fail2ban: output data format wrong

[markuspachali]

Hi all,

today I updated one of my servers to CentOS 8. During the sanity checks I discovered that there is an issue with the output of the fail2ban client. When I execute the fail2ban snmp extension manually I got the following:

[root@host ~]# /usr/local/lib/snmpd/fail2ban -c {"version":"1","error":"0","errorString":"fail2ban-client exited with 0","data":{"jails":{"selinux-ssh":"0","sshd":"1"},"total":1}} [root@host ~]# [root@host ~]# [root@host ~]# /usr/local/lib/snmpd/fail2ban {"version":"1","error":"0","errorString":"fail2ban-client exited with 0","data":{"jails":{"selinux-ssh":"0","sshd":"2"},"total":2}} [root@host ~]#

After that I check also on my other boxes and realized that the output is the same on CentOS 7 Deban 10. As this sounds like an issue with the code an not with the OS I started having a look on the script and found this:

my $jailsOutput=$f2bc status; $toReturn{error}=$?; if ( $? == -1){ $toReturn{errorString}='failed to run fail2ban-client'; } elsif ($? & 127) { $toReturn{errorString}= sprintf "fail2ban-client died with signal %d, %s coredump\n", ($? & 127), ($? & 128) ? 'with' : 'without'; } else { $toReturn{error}=$? >> 8; $toReturn{errorString}="fail2ban-client exited with ".$toReturn{error}; } if ( $toReturn{error} == 0 ){

I'm far away from being a coding expert but could may it be possible that the check for $toReturn{error} is handled wrong and that the check for if == 0 should happen before checking for

elsif ($? & 127) ? As $? can also be 0 I also would expect and "exit" or so after the
$toReturn{errorString}="fail2ban-client exited with ".$toReturn{error};

As of the output of the scripts seems to be like it "throws" the error because return code "0" matches "elsif ($? & 127)" and after that the output of fail2ban-client if also printed to stdout.

Please correct me if I'm wrong and the error is somewhere else.

Best regards, Markus

[murrant]

The output looks correct to me, what is the problem? error 0 means no error.

[markuspachali]

Hi @murrant, yes, sure it means no error, but I haven't expected the return code and "no error" message in the output if there is no error. If expected the message only if the return code is != 0. But if this is the intended behaviour then please ignore my report :)

[PVasileff]

I have configured librenms to monitoring few servers. On two of them I have installed fail2ban and configured that snmp extend. On VM with Debian 11 and on rasberry pi 4 with rasbian 11.

I have installed libjson-perl and configured on both server on snmpd.conf:

extend fail2ban '/usr/bin/sudo /opt/snmp/fail2ban -c -U -f /usr/local/bin/fail2ban-client'

and in /etc/sudoers:

Debian-snmp ALL = NOPASSWD: /opt/snmp/fail2ban

When I have run with root on cli:

sudo -u Debian-snmp /usr/bin/sudo /opt/snmp/fail2ban -c -U -f /usr/local/bin/fail2ban-client

on VM with Debian 11 - reported:

{"data":{"jails":{"nginx-forbidden":"0","ssh":"206"},"total":206},"error":"0","errorString":"fail2ban-client exited with 0","version":"1"} on RPI 4 with Rasbian - reported:

{"data":{"jails":{"openvpn":"0","ssh":"0"},"total":0},"error":"0","errorString":"fail2ban-client exited with 0","version":"1"}

BUT on librenms graphs for VM with Debian 11 - graphs are OK

Debian 11 Graphs RPI4

Any Ideas how to fix that on RPI 4?