I have followed this guide (FAIL2BAN with Docker)
This is a sample log when a loging fails
2021-01-25 19:30:02 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 162.158.134.46 (162.158.134.46) (Mozilla/5.0 (Linux; Android 11; SM-G981B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.116 Mobile Safari/537.36 EdgA/45.12.4.5125)
findtime and bantime are set to 60 seconds just for the test.
The behaviour is the following
I log in with my phone, no warning message appears in home assistant log
I log out
I log in again, the login is suscesful but I automatically get a ban in in fail to ban. Maxtry is set to 3 but it shouldn’t matter since all the logins are suscesfull.
2021-01-25 19:33:59,368 fail2ban.filter [439]: INFO [hass-iptables] Found 162.158.7.117 - 2021-01-25 19:33:59
2021-01-25 19:33:59,494 fail2ban.actions [439]: NOTICE [hass-iptables] Ban 162.158.7.117
this is the hass.local file, looks fine to me but I’m not an expert.
[INCLUDES]
before = common.conf
[Definition]
failregex = ^%(__prefix_line)s.*Login attempt or request with invalid authentication from <HOST>.*$
ignoreregex =
[Init]
datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S
I have tried everyting (3 hours troubleshooting).
Why I’m getting baneed even if the login is ok?
# Home Assitant integration https://www.home-assistant.io/integrations/fail2ban/
[hass-iptables]
enabled = true
filter = hass
logencoding = utf-8
action = iptables-allports[name=HASS]
logpath = /hass/home-assistant.log
maxretry = 3