0

I have server with Debian 9. I have installed fail2ban and configured it. It work with sshd (ban IP on failed logins) but i can't make it work with apache-auth (IP is ban but iptables don't block it).

jail.local look like:

[DEFAULT]
bantime  = 720h
findtime  = 60m
banaction = iptables
mta = sendmail
destemail = my-email@example.com
action = %(action_mw)s
maxretry = 2

[sshd]
enabled = true

[apache-auth]
enabled = true

When i run compand:

fail2ban-client status sshd

it show banned IP. When i run command:

iptables -L -n

It show IPs from previous command. So it's working correct.

When i run:

fail2ban-client status apache-auth

It show ban IP (me).

iptables -L -n

Don't show any IP from previous list. Can be important iptables shows:

Chain f2b-apache-auth (0 references)

And i still can connect to server via WWW. Exactly same issue i had with nginx so i switched to apache, i was thinking this will solve my issue.

0

My jail.conf part for apache looks a bit different

[apache]
enabled  = true
port     = http,https
filter   = apache-auth
logpath  = /var/log/apache*/*error.log
maxretry = 6

You can find the loaded configuration with

fail2ban-client -d

You said you are testing locally. Make sure your IP not in the netmask given in ignoreip.

As the action is probably triggered in your case have a look for the entry actionban there and see if it actually adds the desired iptables rule.

Maybe var/log/fail2ban.log has more information?

  • 1
    yes there was but i was not able to find log for longer time :D After i have get it, it was quite easy :) – Small Web Dev Jan 18 at 14:29
0

I have found solution!

[apache-auth]
enabled = true
action   = iptables-multiport[port="http,https"]
port     = http,https

'action' was missing. fail2ban was sending port range and iptables was expecting single port... after adding such "action" all is working great.

So we can say it's solved.

@Jonas Eberle - your config is in all tutorials, unfortunately was also not working :(

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.