From 654fda8a50f65c6b329d75cbac91a50aa5a8a8f5 Mon Sep 17 00:00:00 2001
From: Michael Orlitzky <michael@orlitzky.com>
Date: Sun, 15 Jul 2018 14:08:33 -0400
Subject: [PATCH] files/fail2ban-openrc*: let start-stop-daemon manage the
server.
There are two ways that it would make sense to write the OpenRC
service script for fail2ban:
1. Use the fail2ban-client program to stop, start, reload, etc. the
server; and try to figure out whether or not it worked afterwards.
2. Use the start-stop-daemon program built into OpenRC to manage the
fail2ban-server process. This works only for starting and stopping,
because the "reload" command is sent over an undocumented protocol,
but has the benefit that you get immediate feedback about the result
of calling fail2ban-server.
The existing service script combined the two in a way that appeared to
work, but didn't make too much sense. It used start-stop-daemon to
initiate the fail2ban-client program with either a "start" or "stop"
argument. So long as everything goes fine, that appears to work. But
the start-stop-daemon is not actually monitoring the fail2ban-client
program; it's supposed to be monitoring the fail2ban-server process
that gets started as side-effect.
The existing stop() function does not do quite what you'd expect; for
example the "stop" command is never sent. Again, the daemon does
ultimately get stopped so long as the hard-coded PID file contains
what you think it does -- so it "works" -- but is misleading.
This commit changes everything to use the second approach above, where
start-stop-daemon manages everything. This was done mainly to simplify
the service script, because now the default start() and stop() phases
can be used, allowing us to delete them from our copy. One might worry
that there is some special magic behind "fail2ban-client start" and
"fail2ban-client stop", however that does not appear to be the
case. Admittedly, if in the future those two commands begin to do
something nonstandard, the service script would need to be changed
again to take the first approach above and use fail2ban-client for
everything.
---
files/fail2ban-openrc.conf | 2 +-
files/fail2ban-openrc.init | 31 +++++++++----------------------
2 files changed, 10 insertions(+), 23 deletions(-)
diff --git a/files/fail2ban-openrc.conf b/files/fail2ban-openrc.conf
index 1a2450e2..8493b03c 100644
--- a/files/fail2ban-openrc.conf
+++ b/files/fail2ban-openrc.conf
@@ -1,2 +1,2 @@
-# For available options, plase run "fail2ban-client -h".
+# For available options, plase run "fail2ban-server --help".
#FAIL2BAN_OPTIONS=""
diff --git a/files/fail2ban-openrc.init b/files/fail2ban-openrc.init
index 2de5ae33..21e251db 100755
--- a/files/fail2ban-openrc.init
+++ b/files/fail2ban-openrc.init
@@ -18,13 +18,15 @@
# Author: Sireyessire, Cyril Jaquier
#
-description="Daemon to ban hosts that cause multiple authentication errors"
+description="Ban hosts that cause multiple authentication errors"
description_reload="reload configuration"
extra_started_commands="reload"
-command="/usr/bin/fail2ban-client"
-command_args="${FAIL2BAN_OPTIONS}"
+# The fail2ban-client program is also capable of starting and stopping
+# the server, but things are simpler if we let start-stop-daemon do it.
+command="/usr/bin/fail2ban-server"
pidfile="/run/${RC_SVCNAME}/${RC_SVCNAME}.pid"
+command_args="${FAIL2BAN_OPTIONS} -p ${pidfile}"
retry="30"
depend() {
@@ -34,28 +36,13 @@ depend() {
start_pre() {
checkpath -d "${pidfile%/*}" || return 1
-
- # Remove stale socket after system crash, Gentoo bug 347477
- rm -f /var/run/fail2ban/fail2ban.sock || return 1
-}
-
-start() {
- ebegin "Starting ${RC_SVCNAME}"
-
- start-stop-daemon --start --pidfile "${pidfile}" \
- -- ${command} ${command_args} start
- eend $? "Failed to start ${RC_SVCNAME}"
-}
-
-stop() {
- ebegin "Stopping ${RC_SVCNAME}"
- start-stop-daemon --stop --pidfile "${pidfile}" --retry "${retry}" \
- -- ${command} ${command_args} stop
- eend $? "Failed to stop ${RC_SVCNAME}"
}
reload() {
+ # The fail2ban-client uses an undocumented protocol to tell
+ # the server to reload(), so we have to use it here rather
+ # than e.g. sending a signal to the server daemon.
ebegin "Reloading ${RC_SVCNAME}"
- ${command} ${command_args} reload
+ "${command%/*}/fail2ban-client" ${command_args} reload
eend $? "Failed to reload ${RC_SVCNAME}"
}