Dear Maintainer,
Since recent upgrades with systemd packages, former sysvinit has now disappeared due to
conflicts and only systemd journals are available. This forced me to swith to
the experimental version of fail2ban (0.9.0) which is expected to support systemd
journals.
However, this does not seem to work for the postfix-sasl jail, and probably even not
for regular postfix (but here I have less data to check).
Concerning the confirmed failure with postfix-sasl, there are no [Init] section and
no "journalmatch=" statement in filter.d/postfix-sasl.conf, which may explain why
the errors from systemd journals are not seen by the jail. Running fail2ban-client
fot this jail leads to :
root@b3:~# fail2ban-client status postfix-sasl
Status for the jail: postfix-sasl
|- Filter
| |- Currently failed: 0
| |- Total failed: 0
| `- File list: /var/log/mail.warn
`- Actions
|- Currently banned: 0
|- Total banned: 0
`- Banned IP list:
root@b3:~#
So the /var/log/mail.warn file seems to be used, but this file is not updated anymore
since the recent systemd updates.
Running fail2ban-regex to force checking the journal leads to:
root@b3:~# fail2ban-regex systemd-journal /etc/fail2ban/filter.d/postfix-sasl.conf --print-all-matched
Running tests
=============
Use failregex file : /etc/fail2ban/filter.d/postfix-sasl.conf
Traceback (most recent call last):
File "/usr/bin/fail2ban-regex", line 558, in <module>
print "Use journal match : %s" % " ".join(journalmatch)
TypeError
root@b3:~#
Here, there seem to be an error, perhaps due to the missing "journalmatch" and the attempt
to run fail2ban-regex with systemd-journal option.
Concerning the supposed failure with postfix, there is an [Init] section and a journalmatch
statement in the jail configuration, and in fact fail2ban-regex does report 24 matches
root@b3:~# fail2ban-regex systemd-journal /etc/fail2ban/filter.d/postfix.conf
Running tests
=============
Use failregex file : /etc/fail2ban/filter.d/postfix.conf
Use journal match : _SYSTEMD_UNIT=postfix.service
Results
=======
Failregex: 24 total
|- #) [# of hits] regular expression
| 1) [24] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[ *\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*NOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
`-
Ignoreregex: 0 total
Lines: 1529 lines, 0 ignored, 24 matched, 1505 missed
Missed line(s): too many to print. Use --print-all-missed to print all 1505 lines
However, fail2ban-client reports 0 failed and it also does refer to /var/log/mail.warn.
root@b3:~# fail2ban-client status postfix
Status for the jail: postfix
|- Filter
| |- Currently failed: 0
| |- Total failed: 0
| `- File list: /var/log/mail.warn
`- Actions
|- Currently banned: 0
|- Total banned: 0
`- Banned IP list:
root@b3:~#
This leads me to think that the regular postfix jail also does not really check
the systemd journal (only a manual check with fail2ban-regex with explicit setting
of systemd-journal does) and in fact still relies on now freezed mail.warn file.
Hi Luc, Thanks for trying 0.9.x out. Indeed, journalmatch is still missing for the majority of the filters and your contributions would be very welcome -- I am myself yet to deploy any systemd box/virtualbox for testing/using systemd -- so I do not even have any sample log files to adjust configuration. Would you be kind to send a PR with necessary changes at https://github.com/fail2ban/fail2ban/pulls since systemd is not default, you would need to adjust yourself jail.conf (via customizations dumped into e.g. jail.d/systemd.conf) to set backend=systemd for those jails
Hi Luc, Thanks for trying 0.9.x out. Indeed, journalmatch is still missing for the majority of the filters and your contributions would be very welcome -- I am myself yet to deploy any systemd box/virtualbox for testing/using systemd -- so I do not even have any sample log files to adjust configuration. Would you be kind to send a PR with necessary changes at https://github.com/fail2ban/fail2ban/pulls since systemd is not default, you would need to adjust yourself jail.conf (via customizations dumped into e.g. jail.d/systemd.conf) to set backend=systemd for those jails
Le 11/08/2014 19:16, Yaroslav Halchenko a écrit :> Hi Luc, Hi Yaroslav, I have sent a very small pull request as you suggested. It is a small one as it only adds the journalmatch decalration to postfix-sasl.conf. With this fix, running fail2ban-regex with the systemd-journal option doesn't trigger an error anymore, and it does report some old matches. Perhaps the fail2ban-regex program should report a more explicit error if used with systemd-journal for a jail not configured to used systemd? *\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*NOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$ all 1505 lines /var/log/mail.warn. really check explicit setting mail.warn file. loop and finally try systemd. Now I have explicitly added it to my jail.d/jail.local file for dovecot, postfix and postfix-sasl as you suggested. Indeed, this solved the fail2ban-client report. One or two hours after having made both changes (adding journalmatch and adding backend), here is what fail2ban-clients reports: root@b3:~# fail2ban-client status postfix Status for the jail: postfix |- Filter | |- Currently failed: 1 | |- Total failed: 3 | `- Journal matches: _SYSTEMD_UNIT=postfix.service `- Actions |- Currently banned: 0 |- Total banned: 0 `- Banned IP list: root@b3:~# fail2ban-client status postfix-sasl Status for the jail: postfix-sasl |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- Journal matches: _SYSTEMD_UNIT=postfix.service `- Actions |- Currently banned: 0 |- Total banned: 0 `- Banned IP list: root@b3:~# So both jail now know they should look into systemd journal, and in fact the postfix jail already matched some errors. I am now waiting for the first bans, I guess they would come soon. best regards, Luc
Le 11/08/2014 19:16, Yaroslav Halchenko a écrit :> Hi Luc, Hi Yaroslav, I have sent a very small pull request as you suggested. It is a small one as it only adds the journalmatch decalration to postfix-sasl.conf. With this fix, running fail2ban-regex with the systemd-journal option doesn't trigger an error anymore, and it does report some old matches. Perhaps the fail2ban-regex program should report a more explicit error if used with systemd-journal for a jail not configured to used systemd? *\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*NOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$ all 1505 lines /var/log/mail.warn. really check explicit setting mail.warn file. loop and finally try systemd. Now I have explicitly added it to my jail.d/jail.local file for dovecot, postfix and postfix-sasl as you suggested. Indeed, this solved the fail2ban-client report. One or two hours after having made both changes (adding journalmatch and adding backend), here is what fail2ban-clients reports: root@b3:~# fail2ban-client status postfix Status for the jail: postfix |- Filter | |- Currently failed: 1 | |- Total failed: 3 | `- Journal matches: _SYSTEMD_UNIT=postfix.service `- Actions |- Currently banned: 0 |- Total banned: 0 `- Banned IP list: root@b3:~# fail2ban-client status postfix-sasl Status for the jail: postfix-sasl |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- Journal matches: _SYSTEMD_UNIT=postfix.service `- Actions |- Currently banned: 0 |- Total banned: 0 `- Banned IP list: root@b3:~# So both jail now know they should look into systemd journal, and in fact the postfix jail already matched some errors. I am now waiting for the first bans, I guess they would come soon. best regards, Luc
Hi, Adding the journalmatch statement in an [Init] section indeed did work. Some hosts were properly banned during the night as per jail configuration. One remaining issue concerns the mail notyfying about the ban. My jail.d/jail.local is configured with: action = %(action_mwl)s so I get a mail when some IP is banned. With the systemd configuration, the journal is properly used to detect the errors and trigger the ban, but the mail contains a final empty section with : Lines containing IP:130.0.174.58 in /var/log/mail.warn So the mail reporting code is not aware of systemd and journal. best regards, Luc
yeah -- those mail actions have no clue about systemd -- we would need a new/custom one for that purpose I guess... may be we could just use '<matches>' (e.g. as used in config/action.d/blocklist_de.conf) Someone would need to look into this... please file a new issue on fail2ban issues describing a situation, ok?