0

I've a ton of errors like this in my fail2ban.log

fail2ban.actions        [13370]: ERROR   Failed to execute ban jail 'recidive' action 'iptables-multiport' info 'CallingMap({'ip': '164.132.49.140', 'matches': '2019-04-01 08:30:14,100 fail2ban.actions        [1415]: NOTICE  [sshd] Ban 164.132.49.140\n2019-04-01 23:08:43,345 fail2ban.actions        [26861]: NOTICE  [sshd] Ban 164.132.49.140\n2019-04-01 08:30:14,100 fail2ban.actions        [1415]: NOTICE  [sshd] Ban 164.132.49.140\n2019-04-01 23:08:43,345 fail2ban.actions        [26861]: NOTICE  [sshd] Ban 164.132.49.140', 'ipmatches': <function Actions.__checkBan.<locals>.<lambda> at 0x7fa4a8366598>, 'time': 1554154478.985568, 'ipjailfailures': <function Actions.__checkBan.<locals>.<lambda> at 0x7fa4a8366510>, 'ipfailures': <function Actions.__checkBan.<locals>.<lambda> at 0x7fa4a8366488>, 'failures': 4, 'ipjailmatches': <function Actions.__checkBan.<locals>.<lambda> at 0x7fa4a8366400>})': Error starting action

I see that this is a single-line error, but it looks to me like there is an error with the pattern matching or something else in the log has caused a loop because pattern now matches even the error rows.

EDIT I found these rows, in the log, probably related to the error

2019-04-01 23:44:35,895 fail2ban.action         [19570]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-recidive[ \t]' -- stdout: b''
2019-04-01 23:44:35,896 fail2ban.action         [19570]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-recidive[ \t]' -- stderr: b''
2019-04-01 23:44:35,897 fail2ban.action         [19570]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-recidive[ \t]' -- returned 1
2019-04-01 23:44:35,898 fail2ban.CommandAction  [19570]: ERROR   Invariant check failed. Trying to restore a sane environment
2019-04-01 23:44:36,114 fail2ban.action         [19570]: ERROR   iptables -w -N f2b-recidive
iptables -w -A f2b-recidive -j RETURN
iptables -w -I INPUT -p all -m multiport --dports 0:65535 -j f2b-recidive -- stdout: b''

This is my recidive definition in jail.local

[recidive]

enabled  = true
logpath  = /var/log/fail2ban.log
filter   = recidive
findtime = 86400
maxretry = 2
bantime  = 648000
protocol = all

My filter.d/recidive.conf has this line

failregex = ^(%(__prefix_line)s| %(_daemon)s%(__pid_re)s?:\s+)NOTICE\s+\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+<HOST>\s*$

And this is all for my knowledge.

I am on a ubuntu 16.04 if usefull.

Question is: how to debug the config error and even how to restore default working configuration. I have only another custom filter (pihole) and I know how to restore it but I have no idea if there is something like a reset for fail2ban config

1 Answer 1

0

This is actually my solution. Only the next hours will tell me if this is really the solution or not.

I stopped fail2ban

systemctl stop fail2ban

Then emptied its log

echo > /var/log/fail2ban.log

Then added an action to my recidive configuration

action   = iptables-allports[name=recidive, protocol=all]

Then restart faiilban service

systemctl start fail2ban
1
  • can you explain what your 'action' directive does and why you had to add it? Why does emptying your log help?
    – ikwyl6
    Mar 8, 2021 at 0:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .