File: debian-initd

package info (click to toggle)
fail2ban 0.10.2-2~bpo9+1
  • links: PTS, VCS
  • area: main
  • in suites: stretch-backports
  • size: 3,564 kB
  • sloc: python: 17,464; sh: 559; xml: 352; perl: 344; makefile: 196
file content (248 lines) | stat: -rwxr-xr-x 6,712 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
#! /bin/sh
### BEGIN INIT INFO
# Provides:          fail2ban
# Required-Start:    $local_fs $remote_fs
# Required-Stop:     $local_fs $remote_fs
# Should-Start:      $time $network $syslog $named iptables firehol shorewall ipmasq arno-iptables-firewall iptables-persistent ferm ufw
# Should-Stop:       $network $syslog $named iptables firehol shorewall ipmasq arno-iptables-firewall iptables-persistent ferm ufw
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start/stop fail2ban
# Description:       Start/stop fail2ban, a daemon scanning the log files and
#                    banning potential attackers.
### END INIT INFO

# Author: Aaron Isotton <aaron@isotton.com>
# Modified: by Yaroslav Halchenko <debian@onerussian.com>
#  reindented + minor corrections + to work on sarge without modifications
# Modified: by Glenn Aaldering <glenn@openvideo.nl>
#  added exit codes for status command
# Modified: by Juan Karlo de Guzman <jkarlodg@gmail.com>
#  corrected the DAEMON's path and the SOCKFILE
#  rename this file: (sudo) mv /etc/init.d/fail2ban.init /etc/init.d/fail2ban
#  same with the logrotate file: (sudo) mv /etc/logrotate.d/fail2ban.logrotate /etc/logrotate.d/fail2ban
#
PATH=/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin
DESC="authentication failure monitor"
NAME=fail2ban

# fail2ban-client is not a daemon itself but starts a daemon and
# loads its with configuration
DAEMON=/usr/bin/$NAME-client
SCRIPTNAME=/etc/init.d/$NAME

# Ad-hoc way to parse out socket file name
SOCKFILE=`grep -h '^[^#]*socket *=' /etc/$NAME/$NAME.conf /etc/$NAME/$NAME.local 2>/dev/null \
          | tail -n 1 | sed -e 's/.*socket *= *//g' -e 's/ *$//g'`
[ -z "$SOCKFILE" ] && SOCKFILE='/var/run/fail2ban.sock'

# Exit if the package is not installed
[ -x "$DAEMON" ] || exit 0

# Run as root by default.
FAIL2BAN_USER=root

# Read configuration variable file if it is present
[ -r /etc/default/$NAME ] && . /etc/default/$NAME
DAEMON_ARGS="$FAIL2BAN_OPTS"

# Load the VERBOSE setting and other rcS variables
[ -f /etc/default/rcS ] && . /etc/default/rcS

# Predefine what can be missing from lsb source later on -- necessary to run
# on sarge. Just present it in a bit more compact way from what was shipped
log_daemon_msg () {
	[ -z "$1" ] && return 1
	echo -n "$1:"
	[ -z "$2" ] || echo -n " $2"
}

# Define LSB log_* functions.
# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
# Actually has to (>=2.0-7) present in sarge. log_daemon_msg is predefined
#  so we must be ok
. /lib/lsb/init-functions

#
# Shortcut function for abnormal init script interruption
#
report_bug()
{
	echo $*
	echo "Please submit a bug report to Debian BTS (reportbug fail2ban)"
	exit 1
}

#
# Helper function to check if socket is present, which is often left after
# abnormal exit of fail2ban and needs to be removed
#
check_socket()
{
	# Return
	#	0 if socket is present and readable
	#	1 if socket file is not present
	#	2 if socket file is present but not readable
	#	3 if socket file is present but is not a socket
	[ -e "$SOCKFILE" ] || return 1
	[ -r "$SOCKFILE" ] || return 2
	[ -S "$SOCKFILE" ] || return 3
	return 0
}

#
# Function that starts the daemon/service
#
do_start()
{
	# Return
	#	0 if daemon has been started
	#	1 if daemon was already running
	#	2 if daemon could not be started
	do_status && return 1

	if [ -e "$SOCKFILE" ]; then
		log_failure_msg "Socket file $SOCKFILE is present"
		[ "$1" = "force-start" ] \
			&& log_success_msg "Starting anyway as requested" \
			|| return 2
		DAEMON_ARGS="$DAEMON_ARGS -x"
	fi

	# Assure that /var/run/fail2ban exists
	[ -d /var/run/fail2ban ] || mkdir -p /var/run/fail2ban

	if [ "$FAIL2BAN_USER" != "root" ]; then
		# Make the socket directory, IP lists and fail2ban log
		# files writable by fail2ban
		chown "$FAIL2BAN_USER" /var/run/fail2ban
		# Create the logfile if it doesn't exist
		touch /var/log/fail2ban.log
		chown "$FAIL2BAN_USER" /var/log/fail2ban.log
		find /proc/net/xt_recent -name 'fail2ban-*' -exec chown "$FAIL2BAN_USER" {} \;
	fi

	start-stop-daemon --start --quiet --chuid "$FAIL2BAN_USER" --exec $DAEMON -- \
		$DAEMON_ARGS start > /dev/null\
		|| return 2

	return 0
}


#
# Function that checks the status of fail2ban and returns
# corresponding code
#
do_status()
{
	$DAEMON ping > /dev/null 2>&1
	return $?
}

#
# Function that stops the daemon/service
#
do_stop()
{
	# Return
	#	0 if daemon has been stopped
	#	1 if daemon was already stopped
	#	2 if daemon could not be stopped
	#	other if a failure occurred
	$DAEMON status > /dev/null 2>&1 || return 1
	$DAEMON stop > /dev/null || return 2

	# now we need actually to wait a bit since it might take time
	# for server to react on client's stop request. Especially
	# important for restart command on slow boxes
	count=1
	while do_status && [ $count -lt 60 ]; do
		sleep 1
		count=$(($count+1))
	done
	[ $count -lt 60 ] || return 3 # failed to stop

	return 0
}

#
# Function to reload configuration
#
do_reload() {
	$DAEMON reload > /dev/null && return 0 || return 1
	return 0
}

# yoh:
# shortcut function to don't duplicate case statements and to don't use
# bashisms (arrays). Fixes #368218
#
log_end_msg_wrapper()
{
	if [ "$3" != "no" ]; then
		[ $1 -lt $2 ] && value=0 || value=1
		log_end_msg $value
	fi
}

command="$1"
case "$command" in
	start|force-start)
		[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
		do_start "$command"
		log_end_msg_wrapper $? 2 "$VERBOSE"
		;;

	stop)
		[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
		do_stop
		log_end_msg_wrapper $? 2 "$VERBOSE"
		;;

	restart|force-reload)
		log_daemon_msg "Restarting $DESC" "$NAME"
		do_stop
		case "$?" in
			0|1)
				do_start
				log_end_msg_wrapper $? 1 "always"
				;;
			*)
				# Failed to stop
				log_end_msg 1
				;;
 		esac
		;;

	reload|force-reload)
        log_daemon_msg "Reloading $DESC" "$NAME"
        do_reload
        log_end_msg $?
        ;;

	status)
		log_daemon_msg "Status of $DESC"
		do_status
		case $? in
			0)  log_success_msg " $NAME is running" ;;
			255)
				check_socket
				case $? in
					1)  log_failure_msg " $NAME is not running" && exit 3 ;;
					0)  log_failure_msg " $NAME is not running but $SOCKFILE exists" && exit 3 ;;
					2)  log_failure_msg " $SOCKFILE not readable, status of $NAME is unknown" && exit 3 ;;
					3)  log_failure_msg " $SOCKFILE exists but not a socket, status of $NAME is unknown" && exit 3 ;;
					*)  report_bug "Unknown return code from $NAME:check_socket." && exit 4 ;;
				esac
				;;
			*)  report_bug "Unknown $NAME status code" && exit 4
		esac
		;;
	*)
		echo "Usage: $SCRIPTNAME {start|force-start|stop|restart|force-reload|status}" >&2
		exit 3
		;;
esac

: