fix: fail2ban jail config broken on modern Debian and multi-server setups - #24
Open
rlei-odes wants to merge 1 commit into
Open
fix: fail2ban jail config broken on modern Debian and multi-server setups#24rlei-odes wants to merge 1 commit into
rlei-odes wants to merge 1 commit into
Conversation
Two related bugs in module_fail2ban(): 1. When a web server was detected, both nginx-http-auth and apache-auth jails were always added together. On nginx-only systems (e.g. Passbolt) the apache-auth jail has no log file to watch, causing fail2ban to crash on startup with "Have not found any log file for apache-auth jail". Fix: check for each server independently at the point of writing the jail, so only installed servers get a jail entry. 2. The sshd jail hardcoded logpath = /var/log/auth.log, which does not exist on Debian 12+/13 (Trixie) where systemd-journald handles logging without writing syslog files. fail2ban crashed silently on these systems. Fix: replace logpath with backend = systemd so the sshd jail reads directly from the journal, which is correct on modern Debian/Ubuntu.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two separate issues found while running the script on a Debian 13 server, both causing fail2ban to fail on startup.
1.
/var/log/auth.logdoesn't exist on Debian 12+The sshd jail config had
logpath = /var/log/auth.log. On Debian 12 and 13, systemd-journald handles auth logging and/var/log/auth.logis not created by default. fail2ban starts, can't find the log file, and exits.Fixed by replacing
logpathwithbackend = systemd, which reads SSH auth events directly from the systemd journal. Works on older Debian/Ubuntu too since the journal has always existed alongside auth.log — so this is strictly more portable.2. Both nginx and apache jails get written even if only one is installed
The web server jails were written inside a single
if [[ "${has_web_server}" == "true" ]]block. That flag is set to true if either nginx or apache2 is found. The result: on an nginx-only server, an apache jail pointing at/var/log/apache*/*error.log(which doesn't exist) gets written. fail2ban then refuses to start because it can't find the log path.Fixed by splitting into two separate
command -vchecks — each jail is only written if its corresponding binary is actually present on the system.Both issues were hit in practice on a Debian 13 machine with nginx and no Apache installed.