novox/mesh-controller
3
0
Fork 0
Code Issues Pull Requests 6 Releases Wiki Activity

A changed jail filter restarts fail2ban #231

Merged
mesh-admin merged 1 commits from jschoubben/jail-filter-restart AGit into main 2026-10-02 21:28:32 +00:00
Conversation 0 Commits 1 Files Changed 2
+38 -2
jschoubben commented 2026-10-02 21:28:25 +00:00
Owner
Copy Link
Copy Source

fail2ban's service restarts on the composed jail file (composed-jails) only. Each jail's filter is a separate file (filter-), so a module that changed only its failregex rewrote the filter on disk while the running jail kept the old pattern, silently. Found when gitea's jail gained sshd patterns (mesh-catalog 232): the filter file updated at 23:24, fail2ban (up since 18:44) kept matching the web login only, and 49 ssh attempts went unbanned. The composed jail file now names each filter's sha256 (12 hex), so a changed pattern changes the jail file and the existing restart covers it. Test: same pattern, same file; changed pattern, changed file. go test ./... passes.

fail2ban's service restarts on the composed jail file (composed-jails) only. Each jail's filter is a separate file (filter-<jail>), so a module that changed only its failregex rewrote the filter on disk while the running jail kept the old pattern, silently. Found when gitea's jail gained sshd patterns (mesh-catalog 232): the filter file updated at 23:24, fail2ban (up since 18:44) kept matching the web login only, and 49 ssh attempts went unbanned. The composed jail file now names each filter's sha256 (12 hex), so a changed pattern changes the jail file and the existing restart covers it. Test: same pattern, same file; changed pattern, changed file. go test ./... passes.
jschoubben added 1 commit 2026-10-02 21:28:26 +00:00
A changed jail filter restarts fail2ban d293a0deaf 
fail2ban restarts when the composed jail file changes, and each filter is
a file of its own, so a module that changed only its failregex left the
running jail on the old pattern. The jail file now names each filter's
digest.
mesh-admin merged commit 06d0a4bfe8 into main 2026-10-02 21:28:32 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
jschoubben miel.truyen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#231