0

Running Debian unstable with shorewall for the firewall and fail2ban. Was getting "shorewall not running errors" upon boot up in the fail2ban log, but that was fixed with

After=network.target

in /lib/systemd/system/fail2ban.service. However, I still get these errors on shutdown or reboot. How do I tell shorewall to wait to shutdown until fail2ban is done?

1

I hunted for the answer to this for quite awhile. @Munir (in the comments on the first answer) pretty much has it. To make sure that the edits endure package upgrades, don't edit /lib/systemd/system/fail2ban.service, instead use systemd's override mechanism. E.g. create a file /etc/systemd/system/fail2ban.service.d/override.conf. In that file, put

[Unit]
Requires=shorewall.service
After=shorewall.service

That causes shorewall.service to be added to both Requires and After (in addition to what might be specified in /lib/systemd/system/fail2ban.service), and won't be over-written in the event of fail2ban being upgraded.

In my case, I already had a private reprepro repository set up, so I created a package that inserts this file (and also adds my standard fail2ban configuration at /etc/fail2ban/jail.d/local.conf) and has a package dependency on fail2ban and shorewall. Call the package f2b-shorewall. All I have to do to get this going on a server is install f2b-shorewall, and it will pull in fail2ban and shorewall, with my standard fail2ban jail config already in, leaving only the need to configure shorewall (which is typically going to be different for each server anyway).

  • 1
    Note that this is not something you'd want to have the debian fail2ban maintainer put in the Debian repositories, as someone using a different firewall package would need something different (unless you wanted to think of all the different possibilities and make a package like the one I made for each possibility - which could get complicated and messy). Better to just set up your own private repository and craft the appropriate package for your situation, or use a configuration management tool like Ansible to insert the appropriate systemd override file. – Ben Coleman Jan 22 '18 at 5:44
1

Why aren't you adding explicitly in the fail2ban service file that should start after shorewall with After=shorewall.service?

  • 1
    Ideally, use both Requires=shorewall.service and After=shorewall.service. The Requires= will create a hard dependency and the After= will enforce the order during system startup and reverse order during shutdown. – Munir Dec 13 '16 at 22:07
  • Thanks both! I will try these and communicate them to the Debian fail2ban maintainer. Not sure my edits will endure package upgrades. – Brian Flaherty Dec 14 '16 at 1:01
0

I found this in Debian Stretch and latest Shorewall:

[Unit]
Description=Fail2Ban Service
Documentation=man:fail2ban(1)
After=network.target iptables.service firewalld.service shorewall.service
PartOf=iptables.service firewalld.service shorewall.service

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.