Hi. My fail2ban logs does not show it doing anything other than provide information regarding my restarting it or changes I made to findtime and related configuration changes. No listing of protecting my ssh service at all.
Of course we need info. A section from my jail.local:
Defaults (in part) are:
bantime = 6000
findtime = 480
maxretry = 3
...
Action section
#Action shortcuts. To be used to define action parameter
# The simplest action to take: ban only
action_ = %(banaction)s[name=%(name)s, port="% (port)s", protocol="%(protocol)s", chain="%(chain)s"]
# ban & send an e-mail with whois report to the destemail.
actionmw = %(banaction)s[name=%(name)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] %(mta)s-whois[name=%(name_)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s", sendername="%(sendername)s"]
# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
actionmwl = %(banaction)s[name=%(name)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] %(mta)s-whois-lines[name=%(name_)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"]
# Choose default action. To change, just override value of 'action' with the
# interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local
# globally (section [DEFAULT]) or per specific section
#action = %(action_)s
action = %(action_mwl)s
Jail section
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
from fail2ban.local:
logtarget = /var/log/fail2ban.log
loglevel = 3
Sorry, this is long.
root@vbox:/var/log# less /etc/fail2ban/jail.local
root@vbox:/var/log# fail2ban-client status
Status
|- Number of jail: 1
`- Jail list: ssh
root@vbox:/var/log# fail2ban-client --version | head -1
Fail2Ban v0.8.13
root@vbox:/var/log# ll fail2ban.log
-rw-r----- 1 root adm 0 Jun 26 06:25 fail2ban.log
root@vbox:/var/log# iptables -L fail2ban-SSH -n
iptables: No chain/target/match by that name.
That one bothers me, and I am unsure how to remedy it.
I didn't want to ask without giving enough information, but it sadly creates a wall of text. I have searched online, but haven't found a solution. Any ideas? I must have made a small error somewhere.
[link] [comments]