Fail2ban: Difference between revisions

Revision as of 13:29, 18 March 2018

sudo cp /etc/fail2ban/fail2ban.conf /etc/fail2ban/fail2ban.local

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

to edit config edit the jail.local file!!!

sudo nano /etc/fail2ban/jail.local

Log Files

sudo nano /var/log/fail2ban.log

trying to resolve errors:

<poem> 018-03-14 19:45:55,363 fail2ban.action iptables -w -F f2b-recidive iptables -w -X f2b-recidive -- 2018-03-14 19:45:55,364 fail2ban.action iptables -w -F f2b-recidive iptables -w -X f2b-recidive -- 2018-03-14 19:45:55,365 fail2ban.action iptables -w -F f2b-recidive iptables -w -X f2b-recidive -- 2018-03-14 19:45:55,366 fail2ban.actions 2018-03-14 19:45:55,367 fail2ban.jail 2018-03-14 19:45:56,450 fail2ban.action iptables -w -F f2b-sshd iptables -w -X f2b-sshd -- stdout: 2018-03-14 19:45:56,451 fail2ban.action iptables -w -F f2b-sshd iptables -w -X f2b-sshd -- stderr: 2018-03-14 19:45:56,452 fail2ban.action iptables -w -F f2b-sshd iptables -w -X f2b-sshd -- returned 1 2018-03-14 19:45:56,453 fail2ban.actions 2018-03-14 19:45:56,454 fail2ban.jail 2018-03-14 19:45:57,452 fail2ban.jail 2018-03-14 19:45:57,457 fail2ban.server 2018-03-14 19:46:16,950 fail2ban.server 2018-03-14 19:46:16,972 fail2ban.database 2018-03-14 19:46:16,992 fail2ban.jail 2018-03-14 19:46:17,099 fail2ban.jail 2018-03-14 19:46:17,200 fail2ban.jail 2018-03-14 19:46:17,203 fail2ban.filter </poem> [571]: ERROR iptables -w -D INPUT -p tcp -j f2b-recidive stdout: b [571]: ERROR iptables -w -D INPUT -p tcp -j f2b-recidive stderr: b'iptables: Too many links.\n' [571]: ERROR iptables -w -D INPUT -p tcp -j f2b-recidive returned 1 [571]: ERROR Failed to stop jail 'recidive' action 'iptables-allports': Error stopping action [571]: INFO Jail 'recidive' stopped [571]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports 2222 -j f2b-sshd b [571]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports 2222 -j f2b-sshd b'iptables: Too many links.\n' [571]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports 2222 -j f2b-sshd [571]: ERROR Failed to stop jail 'sshd' action 'iptables-multiport': Error stopping action [571]: INFO Jail 'sshd' stopped [571]: INFO Jail 'sshd-ddos' stopped [571]: INFO Exiting Fail2ban [588]: INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.9.6 [588]: INFO Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3' [588]: INFO Creating new jail 'sshd' [588]: INFO Jail 'sshd' uses pyinotify {} [588]: INFO Initiated 'pyinotify' backend [588]: INFO Set jail log file encoding to UTF-8

steps taken:

sudo apt install python-pyinotify

sudo nano /etc/fail2ban/jail.local

changed: backend = auto to: backend = pyinotify

then: sudo systemctl restart fail2ban

I notice restarting f2b re-created the errors in the logs. It seems that the problem is with deleting the iptables rules (banned ips from recdrive)...it gets the 'too many links' error when it tries.

I think this is a pretty minor problem but it would be nice to fix. note the the attempt to fix above did nothing.

Revision as of 13:28, 18 March 2018 (view source) Ractive (talk \| contribs) No edit summary ← Older edit		Revision as of 13:29, 18 March 2018 (view source) Ractive (talk \| contribs) No edit summary Newer edit →
Line 57:		Line 57:
	I notice restarting f2b re-created the errors in the logs. It seems that the problem is with deleting the iptables rules (banned ips from recdrive)...it gets the 'too many links' error when it tries.		I notice restarting f2b re-created the errors in the logs. It seems that the problem is with deleting the iptables rules (banned ips from recdrive)...it gets the 'too many links' error when it tries.

	I think this is a pretty minor problem but it would be nice to fix.		I think this is a pretty minor problem but it would be nice to fix. note the the attempt to fix above did nothing.