Skip to content

v0.2.0

Latest
Latest

Choose a tag to compare

View all tags
@vernu vernu released this 10 Aug 11:13
v0.2.0
57c323d

Fail2ban SSH jail port alignment check

New check that catches a failure mode where fail2ban appears to be working but blocks nothing.

fail2ban's [sshd] jail inherits port = ssh (port 22) from jail.conf. If sshd listens on a non-standard port, the generated firewall rule reads tcp dport 22 ... reject and every ban is a silent no-op. fail2ban-client status still reports the bans as successful, so nothing looks wrong from the outside.

This was found on a live host running SSH on port 2022: roughly 114,000 brute force attempts over a month, 209 "successful" bans, none of which blocked anything. One source IP sustained the attack for 16 consecutive days without ever being meaningfully blocked.

What the check does

  • Resolves the effective SSH port from sshd -T, falling back to the existing config grep
  • Compares it against the jail port, honouring fail2ban's file precedence: jail.conf, jail.d/*.conf, jail.local, jail.d/*.local
  • Resolves service names (ssh), comma lists (ssh,2222) and ranges (0:65535)
  • Treats an allports banaction as covering every port
  • Reports WARN when the [sshd] jail is disabled entirely

Example failing output:

[FAIL] Fail2ban Port Alignment - The fail2ban [sshd] jail blocks port 'ssh' but SSH
listens on 2022 - every ban is silently ineffective. Set 'port = 2022' in
/etc/fail2ban/jail.local, or use banaction = nftables[type=allports]

Other changes

  • New FAIL2BAN_CONFIG_DIR configuration variable (defaults to /etc/fail2ban)
  • Version string bumped to 0.2.0

Full Changelog: v0.1.0...v0.2.0

Assets 2
Loading