Question Fail2Ban and Servermemory

[DieterWerner]

What should be done to avoid the 'memory allocation' problem?

 

[IgorG]

Could you please be more specific?

 

[Ankita tech]

Hey,
Firstly Log in to Plesk. Then Go to Tools & Settings> IP address ban (Fail2Ban)> go to the Settings tab and check/uncheck Enable intrusion detection to enable/disable Fail2Ban. And click on Apply. At the end switch the Jails tab.

 

[DieterWerner]

Could you please be more specific?

CentOs 7
plesk 18.0.37 Update #2
iptables v1.4.21
Fail2Ban 0.11.2 . 23
fail2ban.sqlite3 = 3.991 kb

Jail ssh:
[ssh]
enabled = true
filter = sshd[mode=aggressive]
action = iptables[name=ssh, port=ssh]
logpath = /var/log/secure
maxretry = 2

Example fail2ban.log
7f8ecc7ec1b0 -- exec: iptables -w -I f2b-ssh 1 -s 190.117.113.32 -j REJECT --reject-with icmp-port-unreachable
2021-08-12 12:30:05,705 fail2ban.utils [1215]: ERROR 7f8ecc7ec1b0 -- stderr: 'iptables: Memory allocation problem.'
2021-08-12 12:30:05,705 fail2ban.utils [1215]: ERROR 7f8ecc7ec1b0 -- returned 1

 

[IgorG]

The 'memory allocation' issue is usually related to the number of rules set into the firewall. Plesk does not control the network traffic, the firewall extension or fail2ban just configures the iptables firewall rules provided by the operating system vendor, which works within the kernel. I suggest you consider contacting the OS vendor in order to see if this limit can be circumvented somehow.

 

[DieterWerner]

The 'memory allocation' issue is usually related to the number of rules set into the firewall. Plesk does not control the network traffic, the firewall extension or fail2ban just configures the iptables firewall rules provided by the operating system vendor, which works within the kernel. I suggest you consider contacting the OS vendor in order to see if this limit can be circumvented somehow.

my numiptent has a failcnt of 833
is it that what you mean?

 

[IgorG]

my numiptent has a failcnt of 833
is it that what you mean?

Is this Virtuozzo VPS?
Yes, that number looks very large. It is necessary to add the missing resource for this VPS.

 

[DieterWerner]

Is this Virtuozzo VPS?
Yes, that number looks very large. It is necessary to add the missing resource for this VPS.

Yes - it is Virtuozzo and numiptent is the badboy.
Thanks!