Fail2Ban Date/Time Issues

Discussion in 'Server Operation' started by Goater, Jan 26, 2014.

  1. Goater

    Goater New Member


    I am setting up a fairly new server and trying to get Fail2Ban to work.

    It is currently not blocking anyone no matter after how many attempts. After a lot of debugging I think that the cause of the problem is due to the timestamp being wrong for Fail2Ban.

    I can see this in the logs:
    2014-01-26 08:25:58,946 fail2ban.datetemplate: DEBUG  Correcting deduced year from 2014 to 2013 since 1390728358.000000 > 1390724758.946038
    The code above looks like Fail2Ban automatically deducts the time by a whole year if it is (like above) only an hour ahead.

    Then the debug goes on to read:
    2014-01-26 08:25:58,946 fail2ban.filter : DEBUG  Processing line with time:1359192358.0 and ip:123.234.345.456
    2014-01-26 08:25:58,946 fail2ban.filter : DEBUG  Ignore line since time 1359192358.0 < 1390724758.95 - 10800
    So Fail2Ban looks to be ignoring the rule because it has last years date.

    I have looked and looked and cannot see why Fail2Ban would be using a date that is 1 hour ahead in the first place.

    Can anyone shed any light on this please.
    Last edited: Jan 26, 2014
  2. Goater

    Goater New Member

    Fixed It

    I have figured out what the issue was. I had spent many hours looking into this and that's why I posted on here. But after a few more hours it worked out to be something simple.

    It was the time zones that were set on the server.

    The time zones on the server should have been set to, Europe/London and that is where the /etc/localtime was linked to.

    But what I didn't realise was that there is a secondary file that needed editing, /etc/sysconfig/clock This was set to Europe/Paris hence the 1 hour ahead.

    Ruby uses the latter time zone config so when Fail2Ban (which uses Ruby) was checking against the system time it was throwing the error. After a server reboot and a quick check of Fail2Ban all seems to be working great now.

Share This Page