Proftpd and fail2ban not working

[lawk]

System Alma 9, all latest, all tatest virtualmin.

my Proftpd jail for fail2ban does not work.

I created a post a while back where it was claimed it was fixed but I have this in var log messages all the time:

Sep 10 15:09:46 home proftpd[42417]: session[42417] 0.0.0.0 (45.61.187.79[45.61.187.79]): USER root (Login failed): Incorrect password
Sep 10 15:09:47 home proftpd[42417]: session[42417] 0.0.0.0 (45.61.187.79[45.61.187.79]): SSH2 session closed.

And yet the proftpd jail for fail2ban does nothing.

this is all the jail local for it contains:

[proftpd]
enabled = true

this virtualmin instance was installed months after the fix from here:
Fix ProFTPd jail work · virtualmin/Virtualmin-Config@6c7d92a (github.com)

[jimr1]

Have you got backend auto in tbe config

[lawk]

No, backend = systemd for global

[lawk]

how can I check which virtualmin-config I am running?

the global virtualmin is at 7.7.

Maybe I am still at a version where the fix was not yet implemented?

based on the line SSH2 I think it might be attempts for the SFTP ?

[Joe]

@lawk

Maybe I am still at a version where the fix was not yet implemented?

virtualmin-config only runs one time, at installation. It can be run later, but it isn’t likely to fix existing configurations, as it assumes a fresh OS.

So, it doesn’t matter what version you have (it is a package that can be queried by your package manager like any other, so it is trivial to find what version you have), it matters what version you had when you installed.

I don’t know how to reliably provide a tool to “fix broken stuff” without also “breaking intentional customizations”, so virtualmin-config doesn’t attempt to do that.

There have also been a variety of bugs in upstream packages in this area (the fail2ban folks didn’t ship functional examples for modern systemd and firewalld systems for quite a while, and the distros didn’t do a great job patching that gap), which updating also probably won’t fix (for roughly the same reason: once a config file has been changed, the package manager can no longer safely replace the config file with a “fixed” one without breaking user changes).

If you were to run it again, you’d run it with:

virtualmin config-system --include Fail2banFirewalld

I don’t know what it’ll do, exactly, given a configuration that’s not fresh. I mean, it almost certainly won’t break anything, but it might no do anything useful either.

[jimr1]

Change it to auto and restart fail2ban

[lawk]

From another post I tried this and it worked!

Not touching fail2ban, proftpd jail and filter at default.

Edit: /lib/systemd/system/proftpd.service

and replace and put in this section:

[Service]
Type=forking
Environment=PROFTPD_OPTIONS= CONFIG_FILE=/etc/proftpd.conf
EnvironmentFile=-/etc/sysconfig/proftpd
ExecStartPre=/usr/sbin/proftpd --configtest -c $CONFIG_FILE
ExecStart=/usr/sbin/proftpd -c $CONFIG_FILE $PROFTPD_OPTIONS
ExecReload=/bin/kill -HUP $MAINPID
PIDFile=/run/proftpd/proftpd.pid

I think there is a problem where the script is not paying attention to the config file.

So with CONFIG_FILE=/etc/proftpd.conf seems to fix it for me.

ProFTPD not logging

Hi @Ilia, First of all, thank you very much for this patch. I haven’t tried it yet but looking at my friend’s server, I actually solved the issue in a bit different way. What surprised me was that ProFTPd didn’t want to log to /var/log/proftpd/proftpd.log on Alma when I put the path there in the logging options in Webmin. So, I had a look at the startup script which was: [Unit] Description = ProFTPD FTP Server Wants=network-online.target After=network-online.target nss-lookup.target local-fs.t…

[jorgecardenas1]

I have a working config in CentOS 7, Rock Linux 8 & 9 for Postfix but I may include SSH, Proftpd, Apache.

As a matter of fact since Fail2ban can’t be as precise as I’d like, I developed a small python program that downloads some ip databases (containing ips known as a source of malware) then use it with a cron job to block and report a lot of ips. The program can exclude ips that are already connected making it safe to not block good ips like (users connecting with pop3/imap), it can also exclude ips for a country.
I will open source that program this week as soon as it is prepared so anyone can use it, and you may include in virtualmin if you wish (actually I’d love to have it included as brute force attacks have been a weak area for Virtualmin) and as you already saw it is not quite easy to set Fail2ban up. Currently the program reports to blocklist.de and I’m working to add reports to AbuseIPDB.

[lawk]

I use crowdsec and fail2ban in parallel. I think it works fine even with firewalld installed. The bouncer for crowdsec can be for nftables and I think there is no conflict.

since using crowdsec the postfix-sasl jail is mostly silent since crowdsec also bans based on lists