Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing).

2011-07-06 01:48:16,249 fail2ban.server : INFO   Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.3
2011-07-06 01:48:16,250 fail2ban.jail   : INFO   Creating new jail 'ssh'
2011-07-06 01:48:16,250 fail2ban.jail   : INFO   Jail 'ssh' uses poller
2011-07-06 01:48:16,251 fail2ban.filter : INFO   Added logfile = /var/log/auth.log
2011-07-06 01:48:16,252 fail2ban.filter : INFO   Set maxRetry = 3
2011-07-06 01:48:16,253 fail2ban.filter : INFO   Set findtime = 600
2011-07-06 01:48:16,253 fail2ban.actions: INFO   Set banTime = 600
2011-07-06 01:48:16,329 fail2ban.jail   : INFO   Jail 'ssh' started

Why isn't it blocking them? I haven't changed (except the maxRetry) anything in the configurations - I just installed it on my Linux Debian Lenny and it started, but it isn't blocking anyone. :/
What could I do to fix this?

I can share some of the attacks:

Jul  6 01:02:24 tornado sshd[19768]: Failed password for root from 200.63.212.41 port 43457 ssh2
Jul  6 01:02:26 tornado sshd[19771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=www.gamavision.com  user=root
Jul  6 01:02:27 tornado sshd[19771]: Failed password for root from 200.63.212.41 port 43565 ssh2
Jul  6 01:02:29 tornado sshd[19773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=www.gamavision.com  user=root
Jul  6 01:02:31 tornado sshd[19773]: Failed password for root from 200.63.212.41 port 43662 ssh2
Jul  6 01:02:32 tornado sshd[19775]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=www.gamavision.com  user=root

By the way, does it change something that server time is 1 hour off as I see? ;D

Edit:

Status for the jail: ssh
|- filter
|  |- File list:        /var/log/auth.log
|  |- Currently failed: 0
|  `- Total failed:     0
`- action
   |- Currently banned: 0
   |  `- IP list:
   `- Total banned:     0

Before I had installed fail2ban in auth.log I noticed such lines:

reverse mapping checking getaddrinfo for server1.intensevps.com [94.75.242.39] failed - POSSIBLE BREAK-IN ATTEMPT!

Could it be that fail2ban is conflicting with something else? I just don't know what that thing is which detected the possible break in thing. Now it doesn't detect anything once fail2ban is installed.

share|improve this question
    
What is the output of fail2ban-client status ssh? –  Mark Wagner Jul 5 '11 at 23:10
    
@embobo, added it to post. –  Richards Jul 5 '11 at 23:15
    
Maybe I've got an older version of fail2ban, shouldn't it be the 'sshd' jail, not 'ssh'? What's your jail.local file have configured for the ssh section? –  Chris S Jul 5 '11 at 23:52
    
enabled = true port = ssh,sftp filter = sshd logpath = /var/log/auth.log maxretry = 3 That is default setting, i just added sftp as I saw that somewhere. –  Richards Jul 6 '11 at 11:21
    
And there is no ssh filter. ;P –  Richards Jul 6 '11 at 11:21

3 Answers 3

up vote 2 down vote accepted

I had exactly the same problem. Actually, the time was not sync.

dpkg-reconfigure tzdata
cp /usr/share/zoneinfo/Europe/Paris /etc/localtime
vim /etc/rsyslog.conf
#see all messages
$RepeatedMsgReduction off
service rsyslog restart
share|improve this answer
    
Can you clarify what is happening here? It is unclear to me how this is related. . . –  meawoppl Jul 16 '13 at 16:58
    
Setting '$RepeatedMsgReduction off' is what does the magic. If it was on, that changes the format of /var/log/auth.log (or wherever login failures are logged on your system), which messes up fail2ban. See this for how to turn off RepeatedMsgReduction only for auth logging. –  Alexander Garden Apr 10 at 4:16

You need to enable fail to ban for it to work right. Just run "service fail2ban start"

share|improve this answer
    
-bash: service: command not found –  Richards Jul 6 '11 at 11:08
    
/sbin/service is a RH-specific item. Debian might have another similar command, but the fallback that I know is on there is to run /etc/init.d/fail2ban start –  Kevin M Nov 3 '11 at 18:57
    
Service is the more modern way to get at /etc/init.d/ scripts. Use it if you have it! –  meawoppl Jul 16 '13 at 16:48

Try with the "logpath" set as "/var/log/secure".

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.