Fail2ban plugin

  • Hi,


    I'm trying to play with Fail2ban plugin and I don't understand the goal of "exclusion time" and "max retry" in the main parameters tab :


    They seem to always be ignored and replaced by the same parameters under each jail service configuration which are not optional :


    With the previous values, exclusion time is set to "forever" and cannot be left empty to use general parameter (1h).

    Same for max retry... except I don't know what "-1" means. It seems it blocks account on each fail.


    Another small issue is for the text attached to max retry (in jail tab). In french, it's translated in "Essai maximum en secondes" but, as I understood it's in occurrences, not in seconds.

    And it's not a translation issue because in english, the text is the same :

    Code: /usr/share/openmediavault/locale/fr_FR/openmediavault-fail2ban.po
    msgid "Max Retry in seconds."
    msgstr "Essai maximum en secondes."


    Finally, last issue I had is the default MTA generated by OMV in /etc/fail2ban/jail.conf file.

    It's set as "mta = sendmail" (the default for fail2ban), but as I remember sendmail is not installed on OMV by default (finally, not really sure, it's not a path issue...)


    So to solve this, my 1st try was to install sendmail with "apt install sendmail" (DON'T DO THIS) without looking enough on packages impacts and, doing this, OMV is simply uninstalled... :(

    Well, I solved this by reinstalling OMV and sendmail stays installed for me.

    If sendmail is effectively not installed by default, better option would be to change OMV generated jail.conf file to use "mta = mail", no ?

    As an alternative, on the user side, it's possible to create a local file for this :

    Code
    sudo nano /etc/fail2ban/jail.d/default.conf

    and insert in this file :

    Code
    [DEFAULT]
    mta = mail

    then reload fail2ban with :

    Code
    sudo systemctl restart fail2ban.service


    Sorry for this long mail and thank you for your advices.


    Regards.

  • I didn't write the plugin or use it but I did port it to OMV 5.x.


    I guess I don't understand what you are telling me it is doing wrong with the max retry time. The code looks correct. Can you give a more precise description of what it is doing wrong?


    You do know that a sendmail binary is provided by postfix that OMV uses?

    $ dpkg -S /usr/sbin/sendmail

    postfix: /usr/sbin/sendmail


    If you still want to change it, you can set the MTA in /etc/default/openmediavault by adding:

    OMV_FAIL2BAN_MTA="mail"

    followed by

    sudo omv-salt stage run prepare

    omv 5.5.5 usul | 64 bit | 5.4 proxmox kernel | omvextrasorg 5.3.5
    omv-extras.org plugins source code and issue tracker - github


    Please read this before posting a question.
    Please don't PM for support... Too many PMs!

  • Thank you for your answer and sorry for my english :)

    I'm going to try to reformulate...


    My 1st question about "exclusion time" and "max retry" :

    Can the values entered in the fail2ban plugin main page (1st tab "General parameters") be used in anyway ?

    I'm telling that because I think they are overridden by the same parameters you must fill in each jail (under jail service you cannot leave it blank to inherit general values ? "This field is required" ).



    2nd point, for the "tip" below the "max retry", it's not "in seconds" :



    Finaly, for sendmail, no, unfortunately I didn't know it's part of postfix (I should have been... It would have prevented me from all the problems I had to deal with ^^)

    That's what I finally though... I didn't have /usr/sbin in my path and so missed this binary existence... So tried to install it and crashed my OMV...

    Of course, if sendmail is present by default, no need to switch to mail (the way I described or the alternative way you told).

    This part is solved... even if I think I broke some things in my installation because if I try to make the same manipulations (without going to the end...), I can't cause something seems to be broken :

    Don't know if I should try to correct this or not (also because I don't know how...). I fear to broke OMV again...


    Thanks

  • Can the values entered in the fail2ban plugin main page (1st tab "General parameters") be used in anyway ?

    I'm telling that because I think they are overridden by the same parameters you must fill in each jail (under jail service you cannot leave it blank to inherit general values ? "This field is required" ).

    While I don't use the plugin, my interpretation of fail2ban tells me that the settings on the Settings tab would be used for any service not referenced in a specific jail. I'm unsure that if the value was not specified in the jail that it would use the default value. I'm guessing it would but the plugin has always been that way.

    2nd point, for the "tip" below the "max retry", it's not "in seconds" :

    I see that it is matches not seconds. I will fix that. The plugin has always been wrong about that unless fail2ban changed.


    Don't know if I should try to correct this or not (also because I don't know how...). I fear to broke OMV again...

    Why are you trying to install sendmail? It conflicts with postfix and if you force the install, it will uninstall OMV because postfix is a dependency of OMV. If you see 'ii' in the first column of dpkg -l | grep openmediavault, then OMV should be installed properly. Otherwise, I would reinstall.

    omv 5.5.5 usul | 64 bit | 5.4 proxmox kernel | omvextrasorg 5.3.5
    omv-extras.org plugins source code and issue tracker - github


    Please read this before posting a question.
    Please don't PM for support... Too many PMs!

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!