On Thu, 11 May 2017, Pierre Rudloff wrote: > Hello,
> Le 11/05/2017 à 03:44, Yaroslav Halchenko a écrit : > > try to stop fail2ban, cleanse all the fail2ban entries from the firewall > > and try to start it again -- if it fails to start then -- provide full > > log file for that run not just an excerpt > I already tried that several times. > When stopping fail2ban, it seems to correctly remove fail2ban-ssh chain from > iptables and here are the things remaining: > > Chain INPUT (policy ACCEPT) > > target prot opt source destination > > Chain FORWARD (policy ACCEPT) > > target prot opt source destination > > Chain OUTPUT (policy ACCEPT) > > target prot opt source destination > Here are the full logs I get when I start fail2ban after that: > > 2017-05-11 10:16:32,533 fail2ban.server [13737]: INFO Changed logging > > target to /var/log/fail2ban.log for Fail2ban v0.8.13 > > 2017-05-11 10:16:32,538 fail2ban.jail [13737]: INFO Creating new jail > > 'ssh' > > 2017-05-11 10:16:32,543 fail2ban.jail [13737]: INFO Jail 'ssh' uses > > poller > > 2017-05-11 10:16:32,712 fail2ban.jail [13737]: INFO Initiated > > 'polling' backend > > 2017-05-11 10:16:32,721 fail2ban.filter [13737]: INFO Added logfile = > > /var/log/auth.log > > 2017-05-11 10:16:32,726 fail2ban.filter [13737]: INFO Set maxRetry = 6 > > 2017-05-11 10:16:32,737 fail2ban.filter [13737]: INFO Set findtime = 600 > > 2017-05-11 10:16:32,742 fail2ban.actions[13737]: INFO Set banTime = 600 > > 2017-05-11 10:16:33,114 fail2ban.jail [13737]: INFO Jail 'ssh' started > > 2017-05-11 10:16:33,224 fail2ban.actions.action[13737]: ERROR iptables -N > > fail2ban-ssh > > iptables -A fail2ban-ssh -j RETURN > > iptables -I INPUT -p tcp -m multiport --dports ssh -j fail2ban-ssh returned > > 100 so -- do you have support in your kernel for multiport matching (having a custom one?)? what if you try to run those commands manually (after stopping fail2ban first) and/or just see quick google hit https://superuser.com/questions/662734/install-multiport-module-on-iptables -- Yaroslav O. Halchenko Center for Open Neuroscience http://centerforopenneuroscience.org Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755 Phone: +1 (603) 646-9834 Fax: +1 (603) 646-1419 WWW: http://www.linkedin.com/in/yarik
