I installed fail2ban with the default settings because there's a bunch of bots trying to log in as root to my server. I installed it but nothing has changed, I checked fail2ban jail IP list and there's nothing there.This is how my secure log looks like: May 19 09:11:25 localhost sshd[6080]: Failed password for root from 43.255.188.160 port 52111 ssh2May 19 09:11:25 localhost unix_chkpwd[6083]: password check failed for user (root)May 19 09:11:25 localhost sshd[6080]: pam_succeed_if(sshd:auth): requirement uid >= 1000 not met by user rootMay 19 09:11:28 localhost sshd[6080]: Failed password for root from 43.255.188.160 port 52111 ssh2May 19 09:11:28 localhost unix_chkpwd[6084]: password check failed for user (root)May 19 09:11:28 localhost sshd[6080]: pam_succeed_if(sshd:auth): requirement uid >= 1000 not met by user rootMay 19 09:11:29 localhost sshd[6080]: Failed password for root from 43.255.188.160 port 52111 ssh2May 19 09:11:29 localhost sshd[6080]: Received disconnect from 43.255.188.160: 11:  [preauth]May 19 09:11:29 localhost sshd[6080]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.188.160  user=rootMay 19 09:11:30 localhost unix_chkpwd[6087]: password check failed for user (root)May 19 09:11:30 localhost sshd[6085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.188.160  user=rootMay 19 09:11:30 localhost sshd[6085]: pam_succeed_if(sshd:auth): requirement uid >= 1000 not met by user rootMay 19 09:11:31 localhost sshd[6085]: Failed password for root from 43.255.188.160 port 39053 ssh2May 19 09:11:31 localhost unix_chkpwd[6088]: password check failed for user (root)May 19 09:11:31 localhost sshd[6085]: pam_succeed_if(sshd:auth): requirement uid >= 1000 not met by user rootMay 19 09:11:33 localhost sshd[6085]: Failed password for root from 43.255.188.160 port 39053 ssh2May 19 09:11:33 localhost unix_chkpwd[6089]: password check failed for user (root)May 19 09:11:33 localhost sshd[6085]: pam_succeed_if(sshd:auth): requirement uid >= 1000 not met by user rootMay 19 09:11:36 localhost sshd[6085]: Failed password for root from 43.255.188.160 port 39053 ssh2May 19 09:11:36 localhost sshd[6085]: Received disconnect from 43.255.188.160: 11:  [preauth]May 19 09:11:36 localhost sshd[6085]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.188.160  user=rootMay 19 09:11:36 localhost unix_chkpwd[6093]: password check failed for user (root)May 19 09:11:36 localhost sshd[6091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.188.160  user=rootMay 19 09:11:36 localhost sshd[6091]: pam_succeed_if(sshd:auth): requirement uid >= 1000 not met by user rootMay 19 09:11:38 localhost sshd[6091]: Failed password for root from 43.255.188.160 port 53516 ssh2May 19 09:11:38 localhost unix_chkpwd[6094]: password check failed for user (root)May 19 09:11:38 localhost sshd[6091]: pam_succeed_if(sshd:auth): requirement uid >= 1000 not met by user rootMay 19 09:11:40 localhost sshd[6091]: Failed password for root from 43.255.188.160 port 53516 ssh2May 19 09:11:40 localhost unix_chkpwd[6095]: password check failed for user (root)May 19 09:11:40 localhost sshd[6091]: pam_succeed_if(sshd:auth): requirement uid >= 1000 not met by user rootMay 19 09:11:42 localhost sshd[6091]: Failed password for root from 43.255.188.160 port 53516 ssh2May 19 09:11:42 localhost sshd[6091]: Received disconnect from 43.255.188.160: 11:  [preauth]May 19 09:11:42 localhost sshd[6091]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.188.160  user=rootMay 19 09:11:43 localhost unix_chkpwd[6098]: password check failed for user (root)May 19 09:11:43 localhost sshd[6096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.188.160  user=rootMay 19 09:11:43 localhost sshd[6096]: pam_succeed_if(sshd:auth): requirement uid >= 1000 not met by user rootMay 19 09:11:44 localhost sshd[6096]: Failed password for root from 43.255.188.160 port 40323 ssh2May 19 09:11:44 localhost unix_chkpwd[6099]: password check failed for user (root)May 19 09:11:44 localhost sshd[6096]: pam_succeed_if(sshd:auth): requirement uid >= 1000 not met by user rootMay 19 09:11:46 localhost sshd[6096]: Failed password for root from 43.255.188.160 port 40323 ssh2May 19 09:11:46 localhost unix_chkpwd[6100]: password check failed for user (root)May 19 09:11:46 localhost sshd[6096]: pam_succeed_if(sshd:auth): requirement uid >= 1000 not met by user rootI enabled fail2ban, (here says that is already running) fail2ban-client startERROR  Server already runningand the status since yesterday: fail2ban-client statusStatus|- Number of jail:  0`- Jail list:Is there something that I'm not doing which is not enabling fail2ban?
Fail2ban is not blocking IPs trying to access my server via ssh
ssh;fail2ban
As someone pointed out and I think is a good practice to have this directive PermitRootLogin no in sshd_config just in case. I had a ssh section on my jail local but now I see that I was missing a ssh-iptables section so it would add rules to iptables and now it works:[ssh-iptables]enabled  = truefilter   = sshdaction   = iptables[name=SSH, port=ssh, protocol=tcp]logpath  = /var/log/securemaxretry = 5