18

I've install fail2ban on Debian Jessie LXC container, currently it's failing due to:

Starting authentication failure monitor: fail2ban
ERROR  No file(s) found for glob /var/log/auth.log
ERROR  Failed during configuration: Have not found any log file for ssh jail

There's no syslog or rsyslog on the system and thus /var/log/auth.log is not generated. Is there a way how to tell fail2ban to use output of journalctl _COMM=sshd?

4 Answers 4

23

For systemd systems:

You have to specify the backend in /etc/fail2ban/jail.conf to use systemd as follows:

[DEFAULT]
backend = systemd

Then restart fail2ban:

systemctl restart fail2ban

Edit:

I'm a heavy CentOS/RHEL/Fedora guy so you may have to adapt what I say a bit. As far as this answer, you may have to update the fail2ban package to a version that supports systemd as a backend or you'll have to install rsyslog and add the following to your /etc/rsyslog.conf:

authpriv.*      /var/log/auth.log

This will make sure sshd auth logs are logging to /var/log/auth.log which will be read by the default pyinotify backend in fail2ban:

5
  • systemd option doesn't seem to be supported by fail2ban 0.8.13: fail2banERROR NOK: ("Unknown backend systemd. Must be among ['pyinotify', 'gamin', 'polling'] or 'auto'",)
    – Tombart
    Jan 7, 2017 at 10:18
  • @Tombart What version of Debian are you running? Looks like you need an updated fail2ban package that supports the systemd backend OR you can install rsyslog and add the right configuration to your rsyslog.conf
    – user136881
    Jan 8, 2017 at 5:31
  • It's the latest version of Debian 8 Jessie which comes with systemd support.
    – Tombart
    Jan 9, 2017 at 8:13
  • @MatthewSanabria, why have to install rsyslog in centos?
    – kittygirl
    Oct 12, 2018 at 3:24
  • How do you specify/configure the systemd unit? How does fail2ban know where to look? Aug 13, 2020 at 14:42
8

There is an Issue with the config files.

I had jail.conf and jail.d/defaults-debian.conf

The content of the latter one was:

[sshd]
enabled = true

Because of backend not being set here the default value is used instead of the one in jail.conf. The Problem ist described in detail here: https://github.com/fail2ban/fail2ban/issues/1372

adding backend = systemd did the trick.

defaults-debian.conf

[sshd]
enabled = true
backend = systemd
2
  • To be more explicit about this, the admin can create any file named like /etc/fail2ban/jail.d/*.local and include the desired configurations starting with [sshd]. This allows for customizing without touching the files that come with the package by default.
    – Sam Sirry
    Jan 24 at 8:17
  • Finally an answer! Thank you. The configs are abstracted up the wazoo with %() placeholders and whatnot. Additionally there's files like paths-arch.conf paths-opensuse.conf in the default config. WHY IN THE WORLD would you even include those in a debian distributed package?!
    – andsens
    Mar 8 at 12:10
2

I have the same problem. Rather than figuring it out, I ended up re-installing syslogd to generate the logfile(s).

apt-get install inetutils-syslogd

It may take a few mins after installation for the log file to be created - It will be created when a log entry is added.

I wouldn't recommend it long term (as it doesn't actually fix the problem), but if you want fail2ban working immediately, it does the job.

2
  • 1
    Removing the squeaky door because you can't find the oil can is no solution!
    – Gill-Bates
    Nov 21, 2023 at 11:04
  • As mentioned, I didn't recommend it long term. This was one of the things that didn't work out of the box (for me) when systemd was first a thing. Ultimately, the REAL fix was for the package maintainers to fix the default install. Remember, this answer is now nearly 8 years old. Jan 22 at 12:22
2

You'll need fail2ban version 0.9.0 which can support systemd, while Debian Jessie has 0.8.3 in the repository.

Try downloading and installing from sources, or look for the alternative repos.

Regards.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .