I'm trying to configure fail2ban to block ssh from a local hosts. Fail2ban is install on CentOS 7 with firewall (Linux 3.10.0-229.4.2.el7.x86_64 x86_64 ). I have copied the jail.conf to jail.local i have change the following parameters in jail.local:
banaction = firewallcmd-new
[sshd]
enabled = true
maxretry = 5
port = ssh
logpath = /var/log/secure
action = firewallcmd-ipset
And i have no results. Any idea ?
Some log info:
Jun 23 07:21:33 localhost.localdomain fail2ban-client[2486]: 2015-06-23 07:21:33,351 fail2ban.server [2487]: INFO Starting Fail2ban v0.9.1
Jun 23 07:21:33 localhost.localdomain fail2ban-client[2486]: 2015-06-23 07:21:33,351 fail2ban.server [2487]: INFO Starting in daemon mode
Jun 23 07:21:33 localhost.localdomain systemd[1]: Started Fail2Ban Service.
2015-06-23 07:14:27,571 fail2ban.server [1926]: INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.9.1
2015-06-23 07:14:27,710 fail2ban.database [1926]: INFO Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
2015-06-23 07:14:27,788 fail2ban.jail [1926]: INFO Creating new jail 'sshd'
2015-06-23 07:14:27,923 fail2ban.jail [1926]: INFO Jail 'sshd' uses poller
2015-06-23 07:14:27,985 fail2ban.filter [1926]: INFO Set jail log file encoding to UTF-8
2015-06-23 07:14:27,985 fail2ban.jail [1926]: INFO Initiated 'polling' backend
2015-06-23 07:14:28,063 fail2ban.filter [1926]: INFO Added logfile = /var/log/secure
2015-06-23 07:14:28,064 fail2ban.filter [1926]: INFO Set maxRetry = 2
2015-06-23 07:14:28,066 fail2ban.filter [1926]: INFO Set jail log file encoding to UTF-8
2015-06-23 07:14:28,066 fail2ban.actions [1926]: INFO Set banTime = 86400
2015-06-23 07:14:28,067 fail2ban.filter [1926]: INFO Set findtime = 600
2015-06-23 07:14:28,068 fail2ban.filter [1926]: INFO Set maxlines = 10
2015-06-23 07:14:28,158 fail2ban.server [1926]: INFO Jail sshd is not a JournalFilter instance
2015-06-23 07:14:28,459 fail2ban.jail [1926]: INFO Jail 'sshd' started
2015-06-23 07:21:32,667 fail2ban.server [1926]: INFO Stopping all jails
2015-06-23 07:21:33,181 fail2ban.jail [1926]: INFO Jail 'sshd' stopped
2015-06-23 07:21:33,188 fail2ban.server [1926]: INFO Exiting Fail2ban
2015-06-23 07:21:33,404 fail2ban.server [2489]: INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.9.1
2015-06-23 07:21:33,406 fail2ban.database [2489]: INFO Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
2015-06-23 07:21:33,409 fail2ban.jail [2489]: INFO Creating new jail 'sshd'
2015-06-23 07:21:33,413 fail2ban.jail [2489]: INFO Jail 'sshd' uses poller
2015-06-23 07:21:33,433 fail2ban.filter [2489]: INFO Set jail log file encoding to UTF-8
2015-06-23 07:21:33,433 fail2ban.jail [2489]: INFO Initiated 'polling' backend
2015-06-23 07:21:33,438 fail2ban.filter [2489]: INFO Added logfile = /var/log/secure
2015-06-23 07:21:33,439 fail2ban.filter [2489]: INFO Set maxRetry = 3
2015-06-23 07:21:33,440 fail2ban.filter [2489]: INFO Set jail log file encoding to UTF-8
2015-06-23 07:21:33,441 fail2ban.actions [2489]: INFO Set banTime = 86400
2015-06-23 07:21:33,442 fail2ban.filter [2489]: INFO Set findtime = 600
2015-06-23 07:21:33,442 fail2ban.filter [2489]: INFO Set maxlines = 10
2015-06-23 07:21:33,501 fail2ban.server [2489]: INFO Jail sshd is not a JournalFilter instance
2015-06-23 07:21:33,599 fail2ban.jail [2489]: INFO Jail 'sshd' started
And SELinux is disabled.