Plesk 12.x / Linux :: Fail2ban Errors In Log After Domain Change
Feb 4, 2015
After changing website domain name (from development one -dev-domain.com- to production one) we have this error in fail2ban.log :
2015-02-01 06:46:41,176 fail2ban.filter [2848]: ERROR Unable to open /var/www/vhosts/system/dev-domain.com/logs/proxy_access_log
2015-02-01 06:46:41,176 fail2ban.filter [2848]: ERROR [Errno 2] No such file or directory: '/var/www/vhosts/system/dev-domain.com/logs/proxy_access_log'
Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/server/filter.py", line 520, in getFailures
has_content = container.open()
File "/usr/lib/python2.7/dist-packages/server/filter.py", line 601, in open
self.__handler = open(self.__filename)
IOError: [Errno 2] No such file or directory: '/var/www/vhosts/system/dev-domain.com/logs/proxy_access_log'
I have only tried to "switch on" the jail item "apache-badbots" and get a red box with:
Unable to switch on the selected jails: f2bmng failed: ERROR No file(s) found for glob /var/www/*/logs/access_log ERROR Failed during configuration: Have not found any log file for apache-badbots jail ERROR:f2bmng:Command '['/usr/bin/fail2ban-client', 'reload']' returned non-zero exit status 255 ERROR:f2bmng:Failed to reload following jails due to errors in configuration .Click to expand...
Since we switched to Plesk 12 and activated nginx the problem reoccurs reliably on every domain change. As soon as a customer creates a new domain or alias and Apache restarts nginx delivers 502 errors for maybe 10 seconds. After that everything is fine again.
The system is Debian 6.0.10 with Plesk 12.0.18 Update #38
That might not be a problem in small environments, but with >100 domains the timeout is annoying enough for customers to pick up the phone.
Adding this to /etc/sw-cp-server/config did not do the trick.
Recently, we had trouble with Horde, which I Re-installed. However, since then any change that is made to a domain in plesk (changing mailbox settings, domain settings, hosting settings) All website show the default plesk page and I will have to re-run the reconfigure-all command in SSH to bring them all back up. Sometimes even that won't work and I will have to re-run the bootstrap repair command. We were actually on Plesk 11 when this started happening, so we upgraded to Plesk 12, but unfortunately this did not fix the issue.
We have around 500 customer websites on this server, so obviously the changes are made often and the sites going down on every change isn't great at all.
I have a long list of these errors in my error Plesk error log:
2014/09/25 17:31:53 [error] 818#0: *1566 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: *.*.*.*, server: , request: "$
But I can't seem to find out if this is the cause, or how to fix this error correctly on a Plesk install.
Is there a way to change the default value of the "Preferred domain" option in the hosting settings of domains in Plesk 11.5? When ever i create a new subscription/domain it just defaults to the value of "domain.ltd" and i have to go into the hosting settings and manually change it to "None". Is there a way i can set it to use the "None" option every time i create new subscriptions or domains?
I wonder if there is any chance to change the domain that is being shown as the incoming/outgoing mail server to users of the Plesk Panel, when clicking on the "Info"-Icon near an e-mail-account in the mail list (see screenshot).
We only have a SSL certificate for one domain and want our customers to use this domain in their mail client settings, so that the client trusts the domain.
So on our server, fail2ban got itself in a mess. Tried various things to fix, to no avail, so figured I'd just do a fresh install of it. There was minimal customisation to it that I couldn't re-do.
Note I'd already rm'd /etc/fail2ban - as on previous attempts, the files in here didn't appear to be restored to their defaults. So I figured removing the directory would force this to happen (Whether this was wise I'm not sure!) ;-)
So, following instructions here: [URL] .... I now get the following:
# wget http://kb.sp.parallels.com/Attachments/kcs-36245/fail2ban.gz # gunzip fail2ban.gz # mv fail2ban /etc/init.d/fail2ban # chmod 755 /etc/init.d/fail2ban # ll /etc/init.d/fail2ban /etc/fail2ban/fail2ban.conf ls: cannot access /etc/fail2ban/fail2ban.conf: No such file or directory -rwxr-xr-x 1 root root 2141 Aug 15 2014 /etc/init.d/fail2ban
I then uninstall/reinstall with # /usr/local/psa/admin/bin/autoinstaller
(Have tried via the web interface too)
I then get:
# ll /etc/init.d/fail2ban /etc/fail2ban/fail2ban.conf ls: cannot access /etc/fail2ban/fail2ban.conf: No such file or directory -rwxr-xr-x 1 root root 2141 Aug 15 2014 /etc/init.d/fail2ban
i.e., no change..
and if I go to the fail2ban settings in Plesk, I get:
If I go in plesk panel to: Home > Tools & Settings >IP Address Banning > Jails > managing Filters > add filter > type in name & filtercontent and save I get "Information: The jail filter was added". But i can not see the new added filter in the Plesk Filter List (still just the 12 Filters in the list).
On the filesystem > /etc/fail2ban/filter.d/ i can see the new file but with the extension .local - usulay the file is named like xyz.conf
The output of /usr/local/psa/admin/sbin/f2bmng --get-filters-list
Well with activated apache-badbots jails I have in a short time a hugh amount of banned IPs. Usualy action for this is to use iptables-ipset-proto and save all this baned IPs in the ipset insteed as normal in the iptables list - thats also a suggestion which was discussed in the fail2ban forum for better performance. And yes I had this running (ipset package installed) with my manual installation of fail2ban before I switched over to the plesk integrated.
action = iptables-ipset-proto6[name=BadBots, port="http,https,7080,7081"] insteed of action = iptables-multiport[name=BadBots, port="http,https,7080,7081"]
So how can I add iptables-ipset-proto4.conf, iptables-ipset-proto6-allports.conf, iptables-ipset-proto6.conf to the plesk version of fail2ban??
I have the problem that the ip blocked "failban" too short (set findtime=1800).
The ip should be blocked for 30 minutes (the second time).
2015-03-23 22:24:59,779 fail2ban.filter [2807]: INFO Set maxRetry = 5 2015-03-23 22:24:59,780 fail2ban.filter [2807]: INFO Set findtime = 1800 2015-03-23 22:24:59,781 fail2ban.actions[2807]: INFO Set banTime = 600
I would find an easy way to add a list of IP in Fail2ban whitelist in linux console.What is the file to modify ? Is there a command line or a process ?
12.0.18 Update #46, last updated at May 15, 2015 03:57 AM
Just recently (after update #46) Fail2Ban stopped working and I couldn't restart it or pin point the reason behind it. I decided to uninstall F2B component via Plesk installer.
F2B uninstalled however when I try to install it again I get error : 'Installation will not continue'
Where to start and where can I find log files that could give me some clues?
I installed fail2ban via the autoinstaller today. I got a failed install. There is no /etc/init.d/fail2ban file, and no /usr/bin/fail2ban-server.
On the other hand yum-search tells me it's installed:
plesk-fail2ban-configurator.noarch : plesk-specific jails and filters for fail2ban fail2ban.noarch : Scan logfiles and ban ip addresses with too many password failures
I tried to remove it in autoinstaller:
Installing packages Loaded plugins: fastestmirror, priorities Running rpm_check_debug Error in PREUN scriptlet in rpm package fail2ban
I have just looked at the plesk panel log - /usr/local/psa/admin/logs/panel.log - and seen an alarming number of attempts to access plesk using the admin user. i.e.
[2015-02-02 14:53:46] ERR [panel] [Action Log] Failed login attempt with login 'admin' from IP 50.62.148.176
I have fail2ban installed and set up for other things...
i'm running 12.0.18#34 on PCS dedicated server. i recently discovered that some of the default jails on fail2ban that is shipped with Plesk 12 were not working correctly. Let me explain what i mean. For instance, the plesk-panel jail. The logs were parsed correctly, the command was successfully appended in iptables list, the fail2ban log was updated. Still, the intruder was not blocked. I kept reading "already banned" on the fail2ban.log but actually there was no blocking.
After some checks, i found out that fail2ban default configuration states SSH as default blocking port. that means, the block was working but only for ssh hits. thus the plesk-panel admin page hits were passing through.
since i added port=http,https on jail.local > plesk-panel and did it a restart on fail2ban service, only then did it start to actually block incoming hits.
I think this should be verified by programmers group and maybe include a fix in some future minor update.