1

I have just installed fail2ban on my debian7 machine but whenever i start it i get a lot of error which seems to be about python?

[....] Restarting authentication failure monitor: fail2banTraceback (most recent call last):
  File "/usr/bin/fail2ban-client", line 404, in <module>
    if client.start(sys.argv):
  File "/usr/bin/fail2ban-client", line 373, in start
    return self.__processCommand(args)
  File "/usr/bin/fail2ban-client", line 183, in __processCommand
    ret = self.__readConfig()
  File "/usr/bin/fail2ban-client", line 378, in __readConfig
    ret = self.__configurator.getOptions()
  File "/usr/share/fail2ban/client/configurator.py", line 68, in getOptions
    return self.__jails.getOptions(jail)
  File "/usr/share/fail2ban/client/jailsreader.py", line 67, in getOptions
    ret = jail.getOptions()
  File "/usr/share/fail2ban/client/jailreader.py", line 73, in getOptions
    self.__opts = ConfigReader.getOptions(self, self.__name, opts)
  File "/usr/share/fail2ban/client/configreader.py", line 87, in getOptions
    v = self.get(sec, option[1])
  File "/usr/lib/python2.7/ConfigParser.py", line 623, in get
    return self._interpolate(section, option, value, d)
  File "/usr/lib/python2.7/ConfigParser.py", line 691, in _interpolate
    self._interpolate_some(option, L, rawval, section, vars, 1)
  File "/usr/lib/python2.7/ConfigParser.py", line 723, in _interpolate_some
    option, section, rest, var)
ConfigParser.InterpolationMissingOptionError: Bad value substitution:
        section: [pam-generic]
        option : action
        key    : action_mwl
        rawval :

 failed!

I'm not really sure how to debug this one as i have zero knowledge with python but I'm still assuming that it is just something that i have missed during installation or something on the jail.conf. This is my jail.conf:

[DEFAULT]
ignoreip  = 127.0.0.1
bantime   = 18000
destemail = [email protected]
banaction = iptables-multiport
action    = %(action_mwl)s

# JAILS
[ssh]
enabled   = true
port      = 7463
action    = iptables
filter    = sshd
logpath   = /var/log/auth.log
maxretry  = 3

[pam-generic]
enabled   = true
banaction = iptables-allports

[ssh-ddos]
enabled   = true

[nginx-auth]
enabled = true
filter = nginx-auth
action = iptables-multiport[name=NoAuthFailures, port="http,https"]
logpath = /var/log/nginx*/*error*.log
bantime = 600
maxretry = 6

[nginx-login]
enabled = true
filter = nginx-login
action = iptables-multiport[name=NoLoginFailures, port="http,https"]
logpath = /var/log/nginx*/*access*.log
bantime = 600
maxretry = 6

[nginx-badbots]
enabled  = true
filter = apache-badbots
action = iptables-multiport[name=BadBots, port="http,https"]
logpath = /var/log/nginx*/*access*.log
bantime = 86400 # 1 day
maxretry = 1

[nginx-noscript]
enabled = true
action = iptables-multiport[name=NoScript, port="http,https"]
filter = nginx-noscript
logpath = /var/log/nginx*/*access*.log
maxretry = 6
bantime  = 86400 # 1 day

I already made filters for nginx-auth, nginx-login, nginx-proxy and nginx-noscript on /filters.d/

I have Python 2.7.3 installed too.

3 Answers 3

3

From what I can see in your config file and the error you get, the action option for [pam-generic] cannot use the default value (there's no action declare in the section):

ConfigParser.InterpolationMissingOptionError: Bad value substitution:
    section: [pam-generic]
    option : action
    key    : action_mwl
    rawval :

I do not know what would be a good value for it but I would dig in that direction. Worst case if you need only to filter nginx you could remove that section and test if it starts.

1

The key "action_mwl" is not defined in your jail.conf.

In the default jail.conf (at least on Ubuntu) it is defined. It is advised to leave jail.conf as it is, and put your own definitions in jail.local.

action_mwl from stock jail.conf (Ubuntu 12.04):

action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
               %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
1

you have not defined in section [pam-generic] following:

filter
logpath

Filter will be default, action_mwl, but logpath is not default.

logpath is log, where fail2ban finding anomalies, and is mandatory for every section in jail.conf.

The same problem will be in [ssh-ddos].

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .