CentOS - Jan 2021 - fail2ban problems - not banning

Hi everyone,

I've got fail2ban and firewalld set up on a C7 box, in theory protecting 
dovecot, exim and ssh but I'm not convinced it's doing anything.

in /var/log/fail2ban.log I'm getting loads of entries such as:

2020-12-22 19:08:08,100 fail2ban.actions??????? [1836]: WARNING 
[dovecot] 78.128.113.67 already banned

I think this is because the actual ban is not working.? I have entries 
such as:

2020-12-22 19:38:27,619 fail2ban.utils????????? [1836]: ERROR 
7f119e95f7f0 -- exec: ports="0:65535"; for p in $(echo $ports | tr
", "
" "); do firewall-cmd --add-rich-rule="rule family='ipv4'
source
address='113.110.47.81' port port='$p' protocol='tcp'
reject
type='icmp-port-unreachable'"; done
2020-12-22 19:38:27,619 fail2ban.utils????????? [1836]: ERROR 
7f119e95f7f0 -- stderr: 'Error: INVALID_PORT: 0:65535'
2020-12-22 19:38:27,619 fail2ban.utils????????? [1836]: ERROR 
7f119e95f7f0 -- returned 102
2020-12-22 19:38:27,620 fail2ban.actions??????? [1836]: ERROR Failed to 
execute ban jail 'dovecot' action 'firewallcmd-rich-rules' info 
'ActionInfo({'ip': '113.110.47.81', 'fid':
<function <lambda> at
0x7f119f084050>, 'family': 'inet4', 'raw-ticket':
<function <lambda> at
0x7f119f0845f0>})': Error banning 113.110.47.81

I've done some Googling and received lots of responses about fail2ban 
failures but I can't find anything relating to this.

Anyone got any ideas?

On 1/6/21 2:57 AM, Gary Stainburn wrote:
> 2020-12-22 19:38:27,619 fail2ban.utils????????? [1836]: ERROR 
> 7f119e95f7f0 -- exec: ports="0:65535"; for p in $(echo $ports |
tr ",
> " " "); do firewall-cmd --add-rich-rule="rule
family='ipv4' source
> address='113.110.47.81' port port='$p'
protocol='tcp' reject
> type='icmp-port-unreachable'"; done
> 2020-12-22 19:38:27,619 fail2ban.utils????????? [1836]: ERROR 
> 7f119e95f7f0 -- stderr: 'Error: INVALID_PORT: 0:65535' 

See firewalld.richlanguage(5)

 ?????? The port port value can either be a single port number portid or 
a port
 ?????? range portid-portid.

You'll need to also transform your ports with: ?? tr : -

ports="0:65535"; for p in $(echo $ports | tr : - | tr ", "
" "); do
firewall-cmd --add-rich-rule="rule family='ipv4' source 
address='113.110.47.81' port port='$p' protocol='tcp'
reject
type='icmp-port-unreachable'"; done