Quantcast
Channel: linuxadmin: Expanding Linux SysAdmin knowledge
Viewing all articles
Browse latest Browse all 17763

I sure could use some help with fail2ban logs.

$
0
0

Hi. My fail2ban logs does not show it doing anything other than provide information regarding my restarting it or changes I made to findtime and related configuration changes. No listing of protecting my ssh service at all.

Of course we need info. A section from my jail.local:
Defaults (in part) are:
bantime = 6000
findtime = 480
maxretry = 3

...

Action section

#Action shortcuts. To be used to define action parameter

# The simplest action to take: ban only

action_ = %(banaction)s[name=%(name)s, port="% (port)s", protocol="%(protocol)s", chain="%(chain)s"]

# ban & send an e-mail with whois report to the destemail.

actionmw = %(banaction)s[name=%(name)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] %(mta)s-whois[name=%(name_)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s", sendername="%(sendername)s"]

# ban & send an e-mail with whois report and relevant log lines

# to the destemail.

actionmwl = %(banaction)s[name=%(name)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] %(mta)s-whois-lines[name=%(name_)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"]

# Choose default action. To change, just override value of 'action' with the

# interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local

# globally (section [DEFAULT]) or per specific section

#action = %(action_)s

action = %(action_mwl)s

Jail section

[ssh]

enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log

maxretry = 3

from fail2ban.local:
logtarget = /var/log/fail2ban.log
loglevel = 3

Sorry, this is long.
root@vbox:/var/log# less /etc/fail2ban/jail.local
root@vbox:/var/log# fail2ban-client status
Status
|- Number of jail: 1
`- Jail list: ssh

root@vbox:/var/log# fail2ban-client --version | head -1
Fail2Ban v0.8.13


root@vbox:/var/log# ll fail2ban.log
-rw-r----- 1 root adm 0 Jun 26 06:25 fail2ban.log


root@vbox:/var/log# iptables -L fail2ban-SSH -n
iptables: No chain/target/match by that name.


That one bothers me, and I am unsure how to remedy it.

I didn't want to ask without giving enough information, but it sadly creates a wall of text. I have searched online, but haven't found a solution. Any ideas? I must have made a small error somewhere.

submitted by /u/GreatBigPig
[link] [comments]

Viewing all articles
Browse latest Browse all 17763

Trending Articles