Creating a bug report/issue
I have searched the existing open and closed issues
Required Information
- DietPi version |
root@DietPi:~# G_DIETPI_VERSION_CORE=9 G_DIETPI_VERSION_SUB=5 G_DIETPI_VERSION_RC=1 G_GITBRANCH='master' G_GITOWNER='MichaIng' G_LIVE_PATCH_STATUS[0]='not applicable' root@DietPi:~# - Distro version |
bookworm - Kernel version |
Linux DietPi 5.10.160-legacy-rk35xx #1 SMP Wed May 15 03:04:45 UTC 2024 aarch64 GNU/Linux - Architecture |
arm64 - SBC model |
Radxa3E - Power supply used | (5V3A)
- SD card used | (SanDisk ultra)
Additional Information (if applicable)
- Software title | (fail2ban)
- Bug report ID |
a1332c36-9a43-44f6-866f-ea79d3b32167
Hi, I’m connected to this problem “Fail2Ban not logging attemps from Dropbear”
In my case fail2ban is filtering the data but it’s not being logged at all…
I’ll show you my setup
root@DietPi:~# sudo fail2ban-client status dropbear
Status for the jail: dropbear
|- Filter
| |- Currently failed: 0
| |- Total failed: 3
| `- Journal matches:
`- Actions
|- Currently banned: 3
|- Total banned: 4
`- Banned IP list: 183.81.169.238 212.64.211.219 192.168.1.5
root@DietPi:~#
root@DietPi:~# cat /etc/fail2ban/fail2ban.conf
# Fail2Ban main configuration file
#
# Comments: use '#' for comment lines and ';' (following a space) for inline comments
#
# Changes: in most of the cases you should not modify this
# file, but provide customizations in fail2ban.local file, e.g.:
#
# [DEFAULT]
# loglevel = DEBUG
#
[DEFAULT]
# Option: loglevel
# Notes.: Set the log level output.
# CRITICAL
# ERROR
# WARNING
# NOTICE
# INFO
# DEBUG
# Values: [ LEVEL ] Default: INFO
#
loglevel = DEBUG
# Option: logtarget
# Notes.: Set the log target. This could be a file, SYSTEMD-JOURNAL, SYSLOG, STDERR or STDOUT.
# Only one log target can be specified.
# If you change logtarget from the default value and you are
# using logrotate -- also adjust or disable rotation in the
# corresponding configuration file
# (e.g. /etc/logrotate.d/fail2ban on Debian systems)
# Values: [ STDOUT | STDERR | SYSLOG | SYSOUT | SYSTEMD-JOURNAL | FILE ] Default: STDERR
#
logtarget = /var/log/auth.log
# Option: syslogsocket
# Notes: Set the syslog socket file. Only used when logtarget is SYSLOG
# auto uses platform.system() to determine predefined paths
# Values: [ auto | FILE ] Default: auto
syslogsocket = auto
# Option: socket
# Notes.: Set the socket file. This is used to communicate with the daemon. Do
# not remove this file when Fail2ban runs. It will not be possible to
# communicate with the server afterwards.
# Values: [ FILE ] Default: /var/run/fail2ban/fail2ban.sock
#
socket = /var/run/fail2ban/fail2ban.sock
# Option: pidfile
# Notes.: Set the PID file. This is used to store the process ID of the
# fail2ban server.
# Values: [ FILE ] Default: /var/run/fail2ban/fail2ban.pid
#
pidfile = /var/run/fail2ban/fail2ban.pid
# Option: allowipv6
# Notes.: Allows IPv6 interface:
# Default: auto
# Values: [ auto yes (on, true, 1) no (off, false, 0) ] Default: auto
#allowipv6 = auto
# Options: dbfile
# Notes.: Set the file for the fail2ban persistent data to be stored.
# A value of ":memory:" means database is only stored in memory
# and data is lost when fail2ban is stopped.
# A value of "None" disables the database.
# Values: [ None :memory: FILE ] Default: /var/lib/fail2ban/fail2ban.sqlite3
dbfile = /var/lib/fail2ban/fail2ban.sqlite3
# Options: dbpurgeage
# Notes.: Sets age at which bans should be purged from the database
# Values: [ SECONDS ] Default: 86400 (24hours)
dbpurgeage = 1d
# Options: dbmaxmatches
# Notes.: Number of matches stored in database per ticket (resolvable via
# tags <ipmatches>/<ipjailmatches> in actions)
# Values: [ INT ] Default: 10
dbmaxmatches = 10
[Definition]
[Thread]
# Options: stacksize
# Notes.: Specifies the stack size (in KiB) to be used for subsequently created threads,
# and must be 0 or a positive integer value of at least 32.
# Values: [ SIZE ] Default: 0 (use platform or configured default)
#stacksize = 0
root@DietPi:~# cat /etc/fail2ban/jail.conf
[DEFAULT]
enabled = true
ignoreip = 127.0.0.1/8
ignorecommand =
backend = systemd
mode = normal
filter = %(__name__)s[mode=%(mode)s]
findtime = 600
maxretry = 3
bantime = 600
banaction = route
action = %(banaction)s[blocktype=blackhole]
[dropbear]
enabled =true
daemon = dropear
logpath = /var/log/auth.log
port =22
filter = dropbear
banaction = route
action = %(banaction)s[blocktype=blackhole]
maxretry = 3
bantime = 14400
findtime = 14400
mode=normal
backend=systemd
[sshd]
# Mode: normal (default), ddos, extra or aggressive (combines all)
# See "filter.d/sshd.conf" for details.
#mode = normal
root@DietPi:~# cat /etc/fail2ban/jail.local
[DEFAULT]
enabled = true
ignoreip = 127.0.0.1/8
ignorecommand =
backend = systemd
mode = normal
filter = %(__name__)s[mode=%(mode)s]
findtime = 600
maxretry = 3
bantime = 600
banaction = route
action = %(banaction)s[blocktype=blackhole]
[dropbear]
enabled =true
daemon = dropear
logpath = /var/log/auth.log
port =22
filter = dropbear
banaction = route
action = %(banaction)s[blocktype=blackhole]
maxretry = 3
bantime = 14400
findtime = 14400
mode=normal
backend=systemd
[sshd]
# Mode: normal (default), ddos, extra or aggressive (combines all)
# See "filter.d/sshd.conf" for details.
#mode = normal
root@DietPi:~# sudo cat /etc/fail2ban/filter.d/dropbear.conf
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf
[Definition]
_daemon = dropbear
prefregex = ^%(__prefix_line)s\[\d+\] [A-Z][a-z]+ \d\d \d\d:\d\d:\d\d <F-CONTENT>(?:[Ll]ogin|[Bb]ad|[Ee]xit).+</F-CONTENT>$
failregex = ^[Ll]ogin attempt for nonexistent user ('.*' )?from <HOST>:\d+$
^[Bb]ad (PAM )?password attempt for .+ from <HOST>(:\d+)?$
^[Ee]xit before auth \(user '.+', \d+ fails\): Max auth tries reached - user '.+' from <HOST>:\d+\s*$
ignoreregex =
root@DietPi:~# cat /var/log/auth.log
root@DietPi:~# ls -a /var/log/auth.log
/var/log/auth.log
root@DietPi:~# ls -l /var/log/auth.log
-rw-r----- 1 root adm 0 Jul 7 12:35 /var/log/auth.log
root@DietPi:~# journalctl -u fail2ban.service
Jul 07 15:44:33 DietPi systemd[1]: Started fail2ban.service - Fail2Ban Service.
Jul 07 15:44:34 DietPi fail2ban-server[486]: 2024-07-07 15:44:34,624 fail2ban.configreader [486]: WARNING 'allowipv6' not defined in 'Definition'. Using default one: 'auto'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: INFO --------------------------------------------------
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: INFO Starting Fail2ban v1.0.2
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG Creating PID file /var/run/fail2ban/fail2ban.pid
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.observer [486]: INFO Observer start...
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG Starting communication
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.ipdns [486]: DEBUG IPv6 is auto
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.database [486]: INFO Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.jail [486]: INFO Creating new jail 'dropbear'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.jail [486]: INFO Jail 'dropbear' uses systemd {}
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filter [486]: DEBUG Setting usedns = warn for FilterSystemd(Jail('dropbear'))
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filter [486]: DEBUG Created FilterSystemd(Jail('dropbear'))
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filtersystemd [486]: DEBUG Created FilterSystemd
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.jail [486]: INFO Initiated 'systemd' backend
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG prefregex: '^\\s*(?:\\S+\\s+)?(?:dropbear(?:\\[\\d+\\])?:?\\s+)?(?:kernel:\\s?\\[ *\\d+\\.\\d+\\]:?\\s+)?\\[\\d+\\] [A-Z][a-z]+ \\d\\d \\d\\d:\\d\\d:\\d\\d <F-CONTENT>(?:[Ll]ogin|[Bb]ad|[Ee]xit).+</F-CONTENT>$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: "^[Ll]ogin attempt for nonexistent user ('.*' )?from <HOST>:\\d+$"
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^[Bb]ad (PAM )?password attempt for .+ from <HOST>(:\\d+)?$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: "^[Ee]xit before auth \\(user '.+', \\d+ fails\\): Max auth tries reached - user '.+' from <HOST>:\\d+\\s*$"
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filter [486]: INFO maxRetry: 3
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filter [486]: INFO findtime: 14400
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.actions [486]: INFO banTime: 14400
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filter [486]: DEBUG Add '127.0.0.0/8' to ignore list ('127.0.0.1/8')
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Created <class 'fail2ban.server.action.CommandAction'>
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set actionstart = ''
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set actionstop = ''
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set actioncheck = ''
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set actionban = 'ip route add blackhole <ip>'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set actionunban = 'ip route del blackhole <ip>'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set blocktype = 'blackhole'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set name = 'dropbear'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set actname = 'route'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.jail [486]: INFO Creating new jail 'sshd'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.jail [486]: INFO Jail 'sshd' uses systemd {}
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filter [486]: DEBUG Setting usedns = warn for FilterSystemd(Jail('sshd'))
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filter [486]: DEBUG Created FilterSystemd(Jail('sshd'))
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filtersystemd [486]: DEBUG Created FilterSystemd
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.jail [486]: INFO Initiated 'systemd' backend
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG prefregex: '^<F-MLFID>\\s*(?:\\S+\\s+)?(?:sshd(?:\\[\\d+\\])?:?\\s+)?(?:kernel:\\s?\\[ *\\d+\\.\\d+\\]:?\\s+)?</F-MLFID>(?:(?:error|fatal): (?:PAM: )?)?<F-CONTENT>.+</F-CONTENT>$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filter [486]: INFO maxLines: 1
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^[aA]uthentication (?:failure|error|failed) for <F-USER>.*</F-USER> from <HOST>( via \\S+)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^User not known to the underlying authentication module for <F-USER>.*</F-USER> from <HOST>(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^Failed publickey for invalid user <F-USER>(?P<cond_user>\\S+)|(?:(?! from ).)*?</F-USER> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}(?: ssh\\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^Failed (?:<F-NOFAIL>publickey</F-NOFAIL>|\\S+) for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}(?: ssh\\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^<F-USER>ROOT</F-USER> LOGIN REFUSED FROM <HOST>'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> from <HOST>(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^User <F-USER>\\S+|.*?</F-USER> from <HOST> not allowed because not listed in AllowUsers(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^User <F-USER>\\S+|.*?</F-USER> from <HOST> not allowed because listed in DenyUsers(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^User <F-USER>\\S+|.*?</F-USER> from <HOST> not allowed because not in any group(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^refused connect from \\S+ \\(<HOST>\\)'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}:\\s*3: .*: Auth fail(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^User <F-USER>\\S+|.*?</F-USER> from <HOST> not allowed because a group is listed in DenyGroups(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: "^User <F-USER>\\S+|.*?</F-USER> from <HOST> not allowed because none of user's groups are listed in AllowGroups(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$"
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^<F-NOFAIL>pam_[a-z]+\\(sshd:auth\\):\\s+authentication failure;</F-NOFAIL>(?:\\s+(?:(?:logname|e?uid|tty)=\\S*)){0,4}\\s+ruser=<F-ALT_USER>\\S*</F-ALT_USER>\\s+rhost=<HOST>(?:\\s+user=<F-USER>\\S*</F-USER>)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^maximum authentication attempts exceeded for <F-USER>.*</F-USER> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}(?: ssh\\d*)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^User <F-USER>\\S+|.*?</F-USER> not allowed because account is locked(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^<F-MLFFORGET>Disconnecting</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\\S+</F-USER> <HOST>(?: (?:port \\d+|on \\S+)){0,2}:\\s*Change of username or service not allowed:\\s*.*\\[preauth\\]\\s*$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^Disconnecting: Too many authentication failures(?: for <F-USER>\\S+|.*?</F-USER>)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}:\\s*11:'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^<F-NOFAIL><F-MLFFORGET>(Connection (?:closed|reset)|Disconnected)</F-MLFFORGET></F-NOFAIL> (?:by|from)(?: (?:invalid|authenticating) user <F-USER>\\S+|.*?</F-USER>)? <HOST>(?:(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*|\\s*)$'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^<F-MLFFORGET><F-MLFGAINED>Accepted \\w+</F-MLFGAINED></F-MLFFORGET> for <F-USER>\\S+</F-USER> from <HOST>(?:\\s|$)'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.server [486]: DEBUG failregex: '^<F-NOFAIL>Connection from</F-NOFAIL> <HOST>'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filtersystemd [486]: INFO [sshd] Added journal match for: '_SYSTEMD_UNIT=sshd.service + _COMM=sshd'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filter [486]: INFO maxRetry: 3
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filter [486]: INFO findtime: 600
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.actions [486]: INFO banTime: 600
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filter [486]: DEBUG Add '127.0.0.0/8' to ignore list ('127.0.0.1/8')
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Created <class 'fail2ban.server.action.CommandAction'>
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set actionstart = ''
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set actionstop = ''
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set actioncheck = ''
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set actionban = 'ip route add blackhole <ip>'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set actionunban = 'ip route del blackhole <ip>'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set blocktype = 'blackhole'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set name = 'sshd'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.CommandAction [486]: DEBUG Set actname = 'route'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.jail [486]: DEBUG Starting jail 'dropbear'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filtersystemd [486]: NOTICE [dropbear] Jail started without 'journalmatch' set. Jail regexs will be checked against all journal entries, which is not advised for performance reasons.
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.jail [486]: INFO Jail 'dropbear' started
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.jail [486]: DEBUG Starting jail 'sshd'
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.filtersystemd [486]: INFO [sshd] Jail is in operation now (process new journal entries)
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.jail [486]: INFO Jail 'sshd' started
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.transmitter [486]: DEBUG Status: ready
Jul 07 15:44:35 DietPi fail2ban-server[486]: Server ready
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.actions [486]: NOTICE [dropbear] Restore Ban 183.81.169.238
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.utils [486]: DEBUG ffffbd5507b0 -- returned successfully 0
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.actions [486]: NOTICE [dropbear] Restore Ban 192.168.1.5
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.utils [486]: DEBUG ffffbd5507b0 -- returned successfully 0
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.actions [486]: NOTICE [dropbear] Restore Ban 212.64.211.219
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.utils [486]: DEBUG ffffbd5507b0 -- returned successfully 0
Jul 07 15:44:35 DietPi fail2ban-server[486]: fail2ban.actions [486]: DEBUG Banned 3 / 3, 3 ticket(s) in 'dropbear'
Jul 07 15:44:36 DietPi fail2ban-server[486]: fail2ban.filtersystemd [486]: INFO [dropbear] Jail is in operation now (process new journal entries)
Jul 07 15:44:36 DietPi fail2ban-server[486]: fail2ban.filtersystemd [486]: DEBUG [dropbear] Invalidate signaled, take a little break (rotation ends)
Jul 07 15:49:50 DietPi fail2ban-server[486]: fail2ban.actions [486]: NOTICE [dropbear] Unban 192.168.1.5
Jul 07 15:49:50 DietPi fail2ban-server[486]: fail2ban.actions [486]: DEBUG [dropbear] action 'route': unban 192.168.1.5
Jul 07 15:49:50 DietPi fail2ban-server[486]: fail2ban.utils [486]: DEBUG ffffbc4e70f0 -- returned successfully 0
Jul 07 15:49:55 DietPi fail2ban-server[486]: fail2ban.filter [486]: DEBUG Processing line with time:1720363795.334499 and ip:192.168.1.5
Jul 07 15:49:55 DietPi fail2ban-server[486]: fail2ban.filter [486]: INFO [dropbear] Found 192.168.1.5 - 2024-07-07 15:49:55
Jul 07 15:49:55 DietPi fail2ban-server[486]: fail2ban.failmanager [486]: DEBUG Total # of detected failures: 1. Current failures from 1 IPs (IP:count): 192.168.1.5:1
Jul 07 15:49:55 DietPi fail2ban-server[486]: fail2ban.filter [486]: DEBUG Processing line with time:1720363795.657105 and ip:192.168.1.5
Jul 07 15:49:55 DietPi fail2ban-server[486]: fail2ban.filter [486]: INFO [dropbear] Found 192.168.1.5 - 2024-07-07 15:49:55
Jul 07 15:49:55 DietPi fail2ban-server[486]: fail2ban.failmanager [486]: DEBUG Total # of detected failures: 2. Current failures from 1 IPs (IP:count): 192.168.1.5:2
Jul 07 15:49:56 DietPi fail2ban-server[486]: fail2ban.filter [486]: DEBUG Processing line with time:1720363796.025784 and ip:192.168.1.5
Jul 07 15:49:56 DietPi fail2ban-server[486]: fail2ban.filter [486]: INFO [dropbear] Found 192.168.1.5 - 2024-07-07 15:49:56
Jul 07 15:49:56 DietPi fail2ban-server[486]: fail2ban.failmanager [486]: DEBUG Total # of detected failures: 3. Current failures from 1 IPs (IP:count): 192.168.1.5:3
Jul 07 15:49:56 DietPi fail2ban-server[486]: fail2ban.actions [486]: NOTICE [dropbear] Ban 192.168.1.5
Jul 07 15:49:56 DietPi fail2ban-server[486]: fail2ban.observer [486]: DEBUG [dropbear] Observer: ban found 192.168.1.5, 14400
Jul 07 15:49:56 DietPi fail2ban-server[486]: fail2ban.utils [486]: DEBUG ffffbd5507b0 -- returned successfully 0
Jul 07 15:49:56 DietPi fail2ban-server[486]: fail2ban.actions [486]: DEBUG Banned 1 / 4, 3 ticket(s) in 'dropbear'
root@DietPi:~#
