Hi Ken,
maybe fail2ban was upgraded recently on your machine? My ubuntu 16.04
machine (fail2ban version 0.9.3-1) won't read config files too unless I
hand it a full path. This however works for me:
$ cd /etc.fail2ban/filters.d
$ fail2ban-regex /var/log/whatever.log $PWD/myfilter.conf
Kind regards,
Tom
On 20-10-17 00:08, Ken Johnson wrote:
> Hello,
>
> fail2ban-regex seems to have changed how it works, and I am baffled why.
>
> It worked differently, I think, prior to last system restart.
>
> Previously, if my current working directory was the location of the
> filter conf file, I could specify the filter file by name alone.
> Now, I need to specify the full path to the filter file.
>
> It doesn't seem to matter which filter file I use from this directory.
>
> Running as root, on files owned by root. 'more' can open the file,
> why not fail2ban-regex?
>
> Suggestions?
>
> Thanks.
>
> Ken
>
>
> =============== session grab begins ================
> root@newmail:/etc/fail2ban/filter.d# whoami
> root
> root@newmail:/etc/fail2ban/filter.d# ls -la
> total 40
> drwxr-xr-x 4 root root 4096 Oct 19 15:54 .
> drwxr-xr-x 6 root root 4096 Oct 19 15:25 ..
> -rw-r--r-- 1 root root 263 Oct 19 14:26 apache-404.conf
> -rw-r--r-- 1 root root 252 Oct 19 14:30 apache-408.conf
> -rw-r--r-- 1 root root 340 Oct 19 14:38 apache-any-error.conf
> -rw-r--r-- 1 root root 321 Oct 19 15:48 apache-badmethod.conf
> -rw-r--r-- 1 root root 268 Oct 19 14:31 apache-OpenVAS.conf
> -rw-r--r-- 1 root root 393 Oct 19 14:35 apache-proxy.conf
> drwxr-xr-x 2 root root 4096 Oct 19 15:44 dist-confs
> drwxr-xr-x 2 root root 4096 Oct 18 15:40 ignorecommands
> root@newmail:/etc/fail2ban/filter.d# more apache-404.conf
> # Fail2Ban Configuration File
> #
> # apache-404
> #
> # Author: Ken Johnson
> # Revision: 16 Sep 2016
> # 19 Oct 2017 - for new mailserver
> #
> # Match failed requests
> #
> #
> [Definition]
>
> failregex = ^<HOST> \S* \S* \[.*\] "(GET|POST|HEAD).*" 404 .*$
>
> root@newmail:/etc/fail2ban/filter.d# fail2ban-regex -v /root/alog/a1.log
> apache-404.conf
>
> Running tests
> =============
>
> Use failregex file : apache-404.conf
> ERROR: failed to read apache-404.conf
> root@newmail:/etc/fail2ban/filter.d#
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Fail2ban-users mailing list
> Fail2ban-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
