{"action":"created","issue":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1163","labels_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1163/labels{/name}","comments_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1163/comments","events_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1163/events","html_url":"https://github.com/fail2ban/fail2ban/issues/1163","id":101909179,"number":1163,"title":"High Load & hundreds of Entries in iptables","user":{"login":"virtualweb-at","id":6951828,"avatar_url":"https://avatars.githubusercontent.com/u/6951828?v=3","gravatar_id":"","url":"https://api.github.com/users/virtualweb-at","html_url":"https://github.com/virtualweb-at","followers_url":"https://api.github.com/users/virtualweb-at/followers","following_url":"https://api.github.com/users/virtualweb-at/following{/other_user}","gists_url":"https://api.github.com/users/virtualweb-at/gists{/gist_id}","starred_url":"https://api.github.com/users/virtualweb-at/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/virtualweb-at/subscriptions","organizations_url":"https://api.github.com/users/virtualweb-at/orgs","repos_url":"https://api.github.com/users/virtualweb-at/repos","events_url":"https://api.github.com/users/virtualweb-at/events{/privacy}","received_events_url":"https://api.github.com/users/virtualweb-at/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-08-19T14:37:10Z","updated_at":"2015-08-19T15:31:27Z","closed_at":null,"body":"On one of my Servers i have a Load of ~0.70 - after stopping fail2ban the Load goes down to ~0.05\r\nUbuntu Server 15.04, f2b 0.9.1 from Repository\r\n\r\nThen i figured out that in iptables all f2b Rules in the INPUT Chain are listed hundred times\r\nChain INPUT (policy ACCEPT)\r\ntarget     prot opt source               destination         \r\nDROP       all  --  **.**.**.**        0.0.0.0/0           \r\nf2b-apache-bot_for_jce  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443\r\nf2b-pureftpd  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 21\r\nf2b-apache-post-flood  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443\r\nf2b-postfix-sasl  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 25,465,587,220,993,110,995\r\nf2b-dovecot  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 110,995,143,993,587,465,4190\r\nf2b-apache-shellshock  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443\r\nf2b-apache-botsearch  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443\r\nf2b-apache-overflows  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443\r\nf2b-apache-auth  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443\r\nf2b-sshd   tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22\r\n\r\n-> the Block above repeats 100 time, i think on each restart of fail2ban the same block is appended to the existing one instead of replacing it.\r\n\r\nWhat could be the cause for this? I use the standard setup but enhanced the Chains in my jail.local with separate maxretry/bantime entries."},"comment":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/comments/132639194","html_url":"https://github.com/fail2ban/fail2ban/issues/1163#issuecomment-132639194","issue_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1163","id":132639194,"user":{"login":"virtualweb-at","id":6951828,"avatar_url":"https://avatars.githubusercontent.com/u/6951828?v=3","gravatar_id":"","url":"https://api.github.com/users/virtualweb-at","html_url":"https://github.com/virtualweb-at","followers_url":"https://api.github.com/users/virtualweb-at/followers","following_url":"https://api.github.com/users/virtualweb-at/following{/other_user}","gists_url":"https://api.github.com/users/virtualweb-at/gists{/gist_id}","starred_url":"https://api.github.com/users/virtualweb-at/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/virtualweb-at/subscriptions","organizations_url":"https://api.github.com/users/virtualweb-at/orgs","repos_url":"https://api.github.com/users/virtualweb-at/repos","events_url":"https://api.github.com/users/virtualweb-at/events{/privacy}","received_events_url":"https://api.github.com/users/virtualweb-at/received_events","type":"User","site_admin":false},"created_at":"2015-08-19T15:31:27Z","updated_at":"2015-08-19T15:31:27Z","body":"f2b starts, jails are getting created.\r\nthen it gives many errors like the one below. after that, the jails are created a second time. this happens on each restart of f2b. all jails are *appended* to iptables twice. on each start.\r\n\r\none of the errors is (SSHD but there are similar errors for the Stock Apache Jails):\r\n\r\n2015-08-19 17:16:11,456 fail2ban.actions        [21777]: ERROR   Failed to execute ban jail 'sshd' action 'iptables-multiport' info 'CallingMap({'failures': 3, 'ipjailfailures': <function Actions.__checkBan.<locals>.<lambda> at 0x7fc15ed322f0>, 'ipfailures': <function Actions.__checkBan.<locals>.<lambda> at 0x7fc15ed32268>, 'matches': 'Aug 19 15:15:39 myhostname sshd[23100]: Failed password for root from 182.100.67.113 port 60965 ssh2\\nAug 19 15:15:45 myhostname sshd[23106]: Failed password for root from 182.100.67.113 port 60213 ssh2', 'ip': '182.100.67.113', 'time': 1439997369.496184, 'ipmatches': <function Actions.__checkBan.<locals>.<lambda> at 0x7fc15ed321e0>, 'ipjailmatches': <function Actions.__checkBan.<locals>.<lambda> at 0x7fc15ed32048>})': need more than 0 values to unpack\r\n\r\nLooks like the List isn't correct and has 0 Values. But why? Maybe because the \\n between the 3 Logfile entries?"}}