Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > Linux Forums > Server Operation
Reload this Page fail2ban is doing nothing?
Register FAQ Members List Social Groups Calendar Search Today's Posts Mark Forums Read

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 4th August 2009, 03:35
rlischer rlischer is offline
Senior Member
  
Join Date: Jul 2009
Posts: 120
Thanks: 5
Thanked 1 Time in 1 Post
Default fail2ban is doing nothing?
I modified fail2ban config file as seen below. Restarted, service, and then I went to a remote PC and tried to hack in via ssh using bad root passwords and it let me try 100 time and never banned the IP I was coming in on. What did I do wrong? Do I need to set a path somewhere to my host.deny file or something. Thanks


Code:
# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision: 617 $
#

# The DEFAULT allows a global definition of the options. They can be override
# in each jail afterwards.

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1

# "bantime" is the number of seconds that a host is banned.
bantime  = 600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 3

# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto". This option can be overridden in
# each jail too (use "gamin" for a jail and "polling" for another).
#
# gamin:   requires Gamin (a file alteration monitor) to be installed. If Gamin
#          is not installed, Fail2ban will use polling.
# polling: uses a polling algorithm which does not require external libraries.
# auto:    will choose Gamin if available and polling otherwise.
backend = auto


# This jail corresponds to the standard configuration in Fail2ban 0.6.
# The mail-whois action send a notification e-mail with a whois request
# in the body.

[ssh-iptables]

enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]
           sendmail-whois[name=SSH, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
logpath  = /var/log/sshd.log
maxretry = 3

[proftpd-iptables]

enabled  = true
filter   = proftpd
action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
           sendmail-whois[name=ProFTPD, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
logpath  = /var/log/proftpd/proftpd.log
maxretry = 3

# This jail forces the backend to "polling".

[sasl-iptables]

enabled  = true
filter   = sasl
backend  = polling
action   = iptables[name=sasl, port=smtp, protocol=tcp]
           sendmail-whois[name=sasl, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
logpath  = /var/log/mail.log

# Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
# used to avoid banning the user "myuser".

[ssh-tcpwrapper]

enabled     = true
filter      = sshd
action      = hostsdeny
              sendmail-whois[name=SSH, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
ignoreregex = for myuser from
logpath     = /var/log/sshd.log

# This jail demonstrates the use of wildcards in "logpath".
# Moreover, it is possible to give other files on a new line.

[apache-tcpwrapper]

enabled  = true
filter   = apache-auth
action   = hostsdeny
logpath  = /var/log/apache*/*error.log
           /home/www/myhomepage/error.log
maxretry = 3

# The hosts.deny path can be defined with the "file" argument if it is
# not in /etc.

[postfix-tcpwrapper]

enabled  = true
filter   = postfix
action   = hostsdeny[file=/not/a/standard/path/hosts.deny]
           sendmail[name=Postfix, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
logpath  = /var/log/postfix.log
bantime  = 300

# Do not ban anybody. Just report information about the remote host.
# A notification is sent at most every 600 seconds (bantime).

[vsftpd-notification]

enabled  = true
filter   = vsftpd
action   = sendmail-whois[name=VSFTPD, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
logpath  = /var/log/vsftpd.log
maxretry = 5
bantime  = 1800

# Same as above but with banning the IP address.

[vsftpd-iptables]

enabled  = true
filter   = vsftpd
action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
           sendmail-whois[name=VSFTPD, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
logpath  = /var/log/vsftpd.log
maxretry = 5
bantime  = 1800

# Ban hosts which agent identifies spammer robots crawling the web
# for email addresses. The mail outputs are buffered.

[apache-badbots]

enabled  = true
filter   = apache-badbots
action   = iptables-multiport[name=BadBots, port="http,https"]
           sendmail-buffered[name=BadBots, lines=5, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
logpath  = /var/www/*/logs/access_log
bantime  = 172800
maxretry = 1

# Use shorewall instead of iptables.

[apache-shorewall]

enabled  = true
filter   = apache-noscript
action   = shorewall
           sendmail[name=Postfix, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
logpath  = /var/log/apache2/error_log

# This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
# option is overridden in this jail. Moreover, the action "mail-whois" defines
# the variable "name" which contains a comma using "". The characters '' are
# valid too.

[ssh-ipfw]

enabled  = true
filter   = sshd
action   = ipfw[localhost=192.168.0.1]
           sendmail-whois[name="SSH,IPFW", dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
logpath  = /var/log/auth.log
ignoreip = 168.192.0.1

# These jails block attacks against named (bind9). By default, logging is off
# with bind9 installation. You will need something like this:
#
# logging {
#     channel security_file {
#         file "/var/log/named/security.log" versions 3 size 30m;
#         severity dynamic;
#         print-time yes;
#     };
#     category security {
#         security_file;
#     };
# }
#
# in your named.conf to provide proper logging.
# This jail blocks UDP traffic for DNS requests.

[named-refused-udp]

enabled  = true
filter   = named-refused
action   = iptables-multiport[name=Named, port="domain,953", protocol=udp]
           sendmail-whois[name=Named, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
logpath  = /var/log/named/security.log
ignoreip = 168.192.0.1

# This jail blocks TCP traffic for DNS requests.

[named-refused-tcp]

enabled  = true
filter   = named-refused
action   = iptables-multiport[name=Named, port="domain,953", protocol=tcp]
           sendmail-whois[name=Named, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
logpath  = /var/log/named/security.log
ignoreip = 168.192.0.1

Here is the log. It never shows the actual ip, it just says <ip>. And it never did ban me.

Code:
The IP has just been banned by Fail2Ban after
attempts against .\n\n
Here are more information about :\n
`/usr/bin/whois `\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f 
2009-08-03 21:02:17,921 fail2ban.actions.action: INFO Set actionStop = printf %b "Subject: [Fail2Ban] : stopped
From: Fail2Ban <>
To: \n
Hi,\n
The jail has been stopped.\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f 
2009-08-03 21:02:17,923 fail2ban.actions.action: INFO Set actionStart = printf %b "Subject: [Fail2Ban] : started
From: Fail2Ban <>
To: \n
Hi,\n
The jail has been started successfully.\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f 
2009-08-03 21:02:17,926 fail2ban.actions.action: INFO Set actionUnban = 
2009-08-03 21:02:17,928 fail2ban.actions.action: INFO Set actionCheck = 
2009-08-03 21:02:17,934 fail2ban.jail : INFO Using Gamin
2009-08-03 21:02:17,936 fail2ban.filter : INFO Created Filter
2009-08-03 21:02:17,936 fail2ban.filter : INFO Created FilterGamin
2009-08-03 21:02:17,939 fail2ban.filter : INFO Set maxRetry = 3
2009-08-03 21:02:17,942 fail2ban.filter : INFO Set findtime = 600
2009-08-03 21:02:17,944 fail2ban.actions: INFO Set banTime = 600
2009-08-03 21:02:17,950 fail2ban.actions.action: INFO Set actionBan = iptables -I fail2ban- 1 -s -j DROP
2009-08-03 21:02:17,952 fail2ban.actions.action: INFO Set actionStop = iptables -D INPUT -p -m multiport --dports -j fail2ban-
iptables -F fail2ban-
iptables -X fail2ban-
2009-08-03 21:02:17,954 fail2ban.actions.action: INFO Set actionStart = iptables -N fail2ban-
iptables -A fail2ban- -j RETURN
iptables -I INPUT -p -m multiport --dports -j fail2ban-
2009-08-03 21:02:17,957 fail2ban.actions.action: INFO Set actionUnban = iptables -D fail2ban- -s -j DROP
2009-08-03 21:02:17,959 fail2ban.actions.action: INFO Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-
2009-08-03 21:02:17,967 fail2ban.actions.action: INFO Set actionBan = printf %b "Subject: [Fail2Ban] : banned 
From: Fail2Ban <>
To: \n
Hi,\n
The IP has just been banned by Fail2Ban after
attempts against .\n\n
Here are more information about :\n
`/usr/bin/whois `\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f 
2009-08-03 21:02:17,970 fail2ban.actions.action: INFO Set actionStop = printf %b "Subject: [Fail2Ban] : stopped
From: Fail2Ban <>
To: \n
Hi,\n
The jail has been stopped.\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f 
2009-08-03 21:02:17,972 fail2ban.actions.action: INFO Set actionStart = printf %b "Subject: [Fail2Ban] : started
From: Fail2Ban <>
To: \n
Hi,\n
The jail has been started successfully.\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f 
2009-08-03 21:02:17,975 fail2ban.actions.action: INFO Set actionUnban = 
2009-08-03 21:02:17,977 fail2ban.actions.action: INFO Set actionCheck = 
2009-08-03 21:02:17,983 fail2ban.jail : INFO Using Gamin
2009-08-03 21:02:17,985 fail2ban.filter : INFO Created Filter
2009-08-03 21:02:17,985 fail2ban.filter : INFO Created FilterGamin
2009-08-03 21:02:17,988 fail2ban.filter : INFO Set maxRetry = 5
2009-08-03 21:02:17,991 fail2ban.filter : INFO Set findtime = 600
2009-08-03 21:02:17,993 fail2ban.actions: INFO Set banTime = 1800
2009-08-03 21:02:18,008 fail2ban.actions.action: INFO Set actionBan = printf %b "Subject: [Fail2Ban] : banned 
From: Fail2Ban <>
To: \n
Hi,\n
The IP has just been banned by Fail2Ban after
attempts against .\n\n
Here are more information about :\n
`/usr/bin/whois `\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f 
2009-08-03 21:02:18,011 fail2ban.actions.action: INFO Set actionStop = printf %b "Subject: [Fail2Ban] : stopped
From: Fail2Ban <>
To: \n
Hi,\n
The jail has been stopped.\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f 
2009-08-03 21:02:18,013 fail2ban.actions.action: INFO Set actionStart = printf %b "Subject: [Fail2Ban] : started
From: Fail2Ban <>
To: \n
Hi,\n
The jail has been started successfully.\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f 
2009-08-03 21:02:18,016 fail2ban.actions.action: INFO Set actionUnban = 
2009-08-03 21:02:18,018 fail2ban.actions.action: INFO Set actionCheck = 
2009-08-03 21:02:18,025 fail2ban.jail : INFO Using Gamin
2009-08-03 21:02:18,026 fail2ban.filter : INFO Created Filter
2009-08-03 21:02:18,026 fail2ban.filter : INFO Created FilterGamin
2009-08-03 21:02:18,029 fail2ban.filter : INFO Set maxRetry = 3
2009-08-03 21:02:18,032 fail2ban.comm : WARNING Invalid command: ['set', 'ssh-tcpwrapper', 'ignoreregex', 'for myuser from']
Reply With Quote
Sponsored Links
 

Bookmarks

« Previous Thread | Next Thread »
Thread Tools
Display Modes
Threaded Mode Threaded Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Fail2Ban fails to ban :-) Wandering-Aimlessly Installation/Configuration 14 18th August 2009 16:37
SquirrelMail/imap/pop3 fail2ban IP address gscott187 General 8 14th August 2009 10:51
fail2ban not working linuxwannabe Installation/Configuration 1 25th January 2009 06:09
Fail2Ban not banning? tristanlee85 Server Operation 4 15th October 2008 13:44
Fail2ban question joelee HOWTO-Related Questions 1 3rd April 2008 20:16


All times are GMT +2. The time now is 20:18.

Contact Us - HowtoForge - Linux Howtos and Tutorials - Archive - Top

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2013, vBulletin Solutions, Inc.