Answer the question
In order to leave comments, you need to log in
Why does fail2ban v0.10.3.dev1 incremental only ban for 600 seconds?
I installed a new Fail2Ban v0.10.3.dev1
on Raspbian Stretch Lite , which increases the ban time for repeat offenders. I use for ssh. There were problems using. IP addresses of attackers receive a ban for only 600 seconds, and after being unbanned, this chain repeats again. No increase in ban time is observed.
Proper configuration , unfortunately, does not describe my problem.
Problem in jail.local config? Where does fail2ban get these 600 seconds from? Fail2ban.conf somehow used if there is jail.local?
Please share your opinions about the problem, and if possible, a well-commented prop configuration.
Thank you.
PS Yes, I know that it's easier to log in using keys, change the standard port, and so on. But still, let me choose authorization by password. Fail2ban is designed for this.
2018-01-27 07:29:06,446 fail2ban.filter [6272]: INFO [sshd] Found 5.188.10.176 - 2018-01-27 07:29:06
2018-01-27 07:29:06,454 fail2ban.filter [6272]: INFO [sshd] Found 5.188.10.176 - 2018-01-27 07:29:06
2018-01-27 07:29:09,063 fail2ban.filter [6272]: INFO [sshd] Found 5.188.10.176 - 2018-01-27 07:29:08
2018-01-27 07:29:09,169 fail2ban.actions [6272]: NOTICE [sshd] Ban 5.188.10.176
2018-01-27 07:39:09,969 fail2ban.actions [6272]: NOTICE [sshd] Unban 5.188.10.176
2018-01-27 07:46:18,113 fail2ban.filter [6272]: INFO [sshd] Found 5.188.10.176 - 2018-01-27 07:46:16
2018-01-27 07:46:18,121 fail2ban.filter [6272]: INFO [sshd] Found 5.188.10.176 - 2018-01-27 07:46:16
2018-01-27 07:46:18,727 fail2ban.filter [6272]: INFO [sshd] Found 5.188.10.176 - 2018-01-27 07:46:18
2018-01-27 07:46:18,913 fail2ban.actions [6272]: NOTICE [sshd] Ban 5.188.10.176
2018-01-27 07:56:19,788 fail2ban.actions [6272]: NOTICE [sshd] Unban 5.188.10.176
2018-01-27 08:21:51,737 fail2ban.filter [6272]: INFO [sshd] Found 5.188.10.176 - 2018-01-27 08:21:50
2018-01-27 08:21:51,745 fail2ban.filter [6272]: INFO [sshd] Found 5.188.10.176 - 2018-01-27 08:21:50
2018-01-27 08:21:51,950 fail2ban.filter [6272]: INFO [sshd] Found 5.188.10.176 - 2018-01-27 08:21:51
2018-01-27 08:21:52,726 fail2ban.actions [6272]: NOTICE [sshd] Ban 5.188.10.176
[DEFAULT]
bantime.increment = true
ignoreip = 127.0.0.1/8
findtime = 150
maxretry = 3
banaction = iptables-multiport
protocol = tcp
chain = INPUT
action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
[sshd]
enabled = true
port = ssh
filter = sshd
[ssh-iptables]
enabled = false
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question