Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is my specific problem I need to solve (But my question is different, so please read on even if you don't know what fail2ban is):

I'm trying to use fail2ban on a linux server to ban brute force attacks on multiple services (ssh, dovecot, apache, postfix, ...). Now I stumbled over the problem that fail2ban seems to execute multiple iptables commands at the same time (with threads in Python) and this fails pretty often (Especially on startup) where iptables returns "Resource temporarily unavailable." errors.

I want to workaround these problems by "synchronizing" calls to iptables. I'm searching for a program which creates some mutex/lock file and only if this file could be created then it starts the real command and removes the mutex file after the command has finished. If the mutex file is already there then the program waits until the mutex file is gone and then tries to aquire it.

With such a command I could configure the iptables-actions in fail2ban to wait for each other so they don't execute at the same time.

I'm pretty sure there is already such a program out there so I don't have to write this on my own. But so far I haven't found it.

share|improve this question
can you not just make fail2ban call a script that runs the iptables command, and put a random sleep time of 1-5 seconds into the script ? – Sirex Sep 13 '11 at 9:43
@Sirex: That wouldn't be reliable, but you could expand your idea so that the script checks if it can work, and if not, delays a random time and try again, repeated until success. – Sven Sep 13 '11 at 9:47
well, i've had success with similar situations where rate limiting comes in by splaying the hits over a period with a random sleep amount. It'd need a little error checking etc, but it should work. Users own flock answer is better though. should have thought of that really ;-p random sleeps works better for multiple clients talking to one server. – Sirex Sep 13 '11 at 12:11
up vote 6 down vote accepted

Found it myself. The command I was looking for is called flock. I was able to solve my problem by wrapping all iptables calls in /etc/fail2ban/action.d/iptables-multiport.conf like this:

flock /var/lock/fail2ban -c "iptables -N fail2ban-<name>"

Now fail2ban starts correctly every time.

share|improve this answer
Adding a wait timeout might be a good idea. – symcbean Sep 13 '11 at 12:13

From what i could make out , using flock is the most scalable way , especially when you are working in a bash script where you have a very limited range of builtin functions to fall back on. kayahr's answer really saved a lot of time for me since I was having the same problem running iptables commands in parallel.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.