☰

由于控制进程出现错误退出，fail2ban.service 任务失败

tag-icon • tag-icon ssh apache2 sendmail fail2ban
由于控制进程出现错误退出，fail2ban.service 任务失败

我在一台机器上启动 fail2ban 时遇到了一个基本问题。我有一台今天刚安装好 Ubuntu 16.04 的机器，我正在按照来自源代码的 fail2ban 的各种说明进行操作，例如这，这，这， 和这（我关注了几个，以便相互参考，因为官方 fail2ban 常见问题解答（为了公平起见，我也进行了交叉引用）似乎已经过时了，因为它指的是 fail2ban 0.8（并且没有针对 Ubuntu 的特定说明），而我有 0.9.3：

$ fail2ban-client --version
Fail2Ban v0.9.3

Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors
Copyright of modifications held by their respective authors.
Licensed under the GNU General Public License v2 (GPL).

Written by Cyril Jaquier <[email protected]>.
Many contributions by Yaroslav O. Halchenko <[email protected]>.

我通过以下方式安装了 fail2ban

sudo apt-get install fail2ban

还有 sendmail，大概可以用于发送电子邮件。

$ sudo apt-get install sendmail
Reading package lists... Done
Building dependency tree       
Reading state information... Done
sendmail is already the newest version (8.15.2-3).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

按照上述指南中的说明，我将文件复制/etc/fail2ban/jail.conf到中/etc/fail2ban/jail.local，注释掉所有行，然后只更改了中的以下四项/etc/fail2ban/jail.local。（下面，我粘贴了 vim 中显示的行号，这可能有助于检查您是否有类似的 jail 文件。）

(1) 我将最大重试次数改为 3 次，这样在系统阻止用户 ssh 之前应该有 3 次尝试失败。

 65 # # "maxretry" is the number of failures before a host get banned.
 66 maxretry = 3

(2) 和 (3)：我更改了这两项，第一项用我的个人电子邮件（即[mypersonalemail]），另一项用计算机名称。我只输入了“ComputerName”——这里用电子邮件会更好吗？

129 destemail = [mypersonalemail]
130 
131 # # Sender email address used solely for some actions
132 sender = ComputerName

（4）最后，我将动作改为更具表现力的动作，因此它会发出电子邮件通知。

201 # # Choose default action.  To change, just override value of 'action' with the
202 # # interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
203 # # globally (section [DEFAULT]) or per specific section
204 action = %(action_mwl)s

这样，下一步似乎是以某种方式启动服务。我对在这里获取花哨的正则表达式或自定义监狱或摆弄 IP 表不感兴趣。此时，我感兴趣的只是启动服务，并通过使用故意设置的错误密码反复 ssh 进入机器来测试它。

不幸的是，当我尝试启动该服务时，出现错误：

$ sudo service fail2ban start
Job for fail2ban.service failed because the control process exited with error code. See "systemctl status fail2ban.service" and "journalctl -xe" for details.

输出（computer-name是机器的名称）：

$ systemctl status fail2ban.service
● fail2ban.service - Fail2Ban Service
   Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
   Active: failed (Result: start-limit-hit) since Fri 2018-12-07 17:03:55 PST; 29s ago
     Docs: man:fail2ban(1)
  Process: 21838 ExecStart=/usr/bin/fail2ban-client -x start (code=exited, status=255)
 Main PID: 6381 (code=killed, signal=TERM)
Dec 07 17:03:55 computer-name systemd[1]: Failed to start Fail2Ban Service.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Unit entered failed state.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Failed with result 'exit-code'.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Service hold-off time over, scheduling restart.
Dec 07 17:03:55 computer-name systemd[1]: Stopped Fail2Ban Service.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Start request repeated too quickly.
Dec 07 17:03:55 computer-name systemd[1]: Failed to start Fail2Ban Service.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Unit entered failed state.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Failed with result 'start-limit-hit'.

和

$ journalctl -xe
Dec 07 17:03:55 computer-name systemd[1]: Failed to start Fail2Ban Service.
-- Subject: Unit fail2ban.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit fail2ban.service has failed.
-- 
-- The result is failed.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Unit entered failed state.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Failed with result 'exit-code'.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Service hold-off time over, scheduling restart.
Dec 07 17:03:55 computer-name systemd[1]: Stopped Fail2Ban Service.
-- Subject: Unit fail2ban.service has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit fail2ban.service has finished shutting down.
Dec 07 17:03:55 computer-name systemd[1]: Starting Fail2Ban Service...
-- Subject: Unit fail2ban.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit fail2ban.service has begun starting up.
Dec 07 17:03:55 computer-name fail2ban-client[21838]: ERROR  Failed during configuration: File contains no section headers.
Dec 07 17:03:55 computer-name fail2ban-client[21838]: file: '/etc/fail2ban/jail.local', line: 66
Dec 07 17:03:55 computer-name fail2ban-client[21838]: 'maxretry = 3\n'
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Control process exited, code=exited status=255
Dec 07 17:03:55 computer-name systemd[1]: Failed to start Fail2Ban Service.
-- Subject: Unit fail2ban.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit fail2ban.service has failed.
-- 
-- The result is failed.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Unit entered failed state.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Failed with result 'exit-code'.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Service hold-off time over, scheduling restart.
Dec 07 17:03:55 computer-name systemd[1]: Stopped Fail2Ban Service.
-- Subject: Unit fail2ban.service has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit fail2ban.service has finished shutting down.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Start request repeated too quickly.
Dec 07 17:03:55 computer-name systemd[1]: Failed to start Fail2Ban Service.
-- Subject: Unit fail2ban.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit fail2ban.service has failed.
-- 
-- The result is failed.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Unit entered failed state.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Failed with result 'start-limit-hit'.
Dec 07 17:04:32 computer-name org.gtk.vfs.Daemon[1529]: ** (process:3758): WARNING **: Couldn't create directory monitor on smb://x-gnome-

有人能给出一些建议吗？谢谢。

PS:还有一些类似的问题：

  • 这个sendmail/postfix 似乎存在问题，但我已经安装了 sendmail，这应该足够了？
  • 这个类似，但重点关注 apache2，而我重点关注 fail2ban 而不关心 apache2。

答案1

我也遇到了这个问题。首先，我运行了以下命令：

sudo fail2ban-client -vvv -x start

我收到此错误：

ERROR  There is no directory /var/run/fail2ban to contain the socket file /var/run/fail2ban/fail2ban.sock.

之后，我运行以下命令创建了丢失的目录，一切运行正常。

sudo mkdir /var/run/fail2ban

相关内容