Fail2Ban Keeps Turning Off

[Dan Hammer]

I seem to be having an issue on a server with Fail2Ban (ip_ban) turning off. I will occasionally log in to the admin panel in Plesk and I will find IP Address Banning turned off. I will enabled it again and things will be fine for a while but then once again it will turn off. Any idea what might be causing this? The server is running Plesk Onyx 17.5.3 Update #17 and CentOS 7.3.

Thanks in advance.

 

[Trosten]

You must definitly check your logfiles about warnings or errors and your list of rules and filter you also check. somtimes can be possible to double the rules or filters and this falls to malfunction. I had this at the beginning of the year on a debian maschine

 

[kamtec1]

I seem to be having an issue on a server with Fail2Ban (ip_ban) turning off. I will occasionally log in to the admin panel in Plesk and I will find IP Address Banning turned off. I will enabled it again and things will be fine for a while but then once again it will turn off. Any idea what might be causing this? The server is running Plesk Onyx 17.5.3 Update #17 and CentOS 7.3.

Thanks in advance.

Please check logs like Trosten wrote + how many domains you have on this server ? How many rules you turned one or added ?

 

[Dan Hammer]

Can't believe I forgot to check in here. Here is something from the log file. Don't know if it helps at all. BTW at this time there is only one banned IP in this module.

2017-08-12 17:38:37,425 fail2ban.action [23141]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-plesk-postfix[ \t]' -- stdout: ''
2017-08-12 17:38:37,426 fail2ban.action [23141]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-plesk-postfix[ \t]' -- stderr: ''
2017-08-12 17:38:37,426 fail2ban.action [23141]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-plesk-postfix[ \t]' -- returned 1
2017-08-12 17:38:37,427 fail2ban.CommandAction [23141]: ERROR Invariant check failed. Trying to restore a sane environment
2017-08-12 17:38:37,535 fail2ban.action [23141]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports smtp,smtps,submission -j f2b-plesk-postfix
iptables -w -F f2b-plesk-postfix
iptables -w -X f2b-plesk-postfix -- stdout: ''
2017-08-12 17:38:37,536 fail2ban.action [23141]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports smtp,smtps,submission -j f2b-plesk-postfix
iptables -w -F f2b-plesk-postfix
iptables -w -X f2b-plesk-postfix -- stderr: "iptables v1.4.21: Couldn't load target `f2b-plesk-postfix':No such file or directory\n\nTry `iptables -h' or 'iptables --help' for more information.\niptables: No chain/target/match by that name.\niptables: No chain/target/match by that name.\n"
2017-08-12 17:38:37,536 fail2ban.action [23141]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports smtp,smtps,submission -j f2b-plesk-postfix
iptables -w -F f2b-plesk-postfix
iptables -w -X f2b-plesk-postfix -- returned 1
2017-08-12 17:38:37,537 fail2ban.actions [23141]: ERROR Failed to execute ban jail 'plesk-postfix' action 'iptables-multiport' info 'CallingMap({'ipjailmatches': <function <lambda> at 0x27fda28>, 'matches': u'Aug 12 17:38:35 web2 postfix/smtpd[32169]: warning: unknown[175.6.7.144]: SASL LOGIN authentication failed: authentication failure\nAug 12 17:38:35 web2 postfix/smtpd[32750]: warning: unknown[175.6.7.144]: SASL LOGIN authentication failed: authentication failure\nAug 12 17:38:35 web2 postfix/smtpd[32752]: warning: unknown[175.6.7.144]: SASL LOGIN authentication failed: authentication failure\nAug 12 17:38:36 web2 postfix/smtpd[32169]: warning: unknown[175.6.7.144]: SASL LOGIN authentication failed: authentication failure\nAug 12 17:38:36 web2 postfix/smtpd[32752]: warning: unknown[175.6.7.144]: SASL LOGIN authentication failed: authentication failure', 'ip': '175.6.7.144', 'ipmatches': <function <lambda> at 0x27fdc08>, 'ipfailures': <function <lambda> at 0x27fdb90>, 'time': 1502573917.315187, 'failures': 5, 'ipjailfailures': <function <lambda> at 0x27fd938>})': Error stopping action
2017-08-12 17:38:37,676 fail2ban.filter [23141]: INFO [plesk-postfix] Found 175.6.7.144
2017-08-12 17:38:37,762 fail2ban.filter [23141]: INFO [plesk-postfix] Found 175.6.7.144
2017-08-12 17:38:37,869 fail2ban.actions [23141]: NOTICE [recidive] Ban 175.6.7.144

 

[Dan Hammer]

I would like to add that I have virtually identical setups on two different servers and this problem only happens on one.

Additional note: I've performed a kernel update in case the problem was related to that.

 

[Dan Hammer]

I am going to mark this as solved for now. Since the kernel update, Fail2Ban has banned 4 IP addresses and hasn't crashed. I will reopen this if anything changes.

 

[Dan Hammer]

Ok Kernel update did not solve the problem. I'll post the logs. Maybe someone can figure out why F2B keeps shutting off.

2017-09-05 01:47:17,065 fail2ban.action [2103]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports smtp,smtps,submission -j f2b-plesk-postfix
iptables -w -F f2b-plesk-postfix
iptables -w -X f2b-plesk-postfix -- returned 1
2017-09-05 01:47:17,066 fail2ban.actions [2103]: ERROR Failed to stop jail 'plesk-postfix' action 'iptables-multiport': Error stopping action
2017-09-05 01:47:17,066 fail2ban.jail [2103]: INFO Jail 'plesk-postfix' stopped
2017-09-05 01:47:17,492 fail2ban.action [2103]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports http,https,7080,7081 -j f2b-plesk-horde
iptables -w -F f2b-plesk-horde
iptables -w -X f2b-plesk-horde -- stdout: ''
2017-09-05 01:47:17,492 fail2ban.action [2103]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports http,https,7080,7081 -j f2b-plesk-horde
iptables -w -F f2b-plesk-horde
iptables -w -X f2b-plesk-horde -- stderr: "iptables v1.4.21: Couldn't load target `f2b-plesk-horde':No such file or directory\n\nTry `iptables -h' or 'iptables --help' for more information.\niptables: No chain/target/match by that name.\niptables: No chain/target/match by that name.\n"
2017-09-05 01:47:17,493 fail2ban.action [2103]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports http,https,7080,7081 -j f2b-plesk-horde
iptables -w -F f2b-plesk-horde
iptables -w -X f2b-plesk-horde -- returned 1
2017-09-05 01:47:17,493 fail2ban.actions [2103]: ERROR Failed to stop jail 'plesk-horde' action 'iptables-multiport': Error stopping action
2017-09-05 01:47:17,493 fail2ban.jail [2103]: INFO Jail 'plesk-horde' stopped
2017-09-05 01:47:18,505 fail2ban.action [2103]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports ftp,ftp-data,ftps,ftps-data -j f2b-plesk-proftpd
iptables -w -F f2b-plesk-proftpd
iptables -w -X f2b-plesk-proftpd -- stdout: ''
2017-09-05 01:47:18,506 fail2ban.action [2103]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports ftp,ftp-data,ftps,ftps-data -j f2b-plesk-proftpd
iptables -w -F f2b-plesk-proftpd
iptables -w -X f2b-plesk-proftpd -- stderr: "iptables v1.4.21: Couldn't load target `f2b-plesk-proftpd':No such file or directory\n\nTry `iptables -h' or 'iptables --help' for more information.\niptables: No chain/target/match by that name.\niptables: No chain/target/match by that name.\n"
2017-09-05 01:47:18,506 fail2ban.action [2103]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports ftp,ftp-data,ftps,ftps-data -j f2b-plesk-proftpd
iptables -w -F f2b-plesk-proftpd
iptables -w -X f2b-plesk-proftpd -- returned 1
2017-09-05 01:47:18,506 fail2ban.actions [2103]: ERROR Failed to stop jail 'plesk-proftpd' action 'iptables-multiport': Error stopping action
2017-09-05 01:47:18,507 fail2ban.jail [2103]: INFO Jail 'plesk-proftpd' stopped
2017-09-05 01:47:19,332 fail2ban.action [2103]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports http,https,7080,7081 -j f2b-plesk-wordpress
iptables -w -F f2b-plesk-wordpress
iptables -w -X f2b-plesk-wordpress -- stdout: ''
2017-09-05 01:47:19,333 fail2ban.action [2103]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports http,https,7080,7081 -j f2b-plesk-wordpress
iptables -w -F f2b-plesk-wordpress
iptables -w -X f2b-plesk-wordpress -- stderr: "iptables v1.4.21: Couldn't load target `f2b-plesk-wordpress':No such file or directory\n\nTry `iptables -h' or 'iptables --help' for more information.\niptables: No chain/target/match by that name.\niptables: No chain/target/match by that name.\n"
2017-09-05 01:47:19,333 fail2ban.action [2103]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports http,https,7080,7081 -j f2b-plesk-wordpress
iptables -w -F f2b-plesk-wordpress
iptables -w -X f2b-plesk-wordpress -- returned 1
2017-09-05 01:47:19,333 fail2ban.actions [2103]: ERROR Failed to stop jail 'plesk-wordpress' action 'iptables-multiport': Error stopping action
2017-09-05 01:47:19,334 fail2ban.jail [2103]: INFO Jail 'plesk-wordpress' stopped
2017-09-05 01:47:19,336 fail2ban.server [2103]: INFO Exiting Fail2ban


I see the multiport reference often. Don't know if that is a cause or just a symptom. Not sure why I have this problem on this server. I have another server that is virtually identical. Same OS, hardware, Plesk version, configuration, etc. Something seems nerfed on this one. Fail2Ban ran for several days before it finally shut itself off.

If anyone could help me resolve this I'd be very thankful.

 

[Dan Hammer]

I had uninstalled and reinstalled Fail2Ban shortly after posting that last post. So far the service has been running without a problem. A week solid as of now. I'll give it some more time and if that does the trick I will mark this thread as solved.

 

[Dan Hammer]

I really wish people would quit marking things resolved when they are not. Problems are ongoing. The reinstall did not fix the problem Fail2Ban continues to spew errors and it is only a matter of time before it shuts off again. Here is a sample of errors in the log. Maybe someone can make sense of this mess.

2017-09-15 20:56:13,618 fail2ban.action [1515]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-plesk-postfix[ \t]' -- stdout: ''
2017-09-15 20:56:13,619 fail2ban.action [1515]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-plesk-postfix[ \t]' -- stderr: ''
2017-09-15 20:56:13,620 fail2ban.action [1515]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-plesk-postfix[ \t]' -- returned 1
2017-09-15 20:56:13,620 fail2ban.CommandAction [1515]: ERROR Invariant check failed. Trying to restore a sane environment
2017-09-15 20:56:13,733 fail2ban.action [1515]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports smtp,smtps,submission -j f2b-plesk-postfix
iptables -w -F f2b-plesk-postfix
iptables -w -X f2b-plesk-postfix -- stdout: ''
2017-09-15 20:56:13,733 fail2ban.action [1515]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports smtp,smtps,submission -j f2b-plesk-postfix
iptables -w -F f2b-plesk-postfix
iptables -w -X f2b-plesk-postfix -- stderr: "iptables v1.4.21: Couldn't load target `f2b-plesk-postfix':No such file or directory\n\nTry `iptables -h' or 'iptables --help' for more information.\niptables: No chain/target/match by that name.\niptables: No chain/target/match by that name.\n"
2017-09-15 20:56:13,734 fail2ban.action [1515]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports smtp,smtps,submission -j f2b-plesk-postfix
iptables -w -F f2b-plesk-postfix
iptables -w -X f2b-plesk-postfix -- returned 1
2017-09-15 20:56:13,734 fail2ban.actions [1515]: ERROR Failed to execute unban jail 'plesk-postfix' action 'iptables-multiport' info '{'matches': u'Sep 15 20:38:38 web2 postfix/smtpd[3889]: warning: unknown[191.96.249.65]: SASL LOGIN authentication failed: authentication failureSep 15 20:38:48 web2 postfix/smtpd[3889]: warning: unknown[191.96.249.65]: SASL LOGIN authentication failed: authentication failureSep 15 20:39:17 web2 postfix/smtpd[3889]: warning: unknown[191.96.249.65]: SASL LOGIN authentication failed: authentication failureSep 15 20:46:10 web2 postfix/smtpd[4700]: warning: unknown[191.96.249.65]: SASL LOGIN authentication failed: authentication failureSep 15 20:46:13 web2 postfix/smtpd[4700]: warning: unknown[191.96.249.65]: SASL LOGIN authentication failed: authentication failure', 'ip': '191.96.249.65', 'time': 1505522773.348851, 'failures': 5}': Error stopping action
2017-09-15 21:01:26,291 fail2ban.filter [1515]: INFO [plesk-postfix] Found 91.200.12.152
2017-09-15 21:05:26,810 fail2ban.actions [1515]: NOTICE [plesk-apache] Unban 185.115.216.131
2017-09-15 21:05:26,934 fail2ban.action [1515]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-apache[ \t]' -- stdout: ''
2017-09-15 21:05:26,935 fail2ban.action [1515]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-apache[ \t]' -- stderr: ''
2017-09-15 21:05:26,935 fail2ban.action [1515]: ERROR iptables -w -n -L INPUT | grep -q 'f2b-apache[ \t]' -- returned 1
2017-09-15 21:05:26,936 fail2ban.CommandAction [1515]: ERROR Invariant check failed. Trying to restore a sane environment
2017-09-15 21:05:27,045 fail2ban.action [1515]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports http,https,7080,7081 -j f2b-apache
iptables -w -F f2b-apache
iptables -w -X f2b-apache -- stdout: ''
2017-09-15 21:05:27,045 fail2ban.action [1515]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports http,https,7080,7081 -j f2b-apache
iptables -w -F f2b-apache
iptables -w -X f2b-apache -- stderr: "iptables v1.4.21: Couldn't load target `f2b-apache':No such file or directory\n\nTry `iptables -h' or 'iptables --help' for more information.\niptables: No chain/target/match by that name.\niptables: No chain/target/match by that name.\n"
2017-09-15 21:05:27,045 fail2ban.action [1515]: ERROR iptables -w -D INPUT -p tcp -m multiport --dports http,https,7080,7081 -j f2b-apache
iptables -w -F f2b-apache
iptables -w -X f2b-apache -- returned 1
2017-09-15 21:05:27,046 fail2ban.actions [1515]: ERROR Failed to execute unban jail 'plesk-apache' action 'iptables-multiport' info '{'matches': u'[Fri Sep 15 20:53:56.586759 2017] [access_compat:error] [pid 1794:tid 139922031728384] [client 185.115.216.131:41212] AH01797: client denied by server configuration: /var/www/vhosts/xxxxx/httpdocs/dev/tests/functional/etc/config.xml[Fri Sep 15 20:53:56.738341 2017] [access_compat:error] [pid 1544:tid 139921947801344] [client 185.115.216.131:41194] AH01797: client denied by server configuration: /var/www/vhosts/xxxxx/httpdocs/dev/tests/functional/composer.json[Fri Sep 15 20:53:56.791987 2017] [access_compat:error] [pid 1794:tid 139922065299200] [client 185.115.216.131:41204] AH01797: client denied by server configuration: /var/www/vhosts/xxxxx/httpdocs/var/resource_config.json[Fri Sep 15 20:53:58.256881 2017] [access_compat:error] [pid 1794:tid 139922082084608] [client 185.115.216.131:41200] AH01797: client denied by server configuration: /var/www/vhosts/xxxxx/httpdocs/includes/magmi[Fri Sep 15 20:55:25.015652 2017] [access_compat:error] [pid 1544:tid 139922194691840] [client 185.115.216.131:41246] AH01797: client denied by server configuration: /var/www/vhosts/xxxxx/httpdocs/dev/tests/functional/etc/config.xml[Fri Sep 15 20:55:25.093207 2017] [access_compat:error] [pid 1794:tid 139921964586752] [client 185.115.216.131:41232] AH01797: client denied by server configuration: /var/www/vhosts/xxxxx/httpdocs/var/resource_config.json', 'ip': '185.115.216.131', 'time': 1505523325.888501, 'failures': 6}': Error stopping action

I'm out of ideas. Same OS, Plesk, configuration, etc on two servers and only one has a problem.

 

[UFHH01]

Hi Dan Hammer,

did you consider to check your Fail2Ban version with

rpm -qi fail2ban

or/and

yum info fail2ban

and

fail2ban-client -V

... to check, if you use a Plesk supported Fail2Ban version?

Could you pls. tell us, HOW you re-installed Fail2Ban on your server?

If you still experience issues with "multiport" setups, pls. consider to use "allports" instead.

Another reason for your described issues might be in inadequate SELinux - settings. Consider to disable SELinux for investigations purposes.


If you desire help with your investigations, pls. don't forget to include your depending configuration files ( /etc/fail2ban/* ).
As MORE informations are always a good idea for investigations, pls. consider as well to provide the output of:

hostnamectl

and

cat /proc/net/ip_tables_matches

and

iptables -V

and

iptables -L

 

[Dan Hammer]

Thanks for the reply. Fail2Ban should be compatible since it was installed/activated using the Plesk control panel. Before I start messing with more settings on the server I will provide as much info as possible related to the questions you asked in case there is something obvious that I am missing.

[root@web2 ~]# rpm -qi fail2ban
Name : fail2ban
Epoch : 1
Version : 0.9.6
Release : centos7.17031414
Architecture: noarch
Install Date: Mon 11 Sep 2017 07:06:11 PM EDT
Group : System Environment/Daemons
Size : 2114099
License : GPL
Signature : DSA/SHA1, Tue 14 Mar 2017 06:43:12 AM EDT, Key ID bd11a6aa914bdf7e
Source RPM : fail2ban-0.9.6-centos7.17031414.src.rpm
Build Date : Tue 14 Mar 2017 03:47:18 AM EDT
Build Host : bcos7x64.plesk.ru
Relocations : (not relocatable)
Packager : Parallels Ltd. <[email protected]>
Vendor : Plesk
URL : Fail2ban
Summary : ban hosts that cause multiple authentication errors
Description :
Fail2ban monitors log files (e.g. /var/log/auth.log,
/var/log/apache/access.log) and temporarily or persistently bans
failure-prone addresses by updating existing firewall rules. Fail2ban allows
easy specification of different actions to be taken such as to ban an
IP using iptables or hostsdeny rules, or simply to send a
notification email.


[root@web2 ~]# fail2ban-client -V
Fail2Ban v0.9.6

Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors
Copyright of modifications held by their respective authors.
Licensed under the GNU General Public License v2 (GPL).

Written by Cyril Jaquier <[email protected]>.
Many contributions by Yaroslav O. Halchenko <[email protected]>.


[root@web2 ~]# hostnamectl
Static hostname: (I'll message you hostname if you need it)
Icon name: computer-desktop
Chassis: desktop
Machine ID: f7a3256134074e9aa96e294f575ef24d
Boot ID: 5cfcc5a9fc4a490b98fb0f6c7fc5df3a
Operating System: CentOS Linux 7 (Core)
CPE OS Name: cpe:/o:centos:centos:7
Kernel: Linux 3.10.0-514.26.2.el7.x86_64
Architecture: x86-64


[root@web2 ~]# cat /proc/net/ip_tables_matches
conntrack
conntrack
conntrack
limit
owner
icmp
multiport
udplite
udp
tcp


[root@web2 ~]# iptables -V
iptables v1.4.21


iptables -L is currently running and outputting to a text file. I will attach the file to a reply when it has completed. It seems like it will be quite lengthy. Should it be very slow to generate?

 

[Dan Hammer]

Here is the output of iptables -L Took a few minutes to run.

 

[UFHH01]

Hi Dan Hammer,

No chain/target/match by that name.\niptables: No chain/target/match by that name.\n"

The only really usefull output from your provided logs is this part, which shows ( just as your iptables -L - output ), that fail2ban is currently not running on your server.

Pls. consider as well to use "pyinotify" instead of "gamin" for example:

yum install python-inotify

backend = pyinotify

( at "/etc/fail2ban/jail.conf" )
​

... and start Fail2Ban over the command line, to see, if there are any issues/errors/problems, when starting Fail2Ban. Pls. POST possible issues/errors/problems, as we can't guess such things.


IF ( !!! ) you experience further issues/errors/problems, pls. don't forget to include

If you desire help with your investigations, pls. don't forget to include your depending configuration files ( /etc/fail2ban/* ).
As MORE informations are always a good idea for investigations

 

[Dan Hammer]

Thanks for the reply. Fail2Ban was running. It may have been restarted since those errors appeared in the logs. I also edited a Fail2Ban config file (name slips my mind) and changed the rules from multiport to allports. I went to install python-inotify and apparently it was already installed so I updated jail.conf as you suggested. I will update this as things change.

 

[Dan Hammer]

As of now Fail2Ban seems to be running without any kind of errors. Two changes were made and I am not sure why solved the problem. I suspect the change from multiport to allports in the Fail2Ban configuration file solved the issue. But I also updated jail.conf as I mentioned earlier. Not sure if that played any part or not. But unless the system starts generating errors again I will consider this issue resolved. Just wish I knew why I had the error problem on this server while a nearly identical machine ran without problems.

 

[Ripshod]

If the errors should show again:

I had similar problems a while ago with fail2ban where reinstalling failed to fix the error. It turned out that when uninstalling, fail2ban left configuration files in /etc/fail2ban/, which were never overwritten on reinstall. When uninstalling it's best to delete this folder yourself and get fresh configuration files.

Not saying this is a fix - just something to try

 

[Linulex]

I think i recognize this error, i say "think" i could be wrong. We had errors like this if iptables was restarted and f2b not. f2b then has a wrong handle/pid/whatever-f2b-uses to connect to iptables.

reproduce:
start iptables
start fail2ban

restart iptables

If you think it is an error in the configuration and you have a working server you can always copy the map /etc/fail2ban from the working server to the server that gives the errors.

regards
Jan

 

[pleskpanel]

On quite a number of CentOS 7.3 systems running Plesk Onyx 7.5.3 and the Plesk-provisioned Fail2Ban version we saw the same behavior however it's not inherently caused by Plesk or Fail2Ban. In this case each time a daily CSF update ran and completed its update process, iptables would be restarted and Fail2Ban would be stopped but not restarted. We ended up using a command that would run right after the CSF update process to re-enable Fail2Ban.

 

[pleskpanel]

I really wish people would quit marking things resolved when they are not. Problems are ongoing.

Couldn't be more in agreement with that wish. While the "green" resolved status makes the threads look productive and pretty, it's not reflective of the status of an OP's issue.

 

[Dan Hammer]

Unfortunately the problem is back. Frustrating to say the least. Fail2ban is set to automatically restart if the service crashes, so I am not sure why it isn't restarting in these cases. Seems more like a shutdown of the service than a crash. I tested it out. If I kill the fail2ban service it will restart in seconds. If I shut the service down using Plesk, it won't come back up. So this tells me the crash is shutdown like.

Here is the fail2ban log.

2017-10-13 01:47:08,165 fail2ban.server [2866]: INFO Stopping all jails
2017-10-13 01:47:09,080 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-BadBots
iptables -w -F f2b-BadBots
iptables -w -X f2b-BadBots -- stdout: ''
2017-10-13 01:47:09,081 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-BadBots
iptables -w -F f2b-BadBots
iptables -w -X f2b-BadBots -- stderr: 'iptables: Too many links.\n'
2017-10-13 01:47:09,082 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-BadBots
iptables -w -F f2b-BadBots
iptables -w -X f2b-BadBots -- returned 1
2017-10-13 01:47:09,082 fail2ban.actions [2866]: ERROR Failed to stop jail 'plesk-apache-badbot' action 'iptables-allports': Error stopping action
2017-10-13 01:47:09,085 fail2ban.jail [2866]: INFO Jail 'plesk-apache-badbot' stopped
2017-10-13 01:47:09,810 fail2ban.actions [2866]: NOTICE [recidive] Unban 52.161.100.152
2017-10-13 01:47:10,029 fail2ban.actions [2866]: NOTICE [recidive] Unban 175.6.7.144
2017-10-13 01:47:10,248 fail2ban.actions [2866]: NOTICE [recidive] Unban 191.96.249.63
2017-10-13 01:47:10,575 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-recidive
iptables -w -F f2b-recidive
iptables -w -X f2b-recidive -- stdout: ''
2017-10-13 01:47:10,575 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-recidive
iptables -w -F f2b-recidive
iptables -w -X f2b-recidive -- stderr: 'iptables: Too many links.\n'
2017-10-13 01:47:10,575 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-recidive
iptables -w -F f2b-recidive
iptables -w -X f2b-recidive -- returned 1
2017-10-13 01:47:10,576 fail2ban.actions [2866]: ERROR Failed to stop jail 'recidive' action 'iptables-allports': Error stopping action
2017-10-13 01:47:10,576 fail2ban.jail [2866]: INFO Jail 'recidive' stopped
2017-10-13 01:47:11,076 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-roundcube
iptables -w -F f2b-plesk-roundcube
iptables -w -X f2b-plesk-roundcube -- stdout: ''
2017-10-13 01:47:11,076 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-roundcube
iptables -w -F f2b-plesk-roundcube
iptables -w -X f2b-plesk-roundcube -- stderr: 'iptables: Too many links.\n'
2017-10-13 01:47:11,077 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-roundcube
iptables -w -F f2b-plesk-roundcube
iptables -w -X f2b-plesk-roundcube -- returned 1
2017-10-13 01:47:11,077 fail2ban.actions [2866]: ERROR Failed to stop jail 'plesk-roundcube' action 'iptables-allports': Error stopping action
2017-10-13 01:47:11,077 fail2ban.jail [2866]: INFO Jail 'plesk-roundcube' stopped
2017-10-13 01:47:12,080 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-login
iptables -w -F f2b-plesk-login
iptables -w -X f2b-plesk-login -- stdout: ''
2017-10-13 01:47:12,080 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-login
iptables -w -F f2b-plesk-login
iptables -w -X f2b-plesk-login -- stderr: 'iptables: Too many links.\n'
2017-10-13 01:47:12,080 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-login
iptables -w -F f2b-plesk-login
iptables -w -X f2b-plesk-login -- returned 1
2017-10-13 01:47:12,081 fail2ban.actions [2866]: ERROR Failed to stop jail 'plesk-panel' action 'iptables-allports': Error stopping action
2017-10-13 01:47:12,081 fail2ban.jail [2866]: INFO Jail 'plesk-panel' stopped
2017-10-13 01:47:13,073 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-apache
iptables -w -F f2b-apache
iptables -w -X f2b-apache -- stdout: ''
2017-10-13 01:47:13,074 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-apache
iptables -w -F f2b-apache
iptables -w -X f2b-apache -- stderr: 'iptables: Too many links.\n'
2017-10-13 01:47:13,074 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-apache
iptables -w -F f2b-apache
iptables -w -X f2b-apache -- returned 1
2017-10-13 01:47:13,074 fail2ban.actions [2866]: ERROR Failed to stop jail 'plesk-apache' action 'iptables-allports': Error stopping action
2017-10-13 01:47:13,075 fail2ban.jail [2866]: INFO Jail 'plesk-apache' stopped
2017-10-13 01:47:14,072 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-dovecot
iptables -w -F f2b-plesk-dovecot
iptables -w -X f2b-plesk-dovecot -- stdout: ''
2017-10-13 01:47:14,072 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-dovecot
iptables -w -F f2b-plesk-dovecot
iptables -w -X f2b-plesk-dovecot -- stderr: 'iptables: Too many links.\n'
2017-10-13 01:47:14,073 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-dovecot
iptables -w -F f2b-plesk-dovecot
iptables -w -X f2b-plesk-dovecot -- returned 1
2017-10-13 01:47:14,073 fail2ban.actions [2866]: ERROR Failed to stop jail 'plesk-dovecot' action 'iptables-allports': Error stopping action
2017-10-13 01:47:14,073 fail2ban.jail [2866]: INFO Jail 'plesk-dovecot' stopped
2017-10-13 01:47:15,075 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp --dport ssh -j f2b-SSH
iptables -w -F f2b-SSH
iptables -w -X f2b-SSH -- stdout: ''
2017-10-13 01:47:15,076 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp --dport ssh -j f2b-SSH
iptables -w -F f2b-SSH
iptables -w -X f2b-SSH -- stderr: 'iptables: Too many links.\n'
2017-10-13 01:47:15,076 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp --dport ssh -j f2b-SSH
iptables -w -F f2b-SSH
iptables -w -X f2b-SSH -- returned 1
2017-10-13 01:47:15,076 fail2ban.actions [2866]: ERROR Failed to stop jail 'ssh' action 'iptables': Error stopping action
2017-10-13 01:47:15,077 fail2ban.jail [2866]: INFO Jail 'ssh' stopped
2017-10-13 01:47:15,197 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-postfix
iptables -w -F f2b-plesk-postfix
iptables -w -X f2b-plesk-postfix -- stdout: ''
2017-10-13 01:47:15,198 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-postfix
iptables -w -F f2b-plesk-postfix
iptables -w -X f2b-plesk-postfix -- stderr: 'iptables: Too many links.\n'
2017-10-13 01:47:15,198 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-postfix
iptables -w -F f2b-plesk-postfix
iptables -w -X f2b-plesk-postfix -- returned 1
2017-10-13 01:47:15,198 fail2ban.actions [2866]: ERROR Failed to stop jail 'plesk-postfix' action 'iptables-allports': Error stopping action
2017-10-13 01:47:15,199 fail2ban.jail [2866]: INFO Jail 'plesk-postfix' stopped
2017-10-13 01:47:16,078 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-horde
iptables -w -F f2b-plesk-horde
iptables -w -X f2b-plesk-horde -- stdout: ''
2017-10-13 01:47:16,078 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-horde
iptables -w -F f2b-plesk-horde
iptables -w -X f2b-plesk-horde -- stderr: 'iptables: Too many links.\n'
2017-10-13 01:47:16,078 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-horde
iptables -w -F f2b-plesk-horde
iptables -w -X f2b-plesk-horde -- returned 1
2017-10-13 01:47:16,079 fail2ban.actions [2866]: ERROR Failed to stop jail 'plesk-horde' action 'iptables-allports': Error stopping action
2017-10-13 01:47:16,079 fail2ban.jail [2866]: INFO Jail 'plesk-horde' stopped
2017-10-13 01:47:17,085 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-proftpd
iptables -w -F f2b-plesk-proftpd
iptables -w -X f2b-plesk-proftpd -- stdout: ''
2017-10-13 01:47:17,085 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-proftpd
iptables -w -F f2b-plesk-proftpd
iptables -w -X f2b-plesk-proftpd -- stderr: 'iptables: Too many links.\n'
2017-10-13 01:47:17,085 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-proftpd
iptables -w -F f2b-plesk-proftpd
iptables -w -X f2b-plesk-proftpd -- returned 1
2017-10-13 01:47:17,086 fail2ban.actions [2866]: ERROR Failed to stop jail 'plesk-proftpd' action 'iptables-allports': Error stopping action
2017-10-13 01:47:17,086 fail2ban.jail [2866]: INFO Jail 'plesk-proftpd' stopped
2017-10-13 01:47:18,080 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-wordpress
iptables -w -F f2b-plesk-wordpress
iptables -w -X f2b-plesk-wordpress -- stdout: ''
2017-10-13 01:47:18,081 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-wordpress
iptables -w -F f2b-plesk-wordpress
iptables -w -X f2b-plesk-wordpress -- stderr: 'iptables: Too many links.\n'
2017-10-13 01:47:18,081 fail2ban.action [2866]: ERROR iptables -w -D INPUT -p tcp -j f2b-plesk-wordpress
iptables -w -F f2b-plesk-wordpress
iptables -w -X f2b-plesk-wordpress -- returned 1
2017-10-13 01:47:18,081 fail2ban.actions [2866]: ERROR Failed to stop jail 'plesk-wordpress' action 'iptables-allports': Error stopping action
2017-10-13 01:47:18,082 fail2ban.jail [2866]: INFO Jail 'plesk-wordpress' stopped
2017-10-13 01:47:18,084 fail2ban.server [2866]: INFO Exiting Fail2ban