Re: [Fail2ban-users] WARNING [sshd] already banned, fail2ban-0.11.1-10.fc32

[Richard S. <hob...@gm...>]

On Mon, Sep 21, 2020 at 12:34 PM Robert Kudyba <rk...@fo...> wrote:

> Sure but I'm still wondering if:
> 2020-09-21 10:23:29,368 fail2ban.actions        [621763]: WARNING [sshd]
> 107.175.215.101 already banned
> 2020-09-21 10:23:29,384 fail2ban.observer       [621763]: INFO    [sshd]
> Found 107.175.215.101, bad - 2020-09-21 10:19:15, 1 # -> 2.0
> 2020-09-21 10:23:29,384 fail2ban.observer       [621763]: INFO    [sshd]
> Found 107.175.215.101, bad - 2020-09-21 10:19:20, 1 # -> 2.0
>
> How can the subsequent logs show up if the IP is already banned?
>

Others that know the inner workings of fail2ban may know better, but
perhaps because the bans wern't actually working before (but they still get
put in the sqlite database), you may see this for a while until all the old
bans expire. But that's just a theory I have at the moment.

Thanks,
Richard