On 7/17/26 3:36 PM, Tom Moore via Fail2ban-users wrote:
Hi
I am trying to set up fail2ban on Awslinux 2023 (which is a fedora spin)
on EC2. To start with, the service that I am trying to protect is
running and I can connect to it from the outside world on a port in the
7000 range. I then install fail2ban and start it out of the box with no
local changes. At this point, freshly installed, I can still reach the
port from the outside world.
If I reboot the instance, my port is now unreachable from the outside.
Note that I did not enable fail2ban as a service, so it is not even
running in the rebooted instance. If I start or stop fail2ban nothing
changes, at this point the port seems blocked.
If I uninstall fail2ban (dnf remove fail2ban) then the port is
accessible again.
Note that this is with no changes to the config files, just plain out of
the box.
Does anyone have an idea of what is going wrong here? If seems to work
ok initially, but after the first reboot the port is blocked. Ssh still
works, so it is not like all ports are blocked. I do notice that some
of the aws ec2 monitoring is not reporting, so perhaps other ports are
blocked as well.
Thanks,
Tom
Tom,
I use f2b to keep the bad players out of my apache web server that I run
on my home system and those who happen to find my hidden sshd port.
While I don't know what your specific problem is, I can offer a few
suggestions on debugging it. My system run Fedora 44. I don't know
how similar it is to your system.
I'm going to assume for a system log you use journald. If not that then
perhaps all log messages go to /var/log/messages. Wherever it is, you
want to watch that. Open up a terminal window. For journald, you can
run "journalctl -f" which will tail the journal log. Or "tail -f
/var/log/messages" to tail that file. On my system I see a log entry
when an IP address is blocked. F2b also has it's own log file at
/var/log/fail2ban which you can also keep an eye on.
Assuming f2b was set up to use iptables to block things, one command you
can run to see what iptables has in it is "sudo iptables-save" which
will show everything in iptables to stdout. You might also want to
take a look at /etc/sysconfig/iptables. It's a text file that is used
to start iptables. F2b should not have written to that file but maybe
something got added to it somehow. F2b adds to the memory resident
iptables as it runs and not to any config file. It does keep a database
of what it's banned so that when it restarts it can reban sites that
were banned when it was restarted.
This should get you started unless someone else knows more than I do and
has a better suggestion.
Charlie
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
