Bug 1183955
| Summary: | Fail2Ban inconsistently banning | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | frollic nilsson <frollic> |
| Component: | fail2ban | Assignee: | Orion Poplawski <orion> |
| Status: | CLOSED EOL | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 20 | CC: | Axel.Thimm, erik_squires, extras-qa, frollic, jonathan.underwood, orion, steven.chapel, toby, urkedal, vonsch |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 712701 | Environment: | |
| Last Closed: | 2015-06-30 01:15:39 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
frollic nilsson
2015-01-20 09:38:49 UTC
Please remove (or fix) fail2ban from repository, as it is now, it doesn't work at all....
As it is now, sshblacklist works *a lot* better than fail2ban, which pretty much does what the it's name sais - fails to ban.
(from my daily logwatch)
sshd:
Authentication Failures:
root (103.41.124.66): 11699 Time(s)
root (62.210.180.171): 1119 Time(s)
root (103.41.124.44): 632 Time(s)
root (122.225.109.116): 393 Time(s)
unknown (62.210.73.121): 302 Time(s)
root (115.231.223.170): 234 Time(s)
root (115.239.228.9): 220 Time(s)
root (61.174.51.233): 164 Time(s)
root (14.140.222.194): 134 Time(s)
root (61.174.50.225): 97 Time(s)
root (115.239.228.13): 78 Time(s)
unknown (122.225.109.116): 64 Time(s)
unknown (222.219.187.9): 61 Time(s)
root (122.225.103.125): 58 Time(s)
root (61.174.50.188): 46 Time(s)
unknown (175.45.186.50): 39 Time(s)
unknown (203.200.160.213): 39 Time(s)
unknown (216.93.243.138): 39 Time(s)
unknown (50.63.185.226): 39 Time(s)
unknown (85.25.20.63): 39 Time(s)
unknown (58.206.126.23): 37 Time(s)
unknown (68.189.19.218): 33 Time(s)
root (93.174.93.10): 23 Time(s)
root (61.174.50.177): 18 Time(s)
root (175.45.186.50): 15 Time(s)
root (203.200.160.213): 15 Time(s)
root (216.93.243.138): 15 Time(s)
root (50.63.185.226): 15 Time(s)
root (58.206.126.23): 15 Time(s)
root (85.25.20.63): 15 Time(s)
I think removing it from the repository would be a little bit of a knee jerk over reaction. It's working fine for me on F20: # fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 1 | |- Total failed: 316 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 2 |- Total banned: 52 `- Banned IP list: 183.136.216.3 115.239.228.13 So, it would be better to try and work out why it's not working for you. Which Fedora are you using, and what package version of fail2ban do you have installed? Also, why have you now opened two bugs with exactly the same information? fail2ban-0.9-2.fc20.noarch I had to create a copy of the first report, becuse it was for F19, which is now (or at least soon) out of support. AFAIK only the maintaner of the package can migrate a report between diff versions. for me, f2b's SSH-banning stopped working completely sometime around 2nd half of May last year. http://imgbox.com/bDeijD2A It might just be a bug, fixed in the original code of fail2ban, but in that case, there should be an update. sorry, wrong graph posted, please ignore it .... OK, I too am running fail2ban-0.9-2.fc20.noarch on an F20 machine, and my configuration is stock, with just this added in /etc/fail2ban/jail.d/jail.local: [DEFAULT] bantime = 36000 banaction = firewallcmd-new backend = systemd [sshd] enabled = true And, so far I haven't seen any issues. Can you detail your exact configuration? This package has changed ownership in the Fedora Package Database. Reassigning to the new owner of this component. Can you try with 0.9.1-1.fc20 from updates-testing? Hi, There's at least one bug in the fail2ban-0.9-2.fc20.noarch When starting a fail2ban out of the box, you get Mar 03 07:26:46 server.at.com fail2ban-client[16516]: WARNING Wrong value for 'loglevel' in 'Definition'. Using default one: ''INFO'' it's already been reported, and fixed at fail2ban - https://github.com/fail2ban/fail2ban/issues/657 https://github.com/fail2ban/fail2ban/commit/1470e3c01d49841335e11ed7ca7898516d1b8be8 if you then enable all filters (enable = true in jail.conf) you get a Mar 03 07:31:38 server.at.com fail2ban-client[16912]: WARNING 'ignoreregex' not defined in 'Definition'. Using default one: '' warning. It's described here. https://github.com/fail2ban/fail2ban/pull/858 I belive the enable = true also gave you a too many open files error in the /tmp folder, but I can't reproduce that one at the moment. When it comes to inconsistent banning, here's an example: Mar 3 07:24:42 atlantis sshd[16405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:24:44 atlantis sshd[16405]: Failed password for root from 183.136.216.6 port 34299 ssh2 Mar 3 07:24:46 atlantis sshd[16405]: Failed password for root from 183.136.216.6 port 34299 ssh2 Mar 3 07:24:49 atlantis sshd[16405]: Failed password for root from 183.136.216.6 port 34299 ssh2 Mar 3 07:24:49 atlantis sshd[16405]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:24:49 atlantis sshd[16405]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:24:56 atlantis sshd[16407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:24:58 atlantis sshd[16407]: Failed password for root from 183.136.216.6 port 45254 ssh2 Mar 3 07:25:01 atlantis sshd[16407]: Failed password for root from 183.136.216.6 port 45254 ssh2 Mar 3 07:25:03 atlantis sshd[16407]: Failed password for root from 183.136.216.6 port 45254 ssh2 Mar 3 07:25:06 atlantis sshd[16407]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:25:06 atlantis sshd[16407]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:25:08 atlantis sshd[16428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:25:10 atlantis sshd[16428]: Failed password for root from 183.136.216.6 port 41172 ssh2 Mar 3 07:25:13 atlantis sshd[16428]: Failed password for root from 183.136.216.6 port 41172 ssh2 Mar 3 07:25:14 atlantis sshd[16428]: Failed password for root from 183.136.216.6 port 41172 ssh2 Mar 3 07:25:16 atlantis sshd[16428]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:25:16 atlantis sshd[16428]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:25:21 atlantis sshd[16431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:25:23 atlantis sshd[16431]: Failed password for root from 183.136.216.6 port 44662 ssh2 Mar 3 07:25:25 atlantis sshd[16431]: Failed password for root from 183.136.216.6 port 44662 ssh2 Mar 3 07:25:28 atlantis sshd[16431]: Failed password for root from 183.136.216.6 port 44662 ssh2 Mar 3 07:25:28 atlantis sshd[16431]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:25:28 atlantis sshd[16431]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:25:32 atlantis sshd[16434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:25:33 atlantis sshd[16434]: Failed password for root from 183.136.216.6 port 56576 ssh2 Mar 3 07:25:38 atlantis sshd[16434]: Failed password for root from 183.136.216.6 port 56576 ssh2 Mar 3 07:25:40 atlantis sshd[16434]: Failed password for root from 183.136.216.6 port 56576 ssh2 Mar 3 07:25:41 atlantis sshd[16434]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:25:41 atlantis sshd[16434]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:25:46 atlantis sshd[16438]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:25:47 atlantis sshd[16438]: Failed password for root from 183.136.216.6 port 38419 ssh2 Mar 3 07:25:50 atlantis sshd[16438]: Failed password for root from 183.136.216.6 port 38419 ssh2 Mar 3 07:25:53 atlantis sshd[16438]: Failed password for root from 183.136.216.6 port 38419 ssh2 Mar 3 07:25:53 atlantis sshd[16438]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:25:53 atlantis sshd[16438]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:25:55 atlantis sshd[16440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:25:57 atlantis sshd[16440]: Failed password for root from 183.136.216.6 port 46992 ssh2 Mar 3 07:26:00 atlantis sshd[16440]: Failed password for root from 183.136.216.6 port 46992 ssh2 Mar 3 07:26:02 atlantis sshd[16440]: Failed password for root from 183.136.216.6 port 46992 ssh2 Mar 3 07:26:02 atlantis sshd[16440]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:26:02 atlantis sshd[16440]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:26:13 atlantis sshd[16456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:26:15 atlantis sshd[16456]: Failed password for root from 183.136.216.6 port 48534 ssh2 Mar 3 07:26:17 atlantis sshd[16456]: Failed password for root from 183.136.216.6 port 48534 ssh2 Mar 3 07:26:19 atlantis sshd[16456]: Failed password for root from 183.136.216.6 port 48534 ssh2 Mar 3 07:26:20 atlantis sshd[16456]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:26:20 atlantis sshd[16456]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:26:31 atlantis sshd[16486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:26:32 atlantis sshd[16486]: Failed password for root from 183.136.216.6 port 45865 ssh2 Mar 3 07:26:35 atlantis sshd[16486]: Failed password for root from 183.136.216.6 port 45865 ssh2 Mar 3 07:26:38 atlantis sshd[16486]: Failed password for root from 183.136.216.6 port 45865 ssh2 Mar 3 07:26:38 atlantis sshd[16486]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:26:38 atlantis sshd[16486]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:26:43 atlantis sshd[16507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:26:45 atlantis sshd[16507]: Failed password for root from 183.136.216.6 port 43484 ssh2 Mar 3 07:26:47 atlantis sshd[16507]: Failed password for root from 183.136.216.6 port 43484 ssh2 Mar 3 07:26:50 atlantis sshd[16507]: Failed password for root from 183.136.216.6 port 43484 ssh2 Mar 3 07:26:52 atlantis sshd[16507]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:26:52 atlantis sshd[16507]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:26:56 atlantis sshd[16523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:26:59 atlantis sshd[16523]: Failed password for root from 183.136.216.6 port 55185 ssh2 Mar 3 07:27:01 atlantis sshd[16523]: Failed password for root from 183.136.216.6 port 55185 ssh2 Mar 3 07:27:04 atlantis sshd[16523]: Failed password for root from 183.136.216.6 port 55185 ssh2 Mar 3 07:27:04 atlantis sshd[16523]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:27:04 atlantis sshd[16523]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:27:06 atlantis sshd[16549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:27:08 atlantis sshd[16549]: Failed password for root from 183.136.216.6 port 36867 ssh2 Mar 3 07:27:11 atlantis sshd[16549]: Failed password for root from 183.136.216.6 port 36867 ssh2 Mar 3 07:27:13 atlantis sshd[16549]: Failed password for root from 183.136.216.6 port 36867 ssh2 Mar 3 07:27:14 atlantis sshd[16549]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:27:14 atlantis sshd[16549]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:27:21 atlantis sshd[16560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:27:23 atlantis sshd[16560]: Failed password for root from 183.136.216.6 port 39205 ssh2 Mar 3 07:27:26 atlantis sshd[16560]: Failed password for root from 183.136.216.6 port 39205 ssh2 Mar 3 07:27:28 atlantis sshd[16560]: Failed password for root from 183.136.216.6 port 39205 ssh2 Mar 3 07:27:29 atlantis sshd[16560]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:27:29 atlantis sshd[16560]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:27:45 atlantis sshd[16581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:27:47 atlantis sshd[16581]: Failed password for root from 183.136.216.6 port 57510 ssh2 Mar 3 07:27:50 atlantis sshd[16581]: Failed password for root from 183.136.216.6 port 57510 ssh2 Mar 3 07:27:52 atlantis sshd[16581]: Failed password for root from 183.136.216.6 port 57510 ssh2 Mar 3 07:27:53 atlantis sshd[16581]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:27:53 atlantis sshd[16581]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:28:02 atlantis sshd[16619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root Mar 3 07:28:05 atlantis sshd[16619]: Failed password for root from 183.136.216.6 port 40176 ssh2 Mar 3 07:28:07 atlantis sshd[16619]: Failed password for root from 183.136.216.6 port 40176 ssh2 Mar 3 07:28:09 atlantis sshd[16619]: Failed password for root from 183.136.216.6 port 40176 ssh2 Mar 3 07:28:10 atlantis sshd[16619]: Received disconnect from 183.136.216.6: 11: [preauth] Mar 3 07:28:10 atlantis sshd[16619]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.216.6 user=root the related params in jail.conf are set to findtime = 600 maxretry = 5 Again, which backend are you using? Having your full configuration would be very helpful to debugging this. And can you please try 0.9.1-1.fc20 from updates-testing? https://admin.fedoraproject.org/updates/FEDORA-2014-15988/fail2ban-0.9.1-1.fc20 [abc@atlantis fail2ban]$ cat jail.conf | grep -v "#"
[INCLUDES]
before = paths-fedora.conf
[DEFAULT]
ignoreip = 127.0.0.1/8
ignorecommand =
bantime = 2592000
findtime = 600
maxretry = 5
backend = auto
usedns = no
logencoding = auto
enabled = false
filter = %(__name__)s
destemail = root@localhost
sender = root@localhost
mta = sendmail
protocol = tcp
chain = INPUT
port = 0:65535
banaction = shorewall
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
%(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
%(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
action_xarf = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]
action_blocklist_de = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s"]
action_badips = badips.py[category="%(name)s", banaction="%(banaction)s"]
action = %(action_)s
[sshd]
port = ssh
logpath = %(sshd_log)s
[sshd-ddos]
port = ssh
logpath = %(sshd_log)s
[dropbear]
port = ssh
logpath = %(dropbear_log)s
[selinux-ssh]
port = ssh
logpath = %(auditd_log)s
maxretry = 5
[apache-auth]
port = http,https
logpath = %(apache_error_log)s
[apache-badbots]
port = http,https
logpath = %(apache_access_log)s
bantime = 172800
maxretry = 1
[apache-noscript]
port = http,https
logpath = %(apache_error_log)s
maxretry = 6
[apache-overflows]
port = http,https
logpath = %(apache_error_log)s
maxretry = 2
[apache-nohome]
port = http,https
logpath = %(apache_error_log)s
maxretry = 2
[apache-botsearch]
port = http,https
logpath = %(apache_error_log)s
maxretry = 2
[apache-modsecurity]
port = http,https
logpath = %(apache_error_log)s
maxretry = 2
[nginx-http-auth]
ports = http,https
logpath = %(nginx_error_log)s
[php-url-fopen]
port = http,https
logpath = %(nginx_access_log)s %(apache_access_log)s
[suhosin]
port = http,https
logpath = %(suhosin_log)s
[lighttpd-auth]
port = http,https
logpath = %(lighttpd_error_log)s
[roundcube-auth]
port = http,https
logpath = /var/log/roundcube/userlogins
[openwebmail]
port = http,https
logpath = /var/log/openwebmail.log
[horde]
port = http,https
logpath = /var/log/horde/horde.log
[groupoffice]
port = http,https
logpath = /home/groupoffice/log/info.log
[sogo-auth]
port = http,https
logpath = /var/log/sogo/sogo.log
[tine20]
logpath = /var/log/tine20/tine20.log
port = http,https
maxretry = 5
[guacamole]
port = http,https
logpath = /var/log/tomcat*/catalina.out
[webmin-auth]
port = 10000
logpath = /var/log/auth.log
[squid]
port = 80,443,3128,8080
logpath = /var/log/squid/access.log
[3proxy]
port = 3128
logpath = /var/log/3proxy.log
[proftpd]
port = ftp,ftp-data,ftps,ftps-data
logpath = %(proftpd_log)s
[pure-ftpd]
port = ftp,ftp-data,ftps,ftps-data
logpath = %(pureftpd_log)s
maxretry = 6
[gssftpd]
port = ftp,ftp-data,ftps,ftps-data
logpath = %(syslog_daemon)s
maxretry = 6
[wuftpd]
port = ftp,ftp-data,ftps,ftps-data
logpath = %(wuftpd_log)s
maxretry = 6
[vsftpd]
port = ftp,ftp-data,ftps,ftps-data
logpath = %(vsftpd_log)s
[assp]
port = smtp,465,submission
logpath = /root/path/to/assp/logs/maillog.txt
[courier-smtp]
port = smtp,465,submission
logpath = %(syslog_mail)s
[postfix]
port = smtp,465,submission
logpath = %(postfix_log)s
[sendmail-auth]
port = submission,465,smtp
logpath = %(syslog_mail)s
[sendmail-reject]
port = smtp,465,submission
logpath = %(syslog_mail)s
[qmail-rbl]
filter = qmail
port = smtp,465,submission
logpath = /service/qmail/log/main/current
[dovecot]
port = pop3,pop3s,imap,imaps,submission,465,sieve
logpath = %(dovecot_log)s
[sieve]
port = smtp,465,submission
logpath = %(dovecot_log)s
[solid-pop3d]
port = pop3,pop3s
logpath = %(solidpop3d_log)s
[exim]
port = smtp,465,submission
logpath = /var/log/exim/mainlog
[exim-spam]
port = smtp,465,submission
logpath = /var/log/exim/mainlog
[kerio]
port = imap,smtp,imaps,465
logpath = /opt/kerio/mailserver/store/logs/security.log
[courier-auth]
port = smtp,465,submission,imap3,imaps,pop3,pop3s
logpath = %(syslog_mail)s
[postfix-sasl]
port = smtp,465,submission,imap3,imaps,pop3,pop3s
logpath = %(postfix_log)s
[perdition]
port = imap3,imaps,pop3,pop3s
logpath = /var/log/maillog
[squirrelmail]
port = smtp,465,submission,imap2,imap3,imaps,pop3,pop3s,http,https,socks
logpath = /var/lib/squirrelmail/prefs/squirrelmail_access_log
[cyrus-imap]
port = imap3,imaps
logpath = %(syslog_mail)s
[uwimap-auth]
port = imap3,imaps
logpath = %(syslog_mail)s
[named-refused]
port = domain,953
logpath = /var/log/named/security.log
[nsd]
port = 53
action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
%(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
logpath = /var/log/nsd.log
[asterisk]
port = 5060,5061
action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
%(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
%(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]
logpath = /var/log/asterisk/messages
maxretry = 10
[freeswitch]
port = 5060,5061
action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
%(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
%(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]
logpath = /var/log/freeswitch.log
maxretry = 10
[mysqld-auth]
port = 3306
logpath = %(mysql_log)s
maxretry = 5
[recidive]
logpath = /var/log/fail2ban.log
port = all
protocol = all
bantime = 604800 ; 1 week
findtime = 86400 ; 1 day
maxretry = 5
[pam-generic]
banaction = iptables-allports
logpath = /var/log/auth.log
[xinetd-fail]
banaction = iptables-multiport-log
logpath = /var/log/daemon.log
maxretry = 2
[stunnel]
logpath = /var/log/stunnel4/stunnel.log
[ejabberd-auth]
port = 5222
logpath = /var/log/ejabberd/ejabberd.log
[counter-strike]
logpath = /opt/cstrike/logs/L[0-9]*.log
tcpport = 27030,27031,27032,27033,27034,27035,27036,27037,27038,27039
udpport = 1200,27000,27001,27002,27003,27004,27005,27006,27007,27008,27009,27010,27011,27012,27013,27014,27015
action = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
%(banaction)s[name=%(__name__)s-udp, port="%(udpport)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
[nagios]
enabled = false
logpath = /var/log/messages ; nrpe.cfg may define a different log_facility
maxretry = 1
----------------EOF-------------------------
[abc@atlantis fail2ban]$ cat fail2ban.conf | grep -v "#"
[Definition]
loglevel = NOTICE
logtarget = /var/log/fail2ban.log
socket = /var/run/fail2ban/fail2ban.sock
pidfile = /var/run/fail2ban/fail2ban.pid
dbfile = /var/lib/fail2ban/fail2ban.sqlite3
dbpurgeage = 86400
----------------EOF-------------------------
[abc@atlantis jail.d]$ cat jail.local
[DEFAULT]
bantime = 36000
banaction = shorewall
backend = systemd
[sshd]
enabled = true
[sshd-ddos]
enabled = true
[pam-generic]
enabled = true
[php-url-fopen]
enabled = true
[apache-auth]
enabled = true
[apache-common]
enabled = true
[apache-noscript]
enabled = true
[apache-badbots]
enabled = true
[apache-modsecurity]
enabled = true
[apache-overflows]
enabled = true
[apache-botsearch]
enabled = true
[apache-nohome]
enabled = true
Tried 0.9.1-1.fc20, and it starts, but there are warnings in /var/log/messages: Mar 4 08:54:37 atlantis systemd: Starting Fail2Ban Service... Mar 4 08:54:37 atlantis fail2ban-client: ERROR No section: 'Definition' Mar 4 08:54:37 atlantis fail2ban-client: ERROR No section: 'Definition' Mar 4 08:54:37 atlantis fail2ban-client: 2015-03-04 08:54:37,845 fail2ban.server [20680]: INFO Starting Fail2ban v0.9.1 Mar 4 08:54:37 atlantis fail2ban-client: 2015-03-04 08:54:37,846 fail2ban.server [20680]: INFO Starting in daemon mode Mar 4 08:54:39 atlantis systemd: Started Fail2Ban Service. and in /var/log/fail2ban.log: 2015-03-04 09:14:33,034 fail2ban.jail [23723]: INFO Jail 'apache-auth' started 2015-03-04 09:14:33,064 fail2ban.filtersystemd [23723]: NOTICE Jail started without 'journalmatch' set. Jail regexs will be checked against all journal entries, which is not advised for performance reasons. 2015-03-04 09:14:33,085 fail2ban.jail [23723]: INFO Jail 'apache-badbots' started 2015-03-04 09:14:33,120 fail2ban.filtersystemd [23723]: NOTICE Jail started without 'journalmatch' set. Jail regexs will be checked against all journal entries, which is not advised for performance reasons. 2015-03-04 09:14:33,139 fail2ban.jail [23723]: INFO Jail 'apache-noscript' started 2015-03-04 09:14:33,147 fail2ban.filtersystemd [23723]: NOTICE Jail started without 'journalmatch' set. Jail regexs will be checked against all journal entries, which is not advised for performance reasons. 2015-03-04 09:14:33,158 fail2ban.jail [23723]: INFO Jail 'apache-overflows' started 2015-03-04 09:14:33,187 fail2ban.filtersystemd [23723]: NOTICE Jail started without 'journalmatch' set. Jail regexs will be checked against all journal entries, which is not advised for performance reasons. FYI - Using the systemd backend at this point breaks all banning for all services that do not log to the journal - this includes the apache-* jails that you get warnings for as httpd does not log to the journal. Thanks for the heads up.
removed the systemd override I had in the jail.local file, now backend should be auto again.
checking the logs after restart I noticed this (posted in the log before the restart):
2015-03-05 10:05:28,053 fail2ban.actions [26440]: ERROR Failed to execute ban jail 'sshd' action 'shorewall' info 'CallingMap({'ipjailmatches': <function <lambda> at 0x17296e0>, 'matches': u'2015-03-05T07:01:13.835218 atlantis.abc.com sshd[21455]: Failed password for root from 115.231.222.176 port 50572 ssh2\n2015-03-05T07:01:16.530344 atlantis.abc.com sshd[21455]: Failed password for root from 115.231.222.176 port 50572 ssh2\n2015-03-05T07:01:18.478689 atlantis.abc.com sshd[21455]: Failed password for root from 115.231.222.176 port 50572 ssh2\n2015-03-05T07:01:22.754420 atlantis.abc.com sshd[21461]: Failed password for root from 115.231.222.176 port 51852 ssh2\n2015-03-05T07:01:24.699936 atlantis.abc.com sshd[21461]: Failed password for root from 115.231.222.176 port 51852 ssh2', 'ip': '115.231.222.176', 'ipmatches': <function <lambda> at 0x17297d0>, 'ipfailures': <function <lambda> at 0x1729668>, 'time': 1425546328.049277, 'failures': 5, 'ipjailfailures': <function <lambda> at 0x1729758>})': Error binding parameter 0 - probably unsupported type.
You do not appear to have shorewall configured properly, or perhaps a SELinux issue. What happens when you run: shorewall reject 115.231.222.176 Any denials in /var/log/audit/audit.log? [root@atlantis ~]# shorewall reject 115.231.222.176 115.231.222.176 Rejected [root@atlantis ~]# SELinux is disabled. What exactly am I looking for in the audit.log ? grep -F denied /var/log/audit/audit.log I checked the audit.log history I had, back to the beginning of March, not a single denied entry until today. This message is a reminder that Fedora 20 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 20. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '20'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 20 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. Fedora 20 changed to end-of-life (EOL) status on 2015-06-23. Fedora 20 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed. |