lament/pantheon

fail2ban has been deaf for 8 days #114

Merged

lament merged 2 commits from fixes into main

2026-07-26 01:01:57 -05:00

lament commented

2026-07-26 00:55:55 -05:00

Owner

fail2ban has been reading zero journal entries since it started: python3Packages.systemd-python links systemdLibs, which inherits systemdMinimal's withCompression = false - no zstd, so it hard-refuses every journal file (all of them written COMPRESSED-ZSTD) and polls an empty directory forever without ever erroring.
- modules/packages.nix overlays fail2ban onto a python3 whose systemd-python builds against systemdLibs.override { withCompression = true; }. no module change needed - services.fail2ban.package already defaults to pkgs.fail2ban.
- 8 days blind on athena: 248 postfix + 1128 dovecot auth failures, every jail stuck at Total failed: 0.
dovecot 2.4 also rewrote its disconnect log line, so even a working reader missed every real hit: filter expected 2.3's Aborted login (auth failed...), dovecot now emits Login aborted: Connection closed (...) (auth_failed): user=....
- dovecot.local filter appended via environment.etc (module exposes no filters option), keyed on the new parenthesised tags rather than the prose ahead of them.
- bans auth_failed + aggressive-mode no_auth_attempts; deliberately leaves tls_handshake_not_finished and process_full alone (client-side TLS failures / our own login-process cap, not attacker signal).

left for later: bans aren't retroactive, fail2ban seeks to now on start - verify post-deploy with fail2ban-client status dovecot, Total failed should climb off 0 (~380/day inbound).

- `fail2ban` has been reading zero journal entries since it started: `python3Packages.systemd-python` links `systemdLibs`, which inherits `systemdMinimal`'s `withCompression = false` - no zstd, so it hard-refuses every journal file (all of them written `COMPRESSED-ZSTD`) and polls an empty directory forever without ever erroring. - `modules/packages.nix` overlays `fail2ban` onto a `python3` whose `systemd-python` builds against `systemdLibs.override { withCompression = true; }`. no module change needed - `services.fail2ban.package` already defaults to `pkgs.fail2ban`. - 8 days blind on athena: 248 postfix + 1128 dovecot auth failures, every jail stuck at `Total failed: 0`. - dovecot 2.4 also rewrote its disconnect log line, so even a working reader missed every real hit: filter expected 2.3's `Aborted login (auth failed...)`, dovecot now emits `Login aborted: Connection closed (...) (auth_failed): user=...`. - `dovecot.local` filter appended via `environment.etc` (module exposes no `filters` option), keyed on the new parenthesised tags rather than the prose ahead of them. - bans `auth_failed` + aggressive-mode `no_auth_attempts`; deliberately leaves `tls_handshake_not_finished` and `process_full` alone (client-side TLS failures / our own login-process cap, not attacker signal). left for later: bans aren't retroactive, fail2ban seeks to now on start - verify post-deploy with `fail2ban-client status dovecot`, `Total failed` should climb off 0 (~380/day inbound).

lament added 2 commits

2026-07-26 00:55:56 -05:00

fail2ban has been deaf for 8 days: its libsystemd cannot read a compressed journal 2db43c6613

dovecot 2.4 renamed every disconnect line out from under the f2b filter

CI / check (pull_request) Successful in 56s

Details

CI / deploy (pull_request) Has been skipped

Details

CI / build (pull_request) Successful in 4m24s

Details

CI / dry-activate (pull_request) Successful in 33s

Details