{"action":"created","issue":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1474","repository_url":"https://api.github.com/repos/fail2ban/fail2ban","labels_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1474/labels{/name}","comments_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1474/comments","events_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1474/events","html_url":"https://github.com/fail2ban/fail2ban/issues/1474","id":163326409,"number":1474,"title":"FirewallD Ban Actions","user":{"login":"Geraden07","id":5994067,"avatar_url":"https://avatars3.githubusercontent.com/u/5994067?v=4","gravatar_id":"","url":"https://api.github.com/users/Geraden07","html_url":"https://github.com/Geraden07","followers_url":"https://api.github.com/users/Geraden07/followers","following_url":"https://api.github.com/users/Geraden07/following{/other_user}","gists_url":"https://api.github.com/users/Geraden07/gists{/gist_id}","starred_url":"https://api.github.com/users/Geraden07/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Geraden07/subscriptions","organizations_url":"https://api.github.com/users/Geraden07/orgs","repos_url":"https://api.github.com/users/Geraden07/repos","events_url":"https://api.github.com/users/Geraden07/events{/privacy}","received_events_url":"https://api.github.com/users/Geraden07/received_events","type":"User","site_admin":false},"labels":[{"id":207316,"url":"https://api.github.com/repos/fail2ban/fail2ban/labels/enhancement","name":"enhancement","color":"02e10c","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":20,"created_at":"2016-07-01T06:13:20Z","updated_at":"2017-08-16T13:53:25Z","closed_at":null,"body":"Apologies for not adhering to the bug report format but I'm not creating this issue for a bug.\n\nThis is half a question, half a suggestion. \n\nAll the supplied fail2ban action files for use with firewalld use 'direct' rule configuration to essentially ban IPs in the same way that iptables would.\n\nHowever, from their own man page ( https://fedoraproject.org/wiki/FirewallD ) the authors of FirewallD state that `Direct options should be used only as a last resort when it's not possible to use for example --add-service=service or --add-rich-rule='rule'.`\n\nConsidering this, the more appropriate (and significantly simpler) manner in which to ban an IP address in FirewallD is by adding the IP (referred to as the \"source\") to an appropriate zone, such as \"drop\" or \"block\".\n\nThe command to do this would be `firewall-cmd --permanent --zone=drop --add-source=<ip>`. The benefit of this (apart from the simplicity) would be that firewalld would then also be able to display the banned IPs associated with the drop (or block) zone by using the command `firewall-cmd --info-zone=drop` or even `firewall-cmd --list-all-zones`.\n\nNo setup or teardown actions would be necessary. Essentially this approach delegates the nitty-gritty details of rule writing to firewalld. Instead of telling firewalld HOW you want to ban an IP, you instead tell firewalld THAT you want to ban an IP and let firewalld deal with the HOW.\n\nIf the 'block' zone were to be used, the response to banned IPs would be an icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited for IPv6. If the 'drop' zone were used, the packets would be dropped with no response.\n\nI personally am in favor of using the drop behavior, but it's easy enough that both action's could be and should be supplied as options.\n\nAm I missing something as to why this approach is not preferable? Is there a reason that `--direct` rules are necessary and my suggestion is unsuitable? Or is the current behavior simply a result of how iptables rules were ported over to firewalld for compatibility at first release? In which case I strongly suggest this at the very least as an option that should be included with the fail2ban package-provided action files.\n"},"comment":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/comments/322778120","html_url":"https://github.com/fail2ban/fail2ban/issues/1474#issuecomment-322778120","issue_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1474","id":322778120,"user":{"login":"RobbieTheK","id":21204619,"avatar_url":"https://avatars2.githubusercontent.com/u/21204619?v=4","gravatar_id":"","url":"https://api.github.com/users/RobbieTheK","html_url":"https://github.com/RobbieTheK","followers_url":"https://api.github.com/users/RobbieTheK/followers","following_url":"https://api.github.com/users/RobbieTheK/following{/other_user}","gists_url":"https://api.github.com/users/RobbieTheK/gists{/gist_id}","starred_url":"https://api.github.com/users/RobbieTheK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RobbieTheK/subscriptions","organizations_url":"https://api.github.com/users/RobbieTheK/orgs","repos_url":"https://api.github.com/users/RobbieTheK/repos","events_url":"https://api.github.com/users/RobbieTheK/events{/privacy}","received_events_url":"https://api.github.com/users/RobbieTheK/received_events","type":"User","site_admin":false},"created_at":"2017-08-16T13:53:25Z","updated_at":"2017-08-16T13:53:25Z","body":"You can see from the logs below that unbans are still happening even though bantime  = -1. This is Fedora 26  rpm -q fail2ban: fail2ban-0.9.7-2.fc26.noarch. Here are the related jail.local options and log snips. Is there some overlap with the ‘findtime' value?\r\n\r\nbantime = 3600\r\nsender = fail2ban\r\naction = custom-firewalld\r\nbackend = auto\r\nmta = sendmail\r\n\r\n#[Definition]\r\n\r\n[sshd]\r\nenabled = true\r\nfilter   = sshd\r\nlogpath  = /var/log/secure\r\n\r\n[sshd-ddos]\r\nenabled = true\r\n#port    = ssh,sftp\r\nfilter = sshd-ddos\r\nlogpath  = /var/log/secure\r\nmaxretry = 5\r\n\r\n[pam-generic]\r\nenabled  = true\r\n# pam-generic filter can be customized to monitor specific subset of 'tty's\r\nfilter   = pam-generic\r\n# port actually must be irrelevant but lets leave it all for some possible uses\r\nport     = all\r\nbanaction = iptables-allports\r\nlogpath  = /var/log/secure\r\nmaxretry = 3\r\n\r\n[recidive]\r\nenabled  = true\r\nfilter   = recidive\r\nlogpath  = /var/log/fail2ban.log\r\naction   = custom-firewalld[name=recidive]\r\n           sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log]\r\nbantime  = -1 ; forever\r\nfindtime = 86400   ; 1 day\r\nmaxretry = 5\r\n\r\n cat /var/log/fail2ban.log| grep 164.215.170.34\r\n2017-08-15 16:41:26,524 fail2ban.filter         [1996]: INFO    [sshd] Found 164.215.170.34\r\n2017-08-15 16:41:26,530 fail2ban.filter         [1996]: INFO    [pam-generic] Found 164.215.170.34\r\n2017-08-15 16:41:26,534 fail2ban.filter         [1996]: INFO    [sshd] Found 164.215.170.34\r\n2017-08-15 16:41:29,132 fail2ban.filter         [1996]: INFO    [sshd] Found 164.215.170.34\r\n2017-08-15 16:41:31,763 fail2ban.filter         [1996]: INFO    [sshd] Found 164.215.170.34\r\n2017-08-15 16:41:35,006 fail2ban.filter         [1996]: INFO    [sshd] Found 164.215.170.34\r\n2017-08-15 16:41:35,744 fail2ban.actions        [1996]: NOTICE  [sshd] Ban 164.215.170.34\r\n2017-08-15 16:41:35,746 fail2ban.filter         [1996]: INFO    [recidive] Found 164.215.170.34\r\n2017-08-15 16:41:36,811 fail2ban.filter         [1996]: INFO    [sshd] Found 164.215.170.34\r\n2017-08-15 16:41:39,525 fail2ban.filter         [1996]: INFO    [sshd] Found 164.215.170.34\r\n2017-08-15 16:41:42,563 fail2ban.filter         [1996]: INFO    [sshd] Found 164.215.170.34\r\n2017-08-15 16:41:45,622 fail2ban.filter         [1996]: INFO    [sshd] Found 164.215.170.34\r\n2017-08-15 16:41:48,273 fail2ban.filter         [1996]: INFO    [sshd] Found 164.215.170.34\r\n2017-08-15 16:41:48,277 fail2ban.filter         [1996]: INFO    [sshd] Found 164.215.170.34\r\n2017-08-15 16:41:48,527 fail2ban.actions        [1996]: NOTICE  [sshd] 164.215.170.34 already banned\r\n2017-08-15 17:41:35,914 fail2ban.actions        [1996]: NOTICE  [sshd] Unban 164.215.170.34\r\n\r\nfail2ban-client status | grep \"Jail list:\" | sed \"s/ //g\" | awk '{split($2,a,\",\");for(i in a) system(\"fail2ban-client status \" a[i])}' | grep \"Status\\|IP list\" | grep 164.215.170.34\r\n\r\ndoes not return anything."}}
{"actor":{"display_login":"RobbieTheK"}}