[SOLVED] slackware 14.1, fail2ban 0.9.1, daily segfault

af7567 · 12-13-2014, 11:11 PM

Since upgrading fail2ban from 0.9.0 to 0.9.1 it is crashing every day. It looks like the segfault happens while it is adding some info about a blocked ssh attack to a database. Has anyone seen this before and knows of a fix? Or do I need to do a bit more debugging to find out what's really causing it?

Code:

Dec 12 19:16:43 dialbox sshd[8180]: Failed password for root from 61.174.51.214 port 42422 ssh2
Dec 12 19:16:43 dialbox sshd[8176]: Failed password for root from 61.174.51.214 port 42114 ssh2
Dec 12 19:16:43 dialbox kernel: [2518969.725173] fail2ban-server[6883]: segfault at 1e ip b6d10354 sp b62fdcbc error 4 in libsqlite3.so.0.8.6[b6d03000+b2000]
Dec 12 19:16:43 dialbox sshd[8174]: Failed password for root from 61.174.51.214 port 42052 ssh2
Dec 12 19:16:43 dialbox sshd[8172]: Failed password for root from 61.174.51.214 port 41864 ssh2
Dec 12 19:16:43 dialbox sshd[8180]: Failed password for root from 61.174.51.214 port 42422 ssh2

Code:

2014-12-12 19:16:40,489 fail2ban.filter         [6787]: INFO    [sshd] Found 61.174.51.214
2014-12-12 19:16:40,493 fail2ban.filter         [6787]: INFO    [sshd] Found 61.174.51.214
2014-12-12 19:16:40,494 fail2ban.filter         [6787]: INFO    [sshd] Found 61.174.51.214
2014-12-12 19:16:40,498 fail2ban.filter         [6787]: INFO    [sshd] Found 61.174.51.214
2014-12-12 19:16:41,451 fail2ban.actions        [6787]: NOTICE  [sshd] Ban 61.174.51.214
2014-12-12 19:16:42,861 fail2ban.filter         [6787]: INFO    [sshd] Found 61.174.51.214
2014-12-12 19:16:42,862 fail2ban.filter         [6787]: INFO    [sshd] Found 61.174.51.214
2014-12-12 19:16:42,863 fail2ban.filter         [6787]: INFO    [sshd] Found 61.174.51.214
2014-12-12 19:16:42,864 fail2ban.filter         [6787]: INFO    [sshd] Found 61.174.51.214
2014-12-12 19:16:42,868 fail2ban.filter         [6787]: INFO    [sshd] Found 61.174.51.214

unSpawn · 12-14-2014, 04:33 AM

It's a known issue and the fail2ban maintainer stated it's a problem with either sqlite3 or python bindings, not fail2ban. Since slackware neither provides a public bug tracker or fixes this itself you'll have to track upstream bug trackers for fixes yourself.

af7567 · 12-15-2014, 02:52 PM

It is still a bit early to tell if I have fixed it, but after installing fail2ban GIT master it hasn't crashed in more than 24 hours for the first time since installing 0.9.1.

This could be the fix: https://github.com/fail2ban/fail2ban/pull/839

It looks like there is still a bug in sqlite but with this change to fail2ban it doesn't get as far as causing sqlite to crash.