Environment: *CentOS 6.5 *Fail2Ban 0.8.14-1 *date outputs the correct date
Behavior: Fail2ban starts successfully, but does not create iptables blocks after bad SSH login attempts. I'm only concerned with SSH at this point. I attempted to reinstall using this guide: https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-centos-6
Fail2Ban used to work - but through system updates, it appears to have stopped working. If I run
sudo service fail2ban restart
I get an email saying that the jail has stopped and another email saying the jail has started, so it seems that fail2ban is running and functional.
My /etc/fail2ban/jail.local file includes the entry:
[ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois[name=SSH, firstname.lastname@example.org, email@example.com, sendername="Fail2Ban"] logpath = /var/log/secure maxretry = 5
My IP address is not listed in the ignoreip delcaration. I'm using standard bantime of 600, findtime of 600, and maxretry of 3.
When I look at /var/log/secure, I see plenty of failed attempts:
Sep 30 00:17:02 nebo unix_chkpwd: password check failed for user (root) Sep 30 00:17:02 nebo sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.127.116.11 user=root
iptables -L seems to report that fail2ban does have a chain:
Chain fail2ban-SSH (2 references) target prot opt source destination RETURN all -- anywhere anywhere
My current best guest is that the action for sshd in actions.d/sshd.conf is using a regular expression to look through the log file, but it doesn't match the current syntax of the CentOS log for a banned attempt.
Time is insync per: Why isn't fail2ban blocking failures?
Ran fail2ban-regex to test my theory, and it looks like I may be on the right track:
[isdept@nebo action.d]$ sudo fail2ban-regex /var/log/secure /etc/fail2ban/filter.d/sshd.conf Running tests ============= Use failregex file : /etc/fail2ban/filter.d/sshd.conf Use log file : /var/log/secure Results ======= Failregex: 0 total Ignoreregex: 0 total Date template hits: |- [# of hits] date format |  MONTH Day Hour:Minute:Second `- Lines: 22655 lines, 0 ignored, 0 matched, 22655 missed Missed line(s): too many to print. Use --print-all-missed to print all 22655 lines
I'm not totally sure how to modify the regex patterns to fix this (if this is the issue), but I am surprised to find that I haven't found an easy fix since CentOS is common. I'd be happy to provide any additional info. Thanks for any tips or pointers you can give!
For safety - I'm currently disabling public access to this host.
filter.d/sshd.conf) does not match. Compare it with examples from the docs at the internet, and try to fix it yourself. If this does not work out for you, you can ask it at this site.
rootand hammering away using invalid certificate, never got banned. finally i tried a different username and then whaddyaknow, i got banned after 3 tries. it seems weird that it won't ban me if i use the username root and the wrong cert. i checked the logs and yeah it probably wasn't hitting a match, based on what i saw in
filters.d/sshd.confor w/e that sshd filter file is.