Ygtjki

I'm trying to configure fail2ban to block ssh from a local hosts. Fail2ban is install on CentOS 7 with firewall (Linux 3.10.0-229.4.2.el7.x86_64 x86_64 ). I have copied the jail.conf to jail.local i have change the following parameters in jail.local:

banaction = firewallcmd-new
[sshd]
enabled = true
maxretry = 5
port = ssh
logpath = /var/log/secure
action = firewallcmd-ipset

And i have no results. Any idea ?

Some log info:

2ban.filter [2489]: INFO Added logfile = /var/log/secure
2015-06-23 07:21:33,439 fail2ban.filter [2489]: INFO Set maxRetry = 3
2015-06-23 07:21:33,440 fail2ban.filter [2489]: INFO Set jail log file encoding to UTF-8
2015-06-23 07:21:33,441 fail2ban.actions [2489]: INFO Set banTime = 86400
2015-06-23 07:21:33,442 fail2ban.filter [2489]: INFO Set findtime = 600
2015-06-23 07:21:33,442 fail2ban.filter [2489]: INFO Set maxlines = 10
2015-06-23 07:21:33,501 fail2ban.server [2489]: INFO Jail sshd is not a JournalFilter instance
2015-06-23 07:21:33,599 fail2ban.jail [2489]: INFO Jail 'sshd' started

And SELinux is disabled.

action.d/firewallcmd-ipset.conf file

[INCLUDES]

before = iptables-common.conf

[Definition]

actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
 firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>

actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
 ipset flush fail2ban-<name>
 ipset destroy fail2ban-<name>

actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist

actionunban = ipset del fail2ban-<name> <ip> -exist

[Init]

# Option: chain
# Notes specifies the iptables chain to which the fail2ban rules should be
# added
# Values: [ STRING ]
#
chain = INPUT_direct

# Option: bantime
# Notes: specifies the bantime in seconds (handled internally rather than by fail2ban)
# Values: [ NUM ] Default: 600

bantime = 600


# DEV NOTES:
#
# Author: Edgar Hoch and Daniel Black
# firewallcmd-new / iptables-ipset-proto6 combined for maximium goodness

I'm guessing here a bit because I don't have enough info to know what's going on. But I would try something like this:

fail2ban-regex --print-all-missed /var/log/secure /etc/fail2ban/filter.d/sshd.conf

to see if it finds something or what lines it might be missing. I'm assuming /var/log/secure is where sshd is printing out it's login failures. It's /var/log/auth.log on my debian based system.

Also I have a bantime and findtime in my jail.local

bantime = 86400
findtime = 86400

Maybe you are not getting anything because you haven't told it the window of time to look in?