Fail2ban SSH jail port alignment check
New check that catches a failure mode where fail2ban appears to be working but blocks nothing.
fail2ban's [sshd] jail inherits port = ssh (port 22) from jail.conf. If sshd listens on a non-standard port, the generated firewall rule reads tcp dport 22 ... reject and every ban is a silent no-op. fail2ban-client status still reports the bans as successful, so nothing looks wrong from the outside.
This was found on a live host running SSH on port 2022: roughly 114,000 brute force attempts over a month, 209 "successful" bans, none of which blocked anything. One source IP sustained the attack for 16 consecutive days without ever being meaningfully blocked.
What the check does
- Resolves the effective SSH port from
sshd -T, falling back to the existing config grep - Compares it against the jail port, honouring fail2ban's file precedence:
jail.conf,jail.d/*.conf,jail.local,jail.d/*.local - Resolves service names (
ssh), comma lists (ssh,2222) and ranges (0:65535) - Treats an
allportsbanaction as covering every port - Reports WARN when the
[sshd]jail is disabled entirely
Example failing output:
[FAIL] Fail2ban Port Alignment - The fail2ban [sshd] jail blocks port 'ssh' but SSH
listens on 2022 - every ban is silently ineffective. Set 'port = 2022' in
/etc/fail2ban/jail.local, or use banaction = nftables[type=allports]
Other changes
- New
FAIL2BAN_CONFIG_DIRconfiguration variable (defaults to/etc/fail2ban) - Version string bumped to 0.2.0
Full Changelog: v0.1.0...v0.2.0