Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have just installed a fresh version of iptables followed by fail2ban, but fail2ban fails to do anything with iptables and I am stuck with no changes being made, this fail2ban not working properly.

Any help please? Thanks!

My iptables -L: http://pastebin.com/srks3DyH

share|improve this question
    
What does /etc/fail2ban/jail.local look like? –  quanta Oct 21 '11 at 3:25
add comment

1 Answer

Your iptables -L-output looks normal, for a fail2ban-setup that haven't detected anything bad going on.

Verify the following:

  • is fail2ban running? Run ps aux | grep fail2ban, you should see a fail2ban-server-process.
  • Does /var/log/fail2ban.log have any content? (If this file does not exist, check /etc/fail2ban/fail2ban.conf for logtarget.)
  • Does /etc/fail2ban/filter.d/ssh.conf exist?
  • Does /etc/fail2ban/action.d/iptables.conf exist?

If you still can't figure it out, it would be cool if you added the Linux-distribution, and version of fail2ban in use. You should also provide what kind of attack you want to defend yourself against. I have assumed ssh brute-force above.

share|improve this answer
    
the log does have some content just saying that it created new jail 'ssh' and some other things for setting that up. All the files do exist. I am using the latest fail2ban with Ubuntu server 11.04 x64. When I try to purposely get banned on another computer from trying too many failed passwords, it doesnt get me banned. –  dennis linuz Oct 21 '11 at 17:50
    
How does the failed login attempts look in /var/log/daemon.log? What does your /etc/fail2ban/filter.d/ssh.conf look like? –  Kvisle Oct 21 '11 at 18:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.