summaryrefslogtreecommitdiff
path: root/files
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #2182 from orlitzky/openrc-improvementsSergey G. Brester2022-01-104-68/+88
|\ | | | | OpenRC service script improvements
| * files/fail2ban-openrc.init.in: add a comment about @RUNDIR@ in the future.Michael Orlitzky2021-05-141-0/+4
| |
| * files/fail2ban-openrc.init.in: don't restart() with a broken config.Michael Orlitzky2021-05-141-1/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds a new function checkconfig() to the OpenRC service script. All it does is run the server with the "--test" flag in addition to the usual command-line arguments. The new command is not user-facing, but lets us avoid restarting the daemon with a broken config. That helps when the user changes his configuration while the daemon is running, and then tries to restart() not knowing that the new config is broken. A priori, we would stop the daemon and then the error would only become visible when the subsequent start() command failed. Refusing to stop() with a broken configuration is a nicer thing to do.
| * files/fail2ban-openrc.init.in: remove redundant "return" from start_pre.Michael Orlitzky2021-05-141-1/+1
| | | | | | | | | | | | OpenRC functions will exit with the return code from the last command by default, so there's no need for the "|| return 1" in our single-line start_pre() phase.
| * files/fail2ban-openrc.init.in: mention that "reload" doesn't drop bans.Michael Orlitzky2021-05-141-1/+1
| | | | | | | | | | | | | | The description of the "reload" OpenRC command just said that it would reload the configuration, which is true but not totally helpful. This commit updates it to mention that your existing bans won't be dropped, in contrast with the "restart" command that does drop your bans.
| * files/fail2ban-openrc.init: replace @BINDIR@ at build-time.Michael Orlitzky2021-05-141-5/+2
| | | | | | | | | | | | | | | | | | This commit renames fail2ban-openrc.init to fail2ban-openrc.init.in, and replaces the hard-coded value "/usr/bin" with "@BINDIR@" therein. At build-time, setup.py will replace that string with the correct value, and rename the file (without the ".in" suffix). This mimics the procedure done for "fail2ban-service.in" entirely.
| * files/fail2ban-openrc.init: force the socket location in the service script.Michael Orlitzky2021-05-141-5/+17
| | | | | | | | | | | | | | | | | | The socket location needs to be set in the service script for the same reason that the PID file location does: because the service script is taking responsibility for ensuring that its parent directory exists and has the correct permissions. We can't do that if the end user is allowed to move the PID file or socket somewhere else (without parsing the config file, which has other security implications).
| * files/fail2ban-openrc.conf: add back the "-x" example.Michael Orlitzky2021-05-141-1/+1
| | | | | | | | | | | | | | | | | | | | I've removed the stale socket cleanup from our OpenRC service script: * Cleaning up stale sockets isn't really the job of the service script. * The ability to ignore a stale socket is already built into the server. With it gone, maybe the "-x" is a useful example to have in the conf file (although it's commented-out by default, anyway).
| * files/fail2ban-openrc*: let start-stop-daemon manage the server.Michael Orlitzky2021-05-142-23/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are two ways that it would make sense to write the OpenRC service script for fail2ban: 1. Use the fail2ban-client program to stop, start, reload, etc. the server; and try to figure out whether or not it worked afterwards. 2. Use the start-stop-daemon program built into OpenRC to manage the fail2ban-server process. This works only for starting and stopping, because the "reload" command is sent over an undocumented protocol, but has the benefit that you get immediate feedback about the result of calling fail2ban-server. The existing service script combined the two in a way that appeared to work, but didn't make too much sense. It used start-stop-daemon to initiate the fail2ban-client program with either a "start" or "stop" argument. So long as everything goes fine, that appears to work. But the start-stop-daemon is not actually monitoring the fail2ban-client program; it's supposed to be monitoring the fail2ban-server process that gets started as side-effect. The existing stop() function does not do quite what you'd expect; for example the "stop" command is never sent. Again, the daemon does ultimately get stopped so long as the hard-coded PID file contains what you think it does -- so it "works" -- but is misleading. This commit changes everything to use the second approach above, where start-stop-daemon manages everything. This was done mainly to simplify the service script, because now the default start() and stop() phases can be used, allowing us to delete them from our copy. One might worry that there is some special magic behind "fail2ban-client start" and "fail2ban-client stop", however that does not appear to be the case. Admittedly, if in the future those two commands begin to do something nonstandard, the service script would need to be changed again to take the first approach above and use fail2ban-client for everything.
| * files/fail2ban-openrc.init: remove the "showlog" command.Michael Orlitzky2021-05-141-6/+1
| | | | | | | | | | | | | | | | | | | | | | The extra "showlog" command in our OpenRC service script was more trouble than it was worth: the only thing it did was call "less" on a log file, and the service script is only guessing at the location of the log file (only the fail2ban server knows its true location). It's not like "/etc/init.d/fail2ban showlog" is that much easier to type than "less /var/log/fail2ban.log" in the first place, so I think the extra complexity (5 more lines in the service script) is not worth it.
| * files/fail2ban-openrc.init: use the standard OpenRC "retry" variable.Michael Orlitzky2018-07-151-1/+2
| | | | | | | | | | | | | | If the "retry" variable is set in the service script, we don't have to pass it to start-stop-daemon explicitly. While we can't immediately eliminate any code with this change, it will be necessary later to adopt the default OpenRC stop() function.
| * files/fail2ban-openrc.init: use RC_SVCNAME instead of hard-coding the name.Michael Orlitzky2018-07-151-6/+6
| | | | | | | | | | | | | | | | | | If our service is installed under some other name, then we don't want the service script to say things like "Starting fail2ban..." because the name "fail2ban" won't make any sense at that point. Instead, we use the $RC_SVCNAME variable to ensure that the service name matches what we tell the user. Typically, however, $RC_SVCNAME will still be "fail2ban".
| * files/fail2ban-openrc.init: move pre-flight checks into start_pre().Michael Orlitzky2018-07-151-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | Our OpenRC service script performs two tasks before starting the service: 1. It removes any stake sockets (from e.g. a system crash). 2. It ensures that the PID file directory exists. These have both been moved into the "start_pre" phase, which is designed to do such things (and will allow us to simplify the "start" phase in the future). The existing "mkdir -p" has also been converted into a "checkpath -d" command which is built-in to OpenRC.
| * files/fail2ban-openrc.init: use a variable for the pid file location.Michael Orlitzky2018-07-151-2/+3
| | | | | | | | | | | | OpenRC has a special variable "pidfile" that should be used to store the location of the daemon's PID file. This commit replaces two instances of said location with one variable.
| * files/fail2ban-openrc.init: replace FAIL2BAN with standard OpenRC variables.Michael Orlitzky2018-07-151-4/+5
| | | | | | | | | | | | | | The FAIL2BAN variable in our OpenRC service script was a combination of two standard OpenRC variables, "command" and "command_args". This commit simply replaces the custom variable with the two standard ones. This will aid future simplifications of the service script.
| * files/fail2ban-openrc.init: change "need logger" dependency to "use logger".Michael Orlitzky2018-07-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Our OpenRC service script contained a "need logger" dependency, which meant that the life cycle of the fail2ban service was tied to that of the system logger service. That isn't quite correct: fail2ban functions fine even if the system logger is stopped: 1. fail2ban is capable of analyzing non-syslog log files. 2. Even if fail2ban is solely analyzing syslog files, we don't want to stop the fail2ban service simply because syslog was stopped -- fail2ban just won't see any new log lines until syslog is started again. This commit changes the "need net" dependency to "use net", which will still attempt to start the system logger service, but which won't kill fail2ban if the system logger is ever stopped.
| * files/fail2ban-openrc.init: drop "need net" dependency.Michael Orlitzky2018-07-151-1/+0
| | | | | | | | | | | | | | | | | | The "need net" dependency in our OpenRC service script was incorrect: the fail2ban service does not need a working WAN to function. This issue is well-documented and is covered in the OpenRC Service Script Guide, currently located at https://github.com/OpenRC/openrc/blob/master/service-script-guide.md
| * files/fail2ban-openrc.conf: remove a commented example setting.Michael Orlitzky2018-07-151-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Our OpenRC conf file already tells users how to find the available options that can be placed in the FAIL2BAN_OPTIONS variable, so having a specific example of, FAIL2BAN_OPTIONS="-x" doesn't provide much more information. In fact, it makes you wonder why it's there in the first place: does the init script have some kind of problem with stale sockets? It used to, but that problem has been fixed. This commit removes the redundant example.
| * files/fail2ban-openrc.conf: remove hard-coded paths.Michael Orlitzky2018-07-151-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There were two paths mentioned in comments in the fail2ban OpenRC conf file, but those paths aren't guaranteed to be correct (until/unless we integrate the conf file with the build system). The first comment referenced the physical location of the associated init script, and in my opinion is not useful to an end user in the first place. It has been removed: OpenRC users know what this file is for, there's no reason to repeat it in a comment. The second comment contained an absolute path to fail2ban-client, and I've removed the leading path components because "fail2ban-client" is generally run from your $PATH.
| * fail2ban/files: rename "gentoo" files to "openrc".Michael Orlitzky2018-07-152-0/+0
| | | | | | | | | | | | | | We ship a service script and configuration file for "gentoo" that are actually more generally applicable: they work on any system where OpenRC is used. This commit simply renames the files from "gentoo" to "openrc" to reflect the fact that they are in no way Gentoo-specific.
* | fail2ban.service systemd unit template: don't add user site directory to ↵sebres2020-04-151-0/+1
| | | | | | | | python system path (avoids accessing of `/root/.local` directory, prevents SE linux audit warning at daemon startup, gh-2688)
* | amend to #2174 for fail2ban.service, fix legacy path, closes gh-2474Sergey G. Brester2019-07-171-2/+2
| |
* | Merge pull request #2348 from szepeviktor/deb-initd-retrySergey G. Brester2019-03-271-64/+82
|\ \ | | | | | | Safer, nicer, uniform Debian initd script - into 0.10
| * | Fix whitespacesViktor Szépe2019-02-171-1/+1
| | |
| * | Normalizing quote usage in initdViktor Szépe2019-02-171-11/+11
| | |
| * | ENH: disable shell check for $DAEMON_ARGS expansionYaroslav Halchenko2019-02-171-0/+2
| | |
| * | Safer, nicer, uniform Debian initd scriptViktor Szépe2019-02-171-54/+70
| | |
* | | tmpfiles.d: don't use legacy directory pathEli Schwartz2019-03-131-1/+1
|/ / | | | | | | | | | | | | | | | | systemd 239 (released June 22) introduces a new warning for tmpfiles.d snippets touching paths in /var/run instead of the canonical /run See https://github.com/systemd/systemd/commit/a2d1fb882c4308bc10362d971f333c5031d60069 Update to use the preferred path.
* | closes #2313: missing dependency to nftables.serviceSergey G. Brester2019-01-061-2/+2
| |
* | BF: $value not $codeYaroslav Halchenko2018-07-241-1/+1
| |
* | BF: account that now code 255 is the one to say "it is Ok, we are already ↵Yaroslav Halchenko2018-07-241-5/+11
| | | | | | | | running/stopped"
* | BF: debian-initd, exit with exit code in logend_msg_wrapperYaroslav Halchenko2018-07-241-1/+2
|/ | | | and do it unconditionally on the verbosity level
* added new logtarget "SYSOUT" to log from fail2ban working in foreground as ↵sebres2017-11-262-3/+3
| | | | systemd-service (in opposite to "STDOUT" don't log time-stamps).
* Merge remote-tracking branch 'remotes/gh-upstream/master' into 0.10sebres2017-11-061-0/+3
|\
| * gentoo-initd: add descriptionsStuart Cardall2017-11-011-0/+3
| | | | | | | | | | | | | | | | | | add descriptions to stop syslog errors for extra_started_commands when running: rc-service ipset describe Oct 28 15:13:30 xxxx daemon.warn /etc/init.d/fail2ban[26446]: ^[[1m^[[36mreload^[[m: no description Oct 28 15:13:30 xxxx daemon.warn /etc/init.d/fail2ban[26447]: ^[[1m^[[36mshowlog^[[m: no description
* | add ip6tables.service ipset.service in systemd unitmartin612017-10-191-2/+2
| |
* | Fix Gentoo init script's shebangLouis Sautier2017-09-111-1/+1
| | | | | | | | | | Use openrc-run instead of runscript. https://github.com/OpenRC/openrc/commit/5d5856c193768d24f11d5f0533e48c39526aef5c
* | - `files/fail2ban.service` renamed as template to `files/fail2ban.service.in`;sebres2017-08-231-4/+4
| | | | | | | | | | | | - setup process generates `build/fail2ban.service` from `files/fail2ban.service.in` using distribution related bin-path; - bug-fixing by running setup with option `--dry-run` (note: specify option `--dry-run` before `install`, like `python setup.py --dry-run install`); - test cases extended to cover dry-run.
* | Merge remote-tracking branch 'master' into 0.10sebres2017-07-191-1/+1
|\ \ | |/ | | | | | | # Conflicts: # config/filter.d/asterisk.conf
| * Merge pull request #1390 from khumarahn/xxxSerg G. Brester2017-07-111-0/+1
| |\ | | | | | | ensure /var/run/fail2ban is created in systemd service file
| | * ensure /var/run/fail2ban is created in systemd service fileAlexey Korepanov2016-04-121-0/+1
| | |
| * | Wait up to 30 seconds on "stop" to avoid errors.Hank Leininger2016-12-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fail2ban server can take several seconds to shut down. This can make Gentoo's start-stop-service time out and decide that stopping has failed, even if it actually succeeds a few seconds later. The default timeout for start-stop-service if --retry is not specified appears to be 5 seconds. Increase that to 30 seconds to be sure that if fail2ban-server is going to be able to stop, it has time to do so.
* | | Solution for issue #1665oliverdorn2017-01-131-1/+1
| | | | | | | | | Solves the issue of authentic GoogleBots being banned by apache-fakegooglebots.
* | | if fail2ban running as systemd-service, for logging to the systemd-journal, ↵sebres2016-11-241-0/+2
| | | | | | | | | | | | | | | | | | the `logtarget` could be set to STDOUT small fixes by logging in stdout (+ system targets also allowed in lowercase now)
* | | automatically creates /var/run/fail2ban before start fail2ban (systems which ↵sebres2016-11-241-0/+1
| | | | | | | | | | | | /var/run/ is virtual resp. memory mount device)
* | | systemd service update:sebres2016-11-221-3/+4
|/ / | | | | | | | | | | | | - starting service in normal mode (without forking) - does not restart if service exited normally (exit-code 0, e.g. stopped via fail2ban-client) - does not restart if service can not start (exit-code 255, e.g. wrong configuration, etc.) - service can be additionally started/stopped with commands (fail2ban-client, fail2ban-server)
* | By the author:Viktor Szépe2016-09-221-1/+1
| | | | | | | | | | | | > Yes, scripting is not supported in path. https://bitbucket.org/tildeslash/monit/issues/372/webadmin-shows-only-the-first-part-of#comment-27946048
* | fixed --pidfile bug, introduced in gh-1322:sebres2016-05-201-4/+4
|/ | | | | gentoo-initd fixed --pidfile bug: `--pidfile` is option of start-stop-daemon, not argument of fail2ban (see gh-1434) closes gh-1434
* gentoo-initd: Use start-stop-daemon in order to handle crashes betterJack Suter2016-02-161-2/+4
| | | | | | | | | | | Currently, if fail2ban is killed (or crashes), its status will be reported by '/etc/init.d/fail2ban status' as 'running' even though it is not. Attempting to restart the service also fails, because Gentoo unsuccessfully tries to stop the service. By using start-stop-daemon and providing a pidfile, Gentoo will instead report the status as 'crashed' and allow the service to be restarted as normal.
* Merge branch 'logrotate' of https://github.com/sbraz/fail2banYaroslav Halchenko2016-02-101-3/+1
|\ | | | | | | | | * 'logrotate' of https://github.com/sbraz/fail2ban: Remove compression and count from logrotate
View Lorry Controller Status