I have recently set up Debian Jessie on a server for the first time. 'Obviously' fail2ban was set up very early in the process.
It is banning IP addresses and sending me emails ok, but the Apache-based ones do not contain any extracts from the relevant log files. The SSH-based ones, for example, do.
Sample Apache report:
Hi, The IP 193.201.227.112 has just been banned by Fail2Ban after 5 attempts against apache-xmlrpc. Here is more information about 193.201.227.112: (info about it deleted) Lines containing IP:193.201.227.112 in /home/*/logs/*access.log Regards, Fail2Ban
Sample SSH report:
Hi, The IP 184.173.26.138 has just been banned by Fail2Ban after 3 attempts against ssh. Here is more information about 184.173.26.138: (info about it deleted) Lines containing IP:184.173.26.138 in /var/log/auth.log Nov 5 08:21:38 example sshd[20158]: Failed password for invalid user ubnt from 184.173.26.138 port 51131 ssh2 Nov 5 08:21:38 example sshd[20158]: error: Received disconnect from 184.173.26.138: 3: com.jcraft.jsch.JSchException: Auth fail [preauth] Regards, Fail2Ban
/etc/fail2ban/jail.local extract:
action = %(action_mwl)s # JAILS [ssh] enabled = true maxretry = 3 (..) [apache-xmlrpc] enabled = true port = http,https action = %(action_mwl)s filter = apache-xmlrpc logpath = /home/*/logs/*access.log maxretry = 5
Has something changed between Debian Wheezy (where it was including the log file lines in both) and Jessie?
Details of log files and lines missing from the Apache report at pastebin.com/qK8ARrsz (trigger false-positive spam error here!)
(Added later) /var/log/fail2ban.log isn't complaining:
2015-11-04 23:27:08,862 fail2ban.actions[1993]: WARNING [ssh] Ban 109.161.203.139 2015-11-04 23:38:58,786 fail2ban.actions[1993]: WARNING [ssh] Unban 59.47.0.148 2015-11-05 00:55:53,869 fail2ban.actions[1993]: WARNING [ssh] Ban 14.29.113.190 2015-11-05 00:57:38,031 fail2ban.actions[1993]: WARNING [ssh] Ban 109.161.216.214 2015-11-05 05:47:06,644 fail2ban.filter [1993]: WARNING Determined IP using DNS Lookup: mbl-109-61-47.dsl.net.pk = ['124.109.61.47'] 2015-11-05 05:47:13,282 fail2ban.actions[1993]: WARNING [ssh] Ban 124.109.61.47 2015-11-05 08:00:20,049 fail2ban.actions[1993]: WARNING [apache-xmlrpc] Ban 193.201.227.112 2015-11-05 08:21:36,278 fail2ban.filter [1993]: WARNING Determined IP using DNS Lookup: 8a.1a.adb8.ip4.static.sl-reverse.com = ['184.173.26.138'] 2015-11-05 08:21:39,333 fail2ban.filter [1993]: WARNING Determined IP using DNS Lookup: 8a.1a.adb8.ip4.static.sl-reverse.com = ['184.173.26.138'] 2015-11-05 08:21:39,858 fail2ban.actions[1993]: WARNING [ssh] Ban 184.173.26.138
On the one hand, it's not a huge issue because they're still getting banned, but on the other, I use one Apache filter in particular to see what files nasties are searching everywhere for - fckeditor or uploadify.php etc - so they can be banned earlier.
Thanks.