up vote -1 down vote favorite
share [g+] share [fb]

I have just installed a fresh version of iptables followed by fail2ban, but fail2ban fails to do anything with iptables and I am stuck with no changes being made, this fail2ban not working properly.

Any help please? Thanks!

My iptables -L: http://pastebin.com/srks3DyH

link|improve this question
What does /etc/fail2ban/jail.local look like? – quanta Oct 21 '11 at 3:25
feedback

1 Answer

up vote 0 down vote

Your iptables -L-output looks normal, for a fail2ban-setup that haven't detected anything bad going on.

Verify the following:

  • is fail2ban running? Run ps aux | grep fail2ban, you should see a fail2ban-server-process.
  • Does /var/log/fail2ban.log have any content? (If this file does not exist, check /etc/fail2ban/fail2ban.conf for logtarget.)
  • Does /etc/fail2ban/filter.d/ssh.conf exist?
  • Does /etc/fail2ban/action.d/iptables.conf exist?

If you still can't figure it out, it would be cool if you added the Linux-distribution, and version of fail2ban in use. You should also provide what kind of attack you want to defend yourself against. I have assumed ssh brute-force above.

link|improve this answer
the log does have some content just saying that it created new jail 'ssh' and some other things for setting that up. All the files do exist. I am using the latest fail2ban with Ubuntu server 11.04 x64. When I try to purposely get banned on another computer from trying too many failed passwords, it doesnt get me banned. – dennis linuz Oct 21 '11 at 17:50
How does the failed login attempts look in /var/log/daemon.log? What does your /etc/fail2ban/filter.d/ssh.conf look like? – Kvisle Oct 21 '11 at 18:02
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.