Your message dated Sat, 16 Nov 2013 22:45:12 -0500
with message-id <[email protected]>
and subject line if anything it is some other bug but not this one
has caused the Debian Bug report #449465,
regarding fail2ban misses repeated ssh cracking attempt
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
449465: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449465
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: fail2ban
Version: 0.8.1-2
Severity: normal
Might warrant higher severity if my analysis is correct and the
problem is general. However, it only arises when clocks change.
On Nov 4 my logs show the same rhost attempting to login via ssh every
3 seconds from 01:44:30 through 02:00:09. At that point, fail2ban's
log shows it blocked the offending IP.
In my timezone, clocks moved back an hour on Nov 4 02:00.
I strongly suspect that fail2ban is using the nominal time to
determine when it should wake up. So, the first time the clock moved
from 1am to 2am, it recorded that it should wake up shortly after 2am.
This meant it went to sleep for an hour, from the second 01:00 to
02:00.
It's possible there might be issues when clocks move forward as well.
-- System Information:
Debian Release: lenny/sid
APT prefers testing
APT policy: (990, 'testing'), (990, 'stable'), (50, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.18-5-686 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages fail2ban depends on:
ii iptables 1.3.8.0debian1-1 administration tools for packet fi
ii lsb-base 3.1-24 Linux Standard Base 3.1 init scrip
ii python 2.4.4-6 An interactive high-level object-o
ii python-central 0.5.15 register and build utility for Pyt
fail2ban recommends no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
since it has been a very while since original report and no discussion
has happenned while a lot of upstream development
--
Yaroslav O. Halchenko, Ph.D.
http://neuro.debian.net http://www.pymvpa.org http://www.fail2ban.org
Senior Research Associate, Psychological and Brain Sciences Dept.
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
Phone: +1 (603) 646-9834 Fax: +1 (603) 646-1419
WWW: http://www.linkedin.com/in/yarik
--- End Message ---
