Fail2ban not banning

Help! (Home for newbies)
21

Is this where you mean? If so, it is already set.

image
image1309×375 48.9 KB

Again, thanks for your help.

22

The rate of how IP is displayed in access logs demonstrates that it’s actually getting banned.

Try accessing your own server via SSH and entering a wrong password or providing a wrong key 
 make it fail and see on Webmin side in fail2ban module if it’s getting banned or not 
 It can be seen on a new Webmin / Networking ⇟ Fail2Ban Intrusion Detector: Jails Status page.

If you still believe there is a problem check throughout the output of the following commands:

ip a

firewall-cmd --list-all
systemctl status firewalld

systemctl status fail2ban
23

That was very helpful info Illia and gave me a lot to look at. Thank you.

I followed your suggestion to try to access the server in SSH using the wrong credentials (using a different IP to save myself being blocked) and Yes, after 3 attempts the IP was blocked. I then tried to FTP in and was also blocked again. So it does appear to be working.

I was not able to reproduce the symptom of the “already banned” message in Fail2ban though. Once a ban was in place the server simply stopped responding as expected but there was no entry in the fail2ban log that shows any further attempts.

Looking at the Webmin / Networking ⇟ Fail2Ban Intrusion Detector: Jails Status` page I note that the following is shown for FTP

image
image1541×382 47.2 KB

In the banned IP list (last column) it does not show the IP numbers that are banned only the nuimber “3001” which is clickable with the tooltip “remove 3001 from the banned list”. I wonder if not showing a list of banned IP numbers that is indicative of anything. I was exppecting a list of 36 IP numbers.

Other show a list of banned IP number like below.

image
image1152×346 20.9 KB

Each IP can be clicked on to remove it from the banned lsit and at the bottom it says “+2935 more” which I haven’t found a way to list those more within the interface.

Thanks again for your time.

24

I went back over some of the pages I had read online because I remember some seemed to fit this but I don’t want to edit places which are scary. Maybe someone would like to comment on this.

This one is nearly 8 years old so might be well past valid

Thanks.

25

For that ProFTPD issue. What is the output of fail2ban-client status proftpd command?

26

Nevermind, I see the issue. We will fix that for the next Webmin release.

27

Excellent, many thanks.

28

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.

29

For Fail2ban not banning with ProFTPd the fix and explanations are here: