In searching for why fail2ban is not banning patterns, I found that when I run /etc/init.d/fail2ban status it reports over an hour behind my 'date' command.
'date' says its: Tue Mar 18 20:45:02 MST 2014
Output of status returns: Mar 05 19:16:30 fed8 systemd: Starting LSB: Start/Stop fail2ban...
I know my 'date' is correct, why is fail2ban not in sync and how do I fix that? Is there a config option to force it to get the unix command 'date' instead?
Im using fail2ban 8.12 Thanks
EDIT: Added patch from bug report, didnt change things. I should have included the full output. The date is way off as well, almost 2 weeks old? Why is that? It seems the status isnt reporting whats going on the last time I tried to start it? When I do a ps I see that the fail2ban-server is indeed 'running':
root 26430 0.4 0.1 1268652 14820 ? Sl 21:58 0:01 /usr/bin/python /usr/bin/fail2ban-server -b -s /var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail2ban.pid -x /etc/init.d/fail2ban status fail2ban.service - LSB: Start/Stop fail2ban Loaded: loaded (/etc/rc.d/init.d/fail2ban) Active: failed (Result: exit-code) since Wed 2014-03-05 19:26:00 MST; 1 weeks 6 days ago Main PID: 1145 (code=exited, status=0/SUCCESS) CGroup: name=systemd:/system/fail2ban.service Mar 05 19:16:30 fed8 systemd: Starting LSB: Start/Stop fail2ban... Mar 05 19:16:33 fed8 fail2ban: Starting fail2ban: ERROR No section: 'Definition' Mar 05 19:16:33 fed8 fail2ban: ERROR No section: 'Definition' Mar 05 19:16:38 fed8 fail2ban: [ OK ] Mar 05 19:16:38 fed8 systemd: Started LSB: Start/Stop fail2ban. Mar 05 19:26:00 fed8 fail2ban: Stopping fail2ban: ERROR Unable to contact server. Is it running? Mar 05 19:26:00 fed8 fail2ban: [FAILED] Mar 05 19:26:00 fed8 systemd: fail2ban.service: control process exited, code=exited status=255 Mar 05 19:26:00 fed8 systemd: Unit fail2ban.service entered failed state.
EDIT2: I found that I needed to use 'system fail2ban start' rather than using the command line. This fixed the status reporting. The fail2ban log file correctly shows the startup time in sync with the 'date' command now, however it's still not banning. I ran fail2ban-regex on the last pattern I saw in my file and it should have picked it up but did not.
EDIT3: I still cant figure out why it wont ban patterns. fail2ban-regex is catching my patterns properly when I run it manually. The only other thing I found in another post is that someone suggested running 'system iptables status' which produced:
163 ROOT fed8 /etc/fail2ban service iptables status Redirecting to /bin/systemctl status iptables.service iptables.service - IPv4 firewall with iptables Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled) Active: inactive (dead) start condition failed at Sun 2014-03-23 18:23:40 MST; 3s ago Mar 23 18:23:40 fed8 systemd: Started IPv4 firewall with iptables.
Now my question is, if this is the reason its not running, WHY? isnt iptables just called directly by fail2ban to ban/unban stuff? Ive never run iptables as a service. I run it directly out of /etc/rc.local. If this isnt the issue, can anyone tell me why this thing fails to ban?? Im beginning to wonder if its not easier to write my own banning program so at least I know I can count on it rather than having to check that this thing is still catching patterns from day to day! So frustrating. I got other work to do than babysit fail2ban. Im quickly losing faith in it.