fail2ban don't work !

[albertux]

I have done everything possible but nothing works.

There is some documentation to work in Debian Squeeze with IPSConfig 3.

I appreciate your feedback.

[SamTzu]

Fail2ban has 2 different conf files. Check out the .local version.

[albertux]

Originally Posted by SamTzu

Fail2ban has 2 different conf files. Check out the .local version.

Yes i know that ... and write the filters for the diferent service too, but nothing work ...

My jail.local file :

[pureftpd]

enabled = true
port = ftp
filter = pure-ftpd
logpath = /var/log/syslog
maxretry = 3


[sasl]

enabled = true
port = smtp
filter = sasl
logpath = /var/log/mail.log
maxretry = 5


[courierpop3]

enabled = true
port = pop3
filter = courierpop3
logpath = /var/log/mail.log
maxretry = 5


[courierpop3s]

enabled = true
port = pop3s
filter = courierpop3s
logpath = /var/log/mail.log
maxretry = 5


[courierimap]

enabled = true
port = imap2
filter = courierimap
logpath = /var/log/mail.log
maxretry = 5


[courierimaps]

enabled = true
port = imaps
filter = courierimaps
logpath = /var/log/mail.log
maxretry = 5



Thank you for your answer

[Ovidiu]

similar problem here, I manually tried to trigger fail2ban logging in anonymously into pure-ftp:

my fail2ban settings:

failregex = .*pure-ftpd: \(.*@<HOST>\) \[WARNING\] Authentication failed for user.*

[pureftpd]
enabled = true
port = ftp
filter = pure-ftpd
logpath = /var/log/syslog
maxretry = 3

The logs look like this:

Feb 14 11:44:32 h2118175 pure-ftpd: (?@85.214.249.219) [WARNING] Authentication failed for user [anonymous]

I tested it and it should pick up the attempts:

fail2ban-regex /var/log/syslog /etc/fail2ban/filter.d/pure-ftpd.conf
.
.
.
Success, the total number of match is 19

I found this version somewhere, which one is the right one:

[pureftpd]
enabled = true
port = ftp,ftp-data,ftps,ftps-data
filter = pure-ftpd
logpath = /var/log/syslog
maxretry = 3

###edit###
The problem is fail2ban does absolutely nothing , just sits there looking pretty :-(

[Parsec]

What is in /var/log/fail2ban.log?

If nothing try restarting/reloading it and check that log. (debian = /etc/init.d/fail2ban reload)

[Ovidiu]

The log file only contains the normal operating logs:

2013-02-14 14:22:04,800 fail2ban.filter : INFO Set findtime = 300
2013-02-14 14:22:04,800 fail2ban.actions: INFO Set banTime = 3600
2013-02-14 14:22:04,846 fail2ban.jail : INFO Creating new jail 'postfix'
2013-02-14 14:22:04,846 fail2ban.jail : INFO Jail 'postfix' uses poller
2013-02-14 14:22:04,847 fail2ban.filter : INFO Added logfile = /var/log/mail.log
2013-02-14 14:22:04,847 fail2ban.filter : INFO Set maxRetry = 3
2013-02-14 14:22:04,847 fail2ban.filter : INFO Set findtime = 300
2013-02-14 14:22:04,848 fail2ban.actions: INFO Set banTime = 3600
2013-02-14 14:22:04,850 fail2ban.jail : INFO Creating new jail 'sasl'
2013-02-14 14:22:04,850 fail2ban.jail : INFO Jail 'sasl' uses poller
2013-02-14 14:22:04,851 fail2ban.filter : INFO Added logfile = /var/log/mail.warn
2013-02-14 14:22:04,851 fail2ban.filter : INFO Set maxRetry = 3
2013-02-14 14:22:04,852 fail2ban.filter : INFO Set findtime = 300
2013-02-14 14:22:04,852 fail2ban.actions: INFO Set banTime = 3600
2013-02-14 14:22:04,855 fail2ban.jail : INFO Jail 'dovecot-pop3imap' started
2013-02-14 14:22:04,856 fail2ban.jail : INFO Jail 'ssh-ddos' started
2013-02-14 14:22:04,856 fail2ban.jail : INFO Jail 'pureftpd' started
2013-02-14 14:22:04,857 fail2ban.jail : INFO Jail 'ssh' started
2013-02-14 14:22:04,858 fail2ban.jail : INFO Jail 'postfix' started
2013-02-14 14:22:04,858 fail2ban.jail : INFO Jail 'sasl' started
2013-02-14 23:59:23,072 fail2ban.filter : INFO Log rotation detected for /var/log/syslog
2013-02-15 23:59:21,950 fail2ban.filter : INFO Log rotation detected for /var/log/syslo