solved - fail2ban problem w/ apache logfiles?

**fulltilt** · Jul 1st 2014

debian wheezy

after reboot because of a kernel and php update, fail2ban wont start ...
it seems it can not handle the apache logfiles or non-existing logfiles
if I disable all apache plugins from fail2ban it starts ... I dont know if this is a problem with the logpath or non-exist logfiles
any idea?

my log path and config:

Code

[apache-overflows]
enabled = true
port = http,https
filter = apache-overflows
logpath = /var/log/apache2/*/error.log
maxretry = 2
findtime = 3600
bantime = 2592000

rockplums · Jul 1st 2014

Can you post the fail2ban log?

**fulltilt** · Jul 1st 2014

this is strange:

Code

tail -f /var/log/fail2ban.log
iptables -F fail2ban-ssh
iptables -X fail2ban-ssh returned 100
2014-07-01 08:03:11,582 fail2ban.jail : INFO Jail 'ssh' stopped
2014-07-01 08:03:11,583 fail2ban.server : INFO Exiting Fail2ban
2014-07-01 08:03:11,946 fail2ban.server : INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.6
2014-07-01 08:03:11,947 fail2ban.jail : INFO Creating new jail 'ssh'
2014-07-01 08:03:11,948 fail2ban.jail : INFO Jail 'ssh' uses Gamin
2014-07-01 08:06:15,099 fail2ban.server : INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.6
2014-07-01 08:06:15,100 fail2ban.jail : INFO Creating new jail 'ssh'
2014-07-01 08:06:15,101 fail2ban.jail : INFO Jail 'ssh' uses Gamin

Display More

rockplums · Jul 1st 2014

please Restart fail2ban and controlling your fail2log.
for error 100 see
http://unix.stackexchange.com/…bian-lenny-moved-ssh-port

**fulltilt** · Jul 1st 2014

what the hack is jail xxx uses gamin?
this is the first time i see this in the F2B logs ...

i can use only this two plugins ... all other apache plugin wont start with fail2ban anymore:

[roundcube]

enabled = true
port = http,https
filter = roundcube
logpath = /var/www/imscp/gui/public/tools/webmail/logs/errors
maxretry = 6

[apache-badbots]

enabled = true
port = http,https
filter = apache-badbots
logpath = /var/log/apache2/*/access.log
maxretry = 1
findtime = 3600
bantime = 2592000

**Nuxwin** · Jul 1st 2014

@fulltilt

Plugins ??? You want surely say "the filters"... What are the filters which doesn't work anymore?. Post them here.

BTW: Post moved in the correct section

**fulltilt** · Jul 1st 2014

Quote from rockplums

please Restart fail2ban and controlling your fail2log.
for error 100 see
http://unix.stackexchange.com/…bian-lenny-moved-ssh-port

no, that is not the reason I have disabled ssh plugin or set to ssh instead of port 2200, I can not start fail2ban with apache plugins enabled ... could this be a problem with the gamin server?

**fulltilt** · Jul 1st 2014

Quote from Nuxwin

@fulltilt

Plugins ??? You want surely say "the filters"... What are the filters which doesn't work anymore?. Post them here.

BTW: Post moved in the correct section

this is just a sample, ALL other apache filters do not work anymore, I posted it here because I do not know if there is a problem with the location of the apache logs

Code

[apache-overflows]enabled = trueport = http,httpsfilter = apache-overflowslogpath = /var/log/apache2/*/error.logmaxretry = 2findtime = 3600bantime = 2592000

Code

# Fail2Ban configuration file
#
# Author: Tim Connors
#
# $Revision$
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
before = apache-common.conf
[Definition]
# Option: failregex
# Notes.: Regexp to catch Apache overflow attempts.
# Values: TEXT
#
failregex = ^%(_apache_error_client)s (Invalid (method|URI) in request|request failed: URI too long|erroneous characters after proto$
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Display More

**fulltilt** · Jul 1st 2014

below is how it looks without any apache logfile, in this case I am able to stop, start and restart fail2ban
if I activate any filter of apache fex. apache overloads or any other with the logpath /var/log/apache2/*/error.log
it wont start or restart, I have to kill all processes by hand and disable the apache filter before I can start F2B.
Before the kernel update I never had any problems with fail2ban ...

Debain Wheezy, Kernel 3.2.0-4-amd64
can anyone confirm this problem?

Code

tail -f /var/log/fail2ban.log
2014-07-01 09:26:59,573 fail2ban.filter : INFO Set findtime = 600
2014-07-01 09:26:59,574 fail2ban.actions: INFO Set banTime = 600
2014-07-01 09:26:59,636 fail2ban.jail : INFO Creating new jail 'proftpd'
2014-07-01 09:26:59,636 fail2ban.jail : INFO Jail 'proftpd' uses Gamin
2014-07-01 09:26:59,637 fail2ban.filter : INFO Added logfile = /var/log/auth.log
2014-07-01 09:26:59,638 fail2ban.filter : INFO Set maxRetry = 3
2014-07-01 09:26:59,639 fail2ban.filter : INFO Set findtime = 600
2014-07-01 09:26:59,640 fail2ban.actions: INFO Set banTime = 600
2014-07-01 09:26:59,656 fail2ban.jail : INFO Jail 'ssh' started
2014-07-01 09:26:59,659 fail2ban.jail : INFO Jail 'proftpd' started

Display More

rockplums · Jul 1st 2014

Quote

below is how it looks without any apache logfile, in this case I am able to stop, start and restart fail2ban

if I activate any filter of apache fex. apache overloads or any other with the logpath /var/log/apache2/*/error.log

it wont start or restart, I have to kill all processes by hand and disable the apache filter before I can start F2B.

Before the kernel update I never had any problems with fail2ban ...

Debain Wheezy, Kernel 3.2.0-4-amd64

can anyone confirm this problem?

Display More

I can not confirm that.
Works without problems.

solved - fail2ban problem w/ apache logfiles?

Share

Daily visitors