New folder structure impacts fail2ban

[shutterfreak]

Issue information:

While running menu 10 > 13 (System Tweaks) I came across the following warning:

Creating persistent systemd journal folder location: /var/log/journal

$ mkdir -p /var/log/journal 

$ systemd-tmpfiles --create --prefix /var/log/journal 
[/usr/lib/tmpfiles.d/fail2ban-tmpfiles.conf:1] Line references path below legacy directory /var/run/, updating /var/run/fail2ban → /run/fail2ban; please update the tmpfiles.d/ drop-in file accordingly.
Keeping at most 30 days of systemd journal entries

So it appears that fail2ban needs some manual help to adapt to the new folder settings?

See https://community.openhab.org/t/openhabian-hassle-free-openhab-setup/13379/1438?u=shutterfreak

Debug information:

All I could log is the console output. I only executed the menu item, no other input was requested.

System information:

Raspberry Pi OS: Raspbian GNU/Linux 10 (buster) HW: Raspberry Pi 3B+ (arm71)

[mstormi]

did you upgrade your system (menu 02) ? If no try again. What's the output of journalctl --vacuum-time=30d ?

[shutterfreak]

I upgraded the system through menu 02 and all it did was upgrading my JRE from zulu8.40 to zulu8.48. All other packages were already up to date as I routinely use apt for this task.

While upgrading zulu8, I had this error message when stopping or starting openhab2(may be an early SDHC wear-out problem):

$ systemctl stop openhab2.service 
Warning: The unit file, source configuration file or drop-ins of openhab2.service changed on disk. Run 'systemctl daemon-reload' to reload units.

And then I ran openhabian-config again, option 13:

$ sudo openhabian-config 
[sudo] password for openhabian: 
2020-10-20_16:39:29_CEST [openHABian] Checking for root privileges... OK
2020-10-20_16:39:29_CEST [openHABian] Loading configuration file '/etc/openhabian.conf'... OK
2020-10-20_16:39:29_CEST [openHABian] openHABian configuration tool version: [stable]v1.6-880(769ea17)
2020-10-20_16:39:30_CEST [openHABian] Checking for changes in origin branch HEAD... OK
2020-10-20_16:39:33_CEST [openHABian] Switching to branch stable... OK
2020-10-20_16:40:07_CEST [openHABian] Updating Linux package information... OK
2020-10-20_16:40:08_CEST [openHABian] Stopping Samba service... 
$ systemctl stop smbd.service 
OK
2020-10-20_16:40:08_CEST [openHABian] Stopping ZRAM service... 
$ systemctl stop zram-config.service 
OK
2020-10-20_16:40:26_CEST [openHABian] Preparing openHAB folder mounts under '/srv/openhab2-*'... 
$ umount -q /srv/openhab2-sys /srv/openhab2-conf /srv/openhab2-userdata /srv/openhab2-logs /srv/openhab2-addons 

$ rm -f /etc/systemd/system/srv-openhab2-addons.mount /etc/systemd/system/srv-openhab2-conf.mount /etc/systemd/system/srv-openhab2-logs.mount /etc/systemd/system/srv-openhab2-sys.mount /etc/systemd/system/srv-openhab2-userdata.mount 

$ mkdir -p /srv/openhab2-sys /srv/openhab2-conf /srv/openhab2-userdata /srv/openhab2-logs /srv/openhab2-addons 

$ cp /opt/openhabian/includes/srv_readme.txt /srv/README.txt 

$ chmod ugo+w /srv /srv/README.txt 

$ create_mount /usr/share/openhab2 sys 
2020-10-20_16:40:26_CEST [openHABian] Creating mount /usr/share/openhab2 in '/srv/openhab2-sys'... 
$ systemctl enable --now srv-openhab2-sys.mount 
OK

$ create_mount /etc/openhab2 conf 
2020-10-20_16:40:28_CEST [openHABian] Creating mount /etc/openhab2 in '/srv/openhab2-conf'... 
$ systemctl enable --now srv-openhab2-conf.mount 
OK

$ create_mount /var/lib/openhab2 userdata 
2020-10-20_16:40:29_CEST [openHABian] Creating mount /var/lib/openhab2 in '/srv/openhab2-userdata'... 
$ systemctl enable --now srv-openhab2-userdata.mount 
OK

$ create_mount /var/log/openhab2 logs 
2020-10-20_16:40:31_CEST [openHABian] Creating mount /var/log/openhab2 in '/srv/openhab2-logs'... 
$ systemctl enable --now srv-openhab2-logs.mount 
OK

$ create_mount /usr/share/openhab2/addons addons 
2020-10-20_16:40:32_CEST [openHABian] Creating mount /usr/share/openhab2/addons in '/srv/openhab2-addons'... 
$ systemctl enable --now srv-openhab2-addons.mount 
OK
OK
2020-10-20_16:40:34_CEST [openHABian] Restarting ZRAM service... 
$ systemctl restart zram-config.service 
OK
2020-10-20_16:40:42_CEST [openHABian] Restarting Samba service... 
$ systemctl restart smbd.service 
OK
2020-10-20_16:40:43_CEST [openHABian] Applying miscellaneous system settings... Setting Java and arping file capabilites

$ setcap cap_net_raw,cap_net_admin=+eip cap_net_bind_service=+ep /opt/jdk/zulu8.48.3.246-ca-jdk8.0.265-linux_aarch32hf/bin/java 

$ setcap cap_net_raw,cap_net_admin=+eip cap_net_bind_service=+ep /usr/sbin/arping 
Creating a README note for end user's home folder
Creating SSH key files

$ mkdir -p /home/openhabian/.ssh 

$ chmod 700 /home/openhabian/.ssh 

$ touch /home/openhabian/.ssh/authorized_keys 

$ chmod 600 /home/openhabian/.ssh/authorized_keys 

$ chown -R openhabian:openhabian /home/openhabian/.ssh 
Creating persistent systemd journal folder location: /var/log/journal

$ mkdir -p /var/log/journal 

$ systemd-tmpfiles --create --prefix /var/log/journal 
[/usr/lib/tmpfiles.d/fail2ban-tmpfiles.conf:1] Line references path below legacy directory /var/run/, updating /var/run/fail2ban → /run/fail2ban; please update the tmpfiles.d/ drop-in file accordingly.
Keeping at most 30 days of systemd journal entries

$ journalctl --vacuum-time=30d 
Vacuuming done, freed 0B of archived journals from /var/log/journal/0aa54ba631f940e59007b63f90038a80.
Setting a distinguishable apt User-Agent
OK
2020-10-20_16:40:52_CEST [openHABian] Checking for default openHABian username:password combination... OK
2020-10-20_16:40:52_CEST [openHABian] We hope you got what you came for! See you again soon ;)

So now it worked without flaws.

[mstormi]

There's no /usr/lib/tmpfiles.d/fail2ban-tmpfiles.conf on a new openHABian box so that's just an artifact of your system. (and just a warning, no?) Closing as there's no need to change anything.

[shutterfreak]

I indeed installed fail2ban after enabling remote SSH access on my box as a precautionary measure.