0

i installed fail2ban it doesnt work im trying all the day to configure jail.conf.. this is my jail.conf(yes i changed the original one, my fault...)

enabled = true port = ssh filter = sshd logpath = /var/log/auth.log backend = %(sshd_backend)s maxretry = 3 bantime = 60s findtime = 60s

and i changed:

banaction = ufw

im not familar with the linux firewall is that enough?P fail2ban doesnt work can someone help me?

1 Answer 1

0

Create a file under following path and name as "jail.local", so it would be:

 /etc/fail2ban/jail.local

Add the following content to the file.

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1  
bantime = 3600
findtime = 10
maxretry = 2
[sshd]
enabled = true
port     = ssh,22
action   = iptables[name=SSH, port=22, protocol=tcp]

You may alter the port if you are using any port number other than 22 for default ssh port. Also timings cloud be altered based on your needs.

ignoreip is the whitelisted IP addresses, which you don't want fail2ban to block them in any cases.

Please restart your fail2ban service after updating the file content.

systemctl restart fail2ban
2
  • when i connect with winscp fail2ban works correct. Is it perhaps just normal that fail2ban cant ban a already established ssh connection?
    – MKDE
    Jan 12, 2023 at 18:23
  • it shouldn't be like that either with WinSCP or command line, if it reaches the number of failed login, your IP should be banned. Jan 13, 2023 at 11:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .