1

In /etc/fail2ban/jail.local, when I have the MTA setting to Postfix, Fail2Ban is showing an error and is unable to start.

[DEFAULT]

ignoreip = 127.0.0.1/8
bantime  = 1800                         
maxretry =  4                           
destemail = email@example.com   
mta = postfix                           
action = %(action_mwl)s

Error:

WARNING 'findtime' not defined in 'ssh'. Using default value
ERROR  /etc/fail2ban/action.d/postfix-whois-lines.conf and /etc/fail2ban/action.d/postfix-whois-lines.local do not exist
ERROR  Error in action definition postfix-whois-lines[name=ssh, dest="email@example.com", logpath=/var/log/auth.log, chain="INPUT"]
ERROR  Errors in jail 'ssh'. Skipping...
['set', 'loglevel', 3]
['set', 'logtarget', '/var/log/fail2ban.log']

The error is pointing somewhere else, but when I comment out mta=postfix it works.

I have Postfix installed as my MTA (in Debian 7) and I thought I am supposed to change default sendmail to postfix for this setting. Am I wrong?

Neel
  • 1,441
  • 7
  • 21
  • 35

2 Answers2

6

Looking at my /etc/fail2ban/jail.local there is this comment:

Since 0.8.1 upstream fail2ban uses sendmail MTA for the mailing. 
Change mta configuration parameter to mail if you want to revert to conventional 'mail'

Based on this and the error you posted, it seems you can only specify sendmail or mail.

Do you receive emails from fail2ban when mta is set to sendmail?

jas_raj
  • 437
  • 3
  • 6
  • 1
    Thanks for your reply @jas_raj I tested it today with sendmail as the option for mta and fail2ban is still able to email me. So I guess having it as sendmail has no negative impact although I use postfix in my server. Thanks for confirming.. :) – Neel Oct 28 '14 at 16:05
  • 2
    It's weird why it uses only sendmail or mail when postfix is a popular mta used as well. The comments in the file is misleading when it says to specify the mta that fail2ban needs to use. – Neel Oct 28 '14 at 16:10
  • `sendmail` also works for `ssmtp` - this fixed connection errors to a local `exim` relay due to too many emails sent too quickly for `mail` to handle – Stuart Cardall Apr 02 '18 at 11:47
2

Ok, digging up an old thread but this is how I got postfix to work with Fail2ban:

in /etc/fail2ban/action.d/ I copied and renamed this files by changing all the sendmail to postfix Works fine for me now:

e.g cp sendmail-buffered.conf postfix-buffered.conf

same for all the rest of the sendmail conf files within this folder....

Then restart the fail2ban service -

Squid_Vicious
  • 87
  • 1
  • 1
  • 10