1

I see these errors with a recent sshd.conf file. Is there a reason for the mdre-normal being set to nothing?

2017-07-10 10:51:42,218 fail2ban.filter         [10436]: WARNING Mutliline regex set for jail '%s' but maxlines not greater than 1
2017-07-10 10:51:42,231 fail2ban.filter         [10436]: WARNING Mutliline regex set for jail '%s' but maxlines not greater than 1
2017-07-10 10:51:42,245 fail2ban.filter         [10436]: WARNING Mutliline regex set for jail '%s' but maxlines not greater than 1
2017-07-10 10:51:42,255 fail2ban.filter         [10436]: ERROR   No 'host' group in '<mdre-<mode>>'
2017-07-10 10:51:42,255 fail2ban.transmitter    [10436]: WARNING Command ['set', 'sshd', 'addfailregex', '<mdre-<mode>>'] has failed. Received RegexException("No 'host' group in '<mdre-<mode>>'",)
2017-07-10 10:51:42,260 fail2ban.jail           [10436]: INFO    Creating new jail 'sshd-ddos'

unban errors:

2017-07-10 10:50:11,097 fail2ban.action         [3653]: ERROR   firewall-cmd --remove-source=185.56.82.23 --zone=drop && firewall-cmd --remove-source=185.56.82.23 --zone=drop --permanent -- stdout: b'success\n'
2017-07-10 10:50:11,097 fail2ban.action         [3653]: ERROR   firewall-cmd --remove-source=185.56.82.23 --zone=drop && firewall-cmd --remove-source=185.56.82.23 --zone=drop --permanent -- stderr: b''
2017-07-10 10:50:11,097 fail2ban.action         [3653]: ERROR   firewall-cmd --remove-source=185.56.82.23 --zone=drop && firewall-cmd --remove-source=185.56.82.23 --zone=drop --permanent -- killed with SIGTERM (return code: -15)
2017-07-10 10:50:11,098 fail2ban.actions        [3653]: ERROR   Failed to execute unban jail 'recidive' action 'custom-firewalld' info '{'ip': '185.56.82.23', 'failures': 5, 'time': 1499270396.6778345, 'matches': '2016-12-28 14:30:25,831 fail2ban.actions        [1884]
: NOTICE  [sshd] Ban 185.56.82.232016-12-28 15:37:59,825 fail2ban.actions        [1884]: NOTICE  [sshd] Ban 185.56.82.232016-12-28 16:45:28,589 fail2ban.actions        [1884]: NOTICE  [sshd] Ban 185.56.82.232016-12-28 17:52:37,468 fail2ban.actions        [1884]: NOTIC
E  [sshd] Ban 185.56.82.232016-12-28 18:59:56,325 fail2ban.actions        [1884]: NOTICE  [sshd] Ban 185.56.82.23'}': Error unbanning 185.56.82.23

cat sshd.conf I see that mdre-normal = is blank.

# Fail2Ban obsolete multiline example resp. test filter (previously sshd.conf)
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[DEFAULT]

_daemon = sshd

[Definition]

cmnfailre = ^%(__prefix_line_sl)s[aA]uthentication (?:failure|error|failed) for .* from <HOST>( via \S+)?\s*%(__suff)s$
         ^%(__prefix_line_sl)sUser not known to the underlying authentication module for .* from <HOST>\s*%(__suff)s$
         ^%(__prefix_line_sl)sFailed \S+ for (?P<cond_inv>invalid user )?(?P<user>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)) from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
         ^%(__prefix_line_sl)sROOT LOGIN REFUSED.* FROM <HOST>\s*%(__suff)s$
         ^%(__prefix_line_sl)s[iI](?:llegal|nvalid) user .*? from <HOST>%(__on_port_opt)s\s*$
         ^%(__prefix_line_sl)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*%(__suff)s$
         ^%(__prefix_line_sl)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*%(__suff)s$
         ^%(__prefix_line_sl)sUser .+ from <HOST> not allowed because not in any group\s*%(__suff)s$
         ^%(__prefix_line_sl)srefused connect from \S+ \(<HOST>\)\s*%(__suff)s$
         ^%(__prefix_line_sl)sReceived disconnect from <HOST>%(__on_port_opt)s:\s*3: .*: Auth fail%(__suff)s$
         ^%(__prefix_line_sl)sUser .+ from <HOST> not allowed because a group is listed in DenyGroups\s*%(__suff)s$
         ^%(__prefix_line_sl)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*%(__suff)s$
         ^%(__prefix_line_sl)spam_unix\(sshd:auth\):\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=<HOST>\s.*%(__suff)s$
         ^%(__prefix_line_sl)s(error: )?maximum authentication attempts exceeded for .* from <HOST>%(__on_port_opt)s(?: ssh\d*)? \[preauth\]$
         ^%(__prefix_line_ml1)sUser .+ not allowed because account is locked%(__prefix_line_ml2)sReceived disconnect from <HOST>: 11: .+%(__suff)s$
         ^%(__prefix_line_ml1)sDisconnecting: Too many authentication failures(?: for .+?)?%(__suff)s%(__prefix_line_ml2)sConnection closed by <HOST>%(__suff)s$
         ^%(__prefix_line_ml1)sConnection from <HOST>%(__on_port_opt)s%(__prefix_line_ml2)sDisconnecting: Too many authentication failures(?: for .+?)?%(__suff)s$

mdre-normal =

mdre-ddos =  ^%(__prefix_line_sl)sDid not receive identification string from <HOST>%(__suff)s$
             ^%(__prefix_line_sl)sConnection reset by <HOST>%(__on_port_opt)s%(__suff)s
             ^%(__prefix_line_ml1)sSSH: Server;Ltype: (?:Authname|Version|Kex);Remote: <HOST>-\d+;[A-Z]\w+:.*%(__prefix_line_ml2)sRead from socket failed: Connection reset by peer%(__suff)s$

mdre-extra = ^%(__prefix_line_sl)sReceived disconnect from <HOST>%(__on_port_opt)s:\s*14: No supported authentication methods available%(__suff)s$
             ^%(__prefix_line_sl)sUnable to negotiate with <HOST>%(__on_port_opt)s: no matching (?:cipher|key exchange method) found.
             ^%(__prefix_line_ml1)sConnection from <HOST>%(__on_port_opt)s%(__prefix_line_ml2)sUnable to negotiate a (?:cipher|key exchange method)%(__suff)s$

mdre-aggressive = %(mdre-ddos)s
                  %(mdre-extra)s

failregex = %(cmnfailre)s
            <mdre-<mode>>

# Parameter "mode": normal (default), ddos, extra or aggressive (combines all)
# Usage example (for jail.local):
#   [sshd]
#   mode = extra
#   # or another jail (rewrite filter parameters of jail):
#   [sshd-aggressive]
#   filter = sshd[mode=aggressive]
#
mode = normal

ignoreregex = 

# "maxlines" is number of log lines to buffer for multi-line regex searches
maxlines = 10

journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd

datepattern = {^LN-BEG}

# DEV Notes:
#
#   "Failed \S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because
#   it is coming before use of <HOST> which is not hard-anchored at the end as well,
#   and later catch-all's could contain user-provided input, which need to be greedily
#   matched away first.
#
# Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black

cat custom-firewalld.conf based on this suggestion.

[INCLUDES]
before  =

[Definition]
actionstart =
actionstop =
actioncheck =

actionban = firewall-cmd --add-source=<ip> --zone=drop && firewall-cmd --add-source=<ip> --zone=drop --permanent
actionunban = firewall-cmd --remove-source=<ip> --zone=drop && firewall-cmd --remove-source=<ip> --zone=drop --permanent

[Init]

1 Answer 1

0

Looks like I used a sshd.conf file from the newer 0.10 Fail2ban, which is not 100% compatible. This is the correct version for 0.95.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.