3

I have recently set up Debian Jessie on a server for the first time. 'Obviously' fail2ban was set up very early in the process.

It is banning IP addresses and sending me emails ok, but the Apache-based ones do not contain any extracts from the relevant log files. The SSH-based ones, for example, do.

Sample Apache report:

Hi,

The IP 193.201.227.112 has just been banned by Fail2Ban after
5 attempts against apache-xmlrpc.


Here is more information about 193.201.227.112:

(info about it deleted)


Lines containing IP:193.201.227.112 in /home/*/logs/*access.log



Regards,

Fail2Ban

Sample SSH report:

Hi,

The IP 184.173.26.138 has just been banned by Fail2Ban after
3 attempts against ssh.


Here is more information about 184.173.26.138:

(info about it deleted)


Lines containing IP:184.173.26.138 in /var/log/auth.log

Nov  5 08:21:38 example sshd[20158]: Failed password for invalid user ubnt from 184.173.26.138 port 51131 ssh2
Nov  5 08:21:38 example sshd[20158]: error: Received disconnect from 184.173.26.138: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]


Regards,

Fail2Ban

/etc/fail2ban/jail.local extract:

action    = %(action_mwl)s

# JAILS

[ssh]

enabled   = true
maxretry  = 3

(..)

[apache-xmlrpc]

enabled  = true
port     = http,https
action   = %(action_mwl)s
filter   = apache-xmlrpc
logpath  = /home/*/logs/*access.log
maxretry = 5

Has something changed between Debian Wheezy (where it was including the log file lines in both) and Jessie?

Details of log files and lines missing from the Apache report at pastebin.com/qK8ARrsz (trigger false-positive spam error here!)

(Added later) /var/log/fail2ban.log isn't complaining:

2015-11-04 23:27:08,862 fail2ban.actions[1993]: WARNING [ssh] Ban 109.161.203.139
2015-11-04 23:38:58,786 fail2ban.actions[1993]: WARNING [ssh] Unban 59.47.0.148
2015-11-05 00:55:53,869 fail2ban.actions[1993]: WARNING [ssh] Ban 14.29.113.190
2015-11-05 00:57:38,031 fail2ban.actions[1993]: WARNING [ssh] Ban 109.161.216.214
2015-11-05 05:47:06,644 fail2ban.filter [1993]: WARNING Determined IP using DNS Lookup: mbl-109-61-47.dsl.net.pk = ['124.109.61.47']
2015-11-05 05:47:13,282 fail2ban.actions[1993]: WARNING [ssh] Ban 124.109.61.47
2015-11-05 08:00:20,049 fail2ban.actions[1993]: WARNING [apache-xmlrpc] Ban 193.201.227.112
2015-11-05 08:21:36,278 fail2ban.filter [1993]: WARNING Determined IP using DNS Lookup: 8a.1a.adb8.ip4.static.sl-reverse.com = ['184.173.26.138']
2015-11-05 08:21:39,333 fail2ban.filter [1993]: WARNING Determined IP using DNS Lookup: 8a.1a.adb8.ip4.static.sl-reverse.com = ['184.173.26.138']
2015-11-05 08:21:39,858 fail2ban.actions[1993]: WARNING [ssh] Ban 184.173.26.138

On the one hand, it's not a huge issue because they're still getting banned, but on the other, I use one Apache filter in particular to see what files nasties are searching everywhere for - fckeditor or uploadify.php etc - so they can be banned earlier.

Thanks.

6
  • Is there any error or warning in the fail2ban log?
    – JayMcTee
    Nov 5, 2015 at 10:46
  • Just the reports about the bans: 2015-11-05 08:00:20,049 fail2ban.actions[1993]: WARNING [apache-xmlrpc] Ban 193.201.227.112 2015-11-05 08:21:36,278 fail2ban.filter [1993]: WARNING Determined IP using DNS Lookup: 8a.1a.adb8.ip4.static.sl-reverse.com = ['184.173.26.138'] 2015-11-05 08:21:39,333 fail2ban.filter [1993]: WARNING Determined IP using DNS Lookup: 8a.1a.adb8.ip4.static.sl-reverse.com = ['184.173.26.138'] 2015-11-05 08:21:39,858 fail2ban.actions[1993]: WARNING [ssh] Ban 184.173.26.138 It can obviously read the files, or it wouldn't be banning on their contents...
    – Ian
    Nov 5, 2015 at 10:57
  • On CentOS I've been having a lot of issues with wildcards in log paths. It may be worth trying to spell out your logpath(s) and see if that makes any difference, even when it doesn't appear to have any issues accessing the logs in the first place, nor matching lines.
    – JayMcTee
    Nov 5, 2015 at 11:07
  • I will give it a go, but there are dozens of them!
    – Ian
    Nov 5, 2015 at 11:17
  • Hmm, trying, it won't accept multiple logfile lines - there's a bug report about that: github.com/fail2ban/fail2ban/issues/976
    – Ian
    Nov 5, 2015 at 21:36

0

You must log in to answer this question.

Browse other questions tagged .