Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

5
  • Hi Michael thanks for answer, from "fail2ban-regex --print-all-missed" i have the following output when i test ssh access (Jun 25 19:19:26 localhost sshd[3143]: Connection closed by 172.16.45.1 [preauth]) but there is no action from the firewall to block this ip address. I'm testing this on virtual machine with 172.x.x.x. ip. This virtual machine is on my laptop with 192.168.0.x ip using the VMware i have install the fial2ban on centos with 172.xxxx ip. Commented Jun 25, 2015 at 23:22
  • Are there other lines that the filter.d/sshd.conf finds, maybe it's not finding enough lines to ban (6)? Is it able to find ipset command? Commented Jun 26, 2015 at 1:28
  • In the sshd.conf file i was not able to find ipset command ... Commented Jun 27, 2015 at 17:28
  • No, sorry, that's confusing. Look at your action that you stated above, you have "action = firewallcmd-ipset". This action uses the file named "action.d/firewallcmd-ipset.conf" (relative to your fail2ban conf directory). This conf file uses the ipset command to tweak the firewall. Is fail2ban able to execute the ipset command? Can you execute it from the command line? Is there anything in the fail2ban log file that might give a clue as to why it's not doing anything? Commented Jun 28, 2015 at 20:19
  • I have edit the question with the context of the file firewallcmd-ipset.conf ... im not quite sure what command to execute and what to change. Commented Jun 29, 2015 at 23:00