I've just upgraded from RHEL 5 to 6.5 and setup
fail2ban anew. I can't seem to get my custom action to work now, supposedly because of a permission issue. I wan't to know what am I doing wrong, and how can I make
fail2ban run the script successfully.
I have a
fail2ban action set up to run a generic shell script. I prefer things this way.
actionstart = <script> <jail> start
<script> is specified in the
action = run-script[jail=drupal-reg-lim,script=/path/to/script.sh]
But I get a 126 exit code when I try to run the script, which, according to tldp.org, means that there is a "Permission problem or command is not an executable".
This happens regardless of the contents of
script.sh - whether it is completely empty, or only has a shebang (
#!/bin/sh). Trying to run
sudo /path/to/script.sh works.
I tried changing the
actionstart so that it would log, and placed the script as
actionstart = <script> <jail> start || logger -dit fail2ban-run-script <script> <jail> start failed: exitcode = $?
Actually outputs the following into
Apr 23 05:49:25 xx1 fail2ban-run-script: /etc/fail2ban/action.d/script.sh drupal-reg-lim start failed: exitcode = 126
Also trying to run
sh works. Only running a script fails. I also tried
chmod 777 script.sh:
-rwxrwxrwx. 1 root root 10 Apr 23 05:12 script.sh
Another thought was that this might have to do with the SELinux security context (logging
id output gave me
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:system_r:fail2ban_t:s0), but I haven't been successful at testing this (
sudo -t fail2ban_t -r system_r /bin/sh fails with
Permission denied even though
fail2ban can run
sh; I might be doing something wrong in my
Something that might be useful to know is that
fail2ban uses Python's
os.system() to execute the command. But my attempt at recreating it this way has failed too:
>>> import os >>> print os.system('/etc/fail2ban/action.d/script.sh || echo "No"') 0
All of this leaves me with nothing. I'd be glad to get any kind of help.
(Side note: actually,
fail2ban didn't get the 126 exit code for some reason, and simply spit out an error with a code of 0x7e00, which means the process has stopped but the exit code is zero. Took me some time to figure out, so thought I'd share.)