restart of fail2ban service fails

Thanks for the assistance with this. I really appreciate it! The jail.local that is working for you causes my fail2ban service to fail on start up. This installation was pre-installed from my VPS provider, so I dug around and mimicked what I found pre-configured for jails for other services. It seems that I have everything running now successfully according to the logs. However, it appears that the filter may not be matching, so nothing is being banned. I have worked with this for some time this evening and am again out of ideas. Can you offer any further advice?

Here is my messages log excert…

Oct 27 23:07:29 fail2ban.jail : INFO Creating new jail ‘wordpress’
Oct 27 23:07:29 fail2ban.jail : INFO Jail ‘wordpress’ uses Inotify
Oct 27 23:07:29 ¿<30>fail2ban.filter : INFO Added logfile = /var/log/messages
Oct 27 23:07:29 ¿<30>fail2ban.filter : INFO Set maxRetry = 1
Oct 27 23:07:29 ¿<30>fail2ban.filter : INFO Set findtime = 600
Oct 27 23:07:29 fail2ban.actions: INFO Set banTime = 120
Oct 27 23:07:29 fail2ban.jail : INFO Jail ‘wordpress’ started
Oct 27 23:08:25 wordpress(MyDomain.com)[16114]: Authentication failure for someone from 108.162.216.245
Oct 27 23:08:34 wordpress(MyDomain.com)[18147]: Authentication failure for someone from 108.162.216.245
Oct 27 23:08:43 wordpress(MyDomain.com)[15927]: Authentication failure for someone from 108.162.216.245

Here is my jail.local

# This jail blocks WordPress login failures.
[wordpress]
enabled = true
filter = wordpress
action = sendmail-whois[name=wordpress, dest=root, sender=fail2ban@example.com]
iptables-multiport[name=wordpress, port=”80,443″, protocol=tcp]
logpath = /var/log/messages
maxretry = 1
bantime = 120

Here is my wordpress.conf (removed comments only to conserve space in this post)

[INCLUDES]
before = common.conf

[Definition]
_daemon = wordpress

failregex = ^%(__prefix_line)sauthentication failure for .* from <HOST>$

ignoreregex =

“iptables –list | grep fail2ban“
When I run the above command it appears to have the appropriate hooks in the iptables as other services.

target prot opt source destination
fail2ban-wordpress tcp — anywhere anywhere multiport dports http,https

Chain fail2ban-wordpress (1 references)
target prot opt source destination
RETURN all — anywhere anywhere

Thank you for your assistance!

It appears that the filter isn’t catching the authentication failures.

Oct 28 19:44:09 wordpress(MyDomain.com)[26603]: Authentication failure for someone from 8.8.8.8
Oct 28 19:44:33 wordpress(MyDomain.com)[23820]: Authentication failure for someone from 8.8.8.8

————————————————–
# fail2ban-regex /var/log/messages filter.d/wordpress.conf

Running tests
=============

Use regex file : filter.d/wordpress.conf
Use log file : /var/log/messages

Results
=======

Failregex
|- Regular expressions:
| [1] ^\s*(?:\S+ )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?wordpress(?:\(\S+\))?[\]\)]?:?|[\[\(]?wordpress(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*authentication failure for .* from <HOST>$
|

– Number of matches:
[1] 0 match(es)

Ignoreregex
|- Regular expressions:
|

– Number of matches:

Summary
=======

Sorry, no match

Thanks so much for sticking with this! I changed the filter file as follows, but no luck. 🙁

failregex = ^%(__prefix_line)sAuthentication failure for .* from <HOST>$

Could the issue be that __prefix_line isn’t translating correctly?

Common.conf
_daemon = \S*

__pid_re = (?:\[\d+\])

__daemon_re = [\[\(]?%(_daemon)s(?:\(\S+\))?[\]\)]?:?

__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)

__prefix_line = \s*(?:\S+ )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*

Thanks for responding, I appreciate it.

I am alerted about SSH bans on a regular basis. I am not sure if they are truly blocked.

I actually got to filter somehow….

Message from syslogd@vps-1115096-13004 at Nov 6 18:05:34 …
¿<28>fail2ban.actions: WARNING [wordpress] Ban 8.8.8.8

But is doesn’t block anything. I have attempted several actions. Here is the current action.

From jail.local
action = sendmail-whois[name=wordpress, dest=root, sender=fail2ban@example.com]
iptables-multiport[name=Web, port=”80,443″, protocol=tcp]

The iptables-multiport.conf in the filter.d directory is default.