Debian12未运行fail2ban 记录一下报错解决

最近想看一下fail2ban的运行日志，发现安装的fail2ban 服务没有启动

Debian12系统

service fail2ban status

报错：

Failed during configuration: Have not found any log file for sshd jail

查看一下日志文件 /var/log/fail2ban.log

cat /var/log/fail2ban.log

没这个文件，也没有登录日志文件/var/log/auth.log

百度了一下怎么开启这个日志文件

需要安装 rsyslog 或者syslog

apt install -y rsyslog

安装完，再看/var/log目录有了auth.log

重启fail2ban 

service fail2ban start

查看fail2ban服务状态

service fail2ban status

Nov 26 19:30:24 hcss-ecs-481c systemd[1]: Started Fail2Ban Service.
Nov 26 19:30:24 hcss-ecs-481c fail2ban-server[21334]: Server ready

OK 有了fail2ban服务

再看/var/log目录有了 fail2ban.log

tail -f  /var/log/fail2ban.log

2024-12-13 19:53:45,468 fail2ban.filter         [21334]: INFO    [ssh-iptables] Found 103.181.143.96 - 2024-12-13 19:53:45
2024-12-13 19:53:45,468 fail2ban.filter         [21334]: INFO    [sshd] Found 103.181.143.96 - 2024-12-13 19:53:45
2024-12-13 19:53:48,173 fail2ban.filter         [21334]: INFO    [sshd] Found 103.181.143.96 - 2024-12-13 19:53:47
2024-12-13 19:53:48,174 fail2ban.filter         [21334]: INFO    [ssh-iptables] Found 103.181.143.96 - 2024-12-13 19:53:47
2024-12-13 19:54:54,126 fail2ban.actions        [21334]: NOTICE  [sshd] Unban 202.53.175.36

OK

fail2ban服务正常监控中

可以通过修改参数  /etc/fail2ban/jail.local  来修改密码错误次数/禁用IP时间(min) 重启服务后生效

或者重装 apt install fail2ban

总结：通过脚本安装未正确配置，只需安装 rsyslog服务就能解决

完