On Tue, Aug 18, 2015 at 8:55 AM, Mauricio Tavares <raubvo...@gmail.com> wrote:
>
> On Aug 18, 2015 8:19 AM, "Timo Brandt - Umweltsynergien"
> <t.bra...@umweltsynergien.de> wrote:
>>
>> Hm, i checked this now. the ip is not listed in iptables.
>>
>> How can this be? there are a lot of ips added by fail2ban...
>
> In the fail2ban log, there should be a message saying "saw this guy
> too many times, I am banning him." I think there is also a command to query
> who is currently banned. I can't lookup because I am typing on my phone.
>
> Finally, you can grab the log (check the jail.local file) used by
> ssh/whatever and run it in fail2ban in debug mode.
>
Out of curiosity, how does the relevant entry in your jail.local
file looks like?
>>
>> Mauricio Tavares <raubvo...@gmail.com> schrieb am 18.08.2015:
>>>
>>> On Tue, Aug 18, 2015 at 5:34 AM, Timo Brandt - Umweltsynergien
>>> <t.bra...@umweltsynergien.de> wrote:
>>>>
>>>> Hi together,
>>>>
>>>> I've got a stupid question.
>>>> Yesterday, I watched all log files on my debian 7 server with tail -f *.
>>>>
>>>> I've seen some logins with root from different ip's and fail2ban writes
>>>> in
>>>> his log " ip xxx.xxx.xxx.xxx already banned.
>>>>
>>>> How can this be? I thought, fail2ban and iptables ban this ip so that
>>>> they
>>>> can't try any login?
>>>> can you help me?
>>>> Thx,
>>>> Timo
>>>
>>>
>>> Did you check the firewall rules to see if a rule to drop said
>>> IP is in place?
>>>
>>>> ________________________________
>>>>
>>>>
>>>> ________________________________
>>>>
>>>> Fail2ban-users mailing list
>>>> Fail2ban-users@lists.sourceforge.net
>>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>>
>>>
------------------------------------------------------------------------------
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
