Hi,
I have recently updated my fail2ban to v0.9.1 on my Ubuntu Server 12.04.5
32bit. I've never had this problem with my old version 0.9.0.
It didn't spit out any error messages that indicate it has stopped running
until I inadvertently check the status of it and found this message:
> $ service fail2ban status
* Status of authentication failure
monitor
ERROR Unable to contact server. Is it running?
* fail2ban is not running but /var/run/fail2ban/fail2ban.sock exists
Initially, I removed the "fail2ban.sock" from /var/run/fail2ban, and it was
running after restarting it. After a few minutes, I went back to check the
status again and it gave me the above message that it has stopped running
but fail2ban.sock exists.
I dug into my fail2ban.log found in /var/log to see if I could get any
clues as to why it stops running.
<snip>
2015-03-10 16:51:00,961 fail2ban.actions [4060]: ERROR Failed to
execute ban jail 'dovecot-pop3imap' action 'iptables-multiport' info
'CallingMap({'ipjailmatches': <function <lambda> at 0xb6d89a04>, 'matches':
u'Jun 25 05:37:04 mail dovecot: pop3-login: Aborted login (auth failed, 1
attempts in 2 secs): user=<a...@mydomain.com>, method=PLAIN,
rip=62.68.248.50, lip=171.10.10.61\nJun 25 05:37:09 mail dovecot:
pop3-login: Aborted login (auth failed, 1 attempts in 6 secs): user=<
abig...@mydomain.com>, method=PLAIN, rip=62.68.248.50,
lip=171.10.10.61\nJun 25 05:37:10 mail dovecot: pop3-login: Aborted login
(auth failed, 1 attempts in 6 secs): user=<abra...@mydomain.com>,
method=PLAIN, rip=62.68.248.50, lip=171.10.10.61\nJun 25 05:37:04 mail
dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs):
user=<a...@mydomain.com>, method=PLAIN, rip=62.68.248.50,
lip=171.10.10.61\nJun 25 05:37:09 mail dovecot: pop3-login: Aborted login
(auth failed, 1 attempts in 6 secs): user=<abig...@mydomain.com>,
method=PLAIN, rip=62.68.248.50, lip=171.10.10.61\nJun 25 05:37:10 mail
dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 6 secs):
user=<abra...@mydomain.com>, method=PLAIN, rip=62.68.248.50,
lip=171.10.10.61', 'ip': '62.68.248.50', 'ipmatches': <function <lambda> at
0xb6d7bfb4>, 'ipfailures': <function <lambda> at 0xb6d89a74>, 'time':
1425966720.346498, 'failures': 6, 'ipjailfailures': <function <lambda> at
0xb6d89924>})': 'NoneType' object has no attribute '__getitem__'
2015-03-10 16:51:01,203 fail2ban.actions [4060]: ERROR Failed to
execute ban jail 'dovecot-pop3imap' action 'sendmail-whois' info
'CallingMap({'ipjailmatches': <function <lambda> at 0xb6d89a04>, 'matches':
u'Jun 25 05:37:04 mail dovecot: pop3-login: Aborted login (auth failed, 1
attempts in 2 secs): user=<a...@mydomain.com>, method=PLAIN,
rip=62.68.248.50, lip=171.10.10.61\nJun 25 05:37:09 mail dovecot:
pop3-login: Aborted login (auth failed, 1 attempts in 6 secs): user=<
abig...@mydomain.com>, method=PLAIN, rip=62.68.248.50,
lip=171.10.10.61\nJun 25 05:37:10 mail dovecot: pop3-login: Aborted login
(auth failed, 1 attempts in 6 secs): user=<abra...@mydomain.com>,
method=PLAIN, rip=62.68.248.50, lip=171.10.10.61\nJun 25 05:37:04 mail
dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs):
user=<a...@mydomain.com>, method=PLAIN, rip=62.68.248.50,
lip=171.10.10.61\nJun 25 05:37:09 mail dovecot: pop3-login: Aborted login
(auth failed, 1 attempts in 6 secs): user=<abig...@mydomain.com>,
method=PLAIN, rip=62.68.248.50, lip=171.10.10.61\nJun 25 05:37:10 mail
dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 6 secs):
user=<abra...@mydomain.com>, method=PLAIN, rip=62.68.248.50,
lip=171.10.10.61', 'ip': '62.68.248.50', 'ipmatches': <function <lambda> at
0xb6d7bfb4>, 'ipfailures': <function <lambda> at 0xb6d89a74>, 'time':
1425966720.346498, 'failures': 6, 'ipjailfailures': <function <lambda> at
0xb6d89924>})': Error binding parameter 0 - probably unsupported type.
2015-03-10 16:51:39,063 fail2ban.actions [4060]: NOTICE
[dovecot-pop3imap] Ban 211.20.234.118
2015-03-10 16:51:40,176 fail2ban.actions [4060]: NOTICE
[dovecot-pop3imap] Ban 211.235.228.43
2015-03-10 16:51:41,469 fail2ban.actions [4060]: NOTICE
[dovecot-pop3imap] Ban 211.43.207.112
2015-03-10 16:51:42,856 fail2ban.actions [4060]: NOTICE
[dovecot-pop3imap] Ban 211.53.206.21
2015-03-10 16:51:44,118 fail2ban.actions [4060]: NOTICE
[dovecot-pop3imap] Ban 212.225.147.204
2015-03-10 16:51:45,614 fail2ban.actions [4060]: NOTICE
[dovecot-pop3imap] Ban 212.67.203.13
2015-03-10 16:51:47,666 fail2ban.actions [4060]: NOTICE
[dovecot-pop3imap] Ban 217.168.156.140
2015-03-10 16:51:49,016 fail2ban.actions [4060]: NOTICE
[dovecot-pop3imap] Ban 218.64.17.234
2015-03-10 16:51:49,768 fail2ban.actions [4060]: NOTICE
[dovecot-pop3imap] Ban 221.215.221.81
2015-03-10 16:51:50,518 fail2ban.actions [4060]: NOTICE
[dovecot-pop3imap] Ban 222.218.142.194
2015-03-10 16:51:51,306 fail2ban.actions [4060]: NOTICE
[dovecot-pop3imap] Ban 222.85.91.55
<snip>
The IP 66.76.93.141 has just been banned by Fail2Ban after
3 attempts against dovecot-imap.\n\n
Here is more information about 66.76.93.141:\n
`/usr/bin/whois 66.76.93.141 || echo missing whois program`\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f fail2...@mydomain.com
itgene...@mydomain.com -- stderr: ''
2015-03-10 16:53:01,856 fail2ban.action [4060]: ERROR printf %b
"Subject: [Fail2Ban] dovecot-pop3imap: banned 66.76.93.141 from `uname -n`
<snip>
I also checked the version of python running on my server and it is v2.7.3.
Thank you in advance
------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the
conversation now. http://goparallel.sourceforge.net/
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users