2

My fail2ban install is broken after a dist update. I have no idea why it stopped to work. The logfile is over weeks 0 byte. Even if I can see in my server logs that the client should be blocked.

Here is my jail.conf (comments removed):

[DEFAULT]
ignoreip = 127.0.0.1
bantime  = 600
maxretry = 3
backend = polling
destemail = root@localhost
banaction = iptables-multiport
mta = sendmail
protocol = tcp


action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
              %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s]
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
               %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s]
action = %(action_)s

[ssh]
enabled = true
port    = ssh
filter  = sshd
logpath  = /var/log/auth.log
maxretry = 6

#...

[ispconfig-w00tw00t]
enabled  = true
filter   = ispconfig-w00tw00t
action   = iptables-complete[name=ispconfig-w00tw00t]
logpath = /var/log/apache*/*access.log
maxretry = 1
bantime  = 86400

[block-phpmyadmin]
enabled  = true
filter   = block-phpmyadmin
action   = iptables-complete[name=block-phpmyadmin]
logpath = /var/log/apache*/*access.log
maxretry = 1
bantime  = 86400

And here comes my own two rules ispconfig-w00tw00t.conf:

[Definition]
failregex = ^<HOST> -.*"GET \/w00tw00t\.at.*".*
ignoreregex =

Any my block-phpmyadmin:

[Definition]
failregex = ^<HOST> -.*"GET .*php[Mm]y[Aa]dmin.*".*
ignoreregex =

I hacked a little the init.d script and got this error messages:

WARNING 'findtime' not defined in 'apache-noscript'. Using default value
WARNING 'findtime' not defined in 'pam-generic'. Using default value
WARNING 'findtime' not defined in 'vsftpd'. Using default value
WARNING 'findtime' not defined in 'xinetd-fail'. Using default value
WARNING 'findtime' not defined in 'block-phpmyadmin'. Using default value
WARNING 'findtime' not defined in 'ispconfig-w00tw00t'. Using default value
WARNING 'findtime' not defined in 'ssh-ddos'. Using default value
WARNING 'findtime' not defined in 'apache-multiport'. Using default value
WARNING 'findtime' not defined in 'apache-overflows'. Using default value
WARNING 'findtime' not defined in 'couriersmtp'. Using default value
WARNING 'findtime' not defined in 'wuftpd'. Using default value
WARNING 'findtime' not defined in 'ssh'. Using default value
ERROR  /etc/fail2ban/action.d/iptables-multiport.conf and /etc/fail2ban/action.d/iptables-multiport.local do not exist
ERROR  Error in action definition iptables-multiport[name=ssh, port="ssh", protocol="tcp]
ERROR  Errors in jail 'ssh'. Skipping...

And the deamon does not start. Not sure why.

2

Finally I got it manged to fix this error. The problem is that the action was renamed. So I needed to rename the action from iptables-complete[name=block-phpmyadmin] to iptables-allports. Now it runs fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.