![我尝试在 fail2ban 中启用后缀过滤,但 systemd 不允许它启动](https://linux22.com/image/1147471/%E6%88%91%E5%B0%9D%E8%AF%95%E5%9C%A8%20fail2ban%20%E4%B8%AD%E5%90%AF%E7%94%A8%E5%90%8E%E7%BC%80%E8%BF%87%E6%BB%A4%EF%BC%8C%E4%BD%86%20systemd%20%E4%B8%8D%E5%85%81%E8%AE%B8%E5%AE%83%E5%90%AF%E5%8A%A8.png)
systemctl status fail2ban.service
* fail2ban.service - Fail2Ban Service
Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
Active: inactive (dead) (Result: exit-code) since Wed 2017-05-10 05:36:32 EDT; 7s ago
Docs: man:fail2ban(1)
Process: 3157 ExecStop=/usr/bin/fail2ban-client stop (code=exited, status=0/SUCCESS)
Process: 3318 ExecStart=/usr/bin/fail2ban-client -x start (code=exited, status=255)
Main PID: 3135 (code=exited, status=0/SUCCESS)
May 10 05:36:31 lynch-family systemd[1]: Failed to start Fail2Ban Service.
May 10 05:36:31 lynch-family systemd[1]: fail2ban.service: Unit entered failed state.
May 10 05:36:31 lynch-family systemd[1]: fail2ban.service: Failed with result 'exit-code'.
May 10 05:36:32 lynch-family systemd[1]: fail2ban.service: Service hold-off time over, scheduling restart.
May 10 05:36:32 lynch-family systemd[1]: Stopped Fail2Ban Service.
May 10 05:36:32 lynch-family systemd[1]: fail2ban.service: Start request repeated too quickly.
May 10 05:36:32 lynch-family systemd[1]: Failed to start Fail2Ban Service.
和
journalctl-xe
-- Unit fail2ban.service has finished shutting down.
May 10 05:35:04 lynch-family systemd[1]: fail2ban.service: Start request repeated too quickly.
May 10 05:35:04 lynch-family systemd[1]: Failed to start Fail2Ban Service.
-- Subject: Unit fail2ban.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit fail2ban.service has failed.
--
-- The result is failed.
(删除了大量 mail.log 行)
这是运行服务 fail2ban 启动或重新启动。如果我禁用 postfix,它就会工作:jail.local 的相关部分:
[postfix]
enabled = true
port = smtp,465,submission
logpath = %(postfix_log)s
有什么想法吗?谢谢。
答案1
我在 Ubuntu 16.04 LTS 上使用新版本的 Fail2Ban Monitor 时也遇到了同样的问题
通过新的更新,他们对配置进行了更详细的结构化处理。
但是当你启动一个服务时失败2ban然后你会得到详细的输出系统日志类似这样的
Nov 2 02:05:16 xost fail2ban-client[3171]: ERROR No file(s) found for glob /var/log/mail.warn
Nov 2 02:05:16 xost fail2ban-client[3171]: ERROR Failed during configuration: Have not found any log file for postfix jail
或者像这样
Nov 2 02:28:35 xost fail2ban-client[9365]: ERROR Failed during configuration: Bad value substitution: option 'logpath' in section 'sshd' contains an interpolation key 'syslog_authpriv' which is not a valid option name. Raw value: '%(sshd_log)s'
Nov 2 02:28:35 xost systemd[1]: fail2ban.service: Control process exited, code=exited status=255
Nov 2 02:28:35 xost systemd[1]: Failed to start Fail2Ban Service.
只要确保填写了所有变量即可。
在 jail.conf 中放入适当的 vars 文件:
[INCLUDES]
before = paths-common.conf
并在此文件中检查您要监视的所有日志是否均已显示
# There is no sensible generic defaults for syslog log targets, thus
# leaving them empty here so that no errors while parsing/interpolating configs
syslog_daemon =
syslog_ftp = /var/log/proftpd/proftpd.log
syslog_local0 =
syslog_mail_warn = /var/log/mail.log
syslog_user =
在我的例子中,由于我希望监控后缀和proftpd我必须把他们的日志的路径
答案2
我找到了问题所在。我将日志路径设置为
/var/log/mail.log
,现在一切正常。我搜索了一个名为的变量 (?)postfix_log
,但我找不到它的定义。
—— 问题中被 OP 标记为已解决。