1

i've got a Problem with fail2ban on my v-Server. I installed everything as explained in a tutorial, but fail2ban don't block ip adresses.

/etc/init.d/fail2ban status says:

* Status of authentication failure monitor     
*  fail2ban is running

if I test my filter:

fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

there are some matches, but no entries in my iptables

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
fail2ban-SSH  tcp  --  anywhere             anywhere             tcp dpt:ssh
fail2ban-default  tcp  --  anywhere             anywhere             tcp dpt:ssh

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain fail2ban-SSH (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain fail2ban-default (1 references)
target     prot opt source               destination

this is my jail.conf:

[ssh]

enabled  = true
port     = 22
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3
bantime  = 60
action   = iptables[name=SSH, port=22, protocol=tcp]

and here my /filter.d/sshd.conf

[Definition]

_daemon = sshd

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values:  TEXT
#
failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
        ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
        ^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
        ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
        ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
        ^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers$
        ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
        ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
        ^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\s*$
        ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

and my action: /action.d/iptables.conf

[Definition]
actionstart = iptables -N fail2ban-<name>
          iptables -A fail2ban-<name> -j RETURN
          iptables -I <chain> -p <protocol> --dport <port> -j fail2ban-<name>
actionstop = iptables -D <chain> -p <protocol> --dport <port> -j fail2ban-<name>
         iptables -F fail2ban-<name>
         iptables -X fail2ban-<name>
actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP

[Init]
name = default
port = ssh
protocol = tcp
chain = INPUT

I've already tried everything and searched through many forums, but i can't find a mistake. If I try to log in with a wrong password fail2ban don't ban me and I can continuing logging in. Can it be that fail2ban has not the permission to write something in the iptables?

Maybe anyone has got an idea what to do? thanks

this is what stands in auth.log

Jul 24 18:04:13 sshd[12438]: Invalid user sfdsdf from 79.224.101.224
Jul 24 18:04:13 sshd[12438]: input_userauth_request: invalid user sfdsdf [preauth]
Jul 24 18:04:16 sshd[12438]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:04:16 sshd[12438]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=p4fe065e0.dip.t-dialin.net
Jul 24 18:04:19 sshd[12438]: Failed password for invalid user sfdsdf from 79.224.101.224 port 51188 ssh2
Jul 24 18:04:20 sshd[12438]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:04:22 sshd[12438]: Failed password for invalid user sfdsdf from 79.224.101.224 port 51188 ssh2
Jul 24 18:04:24 sshd[12438]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:04:26 sshd[12438]: Failed password for invalid user sfdsdf from 79.224.101.224 port 51188 ssh2
Jul 24 18:04:28 sshd[12438]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:04:30 sshd[12438]: Failed password for invalid user sfdsdf from 79.224.101.224 port 51188 ssh2
Jul 24 18:04:34 sshd[12438]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:04:36 sshd[12438]: Failed password for invalid user sfdsdf from 79.224.101.224 port 51188 ssh2
Jul 24 18:04:37 sshd[12438]: fatal: Read from socket failed: Connection reset by peer [preauth]
Jul 24 18:04:37 sshd[12438]: PAM 4 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=p4fe065e0.dip.t-dialin.net
Jul 24 18:04:37 sshd[12438]: PAM service(sshd) ignoring max retries; 5 > 3
Jul 24 18:04:53 sshd[12440]: Invalid user blabla from 79.224.101.224
Jul 24 18:04:53 sshd[12440]: input_userauth_request: invalid user blabla [preauth]
Jul 24 18:04:55 sshd[12440]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:04:55 sshd[12440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=p4fe065e0.dip.t-dialin.net
Jul 24 18:04:58 sshd[12440]: Failed password for invalid user blabla from 79.224.101.224 port 51194 ssh2
Jul 24 18:05:00 sshd[12440]: Connection closed by 79.224.101.224 [preauth]
Jul 24 18:05:10 sshd[12442]: Invalid user hihi from 79.224.101.224
Jul 24 18:05:10 sshd[12442]: input_userauth_request: invalid user hihi [preauth]
Jul 24 18:05:13 sshd[12442]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:05:13 sshd[12442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=p4fe065e0.dip.t-dialin.net
Jul 24 18:05:15 sshd[12442]: Failed password for invalid user hihi from 79.224.101.224 port 51195 ssh2
Jul 24 18:05:16 sshd[12442]: Connection closed by 79.224.101.224 [preauth]
Jul 24 18:05:22 sshd[12444]: Connection closed by 79.224.101.224 [preauth]
Jul 24 18:05:30 sshd[12446]: Invalid user hoho from 79.224.101.224
Jul 24 18:05:30 sshd[12446]: input_userauth_request: invalid user hoho [preauth]
Jul 24 18:05:31 sshd[12446]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:05:31 sshd[12446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=p4fe065e0.dip.t-dialin.net
Jul 24 18:05:34 sshd[12446]: Failed password for invalid user hoho from 79.224.101.224 port 51198 ssh2
Improve this question
2
  • Can you show us what is logged when you attempt to log in with incorrect credentials ?
    – user9517
    Jul 24, 2012 at 9:42
  • yeah sure, I edited them in my post
    – Sven Jung
    Jul 24, 2012 at 16:12

2 Answers 2

Reset to default
2

You can use the command fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf to validate if any of those regexes are matching. For me they don't and the reason is that the syslog format does not match what is defined as __prefix_line in the filters.d/common.conf.

My regex skills suck and but this is very you can fix things.

Improve this answer
1

To run iptables with any command other than -L, it requires root privileges; hence, the daemon must run as root.

Verify that this is the case.

Improve this answer
1
  • okay, i checked it an started the daemon as root now. Prozess : root 2322 0.0 0.3 199824 1716 ? Sl Jul19 1:30 /usr/bin/python /usr/bin/fail2ban-server -b -s /var/run/fail2ban/fail2ban.sock Now when I log in with a wrong password i can see it in the auth.log, but still i am not banned. Have I to do something else to give the daemon the right to write in the iptables?
    – Sven Jung
    Jul 24, 2012 at 15:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .