fail2ban problem...

[JogoVogo]

Hi together,

i have a big problem with fail2ban...

if i start the fail2ban services the syslog put out this non stop:
ERROR findFailure failed to parse timeText: Jan 26 07:17:40 1582

When it found something:
postfix/smtpd[10402]: warning: 110-170-169-86.static.asianet.co.th[110.170.169.86]: SASL LOGIN authentication failed: authentication failure' but no valid date/time found for u'Jan 26 16:18:19 1582'. Please try setting a custom date pattern (see man page jail.conf(5)). If format is complex, please file a detailed issue on https://github.com/fail2ban/fail2ban/issues in order to get support for this format.

Also the menu item in Plesk stopp working after start/restart fail2ban.

The funny thing it worked without any error when no "jail" is activated .
fail2ban.server[21146]: INFO Changed logging target to SYSLOG (/dev/log) for Fail2ban v0.9.3
fail2ban.database[21146]: INFO Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'


The version:
fail2ban-0.9.3-1.el6.1.noarch
on
OS CentOS 6.7 (Final)
Plesk Version 12.0.18 Update #75

Do i need special timepattern?
I have no idea what I can do about it..., please help ;-))

regards
ron

 

[IgorG]

Looks like that you have fail2ban package from OS vendor but not from Plesk repository. You can check Vendor in output of command

# rpm -qi fail2ban

 

[JogoVogo]

Hi,

here the output, but i installed it via plesk web-surface...
...

Name : fail2ban Relocations: (not relocatable)
Version : 0.9.3 Vendor: Fedora Project
Release : 1.el6.1 Build Date: Sa 17 Okt 2015 17:31:29 CEST
Install Date: Di 26 Jan 2016 17:32:18 CET Build Host: buildhw-11.phx2.fedoraproject.org
Group : System Environment/Daemons Source RPM: fail2ban-0.9.3-1.el6.1.src.rpm
Size : 1408847 License: GPLv2+
Signature : RSA/8, Sa 17 Okt 2015 17:51:12 CEST, Key ID 3b49df2a0608b895
Packager : Fedora Project
URL : http://fail2ban.sourceforge.net/
Summary : Ban IPs that make too many password failures

 

[IgorG]

no valid date/time found for u'Jan 26 16:18:19 1582'.

Strange symbols here. What is output of 'date' command in CLI?

 

[JogoVogo]

Mi 27. Jan 08:58:14 CET 2016

 

[IgorG]

Do you have not default en_US locale in console?

 

[JogoVogo]

It is a virtual Server on Virtuozzo...

LANG=de_DE.UTF-8
LC_CTYPE="de_DE.UTF-8"
LC_NUMERIC="de_DE.UTF-8"
LC_TIME="de_DE.UTF-8"
LC_COLLATE="de_DE.UTF-8"
LC_MONETARY="de_DE.UTF-8"
LC_MESSAGES="de_DE.UTF-8"
LC_PAPER="de_DE.UTF-8"
LC_NAME="de_DE.UTF-8"
LC_ADDRESS="de_DE.UTF-8"
LC_TELEPHONE="de_DE.UTF-8"
LC_MEASUREMENT="de_DE.UTF-8"
LC_IDENTIFICATION="de_DE.UTF-8"
LC_ALL=

 

[IgorG]

Try to set it to en_US and check how it goes on.

 

[JogoVogo]

Hi,

I do not know exactly where to put the under CentOS ...
Did you know?

 

[JogoVogo]

Ok, got it. Forgot to reload the i18n file.

Now output:
LANG=en_US.utf8
LC_CTYPE="en_US.utf8"
LC_NUMERIC="en_US.utf8"
LC_TIME="en_US.utf8"
LC_COLLATE="en_US.utf8"
LC_MONETARY="en_US.utf8"
LC_MESSAGES="en_US.utf8"
LC_PAPER="en_US.utf8"
LC_NAME="en_US.utf8"
LC_ADDRESS="en_US.utf8"
LC_TELEPHONE="en_US.utf8"
LC_MEASUREMENT="en_US.utf8"
LC_IDENTIFICATION="en_US.utf8"
LC_ALL=

 

[JogoVogo]

But, same error:
fail2ban.filter[21174]: ERROR findFailure failed to parse timeText: Jan 27 10:58:40 1582

 

[IgorG]

Try to remove all fail2ban related packages and reinstall it with Plesk autoinstaller.

 

[JogoVogo]

I done it two times. Inc. yum update.
No luck, same error.

 

[IgorG]

In this case I would suggest you ask assistance from Plesk Support Team.

 

[JogoVogo]

Thank you for your support!

regards
ron