i've got a Problem with fail2ban on my v-Server. I installed everything as explained in a tutorial, but fail2ban don't block ip adresses.
/etc/init.d/fail2ban status says:
* Status of authentication failure monitor
* fail2ban is running
if I test my filter:
fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
there are some matches, but no entries in my iptables
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh
fail2ban-default tcp -- anywhere anywhere tcp dpt:ssh
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain fail2ban-SSH (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain fail2ban-default (1 references)
target prot opt source destination
this is my jail.conf:
[ssh]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 60
action = iptables[name=SSH, port=22, protocol=tcp]
and here my /filter.d/sshd.conf
[Definition]
_daemon = sshd
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers$
^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\s*$
^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
and my action: /action.d/iptables.conf
[Definition]
actionstart = iptables -N fail2ban-<name>
iptables -A fail2ban-<name> -j RETURN
iptables -I <chain> -p <protocol> --dport <port> -j fail2ban-<name>
actionstop = iptables -D <chain> -p <protocol> --dport <port> -j fail2ban-<name>
iptables -F fail2ban-<name>
iptables -X fail2ban-<name>
actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
[Init]
name = default
port = ssh
protocol = tcp
chain = INPUT
I've already tried everything and searched through many forums, but i can't find a mistake. If I try to log in with a wrong password fail2ban don't ban me and I can continuing logging in. Can it be that fail2ban has not the permission to write something in the iptables?
Maybe anyone has got an idea what to do? thanks
this is what stands in auth.log
Jul 24 18:04:13 sshd[12438]: Invalid user sfdsdf from 79.224.101.224
Jul 24 18:04:13 sshd[12438]: input_userauth_request: invalid user sfdsdf [preauth]
Jul 24 18:04:16 sshd[12438]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:04:16 sshd[12438]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=p4fe065e0.dip.t-dialin.net
Jul 24 18:04:19 sshd[12438]: Failed password for invalid user sfdsdf from 79.224.101.224 port 51188 ssh2
Jul 24 18:04:20 sshd[12438]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:04:22 sshd[12438]: Failed password for invalid user sfdsdf from 79.224.101.224 port 51188 ssh2
Jul 24 18:04:24 sshd[12438]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:04:26 sshd[12438]: Failed password for invalid user sfdsdf from 79.224.101.224 port 51188 ssh2
Jul 24 18:04:28 sshd[12438]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:04:30 sshd[12438]: Failed password for invalid user sfdsdf from 79.224.101.224 port 51188 ssh2
Jul 24 18:04:34 sshd[12438]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:04:36 sshd[12438]: Failed password for invalid user sfdsdf from 79.224.101.224 port 51188 ssh2
Jul 24 18:04:37 sshd[12438]: fatal: Read from socket failed: Connection reset by peer [preauth]
Jul 24 18:04:37 sshd[12438]: PAM 4 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=p4fe065e0.dip.t-dialin.net
Jul 24 18:04:37 sshd[12438]: PAM service(sshd) ignoring max retries; 5 > 3
Jul 24 18:04:53 sshd[12440]: Invalid user blabla from 79.224.101.224
Jul 24 18:04:53 sshd[12440]: input_userauth_request: invalid user blabla [preauth]
Jul 24 18:04:55 sshd[12440]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:04:55 sshd[12440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=p4fe065e0.dip.t-dialin.net
Jul 24 18:04:58 sshd[12440]: Failed password for invalid user blabla from 79.224.101.224 port 51194 ssh2
Jul 24 18:05:00 sshd[12440]: Connection closed by 79.224.101.224 [preauth]
Jul 24 18:05:10 sshd[12442]: Invalid user hihi from 79.224.101.224
Jul 24 18:05:10 sshd[12442]: input_userauth_request: invalid user hihi [preauth]
Jul 24 18:05:13 sshd[12442]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:05:13 sshd[12442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=p4fe065e0.dip.t-dialin.net
Jul 24 18:05:15 sshd[12442]: Failed password for invalid user hihi from 79.224.101.224 port 51195 ssh2
Jul 24 18:05:16 sshd[12442]: Connection closed by 79.224.101.224 [preauth]
Jul 24 18:05:22 sshd[12444]: Connection closed by 79.224.101.224 [preauth]
Jul 24 18:05:30 sshd[12446]: Invalid user hoho from 79.224.101.224
Jul 24 18:05:30 sshd[12446]: input_userauth_request: invalid user hoho [preauth]
Jul 24 18:05:31 sshd[12446]: pam_unix(sshd:auth): check pass; user unknown
Jul 24 18:05:31 sshd[12446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=p4fe065e0.dip.t-dialin.net
Jul 24 18:05:34 sshd[12446]: Failed password for invalid user hoho from 79.224.101.224 port 51198 ssh2