Legacy FreePBX Distro with fail2ban 0.9.6

[lorn10]

Thanks again lgaetz for your fast replay. That’s exactly what I thought…

However, FreePBX 14 seems to come with exactly that fail2ban recidive filter logpath setting. (I get my config from the jail.local of the thread starter Basildane):

FreePBX 14, fail2ban dead

Here is my jail.local # Configuration automatically generated via the Sysadmin Module # This file will be overwritten by Sysadmin on startup. If you modify`> Preformatted text` # this file, your changes will be lost. DO NOT MODIFY THIS FILE! # generated: Mon, 21 Aug 2017 23:31:09 +0000 [DEFAULT] ignoreip = 127.0.0.1 10.0.10.15 bantime = 1800 findtime = 600 maxretry = 1 backend = auto [asterisk-iptables] enabled = true filter = asterisk action = iptables-allports[name=SIP, protocol=all] s…

I thought if FreePBX 14 comes with this setting then it should be also the correct one for my fail2ban 0.9.6 at FreePBX 11. (Although the logging of fail2ban messages does not make much sense)

Update:

I can confirm now, /var/log/fail2ban.log* is definitely the correct setting for the recidive filter. With this config fail2ban will check his own logs regarding excessive attacks. So far I know recidive is the only fail2ban filter which works on that way.

Note, if the fail2ban.log files are missing on /var/log/ then it is necessary to enforce fail2ban to create it there with the following steps:

1. Open the /etc/fail2ban/fail2ban.conf file
2. Change the line: logtarget = SYSLOG to logtarget = /var/log/fail2ban.log
3. restart fail2ban service or sudo service fail2ban restart

After this the recidive filter is working perfectly.