Fail2ban settings after changing ssh port

Question

I switched my ssh port to 22000 and I changed the port settings in /etc/fail2ban/jail.local to specify to ban on both 22 and 22000 but when I tried failing to login 6 times, my connection was cutoff but was able to try logging in again immediately.

It appears my IP wasn't banned for an hour per the default bantime I set.

Is there something wrong with how I configured this?

# "bantime" is the number of seconds that a host is banned.
bantime  = 3600

[ssh]

enabled  = true
port     = ssh,22000
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 6

Thanks.

EDIT:

Netstat output per request.

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      1061/master
tcp        0      0 0.0.0.0:27017           0.0.0.0:*               LISTEN      940/mongod
tcp        0      0 0.0.0.0:22000           0.0.0.0:*               LISTEN      1377/sshd
tcp        0      0 0.0.0.0:28017           0.0.0.0:*               LISTEN      940/mongod
tcp        0      0 0.0.0.0:8787            0.0.0.0:*               LISTEN      951/rserver
tcp6       0      0 :::25                   :::*                    LISTEN      1061/master
tcp6       0      0 :::22000                :::*                    LISTEN      1377/sshd

Yes, when it was on 22 it was banning IPs. Now when I purposely fail on 22000 it doesn't ban and there's nothing in the logs about it. — Dirk Calloway, Nov 26 '13 at 10:01
Also I switched the config file to maxretry = 3 and it is still allowing 6... I did restart fail2ban after changing. — Dirk Calloway, Nov 26 '13 at 10:03
Is it because I havve ssh in the ports to ban and 22 is no longer active? — Dirk Calloway, Nov 26 '13 at 10:34
How did you restart fail2ban ? the init script doesn't make it reload the conf. try `fail2ban-client reload` — mveroone, Nov 26 '13 at 10:35
@Kwaio -- That worked! Thanks. I managed to ban myself ;) I had restarted with `service fail2ban restart`. Do you want to post as an answer? — Dirk Calloway, Nov 26 '13 at 11:37

score 4 · Accepted Answer · answered Nov 26 '13 at 12:40

What I have seen by trying myself is that restarting the fail2ban daemon doesn't make it reload its configuration file. (Unlike most other daemons under linux... I don't even know how it manages to save its configuration when stopped. Temporary files I guess)

The following command will solve your problem :

fail2ban-client reload

This executable can be used to poll status and other interaction with the daemon.

Fail2ban settings after changing ssh port

1 Answers1