37

When I run this command fail2ban-client status sshd I got this:

Status for the jail: sshd
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     81
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 2
   |- Total banned:     8
   `- Banned IP list:   218.65.30.61 116.31.116.7

It only show two IP in banned IP list instead of 8 just like Total Banned says.

While I do tail -f /var/log/auth.log I got this:

Mar 29 11:08:40 DBSERVER sshd[29163]: error: maximum authentication attempts exceeded for root from 218.65.30.61 port 50935 ssh2 [preauth]
Mar 29 11:08:40 DBSERVER sshd[29163]: Disconnecting: Too many authentication failures [preauth]
Mar 29 11:08:40 DBSERVER sshd[29163]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.65.30.61  user=root
Mar 29 11:08:40 DBSERVER sshd[29163]: PAM service(sshd) ignoring max retries; 6 > 3
Mar 29 11:08:44 DBSERVER sshd[29165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.65.30.61  user=root
Mar 29 11:08:46 DBSERVER sshd[29165]: Failed password for root from 218.65.30.61 port 11857 ssh2
Mar 29 11:09:01 DBSERVER CRON[29172]: pam_unix(cron:session): session opened for user root by (uid=0)
Mar 29 11:09:01 DBSERVER CRON[29172]: pam_unix(cron:session): session closed for user root
Mar 29 11:10:01 DBSERVER CRON[29226]: pam_unix(cron:session): session opened for user root by (uid=0)
Mar 29 11:10:02 DBSERVER CRON[29226]: pam_unix(cron:session): session closed for user root
Mar 29 11:10:18 DBSERVER sshd[29238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.122.43.185  user=root
Mar 29 11:10:20 DBSERVER sshd[29238]: Failed password for root from 113.122.43.185 port 46017 ssh2
Mar 29 11:10:33 DBSERVER sshd[29238]: message repeated 5 times: [ Failed password for root from 113.122.43.185 port 46017 ssh2]
Mar 29 11:10:33 DBSERVER sshd[29238]: error: maximum authentication attempts exceeded for root from 113.122.43.185 port 46017 ssh2 [preauth]
Mar 29 11:10:33 DBSERVER sshd[29238]: Disconnecting: Too many authentication failures [preauth]
Mar 29 11:10:33 DBSERVER sshd[29238]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.122.43.185  user=root
Mar 29 11:10:33 DBSERVER sshd[29238]: PAM service(sshd) ignoring max retries; 6 > 3
Mar 29 11:11:36 DBSERVER sshd[29245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.7  user=root
Mar 29 11:11:38 DBSERVER sshd[29245]: Failed password for root from 116.31.116.7 port 24892 ssh2
Mar 29 11:11:43 DBSERVER sshd[29245]: message repeated 2 times: [ Failed password for root from 116.31.116.7 port 24892 ssh2]
Mar 29 11:11:43 DBSERVER sshd[29245]: Received disconnect from 116.31.116.7 port 24892:11:  [preauth]
Mar 29 11:11:43 DBSERVER sshd[29245]: Disconnected from 116.31.116.7 port 24892 [preauth]
Mar 29 11:11:43 DBSERVER sshd[29245]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.7  user=root
Mar 29 11:12:39 DBSERVER sshd[29247]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.7  user=root
Mar 29 11:12:41 DBSERVER sshd[29247]: Failed password for root from 116.31.116.7 port 26739 ssh2
Mar 29 11:12:45 DBSERVER sshd[29247]: message repeated 2 times: [ Failed password for root from 116.31.116.7 port 26739 ssh2]
Mar 29 11:12:45 DBSERVER sshd[29247]: Received disconnect from 116.31.116.7 port 26739:11:  [preauth]
Mar 29 11:12:45 DBSERVER sshd[29247]: Disconnected from 116.31.116.7 port 26739 [preauth]
Mar 29 11:12:45 DBSERVER sshd[29247]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.7  user=root
Mar 29 11:13:41 DBSERVER sshd[29249]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.7  user=root
Mar 29 11:13:43 DBSERVER sshd[29249]: Failed password for root from 116.31.116.7 port 27040 ssh2

banned IP still trying.

However when I check with sudo iptables -L INPUT -v -n I got this:

Chain INPUT (policy ACCEPT 228 packets, 18000 bytes)
 pkts bytes target     prot opt in     out     source               destination
 6050  435K f2b-sshd   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22

What am I doing wrong here?

How can I show all banned IP list?

Thanks in advance.

  • "Total" means total ever banned, not total currently banned. The only place you will find previously-banned addresses is in the logs (if you kept them). – Stop Harming Monica Jul 31 '18 at 11:08
  • in jail.local or jail.conf, you seem to have a small bantime. Make it 200m or even higher and then do sudo service fail2ban restart and then fail2ban-client status sshd – Allen King Oct 19 at 17:55
19

Please keep in mind that the fail2ban banning of IP is temporary in nature.

The best way to have a look at the full list of IPs that have been blocked would be to check the log file:

sudo zgrep 'Ban:' /var/log/fail2ban.log*

The following command can also give you a clean list of input rules:

sudo iptables -L INPUT -v -n | less
  • 3
    There's no colon in my logfiles (thus needed to adjust the grep). Leaving as a comment rather than an edit though, as I don't know how widespread this is / if this is a recent change. – kwah Apr 15 '18 at 15:54
  • Bear in mind that listing iptables rules only works in case iptables is your banning action. Sometimes this is not the case. – gilad mayani May 18 '18 at 10:09
  • @kwah same for me, no colon in the log file. Probably a recent change in the output, or a typo. – David Mordigal Jun 10 at 2:36
  • Remove the ':' after the search term 'Ban' because the ':' is not written in the log file anymore. So you will be able the see the blocked IPs again with the above mentioned command. – Mario Neubauer Jun 13 at 7:13
9

To view the complete line of iptables:

sudo iptables -L -n | awk '$1=="REJECT" && $4!="0.0.0.0/0"'

To view only the IP address:

sudo iptables -L -n | awk '$1=="REJECT" && $4!="0.0.0.0/0" {print $4}'

You can change "REJECT" by "DROP", depending of your case.

6

Similar to NA AE above with kwaa's comments included, this lists all IPs:

sudo zgrep 'Ban' /var/log/fail2ban.log*

but that output has so many lines. This counts lines of all logged banned (and likely unbanned) ip's:

sudo zgrep 'Ban' /var/log/fail2ban.log* | wc -l

The output from above command (with line count) should match 'Total Banned' count in fail2ban's status output:

fail2ban-client status sshd

tested in Ubuntu 18.04.1 LTS.

My output from 'wc -l' line:

7244

And from fail2ban's status, the same 7244 number is verified:

Status for the jail: sshd
|- Filter
|  |- Currently failed: 7
|  |- Total failed: 49457
|  `- File list:    /var/log/auth.log
`- Actions
   |- Currently banned: 9
   |- Total banned: 7244
   `- Banned IP list:   [...]
4

Just an FYI:

  • "Total banned" are the total IPs that have been banned for that jail (and probably have been unbanned).
  • "Currently banned" are the ONLY IPs that are currently banned for that jail (and the IP list confirms this).

Hope that helps.

4

if you want to see the list of banned IP with their timeout ( timeout expires they are removed from the banned pool ) you can use:

ipset list
2

This will show what is currently banned (REJECT) in the Chain fail2ban-ssh portion of iptables.

sudo iptables -L fail2ban-ssh -v -n
2

To add more generic answer:

Please note that iptables might not be correct answer and might not give you relevant information at all (for original poster it is). It depends on which value for banaction = [action] you are using in your DEFAULT or specific jail definition.

I have many small ARM powered boxes running linux but kernel does not have all relevant iptables modules available, so iptables will not work in that case.

*BSD might not have iptables at all and use use something like pf instead.

On my ARM boxes I am using route for blocking. It adds invalid route for banned IPs and therefore return packets are undeliverable and IP is essentially blocked. Works very well. In that case you can check banned IPs by using:

# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
# normal routing entries
0.0.0.0         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
# banned IPs (no gateway, no iface)
223.96.95.85    -               255.255.255.255 !H    0      -        0 -

You have many options for banning. And therefore many options to check ban list. Which one to use depends on your platform and preference. There are many pre-configured configuration files in: /etc/fail2ban/action.d/ to choose from.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.