On installs where iface reported by "route" command is not the same with ifcfg-iface (pxpy instead of enpxsy or ethx) fail2ban will not start. Does not matter if biosdevname=0 or net.ifnames=0 on the kernel line. Tested this on real hardware and on VirualBox too.
From /var/log/messages:
fail2ban-client[2804]: ERROR Directory /var/run/fail2ban exists but not accessible for writing
Fail2ban is ok on any other install.
C. Sava
On Tue, 2013-07-09 at 09:48 +0300, Cristian Sava wrote:
On installs where iface reported by "route" command is not the same with ifcfg-iface (pxpy instead of enpxsy or ethx) fail2ban will not start. Does not matter if biosdevname=0 or net.ifnames=0 on the kernel line. Tested this on real hardware and on VirualBox too.
From /var/log/messages:
fail2ban-client[2804]: ERROR Directory /var/run/fail2ban exists but not accessible for writing
Fail2ban is ok on any other install.
I forgot to add that is about F19 installs.
C.Sava
On Tue, Jul 9, 2013 at 8:51 AM, Cristian Sava csava@central.ucv.ro wrote:
On Tue, 2013-07-09 at 09:48 +0300, Cristian Sava wrote:
On installs where iface reported by "route" command is not the same with ifcfg-iface (pxpy instead of enpxsy or ethx) fail2ban will not start. Does not matter if biosdevname=0 or net.ifnames=0 on the kernel line. Tested this on real hardware and on VirualBox too.
From /var/log/messages:
fail2ban-client[2804]: ERROR Directory /var/run/fail2ban exists but not
accessible for writing
Fail2ban is ok on any other install.
I forgot to add that is about F19 installs.
C.Sava
Hello,
Similar problem here on a F19 x86_64.
$ systemctl status fail2ban
fail2ban.service - Fail2ban Service Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled) Active: failed (Result: start-limit) since Tue 2013-07-09 08:59:40 CEST; 45min ago Process: 1024 ExecStart=/usr/bin/fail2ban-client -x start (code=exited, status=255)
Jul 09 08:59:40 wildcat systemd[1]: fail2ban.service: control process exited, code=exited status=255 Jul 09 08:59:40 wildcat systemd[1]: Failed to start Fail2ban Service. Jul 09 08:59:40 wildcat systemd[1]: Unit fail2ban.service entered failed state. Jul 09 08:59:40 wildcat systemd[1]: fail2ban.service holdoff time over, scheduling restart. Jul 09 08:59:40 wildcat systemd[1]: Stopping Fail2ban Service... Jul 09 08:59:40 wildcat systemd[1]: Starting Fail2ban Service... Jul 09 08:59:40 wildcat systemd[1]: fail2ban.service start request repeated too quickly, refusing to start. Jul 09 08:59:40 wildcat systemd[1]: Failed to start Fail2ban Service. Jul 09 08:59:40 wildcat systemd[1]: Unit fail2ban.service entered failed state.
$ less /var/log/messages Jul 9 08:59:39 localhost fail2ban-client[1024]: ERROR Directory /var/run/fail2ban exists but not accessible for writing Jul 9 08:59:40 localhost systemd[1]: fail2ban.service: control process exited, code=exited status=255 Jul 9 08:59:40 localhost systemd[1]: Failed to start Fail2ban Service. Jul 9 08:59:40 localhost systemd[1]: Unit fail2ban.service entered failed state. ... Jul 9 08:59:40 localhost systemd[1]: fail2ban.service holdoff time over, scheduling restart. Jul 9 08:59:40 localhost systemd[1]: Stopping Fail2ban Service... Jul 9 08:59:40 localhost systemd[1]: Starting Fail2ban Service... Jul 9 08:59:40 localhost systemd[1]: fail2ban.service start request repeated too quickly, refusing to start. Jul 9 08:59:40 localhost systemd[1]: Failed to start Fail2ban Service. Jul 9 08:59:40 localhost systemd[1]: Unit fail2ban.service entered failed state.
-- Marco
On 07/09/13 15:48, sguazt wrote:
On Tue, Jul 9, 2013 at 8:51 AM, Cristian Sava <csava@central.ucv.ro mailto:csava@central.ucv.ro> wrote:
On Tue, 2013-07-09 at 09:48 +0300, Cristian Sava wrote: > On installs where iface reported by "route" command is not the same with > ifcfg-iface (pxpy instead of enpxsy or ethx) fail2ban will not start. > Does not matter if biosdevname=0 or net.ifnames=0 on the kernel line. > Tested this on real hardware and on VirualBox too. > > >From /var/log/messages: > fail2ban-client[2804]: ERROR Directory /var/run/fail2ban exists but not accessible for writing > > Fail2ban is ok on any other install. I forgot to add that is about F19 installs. C.Sava
Hello,
Similar problem here on a F19 x86_64.
$ systemctl status fail2ban
fail2ban.service - Fail2ban Service Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled) Active: failed (Result: start-limit) since Tue 2013-07-09 08:59:40 CEST; 45min ago Process: 1024 ExecStart=/usr/bin/fail2ban-client -x start (code=exited, status=255)
Jul 09 08:59:40 wildcat systemd[1]: fail2ban.service: control process exited, code=exited status=255 Jul 09 08:59:40 wildcat systemd[1]: Failed to start Fail2ban Service. Jul 09 08:59:40 wildcat systemd[1]: Unit fail2ban.service entered failed state. Jul 09 08:59:40 wildcat systemd[1]: fail2ban.service holdoff time over, scheduling restart. Jul 09 08:59:40 wildcat systemd[1]: Stopping Fail2ban Service... Jul 09 08:59:40 wildcat systemd[1]: Starting Fail2ban Service... Jul 09 08:59:40 wildcat systemd[1]: fail2ban.service start request repeated too quickly, refusing to start. Jul 09 08:59:40 wildcat systemd[1]: Failed to start Fail2ban Service. Jul 09 08:59:40 wildcat systemd[1]: Unit fail2ban.service entered failed state.
$ less /var/log/messages Jul 9 08:59:39 localhost fail2ban-client[1024]: ERROR Directory /var/run/fail2ban exists but not accessible for writing Jul 9 08:59:40 localhost systemd[1]: fail2ban.service: control process exited, code=exited status=255 Jul 9 08:59:40 localhost systemd[1]: Failed to start Fail2ban Service. Jul 9 08:59:40 localhost systemd[1]: Unit fail2ban.service entered failed state. ... Jul 9 08:59:40 localhost systemd[1]: fail2ban.service holdoff time over, scheduling restart. Jul 9 08:59:40 localhost systemd[1]: Stopping Fail2ban Service... Jul 9 08:59:40 localhost systemd[1]: Starting Fail2ban Service... Jul 9 08:59:40 localhost systemd[1]: fail2ban.service start request repeated too quickly, refusing to start. Jul 9 08:59:40 localhost systemd[1]: Failed to start Fail2ban Service. Jul 9 08:59:40 localhost systemd[1]: Unit fail2ban.service entered failed state.
Have you checked /var/log/audit/audit.log for AVC (selinux) entries?
On Tue, Jul 9, 2013 at 10:56 AM, Ed Greshko Ed.Greshko@greshko.com wrote:
On 07/09/13 15:48, sguazt wrote:
On Tue, Jul 9, 2013 at 8:51 AM, Cristian Sava <csava@central.ucv.ro<mailto:
csava@central.ucv.ro>> wrote:
On Tue, 2013-07-09 at 09:48 +0300, Cristian Sava wrote: > On installs where iface reported by "route" command is not the
same with
> ifcfg-iface (pxpy instead of enpxsy or ethx) fail2ban will not
start.
> Does not matter if biosdevname=0 or net.ifnames=0 on the kernel
line.
> Tested this on real hardware and on VirualBox too. > > >From /var/log/messages: > fail2ban-client[2804]: ERROR Directory /var/run/fail2ban exists
but not accessible for writing
> > Fail2ban is ok on any other install. I forgot to add that is about F19 installs. C.Sava
Hello,
Similar problem here on a F19 x86_64.
$ systemctl status fail2ban
fail2ban.service - Fail2ban Service Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled) Active: failed (Result: start-limit) since Tue 2013-07-09 08:59:40
CEST; 45min ago
Process: 1024 ExecStart=/usr/bin/fail2ban-client -x start
(code=exited, status=255)
Jul 09 08:59:40 wildcat systemd[1]: fail2ban.service: control process
exited, code=exited status=255
Jul 09 08:59:40 wildcat systemd[1]: Failed to start Fail2ban Service. Jul 09 08:59:40 wildcat systemd[1]: Unit fail2ban.service entered failed
state.
Jul 09 08:59:40 wildcat systemd[1]: fail2ban.service holdoff time over,
scheduling restart.
Jul 09 08:59:40 wildcat systemd[1]: Stopping Fail2ban Service... Jul 09 08:59:40 wildcat systemd[1]: Starting Fail2ban Service... Jul 09 08:59:40 wildcat systemd[1]: fail2ban.service start request
repeated too quickly, refusing to start.
Jul 09 08:59:40 wildcat systemd[1]: Failed to start Fail2ban Service. Jul 09 08:59:40 wildcat systemd[1]: Unit fail2ban.service entered failed
state.
$ less /var/log/messages Jul 9 08:59:39 localhost fail2ban-client[1024]: ERROR Directory
/var/run/fail2ban exists but not accessible for writing
Jul 9 08:59:40 localhost systemd[1]: fail2ban.service: control process
exited, code=exited status=255
Jul 9 08:59:40 localhost systemd[1]: Failed to start Fail2ban Service. Jul 9 08:59:40 localhost systemd[1]: Unit fail2ban.service entered
failed state.
... Jul 9 08:59:40 localhost systemd[1]: fail2ban.service holdoff time
over, scheduling restart.
Jul 9 08:59:40 localhost systemd[1]: Stopping Fail2ban Service... Jul 9 08:59:40 localhost systemd[1]: Starting Fail2ban Service... Jul 9 08:59:40 localhost systemd[1]: fail2ban.service start request
repeated too quickly, refusing to start.
Jul 9 08:59:40 localhost systemd[1]: Failed to start Fail2ban Service. Jul 9 08:59:40 localhost systemd[1]: Unit fail2ban.service entered
failed state.
Have you checked /var/log/audit/audit.log for AVC (selinux) entries?
Yes.
No AVC entry. The only entries I found are: type=SERVICE_START msg=audit(1373353179.495:389): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="fail2ban" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' type=SERVICE_START msg=audit(1373353179.595:390): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="fail2ban" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' type=SERVICE_STOP msg=audit(1373353179.595:391): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="fail2ban" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' type=SERVICE_START msg=audit(1373353180.002:393): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="fail2ban" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' type=SERVICE_START msg=audit(1373353180.102:406): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="fail2ban" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' type=SERVICE_STOP msg=audit(1373353180.102:407): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="fail2ban" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
-- Marco
On 07/09/13 18:19, Cristian Sava wrote:
On Tue, 2013-07-09 at 16:56 +0800, Ed Greshko wrote:
Have you checked /var/log/audit/audit.log for AVC (selinux) entries?
No AVC messages, not selinux related bug. It is a networking subsystem problem.
Well, I find one thing interesting.....
Notice the error message....
fail2ban-client[2804]: ERROR Directory /var/run/fail2ban exists but not accessible for writing
But, if you execute the command in the service file from the command line....
[root@f18x log]# /usr/bin/fail2ban-client -x start 2013-07-09 18:46:10,558 fail2ban.server : INFO Starting Fail2ban v0.8.10 2013-07-09 18:46:10,559 fail2ban.server : INFO Starting in daemon mode
and....
[root@f18x fail2ban]# pwd /var/run/fail2ban [root@f18x fail2ban]# ls fail2ban.pid fail2ban.sock
And if you put selinux in permissive mode....
[root@f18x fail2ban]# pwd /var/run/fail2ban [root@f18x fail2ban]# ls [root@f18x fail2ban]# setenforce 0 [root@f18x fail2ban]# systemctl start fail2ban [root@f18x fail2ban]# ls fail2ban.pid fail2ban.sock
So it is running with selinux placed in permissive mode.....
On Tue, 2013-07-09 at 18:52 +0800, Ed Greshko wrote:
Well, I find one thing interesting.....
Notice the error message....
fail2ban-client[2804]: ERROR Directory /var/run/fail2ban exists but not accessible for writing
But, if you execute the command in the service file from the command line....
[root@f18x log]# /usr/bin/fail2ban-client -x start 2013-07-09 18:46:10,558 fail2ban.server : INFO Starting Fail2ban v0.8.10 2013-07-09 18:46:10,559 fail2ban.server : INFO Starting in daemon mode
and....
[root@f18x fail2ban]# pwd /var/run/fail2ban [root@f18x fail2ban]# ls fail2ban.pid fail2ban.sock
And if you put selinux in permissive mode....
[root@f18x fail2ban]# pwd /var/run/fail2ban [root@f18x fail2ban]# ls [root@f18x fail2ban]# setenforce 0 [root@f18x fail2ban]# systemctl start fail2ban [root@f18x fail2ban]# ls fail2ban.pid fail2ban.sock
So it is running with selinux placed in permissive mode.....
Yes, you're right. Thank you for the fix. Why selinux is not complaining with an AVC?
C. Sava
On 07/09/13 20:16, Cristian Sava wrote:
Yes, you're right. Thank you for the fix. Why selinux is not complaining with an AVC?
I do not know the answer to that. I'll see if I can figure it out, and if not file a bugzilla.
Welcome.
Ed
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 07/09/2013 08:24 AM, Ed Greshko wrote:
On 07/09/13 20:16, Cristian Sava wrote:
Yes, you're right. Thank you for the fix. Why selinux is not complaining with an AVC?
I do not know the answer to that. I'll see if I can figure it out, and if not file a bugzilla.
Welcome.
Ed
Probably a dontaudit message.
Does
restorecon -R -v /var/run/fail2ban
Change the label?
On 07/09/13 21:51, Daniel J Walsh wrote:
On 07/09/2013 08:24 AM, Ed Greshko wrote:
On 07/09/13 20:16, Cristian Sava wrote:
Yes, you're right. Thank you for the fix. Why selinux is not complaining with an AVC?
I do not know the answer to that. I'll see if I can figure it out, and if not file a bugzilla.
Welcome.
Ed
Probably a dontaudit message.
Does
restorecon -R -v /var/run/fail2ban
Change the label?
No.
I just did a semodule -DB to get the AVC's (reminded by folks on the selinux list) and created/install the resulting module and it seems to have fixed it.
Heading over to bugzilla now.
On 07/09/13 22:00, Ed Greshko wrote:
Heading over to bugzilla now.
This appears to be https://bugzilla.redhat.com/show_bug.cgi?id=975695 ....
The same error message noted in this thread are in the bugzilla.
I think there is no need create a new one.
On 07/09/13 20:16, Cristian Sava wrote:
Yes, you're right. Thank you for the fix. Why selinux is not complaining with an AVC?
Problem is now fixed in selinux-policy-3.12.1-62.fc19.
http://koji.fedoraproject.org/koji/buildinfo?buildID=432416
To get the early download.