0

I've a ton of errors like this in my fail2ban.log

fail2ban.actions        [13370]: ERROR   Failed to execute ban jail 'recidive' action 'iptables-multiport' info 'CallingMap({'ip': '164.132.49.140', 'matches': '2019-04-01 08:30:14,100 fail2ban.actions        [1415]: NOTICE  [sshd] Ban 164.132.49.140\n2019-04-01 23:08:43,345 fail2ban.actions        [26861]: NOTICE  [sshd] Ban 164.132.49.140\n2019-04-01 08:30:14,100 fail2ban.actions        [1415]: NOTICE  [sshd] Ban 164.132.49.140\n2019-04-01 23:08:43,345 fail2ban.actions        [26861]: NOTICE  [sshd] Ban 164.132.49.140', 'ipmatches': <function Actions.__checkBan.<locals>.<lambda> at 0x7fa4a8366598>, 'time': 1554154478.985568, 'ipjailfailures': <function Actions.__checkBan.<locals>.<lambda> at 0x7fa4a8366510>, 'ipfailures': <function Actions.__checkBan.<locals>.<lambda> at 0x7fa4a8366488>, 'failures': 4, 'ipjailmatches': <function Actions.__checkBan.<locals>.<lambda> at 0x7fa4a8366400>})': Error starting action

I see that this is a single-line error, but it looks to me like there is an error with the pattern matching or something else in the log has caused a loop because pattern now matches even the error rows.

EDIT I found these rows, in the log, probably related to the error

2019-04-01 23:44:35,895 fail2ban.action         [19570]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-recidive[ \t]' -- stdout: b''
2019-04-01 23:44:35,896 fail2ban.action         [19570]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-recidive[ \t]' -- stderr: b''
2019-04-01 23:44:35,897 fail2ban.action         [19570]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-recidive[ \t]' -- returned 1
2019-04-01 23:44:35,898 fail2ban.CommandAction  [19570]: ERROR   Invariant check failed. Trying to restore a sane environment
2019-04-01 23:44:36,114 fail2ban.action         [19570]: ERROR   iptables -w -N f2b-recidive
iptables -w -A f2b-recidive -j RETURN
iptables -w -I INPUT -p all -m multiport --dports 0:65535 -j f2b-recidive -- stdout: b''

This is my recidive definition in jail.local

[recidive]

enabled  = true
logpath  = /var/log/fail2ban.log
filter   = recidive
findtime = 86400
maxretry = 2
bantime  = 648000
protocol = all

My filter.d/recidive.conf has this line

failregex = ^(%(__prefix_line)s| %(_daemon)s%(__pid_re)s?:\s+)NOTICE\s+\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+<HOST>\s*$

And this is all for my knowledge.

I am on a ubuntu 16.04 if usefull.

Question is: how to debug the config error and even how to restore default working configuration. I have only another custom filter (pihole) and I know how to restore it but I have no idea if there is something like a reset for fail2ban config

0

This is actually my solution. Only the next hours will tell me if this is really the solution or not.

I stopped fail2ban

systemctl stop fail2ban

Then emptied its log

echo > /var/log/fail2ban.log

Then added an action to my recidive configuration

action   = iptables-allports[name=recidive, protocol=all]

Then restart faiilban service

systemctl start fail2ban

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.