fail2ban 一直说已经被禁止，但实际上并没有禁止

Question

我刚刚配置了一个新服务器并安装了fail2ban，但是当我不断尝试使用错误的密码连接时，它并没有禁止我

fail2ban.log：

2018-03-23 12:46:29,363 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:46:30,747 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:46:33,346 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:46:35,515 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:46:36,372 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:47:45,471 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:47:46,820 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:47:49,503 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:47:50,458 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:47:51,893 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:48:49,699 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:48:51,835 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:48:52,531 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:48:54,477 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:48:57,056 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:50:53,240 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:50:53,677 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:50:55,065 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:50:58,253 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:51:00,494 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:51:00,685 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:52:06,119 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:52:08,300 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:52:11,583 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:52:11,773 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:52:13,498 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:53:07,823 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:53:09,712 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:53:09,842 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:53:11,718 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:53:13,696 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:54:37,181 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:54:37,949 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:54:39,092 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:54:40,906 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:54:42,616 fail2ban.filter         [9756]: INFO    [sshd] Found [my ip]
2018-03-23 12:54:42,955 fail2ban.actions        [9756]: NOTICE  [sshd] [my ip] already banned
2018-03-23 12:54:52,074 fail2ban.action         [9756]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-sshd[ \t]' -- stdout: ''
2018-03-23 12:54:52,075 fail2ban.action         [9756]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-sshd[ \t]' -- stderr: ''
2018-03-23 12:54:52,075 fail2ban.action         [9756]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-sshd[ \t]' -- returned 1
2018-03-23 12:54:52,075 fail2ban.CommandAction  [9756]: ERROR   Invariant check failed. Trying to restore a sane environment
2018-03-23 12:54:52,180 fail2ban.action         [9756]: ERROR   iptables -w -D INPUT -p tcp -m multiport --dports ssh -j f2b-sshd
iptables -w -F f2b-sshd
iptables -w -X f2b-sshd -- stdout: ''
2018-03-23 12:54:52,181 fail2ban.action         [9756]: ERROR   iptables -w -D INPUT -p tcp -m multiport --dports ssh -j f2b-sshd
iptables -w -F f2b-sshd
iptables -w -X f2b-sshd -- stderr: "iptables v1.4.21: Couldn't load target `f2b-sshd':No such file or directory\n\nTry `iptables -h' or 'iptables --help' for more information.\niptables: No chain/target/match by that name.\niptables: No chain/target/match by that name.\n"
2018-03-23 12:54:52,181 fail2ban.action         [9756]: ERROR   iptables -w -D INPUT -p tcp -m multiport --dports ssh -j f2b-sshd
iptables -w -F f2b-sshd
iptables -w -X f2b-sshd -- returned 1
2018-03-23 12:54:52,181 fail2ban.actions        [9756]: ERROR   Failed to execute unban jail 'sshd' action 'iptables-multiport' info '{'matches': '2018-03-23T11:53:46.707058149-210-194-176.colo.transip.net sshd[27676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip-[my ip].ip.prioritytelecom.net  user=root2018-03-23T11:53:48.733188149-210-194-176.colo.transip.net sshd[27676]: Failed password for root from [my ip] port 31224 ssh22018-03-23T11:54:51.709842149-210-194-176.colo.transip.net sshd[27676]: Failed password for root from [my ip] port 31224 ssh2', 'ip': '[my ip]', 'time': 1521802491.930057, 'failures': 3}': Error stopping action

当我跟踪日志文件时，我看到我的 ssh 登录尝试被记录下来，但是在第三次尝试之后，我只能继续尝试；例如，如果我在第 10 次尝试后使用正确的密码，它就会让我登录。

我也时不时地在日志文件的末尾看到错误。

我的 jail.local：

[DEFAULT]
#ban n hosts for one hour:
bantime = 3600

#maxtrys
maxretry = 3

# Override /etc/fail2ban/jail.d/00-firewalld.conf:
banaction = iptables-multiport

[sshd]
enabled = true

有谁知道为什么会这样？

Answer 1

看起来您的iptables配置不包含名为f2b-sshd.

首先，关于iptables.

iptables既是命令又是 Linux 防火墙子系统的名称。该命令用于在 RAM 中设置防火墙规则。该iptables防火墙规则中，首先配置到表：有默认的filter表，而且nat，mangle，raw和security表格，用于各种目的。fail2ban正在做流量过滤，所以它使用filter表。

然后这些表可以进一步划分为过滤器链。每个表都有特定的标准链：对于filter表，标准链是INPUT、FORWARD和OUTPUT。该FORWARD链仅在系统配置为为其他系统路由流量时使用。该INPUT链处理进入该系统的流量。

如果fail2ban将其规则直接添加到INPUT链中，并在所有禁令到期时清除该链，那么您必须将防火墙输入规则的完全控制权移交给fail2ban-除了什么之外，您无法轻松拥有任何自定义防火墙规则fail2ban。这显然是不可取的，所以fail2ban不会这样做。

相反，fail2ban创建自己的过滤器链，它可以完全自行管理，并在启动时向INPUT链添加单个规则，以通过 的链发送要处理的任何匹配流量fail2ban。

例如，当配置为protected 时sshd，fail2ban应该在启动时执行这些命令：

iptables -N f2b-sshd
iptables -A f2b-sshd -j RETURN
iptables -I INPUT -p tcp -m multiport --dports <TCP ports configured for sshd protection> -j f2b-sshd

这些命令创建了一个f2b-sshd过滤器链，设置RETURN为它的最后一条规则（这样当任何fail2ban规则被处理后，INPUT 规则的正常处理将继续进行fail2ban，最后，在INPUT表的开头添加一条规则以捕获任何 SSH 流量并首先将其发送到f2b-sshd链。

现在，当fail2ban需要禁止 SSH 使用的 IP 地址时，它只会向f2b-sshd链中插入一条新规则。

如果您正在使用firewalld或其他一些为您管理 iptables 防火墙规则的系统，或者如果您iptables手动清除所有规则，那么这些初始规则，可能还有整个f2b-sshd过滤器链，可能会被清除。您应该确保您可能使用的任何防火墙管理工具都维护 INPUT 链中的初始规则，并且根本不接触该f2b-sshd链。

代码段末尾的错误消息表明fail2ban正在检查初始规则是否仍然存在（“不变检查”），并发现它们不存在。