Code Monkey home page Code Monkey logo

fail2ban-blacklist-jail-for-repeat-offenders-with-perma-extended-banning's Issues

Unbanning

Is removing from the black list and iptables sufficient? Will the ip not get re-blacklisted if it's in the fail2ban log files?

Also, what stops the emails for this jail? I don't quite understand the magic.

Blacklist JAIL for Repeat Offenders

Hello,

I’m having problem with repeats offenders. I’m using fail2ban 0.9.6 on Debian 8. flowed this link https://github.com/mitchellkrogza/Fail2Ban-Blacklist-JAIL-for-Repeat-Offenders-with-Perma-Extended-Banning
But iptable are allowing after blacklist IP. I don’t know how to diagnose this problem any advice will be appreciate.

This is just one IP From fail2ban.log

:226: 2017-05-10 20:41:56,473 fail2ban.filter [660]: INFO [asterisk] Found 95.141.35.200
:274: 2017-05-10 20:46:39,665 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:278: 2017-05-10 20:51:26,037 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:279: 2017-05-10 20:56:06,140 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:280: 2017-05-10 20:56:06,797 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:281: 2017-05-10 20:56:06,802 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:293: 2017-05-10 21:06:07,047 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:294: 2017-05-10 21:10:26,835 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:299: 2017-05-10 21:15:08,719 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:308: 2017-05-10 21:19:53,933 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:309: 2017-05-10 21:19:54,535 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:310: 2017-05-10 21:19:54,539 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:323: 2017-05-10 21:29:54,584 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:330: 2017-05-10 21:34:01,234 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:341: 2017-05-10 21:38:45,376 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:346: 2017-05-10 21:43:26,882 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:347: 2017-05-10 21:43:27,051 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:348: 2017-05-10 21:43:27,055 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:349: 2017-05-10 21:43:27,425 fail2ban.actions [1590]: NOTICE [blacklist] Ban 95.141.35.200
:357: 2017-05-10 21:53:27,099 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:359: 2017-05-10 21:57:39,762 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:364: 2017-05-10 22:02:26,486 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:379: 2017-05-10 22:07:09,948 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:380: 2017-05-10 22:07:10,584 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:381: 2017-05-10 22:07:10,587 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:391: 2017-05-10 22:17:10,619 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:396: 2017-05-10 22:21:32,252 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:399: 2017-05-10 22:26:16,130 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:406: 2017-05-10 22:31:06,550 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:407: 2017-05-10 22:31:07,117 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:408: 2017-05-10 22:31:07,121 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:415: 2017-05-10 22:41:07,157 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:428: 2017-05-10 22:45:16,255 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:435: 2017-05-10 22:49:59,264 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:438: 2017-05-10 22:54:39,769 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:439: 2017-05-10 22:54:40,588 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:440: 2017-05-10 22:54:40,593 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:441: 2017-05-10 22:54:41,086 fail2ban.actions [1590]: NOTICE [blacklist] 95.141.35.200 already banned
:461: 2017-05-10 23:04:40,834 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:465: 2017-05-10 23:08:56,267 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:477: 2017-05-10 23:13:38,831 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:485: 2017-05-10 23:18:20,771 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:486: 2017-05-10 23:18:21,305 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:487: 2017-05-10 23:18:21,308 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:511: 2017-05-10 23:28:21,355 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:518: 2017-05-10 23:32:30,408 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:523: 2017-05-10 23:37:18,397 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:527: 2017-05-10 23:42:02,893 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:528: 2017-05-10 23:42:03,626 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:529: 2017-05-10 23:42:03,630 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:538: 2017-05-10 23:52:03,862 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:541: 2017-05-10 23:56:23,004 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:557: 2017-05-11 00:02:22,012 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:566: 2017-05-11 00:10:17,283 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:586: 2017-05-11 00:15:16,818 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:593: 2017-05-11 00:20:07,366 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:594: 2017-05-11 00:20:07,610 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:595: 2017-05-11 00:20:07,614 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:596: 2017-05-11 00:20:08,278 fail2ban.actions [1590]: NOTICE [blacklist] 95.141.35.200 already banned
:602: 2017-05-11 00:30:07,638 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:609: 2017-05-11 00:34:16,129 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:611: 2017-05-11 00:39:06,425 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:623: 2017-05-11 00:43:46,923 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:624: 2017-05-11 00:43:47,076 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:625: 2017-05-11 00:43:47,079 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:636: 2017-05-11 00:53:47,101 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:641: 2017-05-11 00:59:01,587 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:648: 2017-05-11 01:04:06,496 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:651: 2017-05-11 01:09:06,732 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:662: 2017-05-11 01:13:58,104 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:669: 2017-05-11 01:19:04,142 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:670: 2017-05-11 01:19:04,709 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:671: 2017-05-11 01:19:04,712 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:678: 2017-05-11 01:29:04,735 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:682: 2017-05-11 01:33:45,960 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:687: 2017-05-11 01:38:30,066 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:690: 2017-05-11 01:43:09,534 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:691: 2017-05-11 01:43:10,022 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:692: 2017-05-11 01:43:10,026 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:693: 2017-05-11 01:43:10,380 fail2ban.actions [1590]: NOTICE [blacklist] 95.141.35.200 already banned
:704: 2017-05-11 01:53:10,290 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:707: 2017-05-11 01:57:32,331 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:712: 2017-05-11 02:02:17,842 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:719: 2017-05-11 02:06:59,171 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:720: 2017-05-11 02:06:59,770 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:721: 2017-05-11 02:06:59,774 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:726: 2017-05-11 02:16:59,820 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:731: 2017-05-11 02:21:05,402 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:734: 2017-05-11 02:25:45,477 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:737: 2017-05-11 02:30:27,965 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:738: 2017-05-11 02:30:28,251 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:739: 2017-05-11 02:30:28,255 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:750: 2017-05-11 02:40:28,290 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:751: 2017-05-11 02:44:35,868 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:757: 2017-05-11 02:49:35,626 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:764: 2017-05-11 02:54:20,159 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:765: 2017-05-11 02:54:20,766 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:766: 2017-05-11 02:54:20,769 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:767: 2017-05-11 02:54:21,740 fail2ban.actions [1590]: NOTICE [blacklist] 95.141.35.200 already banned
:774: 2017-05-11 03:04:20,790 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:779: 2017-05-11 03:08:28,679 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:789: 2017-05-11 03:13:10,301 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:795: 2017-05-11 03:17:55,999 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:796: 2017-05-11 03:17:56,229 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:797: 2017-05-11 03:17:56,232 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:823: 2017-05-11 03:27:56,244 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:838: 2017-05-11 03:32:11,619 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:843: 2017-05-11 03:37:00,855 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:847: 2017-05-11 03:41:42,698 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:848: 2017-05-11 03:41:42,718 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:849: 2017-05-11 03:41:42,721 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:858: 2017-05-11 03:51:42,983 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:860: 2017-05-11 03:56:07,988 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:864: 2017-05-11 04:00:49,297 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:873: 2017-05-11 04:05:33,522 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:874: 2017-05-11 04:05:34,453 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:875: 2017-05-11 04:05:34,457 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:876: 2017-05-11 04:05:35,043 fail2ban.actions [1590]: NOTICE [blacklist] 95.141.35.200 already banned
:880: 2017-05-11 04:15:34,501 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:885: 2017-05-11 04:19:39,824 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:903: 2017-05-11 04:24:22,187 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:905: 2017-05-11 04:29:05,431 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:906: 2017-05-11 04:29:05,961 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:907: 2017-05-11 04:29:05,965 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:924: 2017-05-11 04:39:06,605 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:927: 2017-05-11 04:43:13,709 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:933: 2017-05-11 04:47:57,274 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:940: 2017-05-11 04:52:42,933 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:941: 2017-05-11 04:52:43,293 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:942: 2017-05-11 04:52:43,296 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:950: 2017-05-11 05:02:43,337 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:966: 2017-05-11 05:06:55,354 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:978: 2017-05-11 05:11:39,330 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:983: 2017-05-11 05:16:24,645 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:984: 2017-05-11 05:16:24,812 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:985: 2017-05-11 05:16:24,816 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:986: 2017-05-11 05:16:25,361 fail2ban.actions [1590]: NOTICE [blacklist] 95.141.35.200 already banned
:1006: 2017-05-11 05:26:24,844 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:1008: 2017-05-11 05:30:35,724 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1014: 2017-05-11 05:35:27,067 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1022: 2017-05-11 05:40:14,507 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1023: 2017-05-11 05:40:15,307 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:1024: 2017-05-11 05:40:15,311 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:1030: 2017-05-11 05:50:15,341 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:1035: 2017-05-11 05:54:37,603 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1038: 2017-05-11 05:59:22,218 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1042: 2017-05-11 06:04:04,460 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1043: 2017-05-11 06:04:04,819 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:1044: 2017-05-11 06:04:04,823 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:1054: 2017-05-11 06:14:04,839 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:1058: 2017-05-11 06:18:20,420 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1066: 2017-05-11 06:23:05,279 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1076: 2017-05-11 06:27:49,850 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1077: 2017-05-11 06:27:50,313 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:1078: 2017-05-11 06:27:50,317 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:1079: 2017-05-11 06:27:50,713 fail2ban.actions [1590]: NOTICE [blacklist] 95.141.35.200 already banned
:1106: 2017-05-11 06:37:50,568 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:1109: 2017-05-11 06:42:08,040 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1123: 2017-05-11 06:46:49,694 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1138: 2017-05-11 06:51:32,175 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1139: 2017-05-11 06:51:32,809 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:1140: 2017-05-11 06:51:32,813 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:1186: 2017-05-11 07:01:32,838 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:1193: 2017-05-11 07:05:40,292 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1203: 2017-05-11 07:10:21,348 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1216: 2017-05-11 07:15:10,147 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1217: 2017-05-11 07:15:10,276 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:1218: 2017-05-11 07:15:10,279 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:1230: 2017-05-11 07:25:10,524 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:1231: 2017-05-11 07:29:19,711 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1237: 2017-05-11 07:34:12,721 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1244: 2017-05-11 07:38:55,952 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1245: 2017-05-11 07:38:55,996 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:1246: 2017-05-11 07:38:55,999 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:1247: 2017-05-11 07:38:56,579 fail2ban.actions [1590]: NOTICE [blacklist] 95.141.35.200 already banned
:1253: 2017-05-11 07:48:56,033 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:1258: 2017-05-11 07:53:06,829 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1265: 2017-05-11 07:57:47,579 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1267: 2017-05-11 08:02:28,374 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1268: 2017-05-11 08:02:29,278 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:1269: 2017-05-11 08:02:29,282 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:1279: 2017-05-11 08:12:29,532 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:1280: 2017-05-11 08:16:36,899 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1284: 2017-05-11 08:21:24,903 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1290: 2017-05-11 08:26:10,291 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1291: 2017-05-11 08:26:11,007 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:1292: 2017-05-11 08:26:11,011 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:1298: 2017-05-11 08:36:11,055 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:1305: 2017-05-11 08:40:21,920 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1307: 2017-05-11 08:45:09,530 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1310: 2017-05-11 08:49:53,938 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1311: 2017-05-11 08:49:54,539 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:1312: 2017-05-11 08:49:54,542 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:1313: 2017-05-11 08:49:54,937 fail2ban.actions [1590]: NOTICE [blacklist] 95.141.35.200 already banned
:1324: 2017-05-11 08:59:54,576 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:1326: 2017-05-11 09:04:10,387 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1331: 2017-05-11 09:08:53,483 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1336: 2017-05-11 09:13:37,176 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1337: 2017-05-11 09:13:38,056 fail2ban.actions [1590]: NOTICE [asterisk] Ban 95.141.35.200
:1338: 2017-05-11 09:13:38,060 fail2ban.filter [1590]: INFO [blacklist] Found 95.141.35.200
:1354: 2017-05-11 09:23:38,096 fail2ban.actions [1590]: NOTICE [asterisk] Unban 95.141.35.200
:1361: 2017-05-11 09:27:45,638 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200
:1365: 2017-05-11 09:32:28,673 fail2ban.filter [1590]: INFO [asterisk] Found 95.141.35.200

Regards
Sathees

banaction seems to be ignored

I doubt it's a problem with your jail, so sorry I am spamming your issues with this. But maybe you could help me figuring this one out:
I set up everything exactly as instructed (apart from customized retry values). Unfortunately, the banaction doesn't seem to be executed. I got a message from fail2ban saying

The IP 223.197.XXX.XX has just been banned by Fail2Ban after 5 attempts against blacklist (X inserted by me)

So the jail seems to be reacting to the log entries, but the ip.blacklist isn't modified and sudo iptables -S doesn't show any related entries. BTW I didn't forget to chmod 755 the ip.blacklist. Do you have any idea what I could look at next to find the reason for this? Thanks for your help!

Edit: Also, the fail2ban.log says [blacklist] Found ... and [blacklist] Ban ..., but still no ban via blacklist jail and no modification of ip.blacklist.

IPs on ip.blacklist not getting banned

I'm running Fail2Ban v0.9.3

I've followed the script as described in the instructions & for some reason, the IPs on /etc/fail2ban/ip.blacklist are not getting banned.

After reviewing the fail2ban.log, it looks like asterisk is unbanning IPs that are on the ip.blacklist. The asterisk ban time works perfectly, but after their ban time expires, they unban the IP on the ip.blacklist.

Can you tell me how to troubleshoot, why they are not getting unbanned or how to keep them permanently banned?

/etc/fail2ban/ip.blacklist not getting banned IPs

Hi, I have followed the instruction carefully but I have no IPs in /etc/fail2ban/ip.blacklist

I am running: Fail2Ban v0.10.2 on: Debian/Raspbian GNU/Linux 10 (buster)

The log doesn't show anything special. I can find after restarting fail2ban:

[...]
NOTICE [blacklist] Flush ticket(s) with blacklist
[...]
INFO Jail 'blacklist' started
[...]
INFO [blacklist] Found 116.110.253.171 - 2019-11-19 17:41:19

I am not sure what additional info I can provide. Why would ip.blacklist no record banned IPs?

Thank you

blacklist jail and .gz format logfiles

Thanks for developing this. I've installed, following the instructions. Restarting fail2ban gives an error when it tries to read the compressed .gz format fail2ban logfiles:

2020-07-08 17:50:07,085 fail2ban.jail [13557]: INFO Creating new jail 'blacklist'
2020-07-08 17:50:07,085 fail2ban.jail [13557]: INFO Jail 'blacklist' uses pyinotify {}
2020-07-08 17:50:07,092 fail2ban.jail [13557]: INFO Initiated 'pyinotify' backend
2020-07-08 17:50:07,101 fail2ban.server [13557]: INFO Jail blacklist is not a JournalFilter instance
2020-07-08 17:50:07,102 fail2ban.filter [13557]: INFO Added logfile: '/var/log/fail2ban.log.2.gz' (pos = 581, hash = 52530769d6b9cdd90d587f3503622347572c9120)
2020-07-08 17:50:07,103 fail2ban.filter [13557]: WARNING Error decoding line from '/var/log/fail2ban.log.2.gz' with 'UTF-8'. Consider setting logencoding=utf-8 (or another appropriate encoding) for this jail. Continuing to process line ignoring invalid characters: b'\xb5\xfa\xf1\xcb\ etc etc ... lots more escaped characters.

It then goes on to add the non-compressed fail2ban logfiles and throws no errors.

Changes to logrotate were made as instructed.
Any suggestions?
With thanks.

Receive Email of Banned IP's on Fail2Ban Restart

I was trying out your code (works very well, btw!) however I've found that if I restart Fail2Ban I receive an email for each banned IP, as if it's rescanning/processing all of the logs at startup and not excluding notifications for those in the ip.blacklist file.

Is this expected behavior?

error-log or access-log for [apache-noscript]?

Hi

I am not sure if it is correct place to post but this is the best I can come up with. Sorry if it is inappropriate.

I follow your post here https://ubuntu101.co.za/security/fail2ban/fail2ban-persistent-bans- and left a comment but I think you haven't seen it yet. The main point is I got the recommendation from fail2ban that it is supposed to be logpath = %(apache_error_log)s in [apache-noscript] config file.

Here is the link to the issue I posted. fail2ban/fail2ban#2344

Can you kindly help? Thank you so much.

A couple issues

ip.blacklist has duplicated every IP the filter has put on it and when I remove the dupes, they come back after a reboot. Consequently, every IP has been duped on IPtables as well. Everything works as intended other than this.

Is there a way to get this to watch other filters than just SSH? Like say [Postfix-Auth] or any other custom filter? So far this filter seems to only care about SSH.

Ubuntu Server 18.04 - F2B 10

Thank so much

Error during configuration at startup

First of all thank you very much for the configuration.
It is exactly what i was missing.

Unfortunately i have an error when reloading fail2ban

+ 95 7FC5BEC2B700 fail2ban ERROR Failed during configuration: Bad value substitution: section: [blacklist] option : action key : port rawval : ", protocol="%(protocol)s", chain="%(chain)s"]
I hope you can help me with this error.

Thank you!

empty /etc/fail2ban/ip.blacklist

Hello,
I know you have tested your jail on Fail2ban 0.9.1, I just want to report that with version 0.9.6 ip.blacklist file remains empty after max retry attempts are reached
2017-03-22 19:18:06,519 fail2ban.filter [914]: INFO [apache] Found 10.64.64.64
2017-03-22 19:18:09,536 fail2ban.filter [914]: INFO [apache] Found 10.64.64.64
2017-03-22 19:18:12,552 fail2ban.filter [914]: INFO [apache] Found 10.64.64.64
2017-03-22 19:18:13,287 fail2ban.actions [914]: NOTICE [apache] Ban 10.64.64.64
2017-03-22 19:18:13,425 fail2ban.filter [914]: INFO [blacklist] Found 10.64.64.64

action.d/Blacklist.conf cannot create new chain in IpTables

Hi,

Thanks for sharing this.

I am having issue with iptables. The new chain for 'blacklist' won't get created. I cannot find any detail error message. There is only a very vague one in Fail2Ban.log file:

fail2ban.actions.action[24130]: ERROR iptables -N fail2ban- ...

I know there is not enough here, but that's all I got. I have changed the loglevel to 4, but got some useless information in fail2ban.log file.

Please can you advise?

Kind regards,
Saeed

I got blocked out.

Hi @mitchellkrogza

I cannot ssh to my server and I check my iptables and found I got blocked by myself. 😢

How to avoid this in future? Whitelist my ip? What if I on travel, I will have different ip? Thank you.

Chain f2b-nginxrepeatoffender (1 references)
pkts bytes target prot opt in out source destination
88 5804 DROP all -- any any 121-254-111-144.veetime.com anywhere

After removing the rule and then I just got banned again. I am doing experiment with Fail2Ban and your add-on. So weird.

client working fine, but server won't start

I have tried it without the code but still see it failing. I am running this:
service fail2ban start
and I get:
Job for fail2ban.service failed because the control process exited with error code. See "systemctl status fail2ban.service" and "journalctl -xe" for details.
running:
systemctl status fail2ban.service
gives me:

● fail2ban.service - Fail2Ban Service
   Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
   Active: inactive (dead) (Result: exit-code) since Fri 2018-05-11 16:50:07 UTC; 3min 23s ago
     Docs: man:fail2ban(1)
  Process: 30896 ExecStop=/usr/bin/fail2ban-client stop (code=exited, status=0/SUCCESS)
  Process: 32080 ExecStart=/usr/bin/fail2ban-client -x start (code=exited, status=255)
 Main PID: 30778 (code=killed, signal=TERM)

May 11 16:50:07 lists.pocketmud.com systemd[1]: fail2ban.service: Control process exited, code=exited status=255
May 11 16:50:07 lists.pocketmud.com systemd[1]: Failed to start Fail2Ban Service.
May 11 16:50:07 lists.pocketmud.com systemd[1]: fail2ban.service: Unit entered failed state.
May 11 16:50:07 lists.pocketmud.com systemd[1]: fail2ban.service: Failed with result 'exit-code'.
May 11 16:50:07 lists.pocketmud.com systemd[1]: fail2ban.service: Service hold-off time over, scheduling restart.
May 11 16:50:07 lists.pocketmud.com systemd[1]: Stopped Fail2Ban Service.
May 11 16:50:07 lists.pocketmud.com systemd[1]: fail2ban.service: Start request repeated too quickly.
May 11 16:50:07 lists.pocketmud.com systemd[1]: Failed to start Fail2Ban Service.```

Any ideas where to look?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.