Ele!
Acabei de configurar um novo servidor e instalei o fail2ban também, mas ele não está me banindo quando eu continuo tentando se conectar com a senha errada
fail2ban.log:
2018-03-23 12:46:29,363 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:46:30,747 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:46:33,346 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:46:35,515 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:46:36,372 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:47:45,471 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:47:46,820 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:47:49,503 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:47:50,458 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:47:51,893 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:48:49,699 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:48:51,835 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:48:52,531 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:48:54,477 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:48:57,056 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:50:53,240 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:50:53,677 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:50:55,065 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:50:58,253 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:51:00,494 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:51:00,685 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:52:06,119 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:52:08,300 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:52:11,583 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:52:11,773 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:52:13,498 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:53:07,823 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:53:09,712 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:53:09,842 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:53:11,718 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:53:13,696 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:54:37,181 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:54:37,949 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:54:39,092 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:54:40,906 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:54:42,616 fail2ban.filter [9756]: INFO [sshd] Found [my ip]
2018-03-23 12:54:42,955 fail2ban.actions [9756]: NOTICE [sshd] [my ip] already banned
2018-03-23 12:54:52,074 fail2ban.action [9756]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-sshd[ \t]' -- stdout: ''
2018-03-23 12:54:52,075 fail2ban.action [9756]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-sshd[ \t]' -- stderr: ''
2018-03-23 12:54:52,075 fail2ban.action [9756]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-sshd[ \t]' -- returned 1
2018-03-23 12:54:52,075 fail2ban.CommandAction [9756]: ERROR Invariant check failed. Trying to restore a sane environment
2018-03-23 12:54:52,180 fail2ban.action [9756]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports ssh -j f2b-sshd
iptables -w -F f2b-sshd
iptables -w -X f2b-sshd -- stdout: ''
2018-03-23 12:54:52,181 fail2ban.action [9756]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports ssh -j f2b-sshd
iptables -w -F f2b-sshd
iptables -w -X f2b-sshd -- stderr: "iptables v1.4.21: Couldn't load target 'f2b-sshd':No such file or directory\n\nTry 'iptables -h' or 'iptables --help' for more information.\niptables: No chain/target/match by that name.\niptables: No chain/target/match by that name.\n"
2018-03-23 12:54:52,181 fail2ban.action [9756]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports ssh -j f2b-sshd
iptables -w -F f2b-sshd
iptables -w -X f2b-sshd -- returned 1
2018-03-23 12:54:52,181 fail2ban.actions [9756]: ERROR Failed to execute unban jail 'sshd' action 'iptables-multiport' info '{'matches': '2018-03-23T11:53:46.707058149-210-194-176.colo.transip.net sshd[27676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip-[my ip].ip.prioritytelecom.net user=root2018-03-23T11:53:48.733188149-210-194-176.colo.transip.net sshd[27676]: Failed password for root from [my ip] port 31224 ssh22018-03-23T11:54:51.709842149-210-194-176.colo.transip.net sshd[27676]: Failed password for root from [my ip] port 31224 ssh2', 'ip': '[my ip]', 'time': 1521802491.930057, 'failures': 3}': Error stopping action
Então, quando eu desligo o arquivo de log, vejo minhas tentativas de login ssh sendo registradas, mas após a 3ª tentativa eu continuo tentando, se eu usar a senha correta após a 10ª tentativa, por exemplo, ele me conectará. / p>
Também recebo erros (vistos no final do arquivo de log) de vez em quando.
my jail.local:
[DEFAULT]
#ban n hosts for one hour:
bantime = 3600
#maxtrys
maxretry = 3
# Override /etc/fail2ban/jail.d/00-firewalld.conf:
banaction = iptables-multiport
[sshd]
enabled = true
Alguém tem uma idéia do porquê isso está acontecendo?