As per documentation, setting jail bantime to a negative value should result in a permanent ban. However once that is done, the following behavior changes, compared to when setting bantime to a positive integer:
ipset list doesn't show fail2ban-sshd hash table
firewall-cmd --direct --get-all-rules is empty
/var/log/fail2ban.log becomes a single line. interesting entry
sshd: Invalid user ubuntu from 18.104.22.168 port 37477', 'ip': '22.214.171.124', 'ipmatches': at 0x7f4588f9dc08>, 'ipfailures': at 0x7f4588f9daa0>, 'time': 1536301842.088076, 'failures': 1443, 'ipjailfailures': at 0x7f4588f9dd70>})': Error banning 126.96.36.199
/var/log/messages has the following
firewalld: WARNING: '/usr/sbin/iptables-restore --wait=2 -n' failed: iptables-restore v1.4.21: Set fail2ban-sshd doesn't exist.#012#012Error occurred at line: 2#012Try 'iptables-restore -h' or 'iptables-restore --help' for more information. firewalld: ERROR: COMMAND_FAILED
The only command working as expected is
fail2ban-client status sshd, however the IPs that are shown to be banned still try to connect. I think the root of all problems is that ipset isn't created for whatever reason once the integer is negative.
Any ideas? Also, does the command
fail2ban-client reload has the same affect as
systemctl restart fail2ban.service when applying new configuration?
In my case, /etc/fail2ban/jail.d/local.conf
[sshd] enabled = true bantime = -1 findtime = 3600 maxretry = 5 action = %(action_)s