Hi everyone,
I've got fail2ban and firewalld set up on a C7 box, in theory protecting dovecot, exim and ssh but I'm not convinced it's doing anything.
in /var/log/fail2ban.log I'm getting loads of entries such as:
2020-12-22 19:08:08,100 fail2ban.actions [1836]: WARNING [dovecot] 78.128.113.67 already banned
I think this is because the actual ban is not working. I have entries such as:
2020-12-22 19:38:27,619 fail2ban.utils [1836]: ERROR 7f119e95f7f0 -- exec: ports="0:65535"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='113.110.47.81' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done 2020-12-22 19:38:27,619 fail2ban.utils [1836]: ERROR 7f119e95f7f0 -- stderr: 'Error: INVALID_PORT: 0:65535' 2020-12-22 19:38:27,619 fail2ban.utils [1836]: ERROR 7f119e95f7f0 -- returned 102 2020-12-22 19:38:27,620 fail2ban.actions [1836]: ERROR Failed to execute ban jail 'dovecot' action 'firewallcmd-rich-rules' info 'ActionInfo({'ip': '113.110.47.81', 'fid': <function <lambda> at 0x7f119f084050>, 'family': 'inet4', 'raw-ticket': <function <lambda> at 0x7f119f0845f0>})': Error banning 113.110.47.81
I've done some Googling and received lots of responses about fail2ban failures but I can't find anything relating to this.
Anyone got any ideas?