Fail2ban falhou ao iniciar no Centos 7. Falta o arquivo / var / log / secure

Question

Alguns dias atrás eu comprei vps e instalei o Centos 7 nele. Agora estou tentando configurar o fail2ban para ssh. Eu instalei o lançamento de epel. Iptables estava em uso por padrão. Isso é o que estou recebendo quando estou tentando iniciar o fail2ban:

 Job for fail2ban.service failed because the control process exited with error code. See "systemctl status fail2ban.service" and "journalctl -xe" for details.

Depuração do início do fail2ban:

[root@server ~]# /usr/bin/fail2ban-client -v -v start
INFO   Loading configs for fail2ban under /etc/fail2ban
DEBUG  Reading configs for fail2ban under /etc/fail2ban
DEBUG  Reading config files: /etc/fail2ban/fail2ban.conf
INFO     Loading files: ['/etc/fail2ban/fail2ban.conf']
INFO     Loading files: ['/etc/fail2ban/fail2ban.conf']
INFO   Using socket file /var/run/fail2ban/fail2ban.sock
INFO   Loading configs for jail under /etc/fail2ban
DEBUG  Reading configs for jail under /etc/fail2ban
DEBUG  Reading config files: /etc/fail2ban/jail.conf,/etc/fail2ban/jail.d/00-firewalld.conf, /etc/fail2ban/jail.local
INFO     Loading files: ['/etc/fail2ban/jail.conf']
INFO     Loading files: ['/etc/fail2ban/paths-fedora.conf']
INFO     Loading files: ['/etc/fail2ban/paths-common.conf']
INFO     Loading files: ['/etc/fail2ban/paths-overrides.local']
INFO     Loading files: ['/etc/fail2ban/jail.d/00-firewalld.conf']
INFO     Loading files: ['/etc/fail2ban/jail.local']
INFO     Loading files: ['/etc/fail2ban/paths-common.conf', '/etc/fail2ban/paths-fedora.conf', '/etc/fail2ban/jail.conf', '/etc/fail2ban/jail.d/00-firewalld.conf', '/etc/fail2ban/jail.local']
INFO   Loading configs for filter.d/sshd under /etc/fail2ban
DEBUG  Reading configs for filter.d/sshd under /etc/fail2ban
DEBUG  Reading config files: /etc/fail2ban/filter.d/sshd.conf
INFO     Loading files: ['/etc/fail2ban/filter.d/sshd.conf']
INFO     Loading files: ['/etc/fail2ban/filter.d/common.conf']
INFO     Loading files: ['/etc/fail2ban/filter.d/common.local']
INFO     Loading files: ['/etc/fail2ban/filter.d/common.conf', '/etc/fail2ban/filter.d/sshd.conf']
INFO   Loading configs for action.d/iptables-multiport under /etc/fail2ban
DEBUG  Reading configs for action.d/iptables-multiport under /etc/fail2ban
DEBUG  Reading config files: /etc/fail2ban/action.d/iptables-multiport.conf
INFO     Loading files: ['/etc/fail2ban/action.d/iptables-multiport.conf']
INFO     Loading files: ['/etc/fail2ban/action.d/iptables-common.conf']
INFO     Loading files: ['/etc/fail2ban/action.d/iptables-blocktype.local']
INFO     Loading files: ['/etc/fail2ban/action.d/iptables-common.local']
INFO     Loading files: ['/etc/fail2ban/action.d/iptables-common.conf', '/etc/fail2ban/action.d/iptables-multiport.conf']
ERROR  No file(s) found for glob /var/log/secure
ERROR  Failed during configuration: Have not found any log file for sshd jail

Eu tentei reinstalar o iptables, mas ainda após a nova instalação eu estou perdendo o arquivo de log seguro. Isso pode ser causado pelas configurações do provedor vps?

    

Answer 1

Por que não criar o arquivo ausente?

touch /var/log/secure
chown root. /var/log/secure
chmod 0600 /var/log/secure

Então:

systemctl restart fail2ban.service

/var/log/secure vem de rsyslog . Verifique se você tem authpriv.* /var/log/secure em /etc/rsyslog.conf e rsyslog em execução:

systemctl status rsyslog