4

Ubuntu 20.04. Trying to get fail2ban configured for SSH, but fail2ban not banning any IPs

/etc/fail2ban/jail.local
[DEFAULT]
bantime = 10m
ignoreip = 127.0.0.1/8 ##.##.##.##/32 ##.##.##.##/32
findtime  = 30m
maxretry = 3
[sshd]
enabled = true
# modes: normal (default), ddos, extra or aggressive (combines all).
#mode   = normal
port    = ssh,2233
logpath = %(sshd_log)s
backend = %(sshd_backend)s

Did 20+ bad attempts from a host not on ignoreip but still see this

 fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:   

Running

 fail2ban-regex --print-all-matched /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

shows the failed attempts seem to be seen by fail2ban
| Sep 7 15:59:48 storage sshd[29733]: Failed password for root from ##.##.##.## port 33260 ssh2

Enabled debug: fail2ban-client set loglevel DEBUG
All I see on the fail2ban log is entries like this

2020-09-07 10:45:01,795 fail2ban.filterpyinotif [29945]: DEBUG   Event queue size: 16
2020-09-07 10:45:01,795 fail2ban.filterpyinotif [29945]: DEBUG   <_RawEvent cookie=0 mask=0x2 name='' wd=2 >
2020-09-07 10:45:07,116 fail2ban.filterpyinotif [29945]: DEBUG   Event queue size: 16
2020-09-07 10:45:07,116 fail2ban.filterpyinotif [29945]: DEBUG   <_RawEvent cookie=0 mask=0x2 name='' wd=2 >

Any suggestions on what could check or try to solve this issue?

5
  • What did you choose as your backend? What did you choose as your banaction? Commented Sep 7, 2020 at 15:33
  • Default values that were there. backend = %(sshd_backend)s banaction = iptables-multiport banaction_allports = iptables-allports Commented Sep 7, 2020 at 19:14
  • OK, but you didn't say what the backend is? Commented Sep 7, 2020 at 19:15
  • Where do I see that in the jail.local or what do I need to copy/paste here? except for the lines I put above everything else was "As is" that came on ubuntu 20.04 Commented Sep 7, 2020 at 19:50
  • You said that backend is set to sshd_backend, but that's useless because we don't know what sshd_backend is! Commented Sep 7, 2020 at 19:58

2 Answers 2

7

For anyone who finds this a few months after the thread died, I hit the same problem on a new 20.04 server install while following most write-ups.

I solved it by explicitly setting:

sshd_backend = systemd

In my [sshd] section of jails.local.

The default (pynotify) was incorrect for that system or had some deeper issue stopping it from functioning as expected.

2
  • To get the default backend (pyinotify) working: apt install inotify-tools inotify-hookable python-pyinotify Then restart fail2ban Commented Feb 15, 2021 at 0:42
  • I tried installing pypyinotify to no avail. Setting the backend to systemd was the only thing that worked.
    – Saturnix
    Commented May 8, 2021 at 9:25
1

Check this issue

Fail2ban uses hash of first line to detect log-rotation (normally it'd always seek to last known position, unless it rotates)...

I guess you are emptying the log by writing a empty line to the beginning of it.

1
  • I've zeroed my log file with echo > /var/log/logfile and fail2ban stopped working altogether, I've tried everything but I knew the config was working perfectly before, I would never ever find this out without your help!
    – nnsense
    Commented May 12, 2023 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .