Fail2Ban not working

[bswinnerton]

But now I have problems again LOL =(

I just had to reboot my server and realized that fail2ban wasn't running. So I tried to manually start it and check its status and here is what i get:

admin@myserver:/$ sudo /etc/init.d/fail2ban start
admin@myserver:/$ sudo /etc/init.d/fail2ban status
 * Status of authentication failure monitor
 *  fail2ban is not runni

No errors in the logs or anything

[CavalierDeVache]

If you look in the /etc/init.d/fail2ban script near the top of the file you will see that it is looking for the PID file in /tmp/. That has changed and the new location should be /var/run/fail2ban/

[bswinnerton]

Is this what you are referring to?

# Ad-hoc way to parse out socket file name
SOCKFILE=`grep -h '^[^#]*socket *=' /etc/$NAME/$NAME.conf /etc/$NAME/$NAME.loca$
          | tail -n 1 | sed -e 's/.*socket *= *//g' -e 's/ *$//g'`
[ -z "$SOCKFILE" ] && SOCKFILE='/tmp/fail2ban.sock'

[bswinnerton]

I changed it to this:

# Ad-hoc way to parse out socket file name
SOCKFILE=`grep -h '^[^#]*socket *=' /etc/$NAME/$NAME.conf /etc/$NAME/$NAME.loca$
          | tail -n 1 | sed -e 's/.*socket *= *//g' -e 's/ *$//g'`
[ -z "$SOCKFILE" ] && SOCKFILE='/var/run/fail2ban/fail2ban.sock'

And it still doesn't run. There is no directory /var/run/fail2ban

admin@myserver:/$ ls -s -h /var/run/fail2ban
ls: cannot access /var/run/fail2ban: No such file or directory

[bswinnerton]

Okay!

I found this bug

And created /var/run/fail2ban and it was resolved!

Fail2ban now works.

(For now).

[CavalierDeVache]

I'm sorry I wasn't more verbose, I was in the middle of sorting 3 or 4 things myself with 8.04.

But there is 1 more problem you will have to deal with, the /var/run directory structure is wiped on every reboot so you will need to create /ver/run/fail2ban from within the init script with a check to see if it already exists.

Here is a snippet of the script where you can see the changes I made to get it to work.

PATH=/usr/sbin:/usr/bin:/sbin:/bin
DESC="authentication failure monitor"
NAME=fail2ban

# /var/run is emptied on reboot, need to create run directory on startup
FAIL2BANRUNDIR=/var/run/fail2ban
if [ -d $FAIL2BANRUNDIR ]; then
        #do nothing
        echo "Directory '$FAIL2BANRUNDIR' already exists."
else
        mkdir -p $FAIL2BANRUNDIR
fi

# fail2ban-client is not a daemon itself but starts a daemon and
# loads its with configuration
DAEMON=/usr/bin/$NAME-client
SCRIPTNAME=/etc/init.d/$NAME

# Ad-hoc way to parse out socket file name
SOCKFILE=`grep -h '^[^#]*socket *=' /etc/$NAME/$NAME.conf /etc/$NAME/$NAME.local 2>/dev/null \
          | tail -n 1 | sed -e 's/.*socket *= *//g' -e 's/ *$//g'`
[ -z "$SOCKFILE" ] && SOCKFILE='/var/run/fail2ban/fail2ban.sock'

[wheelsofsteel]

Strangely, I have found that when I log out and log back in the /var/run/fail2ban dir has gone.

Consequently, I can't start to process. Re-creating the dir seems to do the trick though and the .sock file gets created as expected. Bit strange and never happened on pre 8.04 Ubuntu.

[bswinnerton]

Yes its very odd. But I can confirm that CavalierDeVache's way does work. I think that its a bug in fail2ban and they haven't updated the repositories yet.