Sample Header Ad - 728x90

Fail2ban not banning dropbear

2 votes
0 answers
86 views
I'm trying to get fail2ban working on a DietPi but no matter what I do it won't ban me. I've found quite a few threads about this but just can not get it working, so apologies for any repetition. Thanks for any help fail2ban status fail2ban status **My jail.local:**
[DEFAULT]
enabled = true
ignoreip = 127.0.0.1/8
ignorecommand =
backend = systemd
mode = normal
filter = %(__name__)s[mode=%(mode)s]
findtime = 600
maxretry = 3
bantime = 600
banaction = iptables-multiport

[dropbear]
enabled = true
filter = dropbear

[sshd]
enabled = true
filter = sshd
**filter.d/dropbear.conf contains:**
prefregex = ^%(__prefix_line)s(?:[Ll]ogin|[Bb]ad|[Ee]xit).+$
failregex = ^[Ll]ogin attempt for nonexistent user ('.*' )?from :\d+$
            ^[Bb]ad (PAM )?password attempt for .+ from (:\d+)?$
            ^[Ee]xit before auth \(user '.+', \d+ fails\): Max auth tries reached - user '.+' from :\d+\s*$
ignoreregex =
**Logs below:** *sudo journalctl -u dropbear -n 10*
...
Nov 01 13:01:44 DietPi dropbear:  Nov 01 13:01:44 Child connection from IPADDRESS:52290
Nov 01 13:01:44 DietPi dropbear:  Nov 01 13:01:44 Failed loading /etc/dropbear/dropbear_dss_host_key
Nov 01 13:01:46 DietPi dropbear:  Nov 01 13:01:46 Bad password attempt for 'NAME' from IPADDRESS:52290
Nov 01 13:01:47 DietPi dropbear:  Nov 01 13:01:47 Bad password attempt for 'NAME' from IPADDRESS:52290
Nov 01 13:01:48 DietPi dropbear:  Nov 01 13:01:48 Bad password attempt for 'NAME' from IPADDRESS:52290
Nov 01 13:01:48 DietPi dropbear:  Nov 01 13:01:48 Exit before auth from : (user 'NAME', 3 fails): Exited normally
...
*sudo fail2ban-client status dropbear*
Status for the jail: dropbear
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- Journal matches:
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:
Asked by Argo (21 rep)
Nov 1, 2024, 01:29 PM