up vote 1 down vote favorite
share [g+] share [fb]

This is my specific problem I need to solve (But my question is different, so please read on even if you don't know what fail2ban is):

I'm trying to use fail2ban on a linux server to ban brute force attacks on multiple services (ssh, dovecot, apache, postfix, ...). Now I stumbled over the problem that fail2ban seems to execute multiple iptables commands at the same time (with threads in Python) and this fails pretty often (Especially on startup) where iptables returns "Resource temporarily unavailable." errors.

I want to workaround these problems by "synchronizing" calls to iptables. I'm searching for a program which creates some mutex/lock file and only if this file could be created then it starts the real command and removes the mutex file after the command has finished. If the mutex file is already there then the program waits until the mutex file is gone and then tries to aquire it.

With such a command I could configure the iptables-actions in fail2ban to wait for each other so they don't execute at the same time.

I'm pretty sure there is already such a program out there so I don't have to write this on my own. But so far I haven't found it.

link|improve this question
100% accept rate
can you not just make fail2ban call a script that runs the iptables command, and put a random sleep time of 1-5 seconds into the script ? – Sirex Sep 13 '11 at 9:43
@Sirex: That wouldn't be reliable, but you could expand your idea so that the script checks if it can work, and if not, delays a random time and try again, repeated until success. – SvenW Sep 13 '11 at 9:47
well, i've had success with similar situations where rate limiting comes in by splaying the hits over a period with a random sleep amount. It'd need a little error checking etc, but it should work. Users own flock answer is better though. should have thought of that really ;-p random sleeps works better for multiple clients talking to one server. – Sirex Sep 13 '11 at 12:11
feedback

1 Answer

up vote 5 down vote accepted

Found it myself. The command I was looking for is called flock. I was able to solve my problem by wrapping all iptables calls in /etc/fail2ban/action.d/iptables-multiport.conf like this:

flock /var/lock/fail2ban -c "iptables -N fail2ban-<name>"

Now fail2ban starts correctly every time.

link|improve this answer
1  
Adding a wait timeout might be a good idea. – symcbean Sep 13 '11 at 12:13
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.