New subject: fail2ban does not apply ban, fail2ban-regex works

11 May 2016

      Hello.

I have this config for freeswitch:

jail.local:

[ssh]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 5
[freeswitch]
enabled  = true
port     = 5060,5061,5080,5081
ignoreip = 127.0.0.1/8 10.10.0.0/16
filter   = freeswitch
logpath  = /var/log/freeswitch/freeswitch.log
maxretry = 1
findtime = 600
bantime  = 60
action   = iptables-ban

freeswitch.conf:

[Definition]

failregex = ^[-: \.\d]+ \[WARNING\] sofia_reg\.c:\d+ Can't find user 
\[\d+@[^\]]+\] from <HOST>$

ignoreregex =

When running

fail2ban-regex /var/log/freeswitch/freeswitch.log 
/etc/fail2ban/filter.d/freeswitch.conf

There are matches with failed users:

/usr/share/fail2ban/server/filter.py:442: DeprecationWarning: the md5 
module is deprecated; use hashlib instead
   import md5

Running tests
=============

Use regex file : /etc/fail2ban/filter.d/freeswitch.conf
Use log file   : /var/log/freeswitch/freeswitch.log

Results
=======

Failregex
|- Regular expressions:
|  [1] ^[-: \.\d]+ \[WARNING\] sofia_reg\.c:\d+ Can't find user 
\[\d+@[^\]]+\] from <HOST>$
|
`- Number of matches:
    [1] 18 match(es)

Ignoreregex
|- Regular expressions:
|
`- Number of matches:

Summary
=======

Addresses found:
[1]
     163.172.194.73 (Wed May 11 10:16:54 2016)
     163.172.194.73 (Wed May 11 10:18:02 2016)
     163.172.194.73 (Wed May 11 10:18:30 2016)
     163.172.194.73 (Wed May 11 10:18:40 2016)
     163.172.194.73 (Wed May 11 10:19:10 2016)
     163.172.194.73 (Wed May 11 10:19:29 2016)
     163.172.194.73 (Wed May 11 10:20:10 2016)
     163.172.194.73 (Wed May 11 10:20:30 2016)
     163.172.194.73 (Wed May 11 10:20:37 2016)
     163.172.194.73 (Wed May 11 10:21:42 2016)
     163.172.194.73 (Wed May 11 10:21:53 2016)
     163.172.194.73 (Wed May 11 10:22:00 2016)
     163.172.194.73 (Wed May 11 10:22:50 2016)
     163.172.194.73 (Wed May 11 10:23:13 2016)
     163.172.194.73 (Wed May 11 10:23:28 2016)
     163.172.194.73 (Wed May 11 10:23:30 2016)
     163.172.194.73 (Wed May 11 10:25:07 2016)
     163.172.194.73 (Wed May 11 10:25:29 2016)

Date template hits:
0 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
5196 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s): <Month/Day/Year@Hour:Minute:Second>

Success, the total number of match is 18

However, look at the above section 'Running tests' which could contain 
important
information.

However, fail2ban does not ban that ip. Although when ssh login attempt 
is detected, fail2ban does ban the ip.

I've checked the time and time zone and all ok. On server Local time is 
+3 from UTC. sshd log, freeswitch log and fail2ban log are in same time 
zone.

What could be the culprit?

fail2ban does not apply ban, fail2ban-regex works

Mimiko

Sergey Safarov

tags

participants (2)