0

Working on Centos 6.3 ,fail2ban version 0.9.6, fail2ban is unable to write in iptables rules after start and nothing relating to f2b chain seen in iptables -L, I have configured it on local VM and it works like a charm, however on this server, it generates logs which are making me go crazy for 2 days now, Please see logs, seems to me as if it is unable to write rules in iptables, wonder how to fix this :O P.S Jails have been tested and verified. Any help in this regard will be so grateful. Thanks in advance

iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

service fail2ban status

fail2ban-server (pid  30663) is running...
Status
|- Number of jail:      2
`- Jail list:   opensips, ssh-iptables

fail2ban Logs

Feb 20 19:14:05 server-1 fail2ban.server[21215]: INFO Changed logging target to SYSLOG (/dev/log) for Fail2ban v0.9.6
Feb 20 19:14:05 server-1 fail2ban.database[21215]: INFO Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
Feb 20 19:14:05 server-1 fail2ban.jail[21215]: INFO Creating new jail 'ssh-iptables'
Feb 20 19:14:05 server-1 fail2ban.jail[21215]: INFO Jail 'ssh-iptables' uses pyinotify {}
Feb 20 19:14:05 server-1 fail2ban.jail[21215]: INFO Initiated 'pyinotify' backend
Feb 20 19:14:05 server-1 fail2ban.filter[21215]: INFO Added logfile = /var/log/secure
Feb 20 19:14:05 server-1 fail2ban.filter[21215]: INFO Set maxRetry = 2
Feb 20 19:14:05 server-1 fail2ban.filter[21215]: INFO Set jail log file encoding to UTF-8
Feb 20 19:14:05 server-1 fail2ban.actions[21215]: INFO Set banTime = 60
Feb 20 19:14:05 server-1 fail2ban.filter[21215]: INFO Set findtime = 600
Feb 20 19:14:05 server-1 fail2ban.filter[21215]: INFO Set maxlines = 10
Feb 20 19:14:05 server-1 fail2ban.server[21215]: INFO Jail ssh-iptables is not a JournalFilter instance
Feb 20 19:14:05 server-1 fail2ban.jail[21215]: INFO Creating new jail 'opensips'
Feb 20 19:14:05 server-1 fail2ban.jail[21215]: INFO Jail 'opensips' uses pyinotify {}
Feb 20 19:14:05 server-1 fail2ban.jail[21215]: INFO Initiated 'pyinotify' backend
Feb 20 19:14:05 server-1 fail2ban.filter[21215]: INFO Added logfile = /var/log/messages
Feb 20 19:14:05 server-1 fail2ban.filter[21215]: INFO Set maxRetry = 2
Feb 20 19:14:05 server-1 fail2ban.filter[21215]: INFO Set jail log file encoding to UTF-8
Feb 20 19:14:05 server-1 fail2ban.actions[21215]: INFO Set banTime = 60
Feb 20 19:14:05 server-1 fail2ban.filter[21215]: INFO Set findtime = 600
Feb 20 19:14:05 server-1 fail2ban.jail[21215]: INFO Jail 'ssh-iptables' started
Feb 20 19:14:05 server-1 fail2ban.jail[21215]: INFO Jail 'opensips' started
Feb 20 19:14:06 server-1 fail2ban.action[21215]: ERROR iptables  -N f2b-SSH#012iptables  -A f2b-SSH -j RETURN#012iptables  -I INPUT -p tcp -j f2b-SSH -- stdout: ''
Feb 20 19:14:06 server-1 fail2ban.action[21215]: ERROR iptables  -N f2b-SSH#012iptables  -A f2b-SSH -j RETURN#012iptables  -I INPUT -p tcp -j f2b-SSH -- stderr: "iptables v1.4.7: can't initialize iptables table `filter': Permission denied\nPerhaps iptables or your kernel needs to be upgraded.\niptables v1.4.7: can't initialize iptables table `filter': Permission denied\nPerhaps iptables or your kernel needs to be upgraded.\niptables v1.4.7: can't initialize iptables table `filter': Permission denied\nPerhaps iptables or your kernel needs to be upgraded.\n"
Feb 20 19:14:06 server-1 fail2ban.action[21215]: ERROR iptables  -N f2b-SSH#012iptables  -A f2b-SSH -j RETURN#012iptables  -I INPUT -p tcp -j f2b-SSH -- returned 3
Feb 20 19:14:06 server-1 fail2ban.actions[21215]: ERROR Failed to start jail 'ssh-iptables' action 'iptables-allports': Error starting action
Feb 20 19:14:06 server-1 fail2ban.action[21215]: ERROR iptables  -N f2b-opensips#012iptables  -A f2b-opensips -j RETURN#012iptables  -I INPUT -p all -j f2b-opensips -- stdout: ''
Feb 20 19:14:06 server-1 fail2ban.action[21215]: ERROR iptables  -N f2b-opensips#012iptables  -A f2b-opensips -j RETURN#012iptables  -I INPUT -p all -j f2b-opensips -- stderr: "iptables v1.4.7: can't initialize iptables table `filter': Permission denied\nPerhaps iptables or your kernel needs to be upgraded.\niptables v1.4.7: can't initialize iptables table `filter': Permission denied\nPerhaps iptables or your kernel needs to be upgraded.\niptables v1.4.7: can't initialize iptables table `filter': Permission denied\nPerhaps iptables or your kernel needs to be upgraded.\n"
Feb 20 19:14:06 server-1 fail2ban.action[21215]: ERROR iptables  -N f2b-opensips#012iptables  -A f2b-opensips -j RETURN#012iptables  -I INPUT -p all -j f2b-opensips -- returned 3
Feb 20 19:14:06 server-1 fail2ban.actions[21215]: ERROR Failed to start jail 'opensips' action 'iptables-allports': Error starting action
  • 2
    Is the server an OpenVZ container? – jordanm Feb 21 '17 at 14:52
  • Its a physical machine – Haseeb Feb 22 '17 at 7:23
  • This line also appears in the log now: <27>fail2ban.CommandAction[17242]: ERROR Invariant check failed. Trying to restore a sane environment – Haseeb Feb 22 '17 at 9:51
  • Update the system. – Michael Hampton Mar 6 '17 at 8:53
  • The issue is solved by changing python version, no need to update the system. – Haseeb Mar 7 '17 at 9:36
1

The problem was in python version.. I edited /usr/bin/fail2ban-client and /usr/bin/fail2ban-server with correct path("whereis python" gives you paths) in the top line as

!/usr/bin/python2.6 -Es

which was previously

!/usr/bin/python -Es (older version of python),

Due to this older version's compilation, fail2ban was unable to write iptables rules. Started fail2ban using command: fail2ban-client start

Now it is running and blocking unwanted IP's

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.