2

I'm trying to run fail2ban on the rsyslog server that gathers auth logs from the rest of our servers. I'm interested on getting notifications working as a first step.

My problem is that fail2ban only triggers on auth.log lines that come from the local machine (the logserver named 'sth-admin-log01'), but not remote servers. For example, 3 occurrences of this line are enough to trigger fail2ban actions:

Mar 27 10:21:28 sth-admin-log01 sshd[18516]: Failed password for root from 192.168.1.3 port 34234 ssh2

This line does not trigger anything, no matter how many times it shows up:

Mar 27 11:20:19 test-vm sshd[9772]: Failed password for root from 192.168.1.3 port 34631 ssh2

I've tried to verify the (default) sshd.conf filter using fail2ban-regex and it matches both log lines just fine.

I'm using fail2ban 0.8.11-1 on Ubuntu 64bit 14.0.4.1.

Any ideas?

5
  • I think that fail2ban could be a wrong choice for log analysis. Have you tried the IDS / log analysis tools like Snort? – Andrey Sapegin Mar 27 '15 at 11:47
  • Well, a later step would be to use fail2ban to enforce bans. In any case, everything show that this should be working out-of-the-box and this is why I'm asking :) – dtsomp Mar 27 '15 at 17:09
  • But if you collect logs from remote hosts, how do you expect the local fail2ban to act on remote hosts? – Andrey Sapegin Mar 28 '15 at 21:16
  • My plan is to have fail2ban ssh to the load-balanceer that is in front of my auth.log-generating machines. – dtsomp Mar 30 '15 at 6:44
  • 1
    I will bet you have 192.168.0.0/16 in your jail.conf in the "ignore-ip" line. – user296797 Jun 29 '15 at 17:07
0

Edit: My response answers the opposite of what the question is: how do you only ban attacks to the local host. I came across this question searching for the answer to the "opposite", and others might as well.

You need to change the fail2ban filter prefix to only look at lines from the local host.

The ssh (or any service) filters could be constructed differently on your system, but on mine, I havefail2ban/filter.d/common.conf, which defines __prefix_line, which looks like this:

__prefix_line = %(__date_ambit)s?\s*(?:%(__bsd_syslog_verbose)s\s+)?(?:%(__hostname)s\s+)?(?:%(__kernel_prefix)s\s+)?(?:%(__vserver)s\s+)?(?:%(__daemon_combs_re)s\s+)?(?:%(__daemon_extra_re)s\s+)?

They key bit above is how __hostname is defined. It is likely defaulting to simply matching any alphanumeric string:

__hostname = \S+

If you change it to your host's hostname, fail2ban will only match lines that include your host's hostname.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.