LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-26-2013, 08:23 PM   #1
munkz
Member
 
Registered: Aug 2013
Location: A couch
Distribution: linux
Posts: 69

Rep: Reputation: 2
Question Question regarding fail2ban jail.conf


Hi,

I am having issues with fail2ban parsing jailf.conf. The errors are as follows :

Code:
Stopping fail2ban:                                         [FAILED]
Starting fail2ban: Traceback (most recent call last):
  File "/usr/bin/fail2ban-client", line 426, in <module>
    if client.start(sys.argv):
  File "/usr/bin/fail2ban-client", line 395, in start
    return self.__processCommand(args)
  File "/usr/bin/fail2ban-client", line 184, in __processCommand
    ret = self.__readConfig()
  File "/usr/bin/fail2ban-client", line 399, in __readConfig
    self.__configurator.readAll()
  File "/usr/share/fail2ban/client/configurator.py", line 62, in readAll
    self.__jails.read()
  File "/usr/share/fail2ban/client/jailsreader.py", line 49, in read
    return ConfigReader.read(self, "jail")
  File "/usr/share/fail2ban/client/configreader.py", line 70, in read
    config_files_read = SafeConfigParserWithIncludes.read(self, config_files)
  File "/usr/share/fail2ban/client/configparserinc.py", line 105, in read
    fileNamesFull += SafeConfigParserWithIncludes.getIncludes(filename)
  File "/usr/share/fail2ban/client/configparserinc.py", line 76, in getIncludes
    parser.read(resource)
  File "/usr/lib64/python2.6/ConfigParser.py", line 286, in read
    self._read(fp, filename)
  File "/usr/lib64/python2.6/ConfigParser.py", line 510, in _read
    raise e
ConfigParser.ParsingError: File contains parsing errors: /etc/fail2ban/jail.conf
	[line 57]: ' enabled  = true\n'
	[line 58]: ' port     = http,https\n'
	[line 59]: ' filter   = apache-nokiddies\n'
	[line 60]: ' logpath  = /var/log/apache*/*access.log\n'
	[line 61]: ' maxretry = 3\n'
                                                           [FAILED]

The jail.conf file :
Code:
[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1

# "bantime" is the number of seconds that a host is banned.
bantime = 600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 3

#see /etc/fail2ban/filter.d/apache-overflows.conf 
[apache-overflows]
enabled = true

#see /etc/fail2ban/filter.d/apache.conf
[apache]
enabled = true

#see /etc/fail2ban/filter.d/apache-noscript.conf
[apache-noscript]
enabled = true


#see 
[apache-badbots]
enabled = true

 
#see /etc/fail2ban/filter.d/apache-phpmyadmin.conf
[apache-phpmyadmin]
enabled  = true
port     = http,https
filter   = apache-phpmyadmin
logpath  = /var/log/apache*/*error.log
maxretry = 3

#see
#[apache-post]
#enabled = true
#filter = apache-post
#action = iptables[name=httpd, port=80, protocol=tcp]
#sendmail-whois[name=post_block, dest=jtrescue1@gmail.com]
#logpath = /var/log/httpd/access_log
#findtime = 10
#bantime = 183600
#maxretry = 10

#see /etc/fail2ban/filter.d/apache-nokiddies.conf
[apache-nokiddies]
 enabled  = true
 port     = http,https
 filter   = apache-nokiddies
 logpath  = /var/log/apache*/*access.log
 maxretry = 3

#see /etc/fail2ban/filter.d/apache-clientdenied.conf
[apache-clientdenied]
enabled  = true 
port     = http,https
filter   = apache-clientdenied
logpath  = /var/log/apache*/*error.log
maxretry = 3

#see /etc/fail2ban/filter.d/ssh-iptables.conf
[ssh-iptables]
enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]
           sendmail-whois[name=SSH, dest=root, sender=fail2ban@example.com]
logpath  = /var/log/secure
maxretry = 5
So, I am guessing its not the actual filter conf file but the way the jail.conf file is being parsed. Any help would be appreciated.
 
Old 08-27-2013, 03:56 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Start by showing us the difference ('man diff; diff -uN') between the original and the modified jail.conf?
 
Old 08-27-2013, 07:23 PM   #3
munkz
Member
 
Registered: Aug 2013
Location: A couch
Distribution: linux
Posts: 69

Original Poster
Rep: Reputation: 2
sure thing. And thanks for checking it out. After looking into it centos does not compile apache with tcpwrapper support. Using fail2ban would not work in this case. Yes I could compile it. However, I worried that once I leave the setup it will not be updated.

Code:
ldd /usr/sbin/httpd|awk '{print $1}'
linux-vdso.so.1
libm.so.6
libpcre.so.0
libselinux.so.1
libaprutil-1.so.0
libcrypt.so.1
libexpat.so.1
libdb-4.7.so
libapr-1.so.0
libpthread.so.0
libc.so.6
libdl.so.2
/lib64/ld-linux-x86-64.so.2
libuuid.so.1
libfreebl3.so
Any suggestions? It would pointless to run fail2ban if wrappers is not running.
 
Old 08-28-2013, 01:49 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by munkz View Post
sure thing.
*With "show us" I mean post the output.


Quote:
Originally Posted by munkz View Post
After looking into it centos does not compile apache with tcpwrapper support. Using fail2ban would not work in this case.
You shouldn't use tcp_wrappers anyway. Iptables (particularly now fail2ban can use ipset!) would be the least resource-intensive way to go: https://www.linuxquestions.org/quest...iptables-3036/
 
1 members found this post helpful.
  


Reply

Tags
apache, fail2ban, http, https, python



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Quirky VSFTPD.CONF - cannot jail users linuxman2013 Linux - Software 13 04-07-2013 10:26 AM
Fail2ban noscript jail is banning googlebot...should I make an exception? sneakyimp Linux - Security 4 12-08-2012 01:01 PM
fail2ban log errors for ssh jail linuxlover.chaitanya Linux - Security 2 07-24-2010 07:01 AM
Fail2Ban Question nomb Debian 0 05-21-2007 07:28 AM
chroot jail question f1uke Linux - Security 3 11-10-2003 12:14 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 01:43 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration