0

I am new to running a web server. I have fail2ban version 0.9.3 on Ubuntu 16.04.6 LTS. I am pretty sure I have the latest version of fail2ban and just today updated all packages with apt.

Whenever I restart the box or the fail2ban service, fail2ban takes a long time (~1 minute?) to shut down, and by tailing its log I can see that it is systematically unbanning thousands of IPs in the sshd jail in numerical order. Once the service restarts, it spends tons of time (multiple hours) and CPU re-banning those same IPs in order (it takes a second or two for each one, which to me seems to indicate that it is NOT actually reading from a db but is instead reading log files).

I would like it to never unban them in the first place.

I have looked for other questions about this issue, such as this one, and I checked that dbfile is set. The log states upon restart that the db has been connected to, so that is not the issue. Most of the info I can find about this issue seems to be from before fail2ban made persistent dbfile the default behavior.

This is such a huge waste of CPU and I am getting charged for it. How can I stop this?

  • Make sure you are using an ipset-based banaction. – Michael Hampton Jul 21 at 22:24
  • Thanks for your response. I installed ipset with apt. Then I added, in the [DEFAULT] section of /etc/fail2ban/jail.local, the line banaction = iptables-ipset-proto6, and then the log shows that this is not working. For example: ipset add f2b-sshd 100.24.62.170 timeout 864000000 -exist -- stderr: b'ipset v6.29: The set with the given name does not exist\n'. I tried solving this with the answer here. echo $CONFIG_IP_SET shows no value, but the find commands show that my kernel does have ipset enabled. – Kuhron Jul 21 at 23:13
  • Okay I think I fixed it. I had been using a ban time that was too large for the ipset to be created, hence why it said the set doesn't exist. From the log: iptables -w -I INPUT -p tcp -m multiport --dports http,https -m set --match-set f2b-nginx-http-auth src -j REJECT --reject-with icmp-port-unreachable -- stderr: b"ipset v6.29: Syntax error: '864000000' is out of range 0-4294967\niptables v1.6.0: Set f2b-nginx-http-auth doesn't exist.\n. Changing all my huge bantimes/dbpurgetimes back to 86400 fixed everything. – Kuhron Jul 21 at 23:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.