jail.local. This handles a much longer scan time (five days in my case), and seems to catch the slow-but-steady attempts I used to see.

Here are my settings; notice it scans the fail2ban.log file so it only considers hosts that have been banned.

[recidive]

enabled   = true
logpath   = /var/log/fail2ban.log
maxretry  = 3
findtime  = 432000      ; 5 day
bantime   = 2419200     ; 4 week
Improve this answer
1
  • This didn't really solve my problem, but thanks to bringing the recidive option to my attention, I will implement it anyway.
    – Raistlin
    Aug 20, 2022 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.