up vote 1 down vote favorite
share [g+] share [fb]

This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing). 

2011-07-06 01:48:16,249 fail2ban.server : INFO   Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.3
2011-07-06 01:48:16,250 fail2ban.jail   : INFO   Creating new jail 'ssh'
2011-07-06 01:48:16,250 fail2ban.jail   : INFO   Jail 'ssh' uses poller
2011-07-06 01:48:16,251 fail2ban.filter : INFO   Added logfile = /var/log/auth.log
2011-07-06 01:48:16,252 fail2ban.filter : INFO   Set maxRetry = 3
2011-07-06 01:48:16,253 fail2ban.filter : INFO   Set findtime = 600
2011-07-06 01:48:16,253 fail2ban.actions: INFO   Set banTime = 600
2011-07-06 01:48:16,329 fail2ban.jail   : INFO   Jail 'ssh' started

Why isn't it blocking them? I haven't changed (except the maxRetry) anything in the configurations - I just installed it on my Linux Debian Lenny and it started, but it isn't blocking anyone. :/
What could I do to fix this?

I can share some of the attacks:

Jul  6 01:02:24 tornado sshd[19768]: Failed password for root from 200.63.212.41 port 43457 ssh2
Jul  6 01:02:26 tornado sshd[19771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=www.gamavision.com  user=root
Jul  6 01:02:27 tornado sshd[19771]: Failed password for root from 200.63.212.41 port 43565 ssh2
Jul  6 01:02:29 tornado sshd[19773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=www.gamavision.com  user=root
Jul  6 01:02:31 tornado sshd[19773]: Failed password for root from 200.63.212.41 port 43662 ssh2
Jul  6 01:02:32 tornado sshd[19775]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=www.gamavision.com  user=root

By the way, does it change something that server time is 1 hour off as I see? ;D

Edit:

Status for the jail: ssh
|- filter
|  |- File list:        /var/log/auth.log
|  |- Currently failed: 0
|  `- Total failed:     0
`- action
   |- Currently banned: 0
   |  `- IP list:
   `- Total banned:     0

Before I had installed fail2ban in auth.log I noticed such lines:

reverse mapping checking getaddrinfo for server1.intensevps.com [94.75.242.39] failed - POSSIBLE BREAK-IN ATTEMPT!

Could it be that fail2ban is conflicting with something else? I just don't know what that thing is which detected the possible break in thing. Now it doesn't detect anything once fail2ban is installed.

link|improve this question
88% accept rate
What is the output of fail2ban-client status ssh? – Mark Wagner Jul 5 '11 at 23:10
@embobo, added it to post. – Richards Jul 5 '11 at 23:15
Maybe I've got an older version of fail2ban, shouldn't it be the 'sshd' jail, not 'ssh'? What's your jail.local file have configured for the ssh section? – Chris S♦ Jul 5 '11 at 23:52
enabled = true port = ssh,sftp filter = sshd logpath = /var/log/auth.log maxretry = 3 That is default setting, i just added sftp as I saw that somewhere. – Richards Jul 6 '11 at 11:21
And there is no ssh filter. ;P – Richards Jul 6 '11 at 11:21
feedback

3 Answers

up vote 1 down vote accepted

I had exactly the same problem. Actually, the time was not sync.

dpkg-reconfigure tzdata
cp /usr/share/zoneinfo/Europe/Paris /etc/localtime
vim /etc/rsyslog.conf
#see all messages
$RepeatedMsgReduction off
service rsyslog restart
link|improve this answer
feedback
up vote 0 down vote

You need to enable fail to ban for it to work right. Just run "service fail2ban start"

link|improve this answer
-bash: service: command not found – Richards Jul 6 '11 at 11:08
/sbin/service is a RH-specific item. Debian might have another similar command, but the fallback that I know is on there is to run /etc/init.d/fail2ban start – Kevin M Nov 3 '11 at 18:57
feedback
up vote 0 down vote

Try with the "logpath" set as "/var/log/secure".

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.