fail2ban fails to ban on Ubuntu 14.04

Question

I would like to secure my web server from brute force attack (first through ssh). So I installed fail2ban. I cannot get it to ban me though. Here is my /etc/fail2ban/jail.local: ``` [DEFAULT] bantime = 300 findtime = 600 maxretry = 4 backend = auto usedns = warn destemail = moj.adres@gmail.com banaction = iptables-multiport mta = sendmail protocol = tcp chain = INPUT (...) action = %(action_mw)s (...) [ssh] enabled = true port = anyport filter = sshd logpath = /var/log/auth.log maxretry = 4 ``` Only ssh is enabled and I did not change anything that is omitted. According to this configuration I should be banned for 300 seconds after 4 failed login attemps. I am allowed 6 though and there is no ban. The /var/log/auth.log looks probably fine. Here is the fragment showing my 6 unsuccessful logins: ``` Jul 8 09:51:09 nazwaserwera sshd[1798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=abod34.neoplus.adsl.tpnet.pl user=my-admin Jul 8 09:51:10 nazw…

Accepted Answer

Solved it!

According to my configuration in jail.local

```
maxretry = 4
```

fail2ban should search the auth.log file for 5 lines (1 + 4) containing an alert about an unsuccessful login attempt each. But looking at my auth.log more closely I noticed that the maximum I ever get is 2. Here is how 6 failed login attemps are recorded:

```
Jul  8 09:51:10 nazwaserwera sshd[1798]: Failed password for my-admin from 83.8.19.34 port 56451 ssh2
Jul  8 09:51:27 nazwaserwera sshd[1798]: message repeated 5 times: [ Failed password for my-admin from 83.8.19.34 port 56451 ssh2]
```

As you can see instead of 6 lines I only get two with the second one saying "message repeated 5 times".

The solution is very simple: I just changed RepeatedMsgReduction from on to off in /etc/rsyslog.conf. And then restarted both rsyslog and fail2ban.

fail2ban fails to ban on Ubuntu 14.04

Solution

Problem