Score:0

fail2ban - changing banaction not working as expected

ws flag

I am using fail2ban to mitigate attacks on my webservers (Ubuntu 18.04lts). This is working really well, but recently I've noticed a growing trend of returning attacks. So I added a new rule for these:

[repeatOffence]
# enabled = false
enabled = true
filter = repeatOffence
port = http,https,smtp
logpath = /var/log/fail2ban.log
maxretry = 3
# search up to 2 days
findtime = 172800
# ban for a week
bantime = 604800

While this also worked as expected, the number of banned addresses is already well into the 100s and growing. To avoid a performance impact I tried changing this rule to use ipsets :

[repeatOffence]
# enabled = false
enabled = true
filter = repeatOffence
port = http,https,smtp
logpath = /var/log/fail2ban.log
maxretry = 3
banaction = iptables-ipset-proto6.conf
banaction_allports = iptables-ipset-proto6-allports.conf
# search up to 2 days
findtime = 172800
# ban for a week
bantime = 604800

But on restarting fail2ban, it reports

Found no accessible config files for 'action.d/iptables-ipset-proto6.conf' under /etc/fail2ban
Unable to read action 'iptables-ipset-proto6.conf'

The file is present with the same permissions as action.d/iptables.conf

Other references to the banaction in jail.conf do not use a literal value, e.g.

action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]```

What am I missing?

Score:0
ws flag

The issue is that file extensions in fail2ban are significant; fail2ban appends them automatically, so it was looking for "iptables-ipset-proto6.conf.conf". Amending the configuration as shown below resolved the issue:

banaction = iptables-ipset-proto6
banaction_allports = iptables-ipset-proto6-allports
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.