how to setup it up the best way

[klapvogn]

I have just for my [sshd]

[sshd]

# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.

# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define
# action_* variables. Can be overridden globally or per
# section within jail.local file
banaction = iptables-ipset[type=multiport]
banaction_allports = iptables-ipset[type=allports]

enabled = true
mode   = normal
port    = 50512
filter  = sshd
# initial ban time:
bantime = 1h
# incremental banning:
bantime.increment = true
# default factor (causes increment - 1h -> 1d 2d 4d 8d 16d 32d ...):
bantime.factor = 24
# max banning time = 5 week:
bantime.maxtime = 5w
#logpath = %(sshd_log)s
logpath = /var/log/auth.log
backend = %(sshd_backend)s

# "maxretry" is the number of failures before a host get banned.
maxretry = 2

# "maxmatches" is the number of matches stored in ticket (resolvable via tag <matches> in actions).
maxmatches = %(maxretry)s

Should I remove the maxretry and maxmatches because I get : Ban length: 1h and then it removes the ban?

[sebres]

Should I remove the maxretry and maxmatches because I get : Ban length: 1h and then it removes the ban?

Hmm... Neither I know some code piece containing "Ban length" as an error, nor I can imagine some action (especially not the iptables-ipset) would raise such an error or something pythonic could do that.
Does it possibly mean "bad length"? (however even this is unknown to me).
Can you provide detailed error (with a traceback) or at least the excerpt from fail2ban.log after [sshd] Ban 192.0.2.1 (this is test sub-net, so with the IP you have tested it) up to the error (and few lines below)?
Also you don't need wait for the ban, can every time test it with something like ?sudo? fail2ban-client set sshd banip 192.0.2.1

Anyway, I don't think that setting of maxretry and maxmatches has something to do with the error.
Not to mention that maxmatches = %(maxretry)s makes no sense, because it'd normally ban after reaching of maxretry, so one set maxmatches only by large value of maxretry, to avoid wastage of memory with a lot of matched messages by IPs, waiting for a ban in a queue and hereafter in a ban-list.

And bantime = 1h is solely the option which has this "bad" 1h inside, but it'd be internally converted to numeric value (seconds).
In case of doubt please provide output of ?sudo? fail2ban-client -d | grep sshd (dump of whole merged configuration supplied to server).

[klapvogn]

Hi again,

here is the output of sudo fail2ban-client -d | grep sshd
https://0bin.dev-null.site/?14d2fdfc5d3c316f#5uvQTDfNZW7LPLA1efxQF1s11NDbypm3dCguUVt51XuP

[sebres]

But it doesn't use iptables-ipset action at all, instead it uses something called notifiarr:

['set', 'sshd', 'addaction', 'notifiarr']
['multi-set', 'sshd', 'action', 'notifiarr', ...]

It looks like somewhere in configs, the action or action_ parameters get overwritten by some custom values.
This also mean - the iptables-ipset is unused (and there is basically no banning action at all, just this notifiarr).
I have no idea what is it, or why 1h by bantime is not substituted to numeric inside it (one needs more info, like what is the action-config and how it is configured)...
As workaround you can surely set bantime = 3600 instead.

But note that with bantime.increment = true the value of bantime set in jail is just initial value, and basically it is dynamic, so to get proper value use fail2ban interpolations <bantime> instead of pythonic ini-file %(bantime)s.
Because <bantime> would grow by recidive repeated attempts (in actionban if observer module is faster than an actions, but for sure in actionprolong).

However, I'd nevertheless check whether the banning action is necessary.
If yes, normally one makes something like in this example:

fail2ban/config/jail.conf

Lines 236 to 237 in 0c125ec

	# action = %(action_)s
	# apprise

Or something like this:

action = %(default/action)s
         notifiarr[...]

So it would extend the action, not overwrite it and stock action (defined in jail.conf) remains:

fail2ban/config/jail.conf

Line 212 in 0c125ec

action_ = %(banaction)s[port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

fail2ban/config/jail.conf

Line 263 in 0c125ec

action = %(action_)s

[klapvogn]

here is the notifiarr.conf

### Purpose
# Fail2Ban Action for Notifiarr notifications
#### Install
# Download this file using the below curl command then move the file to your fail2ban action.d folder.
# curl -o notifiarr.conf https://notifiarr.com/scripts/fail2ban/notifiarr.conf
# On Most Ubuntu and Debian this can be accomplished with
# sudo curl -o /etc/fail2ban/action.d/notifiarr.conf https://notifiarr.com/scripts/fail2ban/notifiarr.conf
#### Setup
# Add the action to the default action or the jail(s) in your jail.local file
# action = notifiarr[bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s"]
#### Maintainers
# Bakerboy448, HalianElf

[Definition]
# Command executed when the jail starts
actionstart = curl -s -X POST "<url>" \
              -H "Content-Type: application/json" \
              -H "x-api-key: <apikey>" \
              -H "User-Agent: <agent>" \
              -d '{"event": "start", "server_name": "<hostname>", "jail_name": "<name>"}'

# Command executed when the jail stops
actionstop = curl -s -X POST "<url>" \
             -H "Content-Type: application/json" \
             -H "x-api-key: <apikey>" \
             -H "User-Agent: <agent>" \
             -d '{"event": "stop", "server_name": "<hostname>", "jail_name": "<name>"}'

# Command executed when banning an IP
actionban = curl -s -X POST "<url>" \
            -H "Content-Type: application/json" \
            -H "x-api-key: <apikey>" \
            -H "User-Agent: <agent>" \
            -d '{"event": "ban", "server_name": "<hostname>", "jail_name": "<name>", "ip": "<ip>", "ban_length": "<bantime>", "failures": "<failures>", "time_of_ban": "<time>", "port": "<port>", protocol: "<protocol>", "additional_info": {"ipfailures": "<ipfailures>", "ipjailfailures": "<ipjailfailures>"}}'

# Command executed when unbanning an IP
actionunban = curl -s -X POST "<url>" \
            -H "Content-Type: application/json" \
            -H "x-api-key: <apikey>" \
            -H "User-Agent: <agent>" \
            -d '{"event": "unban", "server_name": "<hostname>", "jail_name": "<name>", "ip": "<ip>"}'

[Init]
hostname = xxxx
apikey = xxxx
url = https://notifiarr.com/api/v1/notification/fail2ban
version = 1.0.0
agent = <fail2ban_agent>/Fail2BanNotifiarr_<version>

I have added it like this

enabled = true
mode   = normal
port    = 50512
filter  = sshd
# initial ban time:
bantime = 3600
# incremental banning:
bantime.increment = true
# default factor (causes increment - 1h -> 1d 2d 4d 8d 16d 32d ...):
bantime.factor = 24
# max banning time = 5 week:
bantime.maxtime = 5w
#logpath = %(sshd_log)s
logpath = /var/log/auth.log
backend = %(sshd_backend)s
action = notifiarr[bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s"]

So I can just remove these, as the effect is not that good?
bantime.increment = true
bantime.factor = 24
bantime.maxtime = 5w

one last thing I had f2b-sshd chain before, but now it's gone 🤔 and come back when I remove action = notifiarr[bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s"] so I think I need some help adding it right 😁

FIIIIIIIIIIIIIIIIIIIIIIXED
action = %(action_)s notifiarr[bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s"]

[sebres]

Some says 3d 12h and some says 35d

Please note #3700 (reply in thread)
Without overwriting of bantime as init-parameter in action, it MUST be numeric. Without exception.
Somewhere in your configs it seems to be supplied to the action yet. What is wrong.

No one of this parameters should be overwritten, they are all dynamic and values of them depends on current ticket, getting banned.

I also don't know where you have 3d 12h or 35d, but they would be definitely numeric if it they were from the ticket (no matter initial or prolonged by bantime-increment feature).

[klapvogn]

I have no idea what's going on.
What I have atm:

No where does it have d or w (for days, or weeks)
bantime = 3024000
findtime = 600

[sshd]
enabled = true
mode   = normal
port    = 50512
filter  = sshd
#logpath = %(sshd_log)s
logpath = /var/log/auth.log
backend = %(sshd_backend)s

[recidive]
enabled = true
logpath  = /var/log/fail2ban.log
banaction = %(banaction_allports)s
bantime  = 3024000
findtime = 86400

I noticed this from notifiarr.conf

where it has ban length

actionban = curl -s -X POST "<url>" \
            -H "Content-Type: application/json" \
            -H "x-api-key: <apikey>" \
            -H "User-Agent: <agent>" \
            -d '{"event": "ban", "server_name": "<hostname>", "jail_name": "<name>", "ip": "<ip>", "ban_length": "<bantime>", "failures": "<failures>", "time_of_ban": "<time>", "port": "<port>", protocol: "<protocol>", "additional_info": {"ipfailures": "<ipfailures>", "ipjailfailures": "<ipjailfailures>"}}'

[sebres]

Again, see the diff I provided in #3700 (reply in thread)
With notifiarr[bantime="%(bantime)s"...] you seemed to overwrite bantime of action with fixed value from jail-config (the normally dynamic bantime will be to static fixed value and doesn't change corresponding to the ban ticket anymore).
If you did it, just restart fail2ban (or affected jail) with fail2ban-client or service/systemctl. Note: it must be restart (not reload), because reload can't refresh the actions on the fly (it only refresh the filters etc).

[klapvogn]

Hi,

I have changed that

action = %(action_)s 
         notifiarr[port="%(port)s", protocol="%(protocol)s"]

there is no bantime

[sebres]

Oh boy...
Did you restart fail2ban? If so, it still works not in the way you expect, or what I must understand by that sentence?

No bantime where? You mean in this definition? Or in output your action generates?
What is to expect, what happens instead?
Which version of fail2ban used here in the first place?
People, we cannot read your thoughts...

[klapvogn]

version : 0.11.2

I mean by the bantime, it says 35d but I have no where a place where 35d is, in seconds. I have added 5w in seconds.
that is my issue

[sebres]

Again, did you restarted fail2ban and after restart it is still 35d somewhere in the action results, right?
Then (without to modify configs), try that:
sudo fail2ban-client -d | grep 35d
if you have it, try to grep /etc/fail2ban for that to see what can cause it:
sudo grep -r 35d /etc/fail2ban/
if don't, may be there are some includes points to different locations that /etc/fail2ban/, however it is hard to predict...
Pity that people don't have own configs under theirs own control.

If with 35d you rather mean the time in seconds (something like 3024000), do you realize your own setting?

bantime.increment = true
bantime.maxtime = 5w

The first means that ban of known as bad IPs (recidive evildoers, with repeated attempts) will be enlarged up to the second (maxtime) depending on previous ban-count for this IP, where 35d correspond to exactly the same value than 5w - 5 weeks * 7 days = 35 days.

Otherwise (if it neither one, nor another), I don't understand your issue at all.