[SOLVED] fail2ban ignores my bantime

piramiday · 09-06-2013, 05:45 AM

I've installed fail2ban in order to ban ssh attackers, but even though my jail looks like this:

Code:

[ssh]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 1
findtime = 300 # 5m
bantime  = 86400 # 24h

when I start the fail2ban service I get the following:

Code:

fail2ban.filter : INFO   Set maxRetry = 1
fail2ban.filter : INFO   Set findtime = 600
fail2ban.actions: INFO   Set banTime = 600
fail2ban.jail   : INFO   Jail 'ssh' started

how come my find/ban times are NOT what I configured?

Noway2 · 09-06-2013, 10:23 AM

I would look VERY carefully for a different configuration file than the one you think is being used. For example, do you have any settings in /etc/default? Do you have both a jail.conf and jail.conf.local with any overriding settings? Failing those, I would restart the process and look in your log files for any syntax or errors that could cause it to resort to default settings.

piramiday · 09-06-2013, 11:33 AM

got it!

the problem was the inline comment. at the start of the jail file you can read:

Code:

# Comments: use '#' for comment lines and ';' for inline comments

... meaning that it was indeed my fault.