21

I've install fail2ban on Debian Jessie LXC container, currently it's failing due to:

Starting authentication failure monitor: fail2ban
ERROR  No file(s) found for glob /var/log/auth.log
ERROR  Failed during configuration: Have not found any log file for ssh jail

There's no syslog or rsyslog on the system and thus /var/log/auth.log is not generated. Is there a way how to tell fail2ban to use output of journalctl _COMM=sshd?

Improve this question

4 Answers 4

Reset to default
31

For systemd systems:

You have to specify the backend in /etc/fail2ban/jail.conf to use systemd as follows:

[DEFAULT]
backend = systemd

Then restart fail2ban:

systemctl restart fail2ban

Edit:

I'm a heavy CentOS/RHEL/Fedora guy so you may have to adapt what I say a bit. As far as this answer, you may have to update the fail2ban package to a version that supports systemd as a backend or you'll have to install rsyslog and add the following to your /etc/rsyslog.conf:

authpriv.*      /var/log/auth.log

This will make sure sshd auth logs are logging to /var/log/auth.log which will be read by the default pyinotify backend in fail2ban:

Improve this answer
6
  • systemd option doesn't seem to be supported by fail2ban 0.8.13: fail2banERROR NOK: ("Unknown backend systemd. Must be among ['pyinotify', 'gamin', 'polling'] or 'auto'",) Commented Jan 7, 2017 at 10:18
  • @Tombart What version of Debian are you running? Looks like you need an updated fail2ban package that supports the systemd backend OR you can install rsyslog and add the right configuration to your rsyslog.conf Commented Jan 8, 2017 at 5:31
  • It's the latest version of Debian 8 Jessie which comes with systemd support. Commented Jan 9, 2017 at 8:13
  • @MatthewSanabria, why have to install rsyslog in centos? Commented Oct 12, 2018 at 3:24
  • How do you specify/configure the systemd unit? How does fail2ban know where to look? Commented Aug 13, 2020 at 14:42
11

There is an Issue with the config files.

I had jail.conf and jail.d/defaults-debian.conf

The content of the latter one was:

[sshd]
enabled = true

Because of backend not being set here the default value is used instead of the one in jail.conf. The Problem ist described in detail here: https://github.com/fail2ban/fail2ban/issues/1372

adding backend = systemd did the trick.

defaults-debian.conf

[sshd]
enabled = true
backend = systemd
Improve this answer
2
  • 1
    To be more explicit about this, the admin can create any file named like /etc/fail2ban/jail.d/*.local and include the desired configurations starting with [sshd]. This allows for customizing without touching the files that come with the package by default. Commented Jan 24, 2024 at 8:17
  • Finally an answer! Thank you. The configs are abstracted up the wazoo with %() placeholders and whatnot. Additionally there's files like paths-arch.conf paths-opensuse.conf in the default config. WHY IN THE WORLD would you even include those in a debian distributed package?! Commented Mar 8, 2024 at 12:10
3

I have the same problem. Rather than figuring it out, I ended up re-installing syslogd to generate the logfile(s).

apt-get install inetutils-syslogd

It may take a few mins after installation for the log file to be created - It will be created when a log entry is added.

I wouldn't recommend it long term (as it doesn't actually fix the problem), but if you want fail2ban working immediately, it does the job.

Improve this answer
2
  • 2
    Removing the squeaky door because you can't find the oil can is no solution! Commented Nov 21, 2023 at 11:04
  • 1
    As mentioned, I didn't recommend it long term. This was one of the things that didn't work out of the box (for me) when systemd was first a thing. Ultimately, the REAL fix was for the package maintainers to fix the default install. Remember, this answer is now nearly 8 years old. Commented Jan 22, 2024 at 12:22
2

You'll need fail2ban version 0.9.0 which can support systemd, while Debian Jessie has 0.8.3 in the repository.

Try downloading and installing from sources, or look for the alternative repos.

Regards.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.