| View previous topic :: View next topic |
| Author |
Message |
Crymson
Apprentice
Joined: 21 Mar 2004
Posts: 205
Location: New England
|
 Posted: Tue Mar 25, 2025 7:34 pm Post subject: SOLVED - fail2ban not respecting bantime |
 |
|
I setup fail2ban to keep my system safer and block bad actors. I have multiple jails defined in /etc/fail2ban/jail.local and they're working as I can see the effects in /var/log/messages, but it seems to be ignoring the bantime directive. I have bans ranging from 1w to 30d (not in seconds, those terms) which I understand are valid, but every time I see a ban take place in my log, it says "Banning for 86400 seconds" which is 1 day.
I'm not seeing anywhere in the configs that define a general bantime of 1d, and when I run | Code: | fail2ban-client --dp | grep bantime
['set', 'sshd', 'bantime', '30d']
['set', 'apache-auth', 'bantime', '30d']
['set', 'apache-noscript', 'bantime', '30d']
['set', 'apache-overflows', 'bantime', '30d']
['set', 'postfix', 'bantime', '30d']
['set', 'courier-auth', 'bantime', '30d']
['set', 'postfix-sasl', 'bantime', '1w']
['set', 'named-refused', 'bantime', '30d']
['set', 'postfix-flood-attack', 'bantime', '30d']
|
I see the bantimes that I have specified in jail.local as shown in the block above.
But here's an example from my log file:
| Code: | | Mar 25 12:34:56 <hostname> sshguard[5430]: Blocking "209.38.233.74/27" for 86400 secs (1 attacks in 0 secs, after 1 abuses over 0 secs.) |
Does anyone know why this is? I'm trying to prevent a lot of attacks, and would like the bans to be longer than 1d.
_________________
Knowledge is Power // Power Corrupts // Study Hard // Be Evil
Last edited by Crymson on Thu Mar 27, 2025 12:52 am; edited 1 time in total |
|
| Back to top |
|
 |
freke
Veteran
Joined: 23 Jan 2003
Posts: 1090
Location: Somewhere in Denmark
|
| Posted: Wed Mar 26, 2025 2:23 pm Post subject: |
|
|
sshguard != fail2ban
It seems like it's sshguard doing the banning there - not fail2ban. |
|
| Back to top |
|
|
Crymson
Apprentice
Joined: 21 Mar 2004
Posts: 205
Location: New England
|
| Posted: Thu Mar 27, 2025 12:51 am Post subject: |
|
|
Yeah you're right. I checked the sshguard conf file and it was indeed set to 86400. I bumped that up too, which will help.
I'll keep an eye on the logs, and see if there are any other abuses that may not be respecting bantime.
Thanks for pointing out my stupidity!
_________________
Knowledge is Power // Power Corrupts // Study Hard // Be Evil |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
