[Fail2Ban] Reagiert nicht, unternimmt nichts

D

DJFelipe

New Member
Huhu Ihr,

folgendes Problem. Fail2ban agiert nicht richtig auf meinem Server.
Debian 5.0
Kernel 2.6.35.6
Fail2Ban 0.8.4

LogLevel der SSHd sowie Fail2Ban stehen beide auf 'VERBOSE'

iptables -L
Code: 
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
fail2ban-SSH  tcp  --  anywhere             anywhere            tcp dpt:ssh
DROP       all  --  173-10-225-146-BusName-WestFlorida.hfc.comcastbusiness.net  anywhere
DROP       all  --  c.ecua.net.ec        anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain fail2ban-SSH (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

jail.conf:
Code: 
# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision: 747 $
#

# The DEFAULT allows a global definition of the options. They can be override
# in each jail afterwards.

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 78.159.120.221 78.159.123.73 178.162.174.79 10.0.0.1 10.0.0.2 10.0.0.3

# "bantime" is the number of seconds that a host is banned.
bantime  = 600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 3

# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto". This option can be overridden in
# each jail too (use "gamin" for a jail and "polling" for another).
#
# gamin:   requires Gamin (a file alteration monitor) to be installed. If Gamin
#          is not installed, Fail2ban will use polling.
# polling: uses a polling algorithm which does not require external libraries.
# auto:    will choose Gamin if available and polling otherwise.
backend = auto


# This jail corresponds to the standard configuration in Fail2ban 0.6.
# The mail-whois action send a notification e-mail with a whois request
# in the body.

[ssh-iptables]

enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]
           sendmail-whois[name=SSH, [email protected], [email protected]]
logpath  = /var/log/auth.log
maxretry = 3

filter.d/sshd.conf:
Code: 
# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision: 728 $
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf


[Definition]

_daemon = sshd

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values:  TEXT
#
failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
            ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
            ^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
            ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
            ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$
            ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
            ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
            ^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\s*$
            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$


Jetzt kommt folgendes:
Wenn ich fail2ban-regex manuell ausführe und über die auth.log von der sshd rennen lasse, findet er die IP's. Selbstständig findet er die aber nicht :confused:

fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
Code: 
Running tests
=============

Use regex file : /etc/fail2ban/filter.d/sshd.conf
Use log file   : /var/log/auth.log
...
Date template hits:
22768 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s): <Month/Day/Year@Hour:Minute:Second>

Success, the total number of match is 448

However, look at the above section 'Running tests' which could contain important
information.


Was stimmt hier jetzt nicht?


Tante Edith:
Hier noch die fail2ban.log
Code: 
2011-10-16 14:47:10,539 fail2ban.server : INFO   Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.4
2011-10-16 14:47:10,541 fail2ban.comm   : DEBUG  Command: ['add', 'ssh-iptables', 'auto']
2011-10-16 14:47:10,542 fail2ban.jail   : INFO   Creating new jail 'ssh-iptables'
2011-10-16 14:47:10,542 fail2ban.jail   : INFO   Jail 'ssh-iptables' uses poller
2011-10-16 14:47:10,589 fail2ban.filter : DEBUG  Created Filter
2011-10-16 14:47:10,589 fail2ban.filter : DEBUG  Created FilterPoll
2011-10-16 14:47:10,591 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addlogpath', '/var/log/auth.log']
2011-10-16 14:47:10,592 fail2ban.filter : INFO   Added logfile = /var/log/auth.log
2011-10-16 14:47:10,594 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'maxretry', '3']
2011-10-16 14:47:10,594 fail2ban.filter : INFO   Set maxRetry = 3
2011-10-16 14:47:10,596 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addignoreip', '127.0.0.1']
2011-10-16 14:47:10,596 fail2ban.filter : DEBUG  Add 127.0.0.1 to ignore list
2011-10-16 14:47:10,598 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addignoreip', '78.159.120.221']
2011-10-16 14:47:10,599 fail2ban.filter : DEBUG  Add 78.159.120.221 to ignore list
2011-10-16 14:47:10,600 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addignoreip', '78.159.123.73']
2011-10-16 14:47:10,601 fail2ban.filter : DEBUG  Add 78.159.123.73 to ignore list
2011-10-16 14:47:10,603 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addignoreip', '178.162.174.79']
2011-10-16 14:47:10,603 fail2ban.filter : DEBUG  Add 178.162.174.79 to ignore list
2011-10-16 14:47:10,605 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addignoreip', '10.0.0.1']
2011-10-16 14:47:10,606 fail2ban.filter : DEBUG  Add 10.0.0.1 to ignore list
2011-10-16 14:47:10,608 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addignoreip', '10.0.0.2']
2011-10-16 14:47:10,608 fail2ban.filter : DEBUG  Add 10.0.0.2 to ignore list
2011-10-16 14:47:10,610 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addignoreip', '10.0.0.3']
2011-10-16 14:47:10,611 fail2ban.filter : DEBUG  Add 10.0.0.3 to ignore list
2011-10-16 14:47:10,614 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'findtime', '600']
2011-10-16 14:47:10,615 fail2ban.filter : INFO   Set findtime = 600
2011-10-16 14:47:10,618 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'bantime', '600']
2011-10-16 14:47:10,618 fail2ban.actions: INFO   Set banTime = 600
2011-10-16 14:47:10,621 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:)?\\s*(?:error: PAM: )?Authentication failure for .* from <HOST>\\s*$']
2011-10-16 14:47:10,632 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:)?\\s*(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\\s*$']
2011-10-16 14:47:10,643 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:)?\\s*Failed (?:password|publickey) for .* from <HOST>(?: port \\d*)?(?: ssh\\d*)?$']
2011-10-16 14:47:10,656 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:)?\\s*ROOT LOGIN REFUSED.* FROM <HOST>\\s*$']
2011-10-16 14:47:10,672 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:)?\\s*[iI](?:llegal|nvalid) user .* from <HOST>\\s*$']
2011-10-16 14:47:10,686 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:)?\\s*User \\S+ from <HOST> not allowed because not listed in AllowUsers$']
2011-10-16 14:47:10,701 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:)?\\s*authentication failure; logname=\\S* uid=\\S* euid=\\S* tty=\\S* ruser=\\S* rhost=<HOST>(?:\\s+user=.*)?\\s*$']
2011-10-16 14:47:10,728 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:)?\\s*refused connect from \\S+ \\(<HOST>\\)\\s*$']
2011-10-16 14:47:10,746 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:)?\\s*Address <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\\s*$']
2011-10-16 14:47:10,769 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addfailregex', "^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:)?\\s*User \\S+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$"]
2011-10-16 14:47:10,793 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addaction', 'iptables']
2011-10-16 14:47:10,793 fail2ban.actions.action: DEBUG  Created Action
2011-10-16 14:47:10,795 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'actionban', 'iptables', 'iptables -I fail2ban-<name> 1 -s <ip> -j DROP']
2011-10-16 14:47:10,795 fail2ban.actions.action: DEBUG  Set actionBan = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
2011-10-16 14:47:10,797 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'actionstop', 'iptables', 'iptables -D INPUT -p <protocol> --dport <port> -j fail2ban-<name>\niptables -F fail2ban-<name>\niptables -X fail2ban-<name>']
2011-10-16 14:47:10,798 fail2ban.actions.action: DEBUG  Set actionStop = iptables -D INPUT -p <protocol> --dport <port> -j fail2ban-<name>
iptables -F fail2ban-<name>
iptables -X fail2ban-<name>
2011-10-16 14:47:10,800 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'actionstart', 'iptables', 'iptables -N fail2ban-<name>\niptables -A fail2ban-<name> -j RETURN\niptables -I INPUT -p <protocol> --dport <port> -j fail2ban-<name>']
2011-10-16 14:47:10,800 fail2ban.actions.action: DEBUG  Set actionStart = iptables -N fail2ban-<name>
iptables -A fail2ban-<name> -j RETURN
iptables -I INPUT -p <protocol> --dport <port> -j fail2ban-<name>
2011-10-16 14:47:10,802 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'actionunban', 'iptables', 'iptables -D fail2ban-<name> -s <ip> -j DROP']
2011-10-16 14:47:10,803 fail2ban.actions.action: DEBUG  Set actionUnban = iptables -D fail2ban-<name> -s <ip> -j DROP
2011-10-16 14:47:10,804 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'actioncheck', 'iptables', 'iptables -n -L INPUT | grep -q fail2ban-<name>']
2011-10-16 14:47:10,805 fail2ban.actions.action: DEBUG  Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-<name>
2011-10-16 14:47:10,807 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'setcinfo', 'iptables', 'protocol', 'tcp']
2011-10-16 14:47:10,809 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'setcinfo', 'iptables', 'name', 'SSH']
2011-10-16 14:47:10,811 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'setcinfo', 'iptables', 'port', 'ssh']
2011-10-16 14:47:10,813 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'addaction', 'sendmail-whois']
2011-10-16 14:47:10,814 fail2ban.actions.action: DEBUG  Created Action
2011-10-16 14:47:10,817 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'actionban', 'sendmail-whois', 'printf %b "Subject: [Fail2Ban] <name>: banned <ip>\nFrom: Fail2Ban <<sender>>\nTo: <dest>\\n\nHi,\\n\nThe IP <ip> has just been banned by Fail2Ban after\n<failures> attempts against <name>.\\n\\n\nHere are more information about <ip>:\\n\n`/usr/bin/whois <ip>`\\n\nRegards,\\n\nFail2Ban" | /usr/sbin/sendmail -f <sender> <dest>']
2011-10-16 14:47:10,818 fail2ban.actions.action: DEBUG  Set actionBan = printf %b "Subject: [Fail2Ban] <name>: banned <ip>
From: Fail2Ban <<sender>>
To: <dest>\n
Hi,\n
The IP <ip> has just been banned by Fail2Ban after
<failures> attempts against <name>.\n\n
Here are more information about <ip>:\n
`/usr/bin/whois <ip>`\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
2011-10-16 14:47:10,822 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'actionstop', 'sendmail-whois', 'printf %b "Subject: [Fail2Ban] <name>: stopped\nFrom: Fail2Ban <<sender>>\nTo: <dest>\\n\nHi,\\n\nThe jail <name> has been stopped.\\n\nRegards,\\n\nFail2Ban" | /usr/sbin/sendmail -f <sender> <dest>']
2011-10-16 14:47:10,822 fail2ban.actions.action: DEBUG  Set actionStop = printf %b "Subject: [Fail2Ban] <name>: stopped
From: Fail2Ban <<sender>>
To: <dest>\n
Hi,\n
The jail <name> has been stopped.\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
2011-10-16 14:47:10,824 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'actionstart', 'sendmail-whois', 'printf %b "Subject: [Fail2Ban] <name>: started\nFrom: Fail2Ban <<sender>>\nTo: <dest>\\n\nHi,\\n\nThe jail <name> has been started successfully.\\n\nRegards,\\n\nFail2Ban" | /usr/sbin/sendmail -f <sender> <dest>']
2011-10-16 14:47:10,825 fail2ban.actions.action: DEBUG  Set actionStart = printf %b "Subject: [Fail2Ban] <name>: started
From: Fail2Ban <<sender>>
To: <dest>\n
Hi,\n
The jail <name> has been started successfully.\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
2011-10-16 14:47:10,827 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'actionunban', 'sendmail-whois', '']
2011-10-16 14:47:10,827 fail2ban.actions.action: DEBUG  Set actionUnban = 
2011-10-16 14:47:10,829 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'actioncheck', 'sendmail-whois', '']
2011-10-16 14:47:10,830 fail2ban.actions.action: DEBUG  Set actionCheck = 
2011-10-16 14:47:10,831 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'setcinfo', 'sendmail-whois', 'dest', '[email protected]']
2011-10-16 14:47:10,833 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'setcinfo', 'sendmail-whois', 'name', 'SSH']
2011-10-16 14:47:10,835 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-iptables', 'setcinfo', 'sendmail-whois', 'sender', '[email protected]']
2011-10-16 14:47:10,837 fail2ban.comm   : DEBUG  Command: ['start', 'ssh-iptables']
2011-10-16 14:47:10,838 fail2ban.jail   : INFO   Jail 'ssh-iptables' started
2011-10-16 14:47:10,838 fail2ban.filter : DEBUG  /var/log/auth.log has been modified
2011-10-16 14:47:10,840 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-10-16 14:47:10,838 fail2ban.actions.action: DEBUG  iptables -N fail2ban-SSH
iptables -A fail2ban-SSH -j RETURN
iptables -I INPUT -p tcp --dport ssh -j fail2ban-SSH
2011-10-16 14:47:10,856 fail2ban.actions.action: DEBUG  iptables -N fail2ban-SSH
iptables -A fail2ban-SSH -j RETURN
iptables -I INPUT -p tcp --dport ssh -j fail2ban-SSH returned successfully
2011-10-16 14:47:10,857 fail2ban.actions.action: DEBUG  printf %b "Subject: [Fail2Ban] SSH: started
From: Fail2Ban <[email protected]>
To: [email protected]\n
Hi,\n
The jail SSH has been started successfully.\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f [email protected] [email protected]
2011-10-16 14:47:10,879 fail2ban.actions.action: DEBUG  printf %b "Subject: [Fail2Ban] SSH: started
From: Fail2Ban <[email protected]>
To: [email protected]\n
Hi,\n
The jail SSH has been started successfully.\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f [email protected] [email protected] returned successfully
 
Last edited by a moderator:
Hast du es evtl. von einer IP getestet, die in ignoreip steht?

Laut dem IPTABLES hat Fail2Ban bereits 2 IPs gesperrt.
fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh
DROP all -- 173-10-225-146-BusName-WestFlorida.hfc.comcastbusiness.net anywhere
DROP all -- c.ecua.net.ec anywhere
Click to expand...


Ansonsten, falls ich nichts übersehen hab, läuft Fail2Ban evtl. in einer VM, wo die IPs ansonsten nicht korrekt weitergeleitet werden?
 
die 2 einträge sind von mir manuell gesetzt, nicht von fail2ban!
Und eine VM bzw unter einer VM läuft das ganze nicht. Ist ein ganz normaler root

Die testmaschine steht leider nicht in der ignore...

Das ist ja das seltsame...
 
blocklist said:
Ein grep nach der IP im auth.log hat auch entsprechende Einträge gelistet?
Click to expand...
Kleiner Auszug der /var/log/auth.log:
Code: 
Oct 16 06:03:31 XXXXX sshd[29746]: Failed password for root from 61.236.182.11 port 20394 ssh2
Oct 16 06:03:34 XXXXX sshd[29756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.236.182.11  user=root
Oct 16 06:03:36 XXXXX sshd[29756]: Failed password for root from 61.236.182.11 port 22098 ssh2
Oct 16 06:03:39 XXXXX sshd[29767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.236.182.11  user=root
Oct 16 06:03:41 XXXXX sshd[29767]: Failed password for root from 61.236.182.11 port 23637 ssh2
Oct 16 06:03:44 XXXXX sshd[29780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.236.182.11  user=root
Oct 16 06:03:46 XXXXX sshd[29780]: Failed password for root from 61.236.182.11 port 25080 ssh2
Oct 16 06:03:49 XXXXX sshd[29792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.236.182.11  user=root
Oct 16 06:03:51 XXXXX sshd[29792]: Failed password for root from 61.236.182.11 port 26622 ssh2
Oct 16 06:03:54 XXXXX sshd[29802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.236.182.11  user=root
blocklist said:
Ist die Zeit auf dem Server korrekt?
Click to expand...
Aktiver Crontab als root:
Code: 
0 0 * * * /usr/sbin/ntpdate ptbtime1.ptb.de > /dev/null 2>&1

Die IP oben ist jetzt nicht die, mit der ich getestet habe, allerdings als Beispiel brauchbar :)
 
Soderla... Neue erkenntnisse :)

Nach einer langen Nacht (dist-upgrade sowie Kernel backen etc) bin ich nun zu folgendem ergebnis gekommen:
Es scheint an Debian zu liegen! Die gleichen Config's funktionieren auf 5.0 NICHT, aber auf 6.0 absolut ohne probleme:eek:

/var/log/fail2ban.log
Code: 
2011-10-18 06:12:34,652 fail2ban.actions: WARNING [ssh] Ban 212.87.21.104
2011-10-18 06:22:35,255 fail2ban.actions: WARNING [ssh] Unban 212.87.21.104
2011-10-18 06:23:16,307 fail2ban.actions: WARNING [ssh] Ban 49.212.35.60
2011-10-18 06:33:16,893 fail2ban.actions: WARNING [ssh] Unban 49.212.35.60
2011-10-18 10:08:45,806 fail2ban.actions: WARNING [ssh] Ban 106.187.35.136
2011-10-18 10:18:46,430 fail2ban.actions: WARNING [ssh] Unban 106.187.35.136
2011-10-18 10:37:53,616 fail2ban.actions: WARNING [ssh] Ban 61.180.25.132
2011-10-18 10:47:54,207 fail2ban.actions: WARNING [ssh] Unban 61.180.25.132
 
You must log in or register to reply here.
Back
Top