Custom filter not being read/not accessible.

[dasdsa1]

Hello!

I'm configuring fail2ban for a server, but after creating a custom filter, under /etc/fail2ban/filter.d/ClimatePlatform.conf, I get this error:

Sep 29 23:54:31 ip-172-31-1-128 systemd[1]: Started Fail2Ban Service.
Sep 29 23:54:31 ip-172-31-1-128 fail2ban-server[317069]: 2021-09-29 23:54:31,222 fail2ban.configreader   [317069]: ERROR   Found no accessible config files for '/filter.d/ClimatePlatform.conf' under /etc/fail2ban
Sep 29 23:54:31 ip-172-31-1-128 fail2ban-server[317069]: 2021-09-29 23:54:31,222 fail2ban.jailreader     [317069]: ERROR   Unable to read the filter '/filter.d/ClimatePlatform.conf'
Sep 29 23:54:31 ip-172-31-1-128 fail2ban-server[317069]: 2021-09-29 23:54:31,222 fail2ban.jailsreader    [317069]: ERROR   Errors in jail 'ClimatePlatform'. Skipping...

This is the custom filter:

[Definition]

failregex = ^Login Failed invalidUser IP:\[<HOST>\].*$

ignoreregex =

And here's what I've added to the jail.local:

[ClimatePlatform]
enabled = true
filter = /filter.d/ClimatePlatform.conf
logpath = /var/www/DFGE_Test/AccessLogs/Log.txt

On the filter I've tried both with /filter.d/ and without it, meaning "filter = ClimatePlatform.conf"

The fail2ban service is being run by the root user, so should not be an access issue.

Please help!

Best regards,

dasdsa

[pclimaco]

Hi, dasdsa,

What an odd name, but who am I to judge? :-)

1. First, this regex will not compile and will fail because you cannot add empty square brackets like this in regex, please refer to http://webagility.com/posts/the-basics-of-regex-explained

You did not provide us with your log file, but somehow I can imagine it something like-

• Login Failed invalidUser IP:[100.21.64.66]

So you would need this-

• failregex = Login Failed invalidUser IP:\[<HOST>\].*$

2. Second, I believe the only issue with your "jail.local" file is that you added a reference to the filter location so completely remove the line "filter".
   Instead your "jail.local" custom entry reference just have to match a file with the same name in the /etc/fail2ban/filter.d/ directory.

Please, dasdsa, let us know how it works for you.

Many thanks,
Pedro

[sebres]

First, this regex will not compile and will fail because you cannot add empty square brackets ...

Just for the record: it was wrong markdown formatting... I fixed it now.

[sebres]

You don't really need a filter in this case (simply use failregex directly in jail as suggested by @pclimaco)

Back to the issue - the path to filter is absolute in your case, just use name of filter:

- filter = /filter.d/ClimatePlatform.conf
+ filter = ClimatePlatform

or even remove this line, because by default name of filter is equal name of jail.