12

My fail2ban log at /var/log/fail2ban.log is completely filled with entries saying:

fail2ban.filter : WARNING Determined IP using DNS Lookup: [IP address]

I think this may have begun after I changed my ssh port...

Any idea what the cause of this is and how to stop it?

Improve this question
10

Had the same issue.

Simple solution: add the following line at the top of your /etc/fail2ban/jail.conf file, in the [DEFAULT] section

usedns = no

To understand why your log file is being filled with warnings, consult the following page in the Fail2Ban wiki. It's basically to prevent people manipulating PTR record of their attack IPs to inject false values in your logs.

Improve this answer
  • 1
    Won't this open the possibility for attack if users make login attempts for hostname origins (since hostnames will just be ignored in this case)? Perhaps I've read the docs wrong, but it seems this could be a bad idea. – Quinn Comendant Jul 27 '15 at 18:45
  • 2
    Also, the documentation says, The solution is to set all services not to do reverse DNS lookups and instead to log IP addresses only. The warning given by fail2ban (Determined IP using DNS Lookup) indicates that some service is logging hostnames. The best solution is to determine which service that is, and disable DNS lookups for it. Setting usedns = no stops the warnings and will prevent blocking of spoofed PTR networks, but leaves the service that is logging hostnames completely unprotected by fail2ban. – Quinn Comendant Jul 28 '15 at 17:05
2

Check the PTR record of the [IP address] and compare the resolved name with the original IP address, i.e. 

drill -x ip_address or dig -x ip_address or host ip_address

Then compare the result with:

drill result or dig result or host result

It should be the same. If it is not - the attacker changed the PTR. You may modify usedns directive to "no" or "warn" in jail.conf.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.