I noticed a problem with my fail2ban installation. All my jails have a short bantime, just the "recidive" has a much longer bantime.
I'm using nftables. The banned IP addresses are stored in sets. (Originally I thought there was only one set, but this assumption was wrong). This is what I see in the log for a given single IP:
1. portscan BAN1 for short time 2. portscan UNBAN1 after a while 3. portscan BAN2 for short time 4. portscan UNBAN2 after a while 5. portscan BAN3 for short time 6. recidive BAN for LONG time, because the portscan was activated 3 times 7. portscan UNBAN3 after a while (the IP is no longer banned!!) 8. recidive UNBAN (error logged, IP not found in the set)- In line 5 is the IP banned in jail "portscan" - In line 6 is the IP banned in jail "recidive" - In line 7 is the IP unbanned in "portscan", but it looks like it is unbanned globally! Real log:
NOTICE [portscan] Ban 78.IP.XX.YY NOTICE [portscan] Unban 78.IP.XX.YY NOTICE [portscan] Ban 78.IP.XX.YY NOTICE [portscan] Unban 78.IP.XX.YY NOTICE [portscan] Ban 78.IP.XX.YY NOTICE [portscan] Unban 78.IP.XX.YY NOTICE [portscan] Ban 78.IP.XX.YY NOTICE [recidive] Ban 78.IP.XX.YY NOTICE [portscan] Unban 78.IP.XX.YY NOTICE [portscan] Ban 78.IP.XX.YY NOTICE [portscan] Unban 78.IP.XX.YY NOTICE [portscan] Ban 78.IP.XX.YY NOTICE [portscan] Unban 78.IP.XX.YY NOTICE [recidive] Unban 78.IP.XX.YY ERROR 7fe663585fb0 -- exec: nft delete element inet f2b-table addr-set-recidive \{ 78.IP.XX.YY \} ERROR 7fe663585fb0 -- stderr: 'delete element inet f2b-table addr-set-recidive { 78.IP.XX.YY }' ERROR 7fe663585fb0 -- exec: nft delete element inet f2b-table addr-set-recidive \{ 78.IP.XX.YY \} ERROR 7fe663585fb0 -- stderr: 'delete element inet f2b-table addr-set-recidive { 78.IP.XX.YY }' ERROR Failed to execute unban jail 'recidive' action 'nftables-allports' info 'ActionInfo({'ip': '78.IP.XX.YY', 'family': 'inet4', 'fid': at 0x7fe671bb98a0>, 'raw-ticket': at 0x7fe671bba020>})': Error unbanning 78.IP.XX.YY NOTICE [portscan] Ban 78.IP.XX.YY NOTICE [portscan] Unban 78.IP.XX.YY NOTICE [portscan] Ban 78.IP.XX.YY NOTICE [portscan] Unban 78.IP.XX.YY NOTICE [portscan] Ban 78.IP.XX.YYIgnoring changes not related to this issue my configuration is basically just: banaction = nftables-multiport banaction_allports = nftables-allports I did not not modify any nftables-xxx actions, i.e. I'm using the standard action definitions. The mentioned jails are defined as follows:
[portscan]
enabled = true
filter = portscan
backend = systemd
journalmatch = _TRANSPORT=kernel
logpath = %(syslog_daemon)s
[recidive]
enabled = true
bantime = 18h
Where did I make an error and how to fix it?
Asked by VPfB
(809 rep)
Jan 14, 2025, 08:53 PM
Last activity: Jan 15, 2025, 11:44 AM
Last activity: Jan 15, 2025, 11:44 AM