I am using fail2ban to mitigate attacks on my webservers (Ubuntu 18.04lts). This is working really well, but recently I've noticed a growing trend of returning attacks. So I added a new rule for these:
[repeatOffence]
# enabled = false
enabled = true
filter = repeatOffence
port = http,https,smtp
logpath = /var/log/fail2ban.log
maxretry = 3
# search up to 2 days
findtime = 172800
# ban for a week
bantime = 604800
While this also worked as expected, the number of banned addresses is already well into the 100s and growing. To avoid a performance impact I tried changing this rule to use ipsets :
[repeatOffence]
# enabled = false
enabled = true
filter = repeatOffence
port = http,https,smtp
logpath = /var/log/fail2ban.log
maxretry = 3
banaction = iptables-ipset-proto6.conf
banaction_allports = iptables-ipset-proto6-allports.conf
# search up to 2 days
findtime = 172800
# ban for a week
bantime = 604800
But on restarting fail2ban, it reports
Found no accessible config files for 'action.d/iptables-ipset-proto6.conf' under /etc/fail2ban
Unable to read action 'iptables-ipset-proto6.conf'
The file is present with the same permissions as action.d/iptables.conf
Other references to the banaction in jail.conf do not use a literal value, e.g.
action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]```
What am I missing?