1

I have just installed a fresh version of iptables followed by fail2ban, but fail2ban fails to do anything with iptables and I am stuck with no changes being made, this fail2ban not working properly.

Any help please? Thanks!

My iptables -L: http://pastebin.com/srks3DyH

1
  • What does /etc/fail2ban/jail.local look like?
    – quanta
    Oct 21, 2011 at 3:25

1 Answer 1

4

Your iptables -L-output looks normal, for a fail2ban-setup that haven't detected anything bad going on.

Verify the following:

  • is fail2ban running? Run ps aux | grep fail2ban, you should see a fail2ban-server-process.
  • Does /var/log/fail2ban.log have any content? (If this file does not exist, check /etc/fail2ban/fail2ban.conf for logtarget.)
  • Does /etc/fail2ban/filter.d/ssh.conf exist?
  • Does /etc/fail2ban/action.d/iptables.conf exist?

If you still can't figure it out, it would be cool if you added the Linux-distribution, and version of fail2ban in use. You should also provide what kind of attack you want to defend yourself against. I have assumed ssh brute-force above.

2
  • the log does have some content just saying that it created new jail 'ssh' and some other things for setting that up. All the files do exist. I am using the latest fail2ban with Ubuntu server 11.04 x64. When I try to purposely get banned on another computer from trying too many failed passwords, it doesnt get me banned. Oct 21, 2011 at 17:50
  • How does the failed login attempts look in /var/log/daemon.log? What does your /etc/fail2ban/filter.d/ssh.conf look like?
    – Kvisle
    Oct 21, 2011 at 18:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .