fail2ban not loading jails when started using systemctl #2962

AliGolmirzaei · 2021-03-07T12:01:47Z

AliGolmirzaei
Mar 7, 2021

I have a very strange issue. when I restart fail2ban with fail2ban-client restart I have my jails listed by fail2ban-client status. but when I do a systemctl restart fail2ban then I get no jail with fail2ban-client status. Can anyone help me with this issue?

AliGolmirzaei · 2021-03-08T09:30:41Z

AliGolmirzaei
Mar 8, 2021
Author

I added -vvv --loglevel=DEBUG --logtarget=stdout to my service file at /etc/systemd/system/fail2ban.service. Then restart the service and get output of journalctl -u fail2ban


Mar 08 12:55:49 localhost.localdomain fail2ban-client[15994]: Shutdown successful
Mar 08 12:55:49 localhost.localdomain systemd[1]: Stopped Fail2Ban Service.
Mar 08 12:55:49 localhost.localdomain systemd[1]: Starting Fail2Ban Service...
Mar 08 12:55:49 localhost.localdomain systemd[1]: Started Fail2Ban Service.
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +   96 7F9BC51C0740 fail2ban.configreader     INFO  Loading configs for fail2ban under /etc/fail2ban
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +   96 7F9BC51C0740 fail2ban.configreader     DEBUG Reading configs for fail2ban under /etc/fail2ban
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +   98 7F9BC51C0740 fail2ban.configreader     DEBUG Reading config files: /etc/fail2ban/fail2ban.conf
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +   98 7F9BC51C0740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/fail2ban.conf']
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +   98 7F9BC51C0740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/fail2ban.conf
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +   99 7F9BC51C0740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/fail2ban.conf']
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +   99 7F9BC51C0740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/fail2ban.conf
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  100 7F9BC51C0740 fail2ban                  INFO  Using socket file /var/run/fail2ban/fail2ban.sock
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  100 7F9BC51C0740 fail2ban                  INFO  Using pid file /var/run/fail2ban/fail2ban.pid, [DEBUG] logging to stdout
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  102 7F9BC51C0740 fail2ban                  DEBUG Configure via async client thread
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  103 7F9BB8555700 fail2ban                  HEAVY   client phase {'start': True}
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  104 7F9BB8555700 fail2ban                  HEAVY  -- ['ping', 0.1] failed -- error(2, 'No such file or directory')
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  104 7F9BB8555700 fail2ban.configreader     INFO  Loading configs for jail under /etc/fail2ban
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  105 7F9BB8555700 fail2ban.configreader     DEBUG Reading configs for jail under /etc/fail2ban
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  106 7F9BB8555700 fail2ban.configreader     DEBUG Reading config files: /etc/fail2ban/jail.conf, /etc/fail2ban/jail.d/00-firewalld.conf
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  107 7F9BB8555700 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/jail.conf']
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  107 7F9BB8555700 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/jail.conf
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  118 7F9BB8555700 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/paths-fedora.conf']
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  118 7F9BB8555700 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/paths-fedora.conf
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  119 7F9BB8555700 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/paths-common.conf']
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  119 7F9BB8555700 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/paths-common.conf
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  121 7F9BB8555700 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/paths-overrides.local']
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  121 7F9BB8555700 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/paths-overrides.local
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  121 7F9BB8555700 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/jail.d/00-firewalld.conf']
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  121 7F9BB8555700 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/jail.d/00-firewalld.conf
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  122 7F9BB8555700 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/paths-common.conf', '/etc/fail2ban/paths-fedora.conf', '/etc/fail2ban/jail.conf', '/etc/fail2ban/jail.d/00-firewalld.conf']
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  122 7F9BB8555700 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/paths-common.conf
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  122 7F9BB8555700 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/paths-fedora.conf
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  123 7F9BB8555700 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/jail.conf
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  131 7F9BB8555700 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/jail.d/00-firewalld.conf
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  145 7F9BB8555700 fail2ban                  HEAVY   client phase {'ready': True, 'start': True}
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  151 7F9BC51C0740 fail2ban                  HEAVY   server phase {'ready': True, 'start': True}
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  152 7F9BC51C0740 fail2ban                  DEBUG   direct starting of server in 15999, deamon: False
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  189 7F9BC51C0740 fail2ban.server           INFO  --------------------------------------------------
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  190 7F9BC51C0740 fail2ban.server           INFO  Starting Fail2ban v0.11.1
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  190 7F9BC51C0740 fail2ban.server           DEBUG Creating PID file /var/run/fail2ban/fail2ban.pid
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  192 7F9BB7548700 fail2ban.observer         INFO  Observer start...
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  193 7F9BC51C0740 fail2ban.server           DEBUG Starting communication
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  202 7F9BC51C0740 fail2ban.database         INFO  Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: +  206 7F9BC51C0740 fail2ban.transmitter      DEBUG Status: ready
Mar 08 12:55:49 localhost.localdomain fail2ban-server[15999]: Server ready

it seems is not even finding jail.local. any idea?

4 replies

sebres Mar 8, 2021
Maintainer

Something seems to be different if starting as systemd unit (environment, path or whatever)...
Strange that there are no jails and no errors in log, because the jails are reading from /etc/fail2ban configuration by default (no matter how you starts it, unless you did not change config-prefix), so if there are 2 enabled jails, either you had seen in log this 2 jails starting, or some errors by start of jail.

What do you see if you make the dump with client (also verbose):

fail2ban-client -vvvd

Just to ensure the config is the same, to compare with aforementioned excerpt.

AliGolmirzaei Mar 9, 2021
Author

Thank you for your response. It is really a frustrating issue and I appreciate your help.
This is the output of what you requested

[root@localhost ~]# fail2ban-client -vvvd
 +  110 7FCC33A57740 fail2ban.configreader     INFO  Loading configs for fail2ban under /etc/fail2ban
 +  111 7FCC33A57740 fail2ban.configreader     DEBUG Reading configs for fail2ban under /etc/fail2ban
 +  112 7FCC33A57740 fail2ban.configreader     DEBUG Reading config files: /etc/fail2ban/fail2ban.conf, /etc/fail2ban/fail2ban.local
 +  112 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/fail2ban.conf']
 +  112 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/fail2ban.conf
 +  113 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/fail2ban.local']
 +  113 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/fail2ban.local
 +  113 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/fail2ban.conf', '/etc/fail2ban/fail2ban.local']
 +  114 7FCC33A57740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/fail2ban.conf
 +  114 7FCC33A57740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/fail2ban.local
 +  114 7FCC33A57740 fail2ban                  INFO  Using socket file /var/run/fail2ban/fail2ban.sock
 +  114 7FCC33A57740 fail2ban                  INFO  Using pid file /var/run/fail2ban/fail2ban.pid, [INFO] logging to /var/log/fail2ban.log
 +  115 7FCC33A57740 fail2ban.configreader     INFO  Loading configs for jail under /etc/fail2ban
 +  115 7FCC33A57740 fail2ban.configreader     DEBUG Reading configs for jail under /etc/fail2ban
 +  115 7FCC33A57740 fail2ban.configreader     DEBUG Reading config files: /etc/fail2ban/jail.conf, /etc/fail2ban/jail.d/00-firewalld.conf, /etc/fail2ban/jail.local
 +  116 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/jail.conf']
 +  116 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/jail.conf
 +  207 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/paths-fedora.conf']
 +  207 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/paths-fedora.conf
 +  208 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/paths-common.conf']
 +  208 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/paths-common.conf
 +  210 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/paths-overrides.local']
 +  210 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/paths-overrides.local
 +  210 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/jail.d/00-firewalld.conf']
 +  210 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/jail.d/00-firewalld.conf
 +  211 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/jail.local']
 +  211 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/jail.local
 +  212 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/paths-common.conf', '/etc/fail2ban/paths-fedora.conf', '/etc/fail2ban/jail.conf', '/etc/fail2ban/jail.d/00-firewalld.conf', '/etc/fail2ban/jail.local']
 +  212 7FCC33A57740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/paths-common.conf
 +  212 7FCC33A57740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/paths-fedora.conf
 +  213 7FCC33A57740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/jail.conf
 +  219 7FCC33A57740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/jail.d/00-firewalld.conf
 +  220 7FCC33A57740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/jail.local
 +  221 7FCC33A57740 fail2ban.configreader     INFO  Loading configs for filter.d/sshd under /etc/fail2ban
 +  221 7FCC33A57740 fail2ban.configreader     DEBUG Reading configs for filter.d/sshd under /etc/fail2ban
 +  235 7FCC33A57740 fail2ban.configreader     DEBUG Reading config files: /etc/fail2ban/filter.d/sshd.conf
 +  235 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/filter.d/sshd.conf']
 +  236 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/filter.d/sshd.conf
 +  258 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/filter.d/common.conf']
 +  258 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/filter.d/common.conf
 +  276 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/filter.d/common.local']
 +  276 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/filter.d/common.local
 +  277 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/filter.d/common.conf', '/etc/fail2ban/filter.d/sshd.conf']
 +  277 7FCC33A57740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/filter.d/common.conf
 +  277 7FCC33A57740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/filter.d/sshd.conf
 +  286 7FCC33A57740 fail2ban.configreader     INFO  Loading configs for action.d/iptables-allports under /etc/fail2ban
 +  287 7FCC33A57740 fail2ban.configreader     DEBUG Reading configs for action.d/iptables-allports under /etc/fail2ban
 +  336 7FCC33A57740 fail2ban.configreader     DEBUG Reading config files: /etc/fail2ban/action.d/iptables-allports.conf
 +  337 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/action.d/iptables-allports.conf']
 +  337 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/action.d/iptables-allports.conf
 +  339 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/action.d/iptables-common.conf']
 +  339 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/action.d/iptables-common.conf
 +  342 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/action.d/iptables-blocktype.local']
 +  342 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/action.d/iptables-blocktype.local
 +  342 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/action.d/iptables-common.local']
 +  343 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/action.d/iptables-common.local
 +  343 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/action.d/iptables-common.conf', '/etc/fail2ban/action.d/iptables-allports.conf']
 +  343 7FCC33A57740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/action.d/iptables-common.conf
 +  344 7FCC33A57740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/action.d/iptables-allports.conf
 +  358 7FCC33A57740 fail2ban.configreader     INFO  Loading configs for filter.d/nginx-forbidden under /etc/fail2ban
 +  358 7FCC33A57740 fail2ban.configreader     DEBUG Reading configs for filter.d/nginx-forbidden under /etc/fail2ban
 +  358 7FCC33A57740 fail2ban.configreader     DEBUG Reading config files: /etc/fail2ban/filter.d/nginx-forbidden.conf
 +  359 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/filter.d/nginx-forbidden.conf']
 +  359 7FCC33A57740 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/filter.d/nginx-forbidden.conf
 +  360 7FCC33A57740 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/filter.d/common.conf', '/etc/fail2ban/filter.d/nginx-forbidden.conf']
 +  360 7FCC33A57740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/filter.d/common.conf
 +  360 7FCC33A57740 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/filter.d/nginx-forbidden.conf
['set', 'syslogsocket', 'auto']
['set', 'loglevel', 'INFO']
['set', 'logtarget', '/var/log/fail2ban.log']
['set', 'dbfile', '/var/lib/fail2ban/fail2ban.sqlite3']
['set', 'dbmaxmatches', 10]
['set', 'dbpurgeage', '28800']
['add', 'sshd', 'systemd']
['set', 'sshd', 'usedns', 'warn']
['set', 'sshd', 'prefregex', '^<F-MLFID>\\s*(?:\\S+\\s+)?(?:sshd(?:\\[\\d+\\])?:?\\s+)?(?:kernel:\\s?\\[ *\\d+\\.\\d+\\]:?\\s+)?</F-MLFID>(?:(?:error|fatal): (?:PAM: )?)?<F-CONTENT>.+</F-CONTENT>$']
['set', 'sshd', 'maxlines', 1]
['set', 'sshd', 'addjournalmatch', '_SYSTEMD_UNIT=sshd.service', '+', '_COMM=sshd']
['multi-set', 'sshd', 'addfailregex', ['^[aA]uthentication (?:failure|error|failed) for <F-USER>.*</F-USER> from <HOST>( via \\S+)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User not known to the underlying authentication module for <F-USER>.*</F-USER> from <HOST>(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^Failed publickey for invalid user <F-USER>(?P<cond_user>\\S+)|(?:(?! from ).)*?</F-USER> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}(?: ssh\\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)', '^Failed \\b(?!publickey)\\S+ for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}(?: ssh\\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)', '^<F-USER>ROOT</F-USER> LOGIN REFUSED FROM <HOST>', '^[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> from <HOST>(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>.+</F-USER> from <HOST> not allowed because not listed in AllowUsers(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>.+</F-USER> from <HOST> not allowed because listed in DenyUsers(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>.+</F-USER> from <HOST> not allowed because not in any group(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^refused connect from \\S+ \\(<HOST>\\)', '^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}:\\s*3: .*: Auth fail(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>.+</F-USER> from <HOST> not allowed because a group is listed in DenyGroups(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', "^User <F-USER>.+</F-USER> from <HOST> not allowed because none of user's groups are listed in AllowGroups(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$", '^<F-NOFAIL>pam_[a-z]+\\(sshd:auth\\):\\s+authentication failure;</F-NOFAIL>(?:\\s+(?:(?:logname|e?uid|tty)=\\S*)){0,4}\\s+ruser=<F-ALT_USER>\\S*</F-ALT_USER>\\s+rhost=<HOST>(?:\\s+user=<F-USER>\\S*</F-USER>)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^(error: )?maximum authentication attempts exceeded for <F-USER>.*</F-USER> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}(?: ssh\\d*)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>.+</F-USER> not allowed because account is locked(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*', '^<F-MLFFORGET>Disconnecting</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\\S+</F-USER> <HOST>(?: (?:port \\d+|on \\S+)){0,2}:\\s*Change of username or service not allowed:\\s*.*\\[preauth\\]\\s*$', '^<F-MLFFORGET>Disconnecting</F-MLFFORGET>: Too many authentication failures(?: for <F-USER>.+?</F-USER>)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}:\\s*11:', '^<F-MLFFORGET>(Connection closed|Disconnected)</F-MLFFORGET> (?:by|from)(?: (?:invalid|authenticating) user <F-USER>\\S+|.+?</F-USER>)? <HOST>(?: (?:port \\d+|on \\S+)){0,2}\\s+\\[preauth\\]\\s*$', '^<F-MLFFORGET><F-MLFGAINED>Accepted \\w+</F-MLFGAINED></F-MLFFORGET> for <F-USER>\\S+</F-USER> from <HOST>(?:\\s|$)', '^Did not receive identification string from <HOST>', "^Bad protocol version identification '.*' from <HOST>", '^Connection <F-MLFFORGET>reset</F-MLFFORGET> by <HOST>', '^<F-NOFAIL>SSH: Server;Ltype:</F-NOFAIL> (?:Authname|Version|Kex);Remote: <HOST>-\\d+;[A-Z]\\w+:', '^Read from socket failed: Connection <F-MLFFORGET>reset</F-MLFFORGET> by peer', '^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}:\\s*14: No supported authentication methods available', '^Unable to negotiate with <HOST>(?: (?:port \\d+|on \\S+)){0,2}: no matching (?:(?:\\w+ (?!found\\b)){0,2}\\w+) found.', '^Unable to negotiate a (?:(?:\\w+ (?!found\\b)){0,2}\\w+)', '^no matching (?:(?:\\w+ (?!found\\b)){0,2}\\w+) found:', '^<F-NOFAIL>Connection from</F-NOFAIL> <HOST>']]
['set', 'sshd', 'datepattern', '{^LN-BEG}']
['set', 'sshd', 'maxmatches', 3]
['set', 'sshd', 'maxretry', 3]
['set', 'sshd', 'logencoding', 'auto']
['set', 'sshd', 'ignorecommand', '']
['set', 'sshd', 'findtime', '3600']
['set', 'sshd', 'bantime', '604800']
['set', 'sshd', 'addaction', 'sshd']
['multi-set', 'sshd', 'action', 'sshd', [['actionunban', '<iptables> -D f2b-sshd -s <ip> -j <blocktype>'], ['actionflush', '<iptables> -F f2b-sshd'], ['actionstop', '<iptables> -D INPUT -p all -j f2b-sshd\n<iptables> -F f2b-sshd\n<iptables> -X f2b-sshd'], ['actionstart', '<iptables> -N f2b-sshd\n<iptables> -A f2b-sshd -j RETURN\n<iptables> -I INPUT -p all -j f2b-sshd'], ['actionban', '<iptables> -I f2b-sshd 1 -s <ip> -j <blocktype>'], ['actioncheck', "<iptables> -n -L INPUT | grep -q 'f2b-sshd[ \\t]'"], ['iptables', 'iptables <lockingopt>'], ['lockingopt', '-w'], ['blocktype?family=inet6', 'REJECT --reject-with icmp6-port-unreachable'], ['protocol', 'all'], ['name', 'sshd'], ['chain', 'INPUT'], ['returntype', 'RETURN'], ['iptables?family=inet6', 'ip6tables <lockingopt>'], ['blocktype', 'REJECT --reject-with icmp-port-unreachable'], ['actname', 'sshd'], ['port', 'ssh']]]
['set', 'sshd', 'addaction', 'sshd-docker']
['multi-set', 'sshd', 'action', 'sshd-docker', [['actionunban', '<iptables> -D f2b-sshd-docker -s <ip> -j <blocktype>'], ['actionflush', '<iptables> -F f2b-sshd-docker'], ['actionstop', '<iptables> -D DOCKER-USER -p all -j f2b-sshd-docker\n<iptables> -F f2b-sshd-docker\n<iptables> -X f2b-sshd-docker'], ['actionstart', '<iptables> -N f2b-sshd-docker\n<iptables> -A f2b-sshd-docker -j RETURN\n<iptables> -I DOCKER-USER -p all -j f2b-sshd-docker'], ['actionban', '<iptables> -I f2b-sshd-docker 1 -s <ip> -j <blocktype>'], ['actioncheck', "<iptables> -n -L DOCKER-USER | grep -q 'f2b-sshd-docker[ \\t]'"], ['iptables', 'iptables <lockingopt>'], ['lockingopt', '-w'], ['blocktype?family=inet6', 'REJECT --reject-with icmp6-port-unreachable'], ['protocol', 'all'], ['name', 'sshd-docker'], ['chain', 'DOCKER-USER'], ['returntype', 'RETURN'], ['iptables?family=inet6', 'ip6tables <lockingopt>'], ['blocktype', 'REJECT --reject-with icmp-port-unreachable'], ['actname', 'sshd-docker'], ['port', 'ssh']]]
['add', 'nginx-forbidden', 'systemd']
['set', 'nginx-forbidden', 'usedns', 'warn']
['set', 'nginx-forbidden', 'addfailregex', '^<HOST>[^"]*"[^"]*" 403']
['set', 'nginx-forbidden', 'datepattern', '{^LN-BEG}']
['set', 'nginx-forbidden', 'maxmatches', 20]
['set', 'nginx-forbidden', 'maxretry', 20]
['set', 'nginx-forbidden', 'logencoding', 'auto']
['set', 'nginx-forbidden', 'ignorecommand', '']
['set', 'nginx-forbidden', 'findtime', '600']
['set', 'nginx-forbidden', 'bantime', '3600']
['set', 'nginx-forbidden', 'addaction', 'nginx']
['multi-set', 'nginx-forbidden', 'action', 'nginx', [['actionunban', '<iptables> -D f2b-nginx -s <ip> -j <blocktype>'], ['actionflush', '<iptables> -F f2b-nginx'], ['actionstop', '<iptables> -D INPUT -p all -j f2b-nginx\n<iptables> -F f2b-nginx\n<iptables> -X f2b-nginx'], ['actionstart', '<iptables> -N f2b-nginx\n<iptables> -A f2b-nginx -j RETURN\n<iptables> -I INPUT -p all -j f2b-nginx'], ['actionban', '<iptables> -I f2b-nginx 1 -s <ip> -j <blocktype>'], ['actioncheck', "<iptables> -n -L INPUT | grep -q 'f2b-nginx[ \\t]'"], ['iptables', 'iptables <lockingopt>'], ['lockingopt', '-w'], ['blocktype?family=inet6', 'REJECT --reject-with icmp6-port-unreachable'], ['protocol', 'all'], ['name', 'nginx'], ['chain', 'INPUT'], ['returntype', 'RETURN'], ['iptables?family=inet6', 'ip6tables <lockingopt>'], ['blocktype', 'REJECT --reject-with icmp-port-unreachable'], ['actname', 'nginx'], ['port', 'ssh']]]
['set', 'nginx-forbidden', 'addaction', 'nginx-docker']
['multi-set', 'nginx-forbidden', 'action', 'nginx-docker', [['actionunban', '<iptables> -D f2b-nginx-docker -s <ip> -j <blocktype>'], ['actionflush', '<iptables> -F f2b-nginx-docker'], ['actionstop', '<iptables> -D DOCKER-USER -p all -j f2b-nginx-docker\n<iptables> -F f2b-nginx-docker\n<iptables> -X f2b-nginx-docker'], ['actionstart', '<iptables> -N f2b-nginx-docker\n<iptables> -A f2b-nginx-docker -j RETURN\n<iptables> -I DOCKER-USER -p all -j f2b-nginx-docker'], ['actionban', '<iptables> -I f2b-nginx-docker 1 -s <ip> -j <blocktype>'], ['actioncheck', "<iptables> -n -L DOCKER-USER | grep -q 'f2b-nginx-docker[ \\t]'"], ['iptables', 'iptables <lockingopt>'], ['lockingopt', '-w'], ['blocktype?family=inet6', 'REJECT --reject-with icmp6-port-unreachable'], ['protocol', 'all'], ['name', 'nginx-docker'], ['chain', 'DOCKER-USER'], ['returntype', 'RETURN'], ['iptables?family=inet6', 'ip6tables <lockingopt>'], ['blocktype', 'REJECT --reject-with icmp-port-unreachable'], ['actname', 'nginx-docker'], ['port', 'ssh']]]
['start', 'sshd']
['start', 'nginx-forbidden']
 +  371 7FCC33A57740 fail2ban                  DEBUG Exit with code 0

as a side note, I am using an ansible script to deploy fail2ban to some centos machines. My script is working in 1 machine in 5. my first comparison was centos versions so I upgrade them. No difference. My second comparison was file owner group and permissions. so I did an ls -l but found no difference. This is the output

drwxr-xr-x. 2 root root  4096 Mar  8 12:09 action.d
-rw-r--r--. 1 root root  2817 Jan 11  2020 fail2ban.conf
drwxr-xr-x. 2 root root     6 Aug 28  2020 fail2ban.d
-rw-r--r--. 1 root root    41 Mar  9 09:47 fail2ban.local
drwxr-xr-x. 3 root root  4096 Mar  9 09:47 filter.d
-rw-r--r--. 1 root root 25740 Aug 28  2020 jail.conf
drwxr-xr-x. 2 root root    31 Mar  8 12:09 jail.d
-rw-r--r--. 1 root root   645 Mar  9 09:47 jail.local
-rw-r--r--. 1 root root  2827 Jan 11  2020 paths-common.conf
-rw-r--r--. 1 root root   930 Jan 11  2020 paths-fedora.conf

I also investigate the output of lsattr but I didn't see any difference. And also I found some strange happening. If I do mv jail.local temp and then cp temp jail.local it starts to work!!! If I do the cp by ansible shell command it won't work. So I cants use it as a solution. This happening push me to investigate more. Editing jail.local using vim in the first place didn't help. Finding diff of the copied file didn't show any difference even if I convert them to hex (to see invisible chars). Do you have any idea?

AliGolmirzaei Mar 9, 2021
Author

My last conclusion is it's an os issue that returns false in the output of os.path.exists and causes the jail file to be ignored. But really what's the difference between running service using systemctl and its binary itself?

sebres Mar 9, 2021
Maintainer

My last conclusion is it's an os issue that returns false in the output of os.path.exists and causes the jail file to be ignored.
But really what's the difference between running service using systemctl and its binary itself?

I never saw such an issue, so I cannot say what it is.
Since the permission o=r is given for jail.local anyway, it is readable for systemd unit no matter under which user it is configured to run (by the way per default it must be root).
Also comparing both outputs, it seems to ignore /etc/fail2ban/fail2ban.local.

That os.path.exists not working in unit would be really a nonsense, may be some configuration (environment, whatever) causing that file name supplied to os.path.exists is really different (gets some character like new-line or whatever else).
To ensure it is not a permissions issue, you could try to log directly after this line

fail2ban/fail2ban/server/server.py

Line 45 in fb6315e

logSys = getLogger(__name__)

  logSys = getLogger(__name__)
+ logSys.warning("**** TEST %r", os.path.exists('/etc/fail2ban/jail.local'))

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fail2ban not loading jails when started using systemctl #2962

{{title}}

Replies: 1 comment 4 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

Select a reply

fail2ban not loading jails when started using systemctl #2962

AliGolmirzaei Mar 7, 2021

Replies: 1 comment · 4 replies

AliGolmirzaei Mar 8, 2021 Author

sebres Mar 8, 2021 Maintainer

AliGolmirzaei Mar 9, 2021 Author

AliGolmirzaei Mar 9, 2021 Author

sebres Mar 9, 2021 Maintainer

AliGolmirzaei
Mar 7, 2021

Replies: 1 comment 4 replies

AliGolmirzaei
Mar 8, 2021
Author

sebres Mar 8, 2021
Maintainer

AliGolmirzaei Mar 9, 2021
Author

AliGolmirzaei Mar 9, 2021
Author

sebres Mar 9, 2021
Maintainer