2

Ubuntu 20.04. Trying to get fail2ban configured for SSH, but fail2ban not banning any IPs

/etc/fail2ban/jail.local
[DEFAULT]
bantime = 10m
ignoreip = 127.0.0.1/8 ##.##.##.##/32 ##.##.##.##/32
findtime  = 30m
maxretry = 3
[sshd]
enabled = true
# modes: normal (default), ddos, extra or aggressive (combines all).
#mode   = normal
port    = ssh,2233
logpath = %(sshd_log)s
backend = %(sshd_backend)s

Did 20+ bad attempts from a host not on ignoreip but still see this 

 fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

Running

 fail2ban-regex --print-all-matched /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

shows the failed attempts seem to be seen by fail2ban
| Sep 7 15:59:48 storage sshd[29733]: Failed password for root from ##.##.##.## port 33260 ssh2

Enabled debug: fail2ban-client set loglevel DEBUG
All I see on the fail2ban log is entries like this

2020-09-07 10:45:01,795 fail2ban.filterpyinotif [29945]: DEBUG   Event queue size: 16
2020-09-07 10:45:01,795 fail2ban.filterpyinotif [29945]: DEBUG   <_RawEvent cookie=0 mask=0x2 name='' wd=2 >
2020-09-07 10:45:07,116 fail2ban.filterpyinotif [29945]: DEBUG   Event queue size: 16
2020-09-07 10:45:07,116 fail2ban.filterpyinotif [29945]: DEBUG   <_RawEvent cookie=0 mask=0x2 name='' wd=2 >

Any suggestions on what could check or try to solve this issue?

Improve this question
5
  • What did you choose as your backend? What did you choose as your banaction?
    – Michael Hampton
    Sep 7, 2020 at 15:33
  • Default values that were there. backend = %(sshd_backend)s banaction = iptables-multiport banaction_allports = iptables-allports
    – Francisco1844
    Sep 7, 2020 at 19:14
  • OK, but you didn't say what the backend is?
    – Michael Hampton
    Sep 7, 2020 at 19:15
  • Where do I see that in the jail.local or what do I need to copy/paste here? except for the lines I put above everything else was "As is" that came on ubuntu 20.04
    – Francisco1844
    Sep 7, 2020 at 19:50
  • You said that backend is set to sshd_backend, but that's useless because we don't know what sshd_backend is!
    – Michael Hampton
    Sep 7, 2020 at 19:58

2 Answers 2

Reset to default
5

For anyone who finds this a few months after the thread died, I hit the same problem on a new 20.04 server install while following most write-ups.

I solved it by explicitly setting:

sshd_backend = systemd

In my [sshd] section of jails.local.

The default (pynotify) was incorrect for that system or had some deeper issue stopping it from functioning as expected.

Improve this answer
2
  • To get the default backend (pyinotify) working: apt install inotify-tools inotify-hookable python-pyinotify Then restart fail2ban
    – Aleks Barbour
    Feb 15, 2021 at 0:42
  • I tried installing pypyinotify to no avail. Setting the backend to systemd was the only thing that worked.
    – Saturnix
    May 8, 2021 at 9:25
0

Check this issue

Fail2ban uses hash of first line to detect log-rotation (normally it'd always seek to last known position, unless it rotates)...

I guess you are emptying the log by writing a empty line to the beginning of it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.