[fedora-arm] Fail2ban no longer working

Post by Roger Grosswiler
Hi,
is someone else experiencing problems? with fail2ban and systemd?
Mine doesn't start the jails, client itself is running. Log says, it cannot
create a separate child per jail.

What release/version?
_______________________________________________
arm mailing list -- ***@lists.fedoraproject.org
To unsubscribe send an email to arm-***@lists.fedoraproject.o

Roger Grosswiler

2017-08-31 05:55:03 UTC

Hello,

Release: Linux stbarth 4.12.8-300.fc26.armv7hl #1 SMP Thu Aug 17
18:39:25 UTC 2017 armv7l armv7l armv7l GNU/Linux

Fail2ban: fail2ban.noarch 0.9.7-2.fc26

...and some logs...

Aug 31 07:53:55 stbarth systemd[1]: Started Fail2Ban Service.
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERROR NOK: ("can't start
new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERROR NOK: ("can't start
new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERROR NOK: ("can't start
new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERROR NOK: ("can't start
new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERROR NOK: ("can't start
new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERROR NOK: ("can't start
new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERROR NOK: ("can't start
new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERROR NOK: ("can't start
new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERROR NOK: ("can't start
new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERROR NOK: ("can't start
new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERROR NOK: ("can't start
new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERROR NOK: ("can't start
new thread",)
Aug 31 07:53:51 stbarth fail2ban-client[2887]: 2017-08-31 07:53:51,542
fail2ban.server [2888]: INFO Starting in daemon mode
Aug 31 07:53:51 stbarth fail2ban-client[2887]: 2017-08-31 07:53:51,540
fail2ban.server [2888]: INFO Starting Fail2ban v0.9.7
Aug 31 07:53:48 stbarth systemd[1]: Starting Fail2Ban Service...

Thanks!

Roger

What release/version?
_______________________________________________

Daniel Laczi

2017-08-31 19:05:50 UTC

Hi,

Mine works fine:

â fail2ban.service - Fail2Ban Service
Â Â Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled;
vendor preset: disabled)
Â Â Active: active (running) since Tue 2017-06-27 23:46:09 CEST; 2 months
4 days ago
Â Â Â Â Docs: man:fail2ban(1)
Â Process: 698 ExecStart=/usr/bin/fail2ban-client -x start (code=exited,
status=0/SUCCESS)
Â Main PID: 977 (fail2ban-server)
Â Â Â Tasks: 3 (limit: 4915)
Â Â CGroup: /system.slice/fail2ban.service
Â Â Â Â Â Â Â Â Â Â ââ977 /usr/bin/python3 -s /usr/bin/fail2ban-server -s
/var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail2ban.pid -x -b

Jun 27 23:45:50 servername systemd[1]: Starting Fail2Ban Service...
Jun 27 23:46:06 servername fail2ban-client[698]: 2017-06-27 23:46:06,491
fail2ban.serverÂ Â Â Â Â Â Â Â [924]: INFOÂ Â Â Starting Fail2ban v0.9.7
Jun 27 23:46:06 servername fail2ban-client[698]: 2017-06-27 23:46:06,508
fail2ban.serverÂ Â Â Â Â Â Â Â [924]: INFOÂ Â Â Starting in daemon mode
Jun 27 23:46:09 servername systemd[1]: Started Fail2Ban Service.

Same kernel.

However I have only one jail. How many jails do you have? Does it start
if you reduce the number of jails? Have you seen this:
https://github.com/fail2ban/fail2ban/issues/969 Unfortunately the bug is
still open...

Daniel

Post by Roger Grosswiler
Hello,
Release: Linux stbarth 4.12.8-300.fc26.armv7hl #1 SMP Thu Aug 17
18:39:25 UTC 2017 armv7l armv7l armv7l GNU/Linux
Fail2ban: fail2ban.noarchÂ 0.9.7-2.fc26
...and some logs...
Aug 31 07:53:55 stbarth systemd[1]: Started Fail2Ban Service.
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERRORÂ NOK: ("can't
start new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERRORÂ NOK: ("can't
start new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERRORÂ NOK: ("can't
start new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERRORÂ NOK: ("can't
start new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERRORÂ NOK: ("can't
start new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERRORÂ NOK: ("can't
start new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERRORÂ NOK: ("can't
start new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERRORÂ NOK: ("can't
start new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERRORÂ NOK: ("can't
start new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERRORÂ NOK: ("can't
start new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERRORÂ NOK: ("can't
start new thread",)
Aug 31 07:53:55 stbarth fail2ban-client[2887]: ERRORÂ NOK: ("can't
start new thread",)
Aug 31 07:53:51 stbarth fail2ban-client[2887]: 2017-08-31 07:53:51,542
fail2ban.serverÂ Â Â Â Â Â Â Â [2888]: INFOÂ Â Â Starting in daemon mode
Aug 31 07:53:51 stbarth fail2ban-client[2887]: 2017-08-31 07:53:51,540
fail2ban.serverÂ Â Â Â Â Â Â Â [2888]: INFOÂ Â Â Starting Fail2ban v0.9.7
Aug 31 07:53:48 stbarth systemd[1]: Starting Fail2Ban Service...
Thanks!
Roger
Â

What release/version?
_______________________________________________

_______________________________________________

Roger Grosswiler

2017-08-31 19:50:48 UTC

hi,

thanks, yes i saw the bug, even if its quite old. i didnt find where to change that number.

i have 7 jails, none of them is starting, just one main thread, which does not seem to be a jail.

the service is running as yours does. but there is no jail at all, i think, as i get no mail notification about any jail.

i use mail notification, do you?

Post by Daniel Laczi
Hi,
â fail2ban.service - Fail2Ban Service
Â Â Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled;
vendor preset: disabled)
Â Â Active: active (running) since Tue 2017-06-27 23:46:09 CEST; 2 months
4 days ago
Â Â Â Â Docs: man:fail2ban(1)
Â Process: 698 ExecStart=/usr/bin/fail2ban-client -x start
(code=exited,
status=0/SUCCESS)
Â Main PID: 977 (fail2ban-server)
Â Â Â Tasks: 3 (limit: 4915)
Â Â CGroup: /system.slice/fail2ban.service
Â Â Â Â Â Â Â Â Â Â ââ977 /usr/bin/python3 -s /usr/bin/fail2ban-server -s
/var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail2ban.pid -x -b
Jun 27 23:45:50 servername systemd[1]: Starting Fail2Ban Service...
Jun 27 23:46:06 servername fail2ban-client[698]: 2017-06-27
23:46:06,491
fail2ban.serverÂ Â Â Â Â Â Â Â [924]: INFOÂ Â Â Starting Fail2ban v0.9.7
Jun 27 23:46:06 servername fail2ban-client[698]: 2017-06-27
23:46:06,508
fail2ban.serverÂ Â Â Â Â Â Â Â [924]: INFOÂ Â Â Starting in daemon mode
Jun 27 23:46:09 servername systemd[1]: Started Fail2Ban Service.
Same kernel.
However I have only one jail. How many jails do you have? Does it start
https://github.com/fail2ban/fail2ban/issues/969 Unfortunately the bug is
still open...
Daniel

07:53:51,542

Post by Roger Grosswiler
fail2ban.serverÂ Â Â Â Â Â Â Â [2888]: INFOÂ Â Â Starting in daemon mode
Aug 31 07:53:51 stbarth fail2ban-client[2887]: 2017-08-31

07:53:51,540

Post by Roger Grosswiler
fail2ban.serverÂ Â Â Â Â Â Â Â [2888]: INFOÂ Â Â Starting Fail2ban v0.9.7
Aug 31 07:53:48 stbarth systemd[1]: Starting Fail2Ban Service...
Thanks!
Roger
Â

Post by Roger Grosswiler
Hi,
is someone else experiencing problems? with fail2ban and systemd?
Mine doesn't start the jails, client itself is running. Log says,

Post by Roger Grosswiler
cannot
create a separate child per jail.

What release/version?
_______________________________________________

_______________________________________________

Daniel Laczi

2017-08-31 20:18:07 UTC

Hi,

I don't use mail notification, but the jail creation is being logged and I've tested it.

Have you tried reducing the number of jails? I'd try it with only one jail and do a real test (eg. enter the password for a fake account or whatever applies).

Daniel

Post by Roger Grosswiler
hi,
thanks, yes i saw the bug, even if its quite old. i didnt find where to change that number.
i have 7 jails, none of them is starting, just one main thread, which
does not seem to be a jail.
the service is running as yours does. but there is no jail at all, i
think, as i get no mail notification about any jail.
i use mail notification, do you?
Am 31. August 2017 21:05:50 MESZ schrieb Daniel Laczi

-b

Post by Daniel Laczi
Jun 27 23:45:50 servername systemd[1]: Starting Fail2Ban Service...
Jun 27 23:46:06 servername fail2ban-client[698]: 2017-06-27
23:46:06,491
fail2ban.serverÂ Â Â Â Â Â Â Â [924]: INFOÂ Â Â Starting Fail2ban v0.9.7
Jun 27 23:46:06 servername fail2ban-client[698]: 2017-06-27
23:46:06,508
fail2ban.serverÂ Â Â Â Â Â Â Â [924]: INFOÂ Â Â Starting in daemon mode
Jun 27 23:46:09 servername systemd[1]: Started Fail2Ban Service.
Same kernel.
However I have only one jail. How many jails do you have? Does it

start

Post by Daniel Laczi
https://github.com/fail2ban/fail2ban/issues/969 Unfortunately the bug is
still open...
Daniel

07:53:51,542

Post by Roger Grosswiler
fail2ban.serverÂ Â Â Â Â Â Â Â [2888]: INFOÂ Â Â Starting in daemon mode
Aug 31 07:53:51 stbarth fail2ban-client[2887]: 2017-08-31

07:53:51,540

Post by Roger Grosswiler
fail2ban.serverÂ Â Â Â Â Â Â Â [2888]: INFOÂ Â Â Starting Fail2ban v0.9.7
Aug 31 07:53:48 stbarth systemd[1]: Starting Fail2Ban Service...
Thanks!
Roger
Â

Post by Roger Grosswiler
Hi,
is someone else experiencing problems? with fail2ban and systemd?
Mine doesn't start the jails, client itself is running. Log says,

Post by Roger Grosswiler
cannot
create a separate child per jail.

What release/version?
_______________________________________________

_______________________________________________

Dennis Gilmore

2017-09-01 14:11:26 UTC

I do get mail notifcations and my jail/s work.

my /etc/fail2ban/jail.local looks like the following

[DEFAULT]
findtime = 86400
bantime = 86400
banaction = firewallcmd-ipset
backend = systemd
sender = <actual email>
destemail = <actual email>
action = %(action_mwl)s

[sshd]
enabled = true

I also have a few other jails enabled where appropriate. I have the
following packages installed

fail2ban-systemd-0.9.7-2.fc26.noarch
fail2ban-server-0.9.7-2.fc26.noarch
fail2ban-firewalld-0.9.7-2.fc26.noarch
fail2ban-sendmail-0.9.7-2.fc26.noarch

Dennis

Hi,
● fail2ban.service - Fail2Ban Service
Loaded: loaded (/usr/lib/systemd/system/fail2ban.service;
enabled; vendor preset: disabled)
Active: active (running) since Tue 2017-06-27 23:46:09 CEST; 2
months 4 days ago
Docs: man:fail2ban(1)
Process: 698 ExecStart=/usr/bin/fail2ban-client -x start
(code=exited, status=0/SUCCESS)
Main PID: 977 (fail2ban-server)
Tasks: 3 (limit: 4915)
CGroup: /system.slice/fail2ban.service
└─977 /usr/bin/python3 -s /usr/bin/fail2ban-server -s
/var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail2ban.pid -x -b
Jun 27 23:45:50 servername systemd[1]: Starting Fail2Ban Service...
Jun 27 23:46:06 servername fail2ban-client[698]: 2017-06-27
23:46:06,491 fail2ban.server [924]: INFO Starting
Fail2ban v0.9.7
Jun 27 23:46:06 servername fail2ban-client[698]: 2017-06-27
23:46:06,508 fail2ban.server [924]: INFO Starting in
daemon mode
Jun 27 23:46:09 servername systemd[1]: Started Fail2Ban Service.
Same kernel.
However I have only one jail. How many jails do you have? Does it
//github.com/fail2ban/fail2ban/issues/969 Unfortunately the bug is
still open...

What release/version?
_______________________________________________
rg

_______________________________________________

_______________________________________________
arm mailing list -- ***@lists.fedoraproject.org
To unsubscribe send an

Roger Grosswiler

2017-09-01 15:37:08 UTC

So! This is not nice!
I had 12 jails working before. I rewrote my private jail.config, didn't
help. Changed it in default jail.conf (should'nt), enabled 2 jails -
working. huh?
Reworte again my private config in jail.d with 2 jails, working. Based
on try and error, i confiirm for me, that 7 jails are working
flawlessy, from the eight on, it gives back the error-message. Can
anybody confirm this?
Clear bug for me!
Roger

Post by Dennis Gilmore

Post by Roger Grosswiler
hi,
thanks, yes i saw the bug, even if its quite old. i didnt find
where
to change that number.
i have 7 jails, none of them is starting, just one main thread, which
does not seem to be a jail.
the service is running as yours does. but there is no jail at all, i
think, as i get no mail notification about any jail.
i use mail notification, do you?

I do get mail notifcations and my jail/s work.
my /etc/fail2ban/jail.local looks like the following
[DEFAULT]
findtime = 86400
bantime = 86400
banaction = firewallcmd-ipset
backend = systemd
sender = <actual email>
destemail = <actual email>
action = %(action_mwl)s
[sshd]
enabled = true
I also have a few other jails enabled where appropriate. I have the
following packages installed
fail2ban-systemd-0.9.7-2.fc26.noarch
fail2ban-server-0.9.7-2.fc26.noarch
fail2ban-firewalld-0.9.7-2.fc26.noarch
fail2ban-sendmail-0.9.7-2.fc26.noarch
Dennis

Post by Daniel Laczi
Hi,
â fail2ban.service - Fail2Ban Service
Loaded: loaded (/usr/lib/systemd/system/fail2ban.service;
enabled; vendor preset: disabled)
Active: active (running) since Tue 2017-06-27 23:46:09 CEST; 2
months 4 days ago
Docs: man:fail2ban(1)
Process: 698 ExecStart=/usr/bin/fail2ban-client -x start
(code=exited, status=0/SUCCESS)
Main PID: 977 (fail2ban-server)
Tasks: 3 (limit: 4915)
CGroup: /system.slice/fail2ban.service
ââ977 /usr/bin/python3 -s /usr/bin/fail2ban-server -s
/var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail2ban.pid -x -b
Jun 27 23:45:50 servername systemd[1]: Starting Fail2Ban
Service...
Jun 27 23:46:06 servername fail2ban-client[698]: 2017-06-27
23:46:06,491 fail2ban.server [924]: INFO Starting
Fail2ban v0.9.7
Jun 27 23:46:06 servername fail2ban-client[698]: 2017-06-27
23:46:06,508 fail2ban.server [924]: INFO Starting in
daemon mode
Jun 27 23:46:09 servername systemd[1]: Started Fail2Ban Service.
Same kernel.
However I have only one jail. How many jails do you have? Does it
//github.com/fail2ban/fail2ban/issues/969 Unfortunately the bug is
still open...

Post by Peter Robinson
.n

What release/version?
_______________________________________________
.o
rg

_______________________________________________
rg

_______________________________________________

Peter Robinson

2017-09-01 16:39:40 UTC