1

Ubuntu 20.04. Trying to get fail2ban configured for SSH, but fail2ban not banning any IPs

/etc/fail2ban/jail.local
[DEFAULT]
bantime = 10m
ignoreip = 127.0.0.1/8 ##.##.##.##/32 ##.##.##.##/32
findtime  = 30m
maxretry = 3
[sshd]
enabled = true
# modes: normal (default), ddos, extra or aggressive (combines all).
#mode   = normal
port    = ssh,2233
logpath = %(sshd_log)s
backend = %(sshd_backend)s

Did 20+ bad attempts from a host not on ignoreip but still see this

 fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:   

Running

 fail2ban-regex --print-all-matched /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

shows the failed attempts seem to be seen by fail2ban
| Sep 7 15:59:48 storage sshd[29733]: Failed password for root from ##.##.##.## port 33260 ssh2

Enabled debug: fail2ban-client set loglevel DEBUG
All I see on the fail2ban log is entries like this

2020-09-07 10:45:01,795 fail2ban.filterpyinotif [29945]: DEBUG   Event queue size: 16
2020-09-07 10:45:01,795 fail2ban.filterpyinotif [29945]: DEBUG   <_RawEvent cookie=0 mask=0x2 name='' wd=2 >
2020-09-07 10:45:07,116 fail2ban.filterpyinotif [29945]: DEBUG   Event queue size: 16
2020-09-07 10:45:07,116 fail2ban.filterpyinotif [29945]: DEBUG   <_RawEvent cookie=0 mask=0x2 name='' wd=2 >

Any suggestions on what could check or try to solve this issue?

5
  • What did you choose as your backend? What did you choose as your banaction? – Michael Hampton Sep 7 '20 at 15:33
  • Default values that were there. backend = %(sshd_backend)s banaction = iptables-multiport banaction_allports = iptables-allports – Francisco1844 Sep 7 '20 at 19:14
  • OK, but you didn't say what the backend is? – Michael Hampton Sep 7 '20 at 19:15
  • Where do I see that in the jail.local or what do I need to copy/paste here? except for the lines I put above everything else was "As is" that came on ubuntu 20.04 – Francisco1844 Sep 7 '20 at 19:50
  • You said that backend is set to sshd_backend, but that's useless because we don't know what sshd_backend is! – Michael Hampton Sep 7 '20 at 19:58
3

For anyone who finds this a few months after the thread died, I hit the same problem on a new 20.04 server install while following most write-ups.

I solved it by explicitly setting:

sshd_backend = systemd

In my [sshd] section of jails.local.

The default (pynotify) was incorrect for that system or had some deeper issue stopping it from functioning as expected.

2
  • To get the default backend (pyinotify) working: apt install inotify-tools inotify-hookable python-pyinotify Then restart fail2ban – Aleks Barbour Feb 15 at 0:42
  • I tried installing pypyinotify to no avail. Setting the backend to systemd was the only thing that worked. – Saturnix May 8 at 9:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.