On 08/05/2021 23:08, Dan Egli wrote:
On 5/8/2021 2:52 PM, Nick Howitt wrote:
Snipping as the first attempt to reply got spammed by sourceforge.
Hint. Try grepping your log for ERROR.
Okay. I did that. The result was I got a lot of errors, all the same
thing, but they don't make sense to me. Here's SOME what I got (to avoid
being marked as spam. All entries are indentical exctpo fpr the timeand
the IP:
2021-05-08 14:23:56,613 fail2ban.actions [16526]: ERROR Failed to
execute ban jail 'named-refused' action 'iptables' info
'ActionInfo({'ip': '0.215.198.30', 'family': 'inet4', 'fid': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129b3a0>, 'raw-ticket': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129ba60>})': Error starting action
Jail('named-refused')/iptables: 'Script error'
2021-05-08 14:23:56,628 fail2ban.actions [16526]: ERROR Failed to
execute ban jail 'named-refused' action 'iptables' info
'ActionInfo({'ip': '0.215.218.30', 'family': 'inet4', 'fid': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129b3a0>, 'raw-ticket': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129ba60>})': Error starting action
Jail('named-refused')/iptables: 'Script error'
2021-05-08 14:23:56,642 fail2ban.actions [16526]: ERROR Failed to
execute ban jail 'named-refused' action 'iptables' info
'ActionInfo({'ip': '2.169.102.101', 'family': 'inet4', 'fid': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129b3a0>, 'raw-ticket': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129ba60>})': Error starting action
Jail('named-refused')/iptables: 'Script error'
2021-05-08 14:23:56,847 fail2ban.actions [16526]: ERROR Failed to
execute ban jail 'named-refused' action 'iptables' info
'ActionInfo({'ip': '2.208.13.7', 'family': 'inet4', 'fid': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129b3a0>, 'raw-ticket': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129ba60>})': Error starting action
Jail('named-refused')/iptables: 'Script error'
2021-05-08 14:23:56,859 fail2ban.actions [16526]: ERROR Failed to
execute ban jail 'named-refused' action 'iptables' info
'ActionInfo({'ip': '3.151.4.4', 'family': 'inet4', 'fid': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129b3a0>, 'raw-ticket': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129ba60>})': Error starting action
Jail('named-refused')/iptables: 'Script error'
2021-05-08 14:23:56,871 fail2ban.actions [16526]: ERROR Failed to
execute ban jail 'named-refused' action 'iptables' info
'ActionInfo({'ip': '3.151.4.6', 'family': 'inet4', 'fid': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129b3a0>, 'raw-ticket': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129ba60>})': Error starting action
Jail('named-refused')/iptables: 'Script error'
2021-05-08 14:23:56,909 fail2ban.actions [16526]: ERROR Failed to
execute ban jail 'named-refused' action 'iptables' info
'ActionInfo({'ip': '5.195.12.225', 'family': 'inet4', 'fid': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129b3a0>, 'raw-ticket': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129ba60>})': Error starting action
Jail('named-refused')/iptables: 'Script error'
2021-05-08 14:23:56,944 fail2ban.actions [16526]: ERROR Failed to
execute ban jail 'named-refused' action 'iptables' info
'ActionInfo({'ip': '5.195.12.226', 'family': 'inet4', 'fid': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129b3a0>, 'raw-ticket': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129ba60>})': Error starting action
Jail('named-refused')/iptables: 'Script error'
2021-05-08 14:23:56,999 fail2ban.actions [16526]: ERROR Failed to
execute ban jail 'named-refused' action 'iptables' info
'ActionInfo({'ip': '5.195.12.230', 'family': 'inet4', 'fid': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129b3a0>, 'raw-ticket': <function
Actions.ActionInfo.<lambda> at 0x7fbc4129ba60>})': Error starting action
Jail('named-refused')/iptables: 'Script error'
What's wrong with the script?
# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
#
[INCLUDES]
before = iptables-common.conf
[Definition]
# Option: actionstart
# Notes.: command executed on demand at the first ban (or at the start
of Fail2Ban if actionstart_on_demand is set to false).
# Values: CMD
#
actionstart = <iptables> -N f2b-<name>
# <iptables> -A f2b-<name> -j <returntype>
<iptables> -I <chain> -p <protocol> --dport <port> -j
f2b-<name>
# Option: actionstop
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
# Values: CMD
#
actionstop = <iptables> -D <chain> -p <protocol> --dport <port> -j
f2b-<name>
<actionflush>
<iptables> -X f2b-<name>
# Option: actioncheck
# Notes.: command executed once before each actionban command
# Values: CMD
#
actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
# Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
[Init]
Except for commenting out the -J return like you said, it's 100% stock.
Your published log had changes so I can no longer look at it, but each
set of ERROR lines was in a block of about 5 lines and contained very
useful info.
Try matching up the relevant ERROR line with your action lines. I seem
to remember perhaps "chain" was not specified and there may have been
something else.
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
