2

On my Debian 8 server, I see lots of this error in fail2ban log.

 [27759]: ERROR   Failed to execute ban jail 'sshd' action 'iptables-multiport' info 'ActionInfo({'ip': '1.1.2.2', 'fam
ily': 'inet4', 'ip-rev': '2.2.1.1.', 'ip-host': '210994.cloudwaysapps.com', 'fid': '1.1.2.2', 'failures': 3, 'time': 1547974803.0, 'matches': 'Jan 20 04:00:01
 chat sshd[1326]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.1.2.2 \nJan 20 04:00:03 chat sshd[1326]: Failed password f
or invalid user guest from 1.1.2.2 port 40633 ssh2', 'restored': 0, 'F-*': {'matches': ['Jan 20 04:00:01 chat sshd[1326]: pam_unix(sshd:auth): authentication failure;
 logname= uid=0 euid=0 tty=ssh ruser= rhost=1.1.2.2 ', 'Jan 20 04:00:03 chat sshd[1326]: Failed password for invalid user guest from 1.1.2.2 port 40633 ssh2']
, 'failures': 3, 'mlfid': ' chat sshd[1326]: ', 'user': 'guest', 'ip4': '1.1.2.2'}, 'ipmatches': 'Jan 20 04:00:01 chat sshd[1326]: pam_unix(sshd:auth): authentication
 failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.1.2.2 \nJan 20 04:00:03 chat sshd[1326]: Failed password for invalid user guest from 1.1.2.2 port 40633
 ssh2', 'ipjailmatches': 'Jan 20 04:00:01 chat sshd[1326]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.1.2.2 \nJan 20 04
:00:03 chat sshd[1326]: Failed password for invalid user guest from 1.1.2.2 port 40633 ssh2', 'ipfailures': 3, 'ipjailfailures': 3})': Error banning 1.1.2.2
2019-01-20 04:01:24,018 fail2ban.actions  

I'm wondering what this error mean and how to fix it?

2

possible reason: duplicate IP table chains (you need to check your roles), if this is the issue you can fix it be doing the following:

  • stop f2b
  • restart iptables
  • backup your config-dir (/etc/fail2ban), just to compare (don't use it hereafter)
  • uninstall f2b
  • remove your config-dir (/etc/fail2ban), install f2b
  • create your own fail2ban.local, jail.local and make there the changes, enable jails etc.
    • start f2b

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.