[Pkg-exim4-users] Exim not playing with Fail2Ban on Debian Wheezy i386

[Just Ian]

I am much more familiar with Postfix, so please forgive me if I have
done something really silly.

I have a server with, amongst other things, exim4, logwatch and
fail2ban on it. The latter two are the only things that send mail and
nothing receives any. Because of this, I went for the simplest
'connected all the time' setup I could find in the documentation:

# /etc/exim4/update-exim4.conf.conf
#
# Edit this file and /etc/mailname by hand and execute update-exim4.conf
# yourself or use 'dpkg-reconfigure exim4-config'
#
# Please note that this is _not_ a dpkg-conffile and that automatic changes
# to this file might happen. The code handling this will honor your local
# changes, so this is usually fine, but will break local schemes that mess
# around with multiple versions of the file.
#
# update-exim4.conf uses this file to determine variable values to generate
# exim configuration macros for the configuration file.
#
# Most settings found in here do have corresponding questions in the
# Debconf configuration, but not all of them.
#
# This is a Debian specific file

dc_eximconfig_configtype='internet'
dc_other_hostnames=''
dc_local_interfaces='127.0.0.1'
dc_readhost=''
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets=''
dc_smarthost=''
CFILEMODE='644'
dc_use_split_config='false'
dc_hide_mailname=''
dc_mailname_in_oh='true'
dc_localdelivery='mail_spool'


Logwatch is sending mail fine:

/etc/logwatch/conf/override.conf

# Mail results to me, rather than sending to stdout
logwatch: Output = mail
logwatch: MailTo = ***@example.com

/var/log/exim4/mainlog

2014-06-07 07:24:51 Start queue run: pid=16329
2014-06-07 07:24:51 End queue run: pid=16329
2014-06-07 07:37:53 1WtB9c-0004If-My <= ***@example2.com U=root P=local S=39747
2014-06-07 07:37:53 1WtB9c-0004If-My => ***@example.com R=dnslookup
T=remote_smtp H=mail.example.com [12.34.56.78]
X=TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128
DN="C=GB,ST=Nottinghamshire,L=Newark,O=example,CN=mail.example.com,EMAIL=***@example.com"
2014-06-07 07:37:53 1WtB9c-0004If-My Completed
etc


But Fail2Ban isn't. If I tell it to use the sendmail method, it
generates errors in the fail2ban log files and no mail is sent

/etc/fail2ban/jail.local

mta = sendmail

/var/log/fail2ban.log

2014-06-03 18:43:20,213 fail2ban.jail : INFO Jail 'ssh' started
2014-06-03 18:43:20,263 fail2ban.actions.action: ERROR printf %b
"Subject: [Fail2Ban] ssh: started
Date: `date -u +"%a, %d %h %Y %T +0000"`
From: Fail2Ban <fail2ban>
To: ***@example.com\n
Hi,\n
The jail ssh has been started successfully.\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f fail2ban ***@example.com returned 8b00

But if I do..

echo "Hello me" | sendmail -f fail2ban ***@example.com

at the command line, which is basically what the Python script of
fail2ban does (and the Perl of logwatch) it works.

If I tell fail2ban to use the old mail protocol, it appears to work,
but nothing actually gets sent because the sendmail emulation
segfaults:

/etc/fail2ban/jail.local

mta = sendmail

/var/log/exim4/mainlog

(nothing)

/var/log/syslog

Jun 7 08:44:19 example2 kernel: [320629.730862] sendmail[17581]:
segfault at bf98a3f4 ip b767acad sp bf98a2c0 error 6 in
exim4[b7670000+df000]
Jun 7 08:46:12 example2 kernel: [320742.561156] sendmail[17629]:
segfault at bf972034 ip b763acad sp bf971f00 error 6 in
exim4[b7630000+df000]

etc (the address varies, I presume because it's loaded at different
places in memory)

What am I doing wrong?

Ian

[Just Ian]

Post by Just Ian
If I tell fail2ban to use the old mail protocol, it appears to work,
but nothing actually gets sent because the sendmail emulation
/etc/fail2ban/jail.local
mta = sendmail

That should be

mta = mail

of course.

If I do

echo "Hello me" | mail -s "[Fail2Ban] example2.com: banned
12.34.56.78" ***@example.com

at the command line, which again is what the Python script of fail2ban
does in this case, it works.

Ian

[Just Ian]

Interestingly, if I create a new DigitalOcean Debian 7/32 droplet and just do...

***@twilts:~# history
1 apt-get update
2 apt-get upgrade
3 shutdown now -r

(one of the updates was the kernel)

4 adduser ian

(this is who root and postmaster will be aliased to at step 6)

4 apt-get install joe exim4 fail2ban
5 jstar /etc/fail2ban/jail.local

/etc/fail2ban/jail.local:

[DEFAULT]

ignoreip = 127.0.0.1/8
destemail = ***@example.com
findtime = 600

bantime = 86400
banaction = iptables-multiport
action = %(action_mwl)s

mta=sendmail

# JAILS
[ssh]
enabled = true

6 dpkg-reconfigure exim4-config

/etc/exim4/update-exim4.conf.conf:

# /etc/exim4/update-exim4.conf.conf
#
# Edit this file and /etc/mailname by hand and execute update-exim4.conf
# yourself or use 'dpkg-reconfigure exim4-config'
#
# Please note that this is _not_ a dpkg-conffile and that automatic changes
# to this file might happen. The code handling this will honor your local
# changes, so this is usually fine, but will break local schemes that mess
# around with multiple versions of the file.
#
# update-exim4.conf uses this file to determine variable values to generate
# exim configuration macros for the configuration file.
#
# Most settings found in here do have corresponding questions in the
# Debconf configuration, but not all of them.
#
# This is a Debian specific file

dc_eximconfig_configtype='internet'
dc_other_hostnames=''
dc_local_interfaces='127.0.0.1'
dc_readhost=''
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets=''
dc_smarthost=''
CFILEMODE='644'
dc_use_split_config='false'
dc_hide_mailname=''
dc_mailname_in_oh='true'
dc_localdelivery='mail_spool'

7 service fail2ban restart

.. it works. But I really can't see what makes the difference - the
exim4 conf is the same and the fail2ban conf is smaller (only one jail
rather than several), but the critical bits are the same. The
/usr/sbin/sendmail binaries have the same MD5 hash too. I can even add
the UFW firewall and block everything from coming in except OpenSSH,
and it still works.

Ian

[Just Ian]

I said

Post by Just Ian
Interestingly, if I create a new DigitalOcean Debian 7/32 droplet and just do...
(stuff)
.. it works. But I really can't see what makes the difference

This inspired me to purge fail2ban and exim4 on the server in
question, then reinstall them.

This has worked :) but I still don't understand why :(

Ian

[Just Ian]

Post by Just Ian
This inspired me to purge fail2ban and exim4 on the server in
question, then reinstall them.
This has worked :) but I still don't understand why :(

It was a memory shortage, specifically not enough space on the stack
for the fail2ban user.

Why that wasn't apparent in the error messages, I don't know, nor why
it will work with Postfix in the same size of memory, but...

Ian