0

I have a Raspberry Pi where the Raspbian stretch (just updated and upgraded) is set to read-only (https://hallard.me/raspberry-pi-read-only/). I installed fail2ban using apt-get install fail2ban. The installation went withoug problems, but starting the service fails. Error is the following:

user@raspberrypi(ro):~$ sudo systemctl status fail2ban.service
● fail2ban.service - Fail2Ban Service
   Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sat 2018-06-30 22:32:51 CEST; 53s ago
     Docs: man:fail2ban(1)
  Process: 721 ExecStart=/usr/bin/fail2ban-client -x start (code=exited, status=255)

Jun 30 22:32:51 raspberrypi systemd[1]: fail2ban.service: Control process  exited, code=exited status=255
Jun 30 22:32:51 raspberrypi systemd[1]: Failed to start Fail2Ban Service.
Jun 30 22:32:51 raspberrypi systemd[1]: fail2ban.service: Unit entered failed state.
Jun 30 22:32:51 raspberrypi systemd[1]: fail2ban.service: Failed with result 'exit-code'.
Jun 30 22:32:51 raspberrypi systemd[1]: fail2ban.service: Service hold-off time over, scheduling restart.
Jun 30 22:32:51 raspberrypi systemd[1]: Stopped Fail2Ban Service.
Jun 30 22:32:51 raspberrypi systemd[1]: fail2ban.service: Start request repeated too quickly.
Jun 30 22:32:51 raspberrypi systemd[1]: Failed to start Fail2Ban Service.
Jun 30 22:32:51 raspberrypi systemd[1]: fail2ban.service: Unit entered failed state.
Jun 30 22:32:51 raspberrypi systemd[1]: fail2ban.service: Failed with result 'exit-code'.

and

user@raspberrypi(ro):~$ journalctl -xe
-- Unit fail2ban.service has begun starting up.
Jun 30 22:39:46 raspberrypi fail2ban-client[1590]: ERROR  There is no directory /var/run/fail2ban to contain the socket file /var/run/fail2ban/fail2ban.sock.
Jun 30 22:39:46 raspberrypi systemd[1]: fail2ban.service: Control process exited, code=exited status=255
Jun 30 22:39:46 raspberrypi systemd[1]: Failed to start Fail2Ban Service.
-- Subject: Unit fail2ban.service has failed
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- Unit fail2ban.service has failed.
--
-- The result is failed.
Jun 30 22:39:46 raspberrypi systemd[1]: fail2ban.service: Unit entered failed state.
Jun 30 22:39:46 raspberrypi systemd[1]: fail2ban.service: Failed with result 'exit-code'.
Jun 30 22:39:46 raspberrypi systemd[1]: fail2ban.service: Service hold-off time over, scheduling restart.
Jun 30 22:39:46 raspberrypi systemd[1]: Stopped Fail2Ban Service.
-- Subject: Unit fail2ban.service has finished shutting down
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- Unit fail2ban.service has finished shutting down.
Jun 30 22:39:46 raspberrypi systemd[1]: Starting Fail2Ban Service...
-- Subject: Unit fail2ban.service has begun start-up
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- Unit fail2ban.service has begun starting up.
Jun 30 22:39:48 raspberrypi fail2ban-client[1612]: ERROR  There is no directory /var/run/fail2ban to contain the socket file /var/run/fail2ban/fail2ban.sock.
Jun 30 22:39:48 raspberrypi systemd[1]: fail2ban.service: Control process exited, code=exited status=255
Jun 30 22:39:48 raspberrypi systemd[1]: Failed to start Fail2Ban Service.
-- Subject: Unit fail2ban.service has failed
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- Unit fail2ban.service has failed.
--
-- The result is failed.
Jun 30 22:39:48 raspberrypi systemd[1]: fail2ban.service: Unit entered failed state.
Jun 30 22:39:48 raspberrypi systemd[1]: fail2ban.service: Failed with result 'exit-code'.
Jun 30 22:39:48 raspberrypi systemd[1]: fail2ban.service: Service hold-off time over, scheduling restart.
Jun 30 22:39:48 raspberrypi systemd[1]: Stopped Fail2Ban Service.
-- Subject: Unit fail2ban.service has finished shutting down
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- Unit fail2ban.service has finished shutting down.
Jun 30 22:39:48 raspberrypi systemd[1]: fail2ban.service: Start request repeated too quickly.
Jun 30 22:39:48 raspberrypi systemd[1]: Failed to start Fail2Ban Service.
-- Subject: Unit fail2ban.service has failed
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- Unit fail2ban.service has failed.
--
-- The result is failed.
Jun 30 22:39:48 raspberrypi systemd[1]: fail2ban.service: Unit entered failed state.
Jun 30 22:39:48 raspberrypi systemd[1]: fail2ban.service: Failed with result 'exit-code'.

I guess it has something to do that /var/run is temporary now and is reset with every reboot? If yes, do you guys think there is a way to get around that somehow to get fail2ban running on a read-only fs?

Improve this question
2
  • The installation went withoug problems .... are you sure? – jsotola Jul 1 '18 at 3:54
  • Where do you write your log files? I installed Raspbian ro using busybox memory logging, and I can't figure out how to make fail2ban read from the ring buffer. If I put the real log files on tmpfs I'm afraid it would fill up very quickly. – Elliott B Jul 29 '18 at 22:42
1

The folder /var/run/fail2ban is created during the installation and should be already present for the service to start successfully. You may try to recreate this folder at restart before trying to start fail2ban.

Improve this answer
2
  • I just tried that by having the folder in my home directory and copying it to the designated path for fail2ban at boot. But I think this happens actually after fail2ban was initialised, so it won't work. Is there a way to delay the start of fail2ban or do the cp command earlier during the boot? – BallerNacken Jul 1 '18 at 18:18
  • Okay. Was doing something wrong. Copying the folder to var/run/ with ech boot works just fine. Thx! – BallerNacken Jul 1 '18 at 21:12
1

/var/run is mounted as tmpfs. It's empty when your machine boots.

You have to recreate the folder /var/run/fail2ban manually, with a script or a service during every restart.

Improve this answer
5
  • But why it works on a rw file system? – Ingo Jul 1 '18 at 10:43
  • @Ingo What do you mean exactly? – Dave Jul 1 '18 at 14:58
  • 1
    @Ingo It works on a rw file system, because the folder is not touched. On ro it will be deleted with every reboot. – BallerNacken Jul 1 '18 at 18:19
  • @BallerNacken /run (or the symlink /var/run -> /run) is a tmpfs. See with df /run. At wikpedia - tmpfs I read: "On reboot, everything in tmpfs will be lost." There is no difference between rw or ro filesystem. @Dave And that is what I don't understand. Is the /run directory ro and fail2ban can't create it's directory there as it is doing it on every reboot on a rw file system? What is with the other tmp files there from other applications? Does they all have problems? – Ingo Jul 1 '18 at 22:06
  • @Ingo I do not know which folders are mounted as tmpfs or symlinks in the mentioned case, but yes other applications can also have problems. Mostly when these create folders during the install and then these folders are not available anymore after a reboot. – Dave Jul 2 '18 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.