Fail2Ban starts and then stops – sends email

Hi,

I have VitalPBX installed on as a VM on VMWare Version 2.02-2.

Fail2Ban starts and then appears to stop and restarts sending an email notification. Did this 600+ times overnight according to the number of emails.

Ran command…

# fail2ban-client status asterisk

RESULT…

ERROR Failed to access socket path: /var/run/fail2ban/fail2ban.sock. Is fail2ban running? Traceback (most recent call last): File “/usr/bin/fail2ban-client”, line 472, in <module> if client.start(sys.argv): File “/usr/bin/fail2ban-client”, line 442, in start return self.__processCommand(args) File “/usr/bin/fail2ban-client”, line 281, in __processCommand return self.__processCmd([cmd]) File “/usr/bin/fail2ban-client”, line 185, in __processCmd client.close() File “/usr/lib/python2.7/site-packages/fail2ban/client/csocket.py”, line 55, in close self.__csock.sendall(CSPROTO.CLOSE + CSPROTO.END) File “/usr/lib64/python2.7/socket.py”, line 224, in meth return getattr(self._sock,name)(*args) socket.error: [Errno 32] Broken pipe

Last cycle from log file follows…

2018-12-04 09:47:15,909 fail2ban.filter [5364]: INFO Set findtime = 60 2018-12-04 09:47:16,052 fail2ban.jail [5364]: INFO Jail ‘sshd’ started 2018-12-04 09:47:16,060 fail2ban.jail [5364]: INFO Jail ‘sshd-ddos’ started 2018-12-04 09:47:16,061 fail2ban.filtersystemd [5364]: NOTICE Jail started without ‘journalmatch’ set. Jail regexs will be checked against all journal ent$ 2018-12-04 09:47:16,102 fail2ban.jail [5364]: INFO Jail ‘dropbear’ started 2018-12-04 09:47:16,195 fail2ban.jail [5364]: INFO Jail ‘apache-auth’ started 2018-12-04 09:47:16,232 fail2ban.jail [5364]: INFO Jail ‘apache-badbots’ started 2018-12-04 09:47:16,267 fail2ban.jail [5364]: INFO Jail ‘apache-overflows’ started 2018-12-04 09:47:16,270 fail2ban.jail [5364]: INFO Jail ‘apache-modsecurity’ started 2018-12-04 09:47:16,273 fail2ban.jail [5364]: INFO Jail ‘apache-shellshock’ started 2018-12-04 09:47:25,962 fail2ban.action [5364]: ERROR ipset create fail2ban-sshd hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-sshd src -j REJECT –reject-with icmp-port-unreachable — stdout: ” 2018-12-04 09:47:25,963 fail2ban.action [5364]: ERROR ipset create fail2ban-sshd hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-sshd src -j REJECT –reject-with icmp-port-unreachable — stderr: “$ 2018-12-04 09:47:25,963 fail2ban.action [5364]: ERROR ipset create fail2ban-sshd hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-sshd src -j REJECT –reject-with icmp-port-unreachable — returned $ 2018-12-04 09:47:25,963 fail2ban.actions [5364]: ERROR Failed to start jail ‘sshd’ action ‘firewallcmd-ipset’: Error starting action 2018-12-04 09:47:25,964 fail2ban.actions [5364]: NOTICE [sshd] Ban 1.245.161.226 2018-12-04 09:47:28,018 fail2ban.action [5364]: ERROR ipset create fail2ban-sshd-ddos hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-sshd-ddos src -j REJECT –reject-with icmp-port-unreachable — stdo$ 2018-12-04 09:47:28,018 fail2ban.action [5364]: ERROR ipset create fail2ban-sshd-ddos hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-sshd-ddos src -j REJECT –reject-with icmp-port-unreachable — stde$ 2018-12-04 09:47:28,019 fail2ban.action [5364]: ERROR ipset create fail2ban-sshd-ddos hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-sshd-ddos src -j REJECT –reject-with icmp-port-unreachable — retu$ 2018-12-04 09:47:28,019 fail2ban.actions [5364]: ERROR Failed to start jail ‘sshd-ddos’ action ‘firewallcmd-ipset’: Error starting action 2018-12-04 09:47:29,378 fail2ban.action [5364]: ERROR ipset create fail2ban-dropbear hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-dropbear src -j REJECT –reject-with icmp-port-unreachable — stdou$ 2018-12-04 09:47:29,379 fail2ban.action [5364]: ERROR ipset create fail2ban-dropbear hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-dropbear src -j REJECT –reject-with icmp-port-unreachable — stder$ 2018-12-04 09:47:29,379 fail2ban.action [5364]: ERROR ipset create fail2ban-dropbear hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-dropbear src -j REJECT –reject-with icmp-port-unreachable — retur$ 2018-12-04 09:47:29,380 fail2ban.actions [5364]: ERROR Failed to start jail ‘dropbear’ action ‘firewallcmd-ipset’: Error starting action 2018-12-04 09:47:29,862 fail2ban.filter [5364]: INFO [asterisk] Found 5.62.41.34 2018-12-04 09:47:29,863 fail2ban.filter [5364]: INFO [asterisk] Found 5.62.41.34 2018-12-04 09:47:34,829 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-auth hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-auth src -j REJECT –reject-with icmp-port-unreachable — st$ 2018-12-04 09:47:34,830 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-auth hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-auth src -j REJECT –reject-with icmp-port-unreachable — st$ 2018-12-04 09:47:34,830 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-auth hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-auth src -j REJECT –reject-with icmp-port-unreachable — re$ 2018-12-04 09:47:34,830 fail2ban.actions [5364]: ERROR Failed to start jail ‘apache-auth’ action ‘firewallcmd-ipset’: Error starting action 2018-12-04 09:47:37,927 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-overflows hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-overflows src -j REJECT –reject-with icmp-port-unreachable $ 2018-12-04 09:47:37,927 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-overflows hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-overflows src -j REJECT –reject-with icmp-port-unreachable $ 2018-12-04 09:47:37,927 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-overflows hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-overflows src -j REJECT –reject-with icmp-port-unreachable $ 2018-12-04 09:47:37,928 fail2ban.actions [5364]: ERROR Failed to start jail ‘apache-overflows’ action ‘firewallcmd-ipset’: Error starting action 2018-12-04 09:47:39,749 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-modsecurity hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-modsecurity src -j REJECT –reject-with icmp-port-unreachabl$ 2018-12-04 09:47:39,750 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-modsecurity hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-modsecurity src -j REJECT –reject-with icmp-port-unreachabl$ 2018-12-04 09:47:39,750 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-modsecurity hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-modsecurity src -j REJECT –reject-with icmp-port-unreachabl$ 2018-12-04 09:47:39,750 fail2ban.actions [5364]: ERROR Failed to start jail ‘apache-modsecurity’ action ‘firewallcmd-ipset’: Error starting action 2018-12-04 09:47:42,525 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-shellshock hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-shellshock src -j REJECT –reject-with icmp-port-unreachable$ 2018-12-04 09:47:42,526 fail2ban.action [5364]: ERR
OR ipset create fail2ban-apache-shellshock hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-shellshock src -j REJECT –reject-with icmp-port-unreachable$ 2018-12-04 09:47:42,526 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-shellshock hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-shellshock src -j REJECT –reject-with icmp-port-unreachable$ 2018-12-04 09:47:42,526 fail2ban.actions [5364]: ERROR Failed to start jail ‘apache-shellshock’ action ‘firewallcmd-ipset’: Error starting action 2018-12-04 09:51:44,716 fail2ban.server [5364]: INFO Stopping all jails firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-auth src -j REJECT –reject-with icmp-port-unreachable — st$ 2018-12-04 09:47:34,830 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-auth hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-auth src -j REJECT –reject-with icmp-port-unreachable — re$ 2018-12-04 09:47:34,830 fail2ban.actions [5364]: ERROR Failed to start jail ‘apache-auth’ action ‘firewallcmd-ipset’: Error starting action 2018-12-04 09:47:37,927 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-overflows hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-overflows src -j REJECT –reject-with icmp-port-unreachable $ 2018-12-04 09:47:37,927 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-overflows hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-overflows src -j REJECT –reject-with icmp-port-unreachable $ firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-auth src -j REJECT –reject-with icmp-port-unreachable — st$ 2018-12-04 09:47:34,830 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-auth hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-auth src -j REJECT –reject-with icmp-port-unreachable — re$ 2018-12-04 09:47:34,830 fail2ban.actions [5364]: ERROR Failed to start jail ‘apache-auth’ action ‘firewallcmd-ipset’: Error starting action 2018-12-04 09:47:37,927 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-overflows hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-overflows src -j REJECT –reject-with icmp-port-unreachable $ 2018-12-04 09:47:37,927 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-overflows hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-overflows src -j REJECT –reject-with icmp-port-unreachable $ 2018-12-04 09:47:37,927 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-overflows hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-overflows src -j REJECT –reject-with icmp-port-unreachable $ 2018-12-04 09:47:37,927 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-overflows hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-overflows src -j REJECT –reject-with icmp-port-unreachable $ 2018-12-04 09:47:37,927 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-overflows hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-overflows src -j REJECT –reject-with icmp-port-unreachable $ 2018-12-04 09:47:37,928 fail2ban.actions [5364]: ERROR Failed to start jail ‘apache-overflows’ action ‘firewallcmd-ipset’: Error starting action 2018-12-04 09:47:39,749 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-modsecurity hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-modsecurity src -j REJECT –reject-with icmp-port-unreachabl$ 2018-12-04 09:47:39,750 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-modsecurity hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-modsecurity src -j REJECT –reject-with icmp-port-unreachabl$ 2018-12-04 09:47:39,750 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-modsecurity hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-modsecurity src -j REJECT –reject-with icmp-port-unreachabl$ 2018-12-04 09:47:39,750 fail2ban.actions [5364]: ERROR Failed to start jail ‘apache-modsecurity’ action ‘firewallcmd-ipset’: Error starting action 2018-12-04 09:47:42,525 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-shellshock hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-shellshock src -j REJECT –reject-with icmp-port-unreachable$ 2018-12-04 09:47:42,526 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-shellshock hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-shellshock src -j REJECT –reject-with icmp-port-unreachable$ 2018-12-04 09:47:42,526 fail2ban.action [5364]: ERROR ipset create fail2ban-apache-shellshock hash:ip timeout -1 firewall-cmd –direct –add-rule ipv4 filter ombu_fail2ban 0 -m set –match-set fail2ban-apache-shellshock src -j REJECT –reject-with icmp-port-unreachable$ 2018-12-04 09:47:42,526 fail2ban.actions [5364]: ERROR Failed to start jail ‘apache-shellshock’ action ‘firewallcmd-ipset’: Error starting action 2018-12-04 09:51:44,716 fail2ban.server [5364]: INFO Stopping all jails