#757763 fail2ban: postfix-sasl jail (and probably regular postfix too) doesn't ban on systemd-enabled

#757763#5
Date:
2014-08-11 08:16:43 UTC
From:
To:
Dear Maintainer,

Since recent upgrades with systemd packages, former sysvinit has now disappeared due to
conflicts and only systemd journals are available. This forced me to swith to
the experimental version of fail2ban (0.9.0) which is expected to support systemd
journals.

However, this does not seem to work for the postfix-sasl jail, and probably even not
for regular postfix (but here I have less data to check).

Concerning the confirmed failure with postfix-sasl, there are no [Init] section and
no "journalmatch=" statement in filter.d/postfix-sasl.conf, which may explain why
the errors from systemd journals are not seen by the jail. Running fail2ban-client
fot this jail leads to :

root@b3:~# fail2ban-client status postfix-sasl
Status for the jail: postfix-sasl
|- Filter
|  |- Currently failed:	0
|  |- Total failed:	0
|  `- File list:	/var/log/mail.warn
`- Actions
   |- Currently banned:	0
   |- Total banned:	0
   `- Banned IP list:
root@b3:~#

So the /var/log/mail.warn file seems to be used, but this file is not updated anymore
since the recent systemd updates.

Running fail2ban-regex to force checking the journal leads to:

root@b3:~# fail2ban-regex systemd-journal /etc/fail2ban/filter.d/postfix-sasl.conf  --print-all-matched

Running tests
=============

Use   failregex file : /etc/fail2ban/filter.d/postfix-sasl.conf
Traceback (most recent call last):
  File "/usr/bin/fail2ban-regex", line 558, in <module>
    print "Use    journal match : %s" % " ".join(journalmatch)
TypeError
root@b3:~#

Here, there seem to be an error, perhaps due to the missing "journalmatch" and the attempt
to run fail2ban-regex with systemd-journal option.


Concerning the supposed failure with postfix, there is an [Init] section and a journalmatch
statement in the jail configuration, and in fact fail2ban-regex does report 24 matches

root@b3:~# fail2ban-regex systemd-journal /etc/fail2ban/filter.d/postfix.conf

Running tests
=============

Use   failregex file : /etc/fail2ban/filter.d/postfix.conf
Use    journal match : _SYSTEMD_UNIT=postfix.service


Results
=======

Failregex: 24 total
|-  #) [# of hits] regular expression
|   1) [24] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[ *\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*NOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
`-

Ignoreregex: 0 total

Lines: 1529 lines, 0 ignored, 24 matched, 1505 missed
Missed line(s): too many to print.  Use --print-all-missed to print all 1505 lines


However, fail2ban-client reports 0 failed and it also does refer to /var/log/mail.warn.

root@b3:~# fail2ban-client status postfix
Status for the jail: postfix
|- Filter
|  |- Currently failed:	0
|  |- Total failed:	0
|  `- File list:	/var/log/mail.warn
`- Actions
   |- Currently banned:	0
   |- Total banned:	0
   `- Banned IP list:
root@b3:~#


This leads me to think that the regular postfix jail also does not really check
the systemd journal (only a manual check with fail2ban-regex with explicit setting
of systemd-journal does) and in fact still relies on now freezed mail.warn file.

#757763#10
Date:
2014-08-11 17:16:21 UTC
From:
To:
Hi Luc,

Thanks for trying 0.9.x out.  Indeed, journalmatch is still missing for
the majority of the filters and your contributions would be very welcome
-- I am myself yet to deploy any systemd box/virtualbox for
testing/using systemd -- so I do not even have any sample log files to
adjust configuration.  Would you be kind to send a PR with necessary
changes at
https://github.com/fail2ban/fail2ban/pulls

since systemd is not default, you would need to adjust yourself
jail.conf (via customizations dumped into e.g. jail.d/systemd.conf) to
set backend=systemd for those jails

#757763#15
Date:
2014-08-11 17:16:21 UTC
From:
To:
Hi Luc,

Thanks for trying 0.9.x out.  Indeed, journalmatch is still missing for
the majority of the filters and your contributions would be very welcome
-- I am myself yet to deploy any systemd box/virtualbox for
testing/using systemd -- so I do not even have any sample log files to
adjust configuration.  Would you be kind to send a PR with necessary
changes at
https://github.com/fail2ban/fail2ban/pulls

since systemd is not default, you would need to adjust yourself
jail.conf (via customizations dumped into e.g. jail.d/systemd.conf) to
set backend=systemd for those jails

#757763#20
Date:
2014-08-11 20:20:47 UTC
From:
To:
Le 11/08/2014 19:16, Yaroslav Halchenko a écrit :> Hi Luc,

Hi Yaroslav,

I have sent a very small pull request as you suggested. It is a small
one as it only adds the journalmatch decalration to postfix-sasl.conf.

With this fix, running fail2ban-regex with the systemd-journal option
doesn't trigger an error anymore, and it does report some old matches.

Perhaps the fail2ban-regex program should report a more explicit error
if used with systemd-journal for a jail not configured to used systemd?
*\d+\.\d+\] )?(?:@vserver_\S+
)?(?:(?:\[\d+\])?:\s+[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID
\d+ \S+\])?\s*NOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
all 1505 lines
/var/log/mail.warn.
really check
explicit setting
mail.warn file.
loop and finally try systemd.

Now I have explicitly added it to my jail.d/jail.local file for dovecot,
postfix and postfix-sasl as you suggested. Indeed, this solved the
fail2ban-client report.

One or two hours after having made both changes (adding journalmatch and
adding backend), here is what fail2ban-clients reports:

root@b3:~# fail2ban-client status postfix
Status for the jail: postfix
|- Filter
|  |- Currently failed:	1
|  |- Total failed:	3
|  `- Journal matches:	_SYSTEMD_UNIT=postfix.service
`- Actions
   |- Currently banned:	0
   |- Total banned:	0
   `- Banned IP list:
root@b3:~# fail2ban-client status postfix-sasl
Status for the jail: postfix-sasl
|- Filter
|  |- Currently failed:	0
|  |- Total failed:	0
|  `- Journal matches:	_SYSTEMD_UNIT=postfix.service
`- Actions
   |- Currently banned:	0
   |- Total banned:	0
   `- Banned IP list:
root@b3:~#


So both jail now know they should look into systemd journal, and in fact
the postfix jail already matched some errors.

I am now waiting for the first bans, I guess they would come soon.

best regards,
Luc

#757763#25
Date:
2014-08-11 20:20:47 UTC
From:
To:
Le 11/08/2014 19:16, Yaroslav Halchenko a écrit :> Hi Luc,

Hi Yaroslav,

I have sent a very small pull request as you suggested. It is a small
one as it only adds the journalmatch decalration to postfix-sasl.conf.

With this fix, running fail2ban-regex with the systemd-journal option
doesn't trigger an error anymore, and it does report some old matches.

Perhaps the fail2ban-regex program should report a more explicit error
if used with systemd-journal for a jail not configured to used systemd?
*\d+\.\d+\] )?(?:@vserver_\S+
)?(?:(?:\[\d+\])?:\s+[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID
\d+ \S+\])?\s*NOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
all 1505 lines
/var/log/mail.warn.
really check
explicit setting
mail.warn file.
loop and finally try systemd.

Now I have explicitly added it to my jail.d/jail.local file for dovecot,
postfix and postfix-sasl as you suggested. Indeed, this solved the
fail2ban-client report.

One or two hours after having made both changes (adding journalmatch and
adding backend), here is what fail2ban-clients reports:

root@b3:~# fail2ban-client status postfix
Status for the jail: postfix
|- Filter
|  |- Currently failed:	1
|  |- Total failed:	3
|  `- Journal matches:	_SYSTEMD_UNIT=postfix.service
`- Actions
   |- Currently banned:	0
   |- Total banned:	0
   `- Banned IP list:
root@b3:~# fail2ban-client status postfix-sasl
Status for the jail: postfix-sasl
|- Filter
|  |- Currently failed:	0
|  |- Total failed:	0
|  `- Journal matches:	_SYSTEMD_UNIT=postfix.service
`- Actions
   |- Currently banned:	0
   |- Total banned:	0
   `- Banned IP list:
root@b3:~#


So both jail now know they should look into systemd journal, and in fact
the postfix jail already matched some errors.

I am now waiting for the first bans, I guess they would come soon.

best regards,
Luc

#757763#30
Date:
2014-08-12 07:32:04 UTC
From:
To:
Hi,

Adding the journalmatch statement in an [Init] section indeed did work.
Some hosts were properly banned during the night as per jail
configuration.

One remaining issue concerns the mail notyfying about the ban.
My jail.d/jail.local is configured with:

   action = %(action_mwl)s

so I get a mail when some IP is banned.

With the systemd configuration, the journal is properly used to detect
the errors and trigger the ban, but the mail contains a final empty
section
with :

Lines containing IP:130.0.174.58 in /var/log/mail.warn



So the mail reporting code is not aware of systemd and journal.

best regards,
Luc

#757763#35
Date:
2014-08-12 15:13:53 UTC
From:
To:
yeah -- those mail actions have no clue about systemd -- we would need a
new/custom one for that purpose I guess... may be  we could just use
'<matches>' (e.g. as used in config/action.d/blocklist_de.conf)

Someone would need to look into this... please file a new issue on
fail2ban issues describing a situation, ok?