Fail2ban Mail Failures ???

Home » CentOS » Fail2ban Mail Failures ???
CentOS 5 Comments

I’m using fail2ban with CentOS 6.6. Something is causing fail2ban’s alerts sent to root’s mail to be rejected. Here’s a clip from one of the error messages:

Message 48:
From MAILER-DAEMON@lion.protogeek.org Sun Dec 21 03:09:20 2014
Return-Path:
Date: Sun, 21 Dec 2014 03:09:19 -0600
From: Mail Delivery Subsystem
To: postmaster@lion.protogeek.org
Content-Type: multipart/report; report-type

5 thoughts on - Fail2ban Mail Failures ???

  • Robert G. (Doc) Savage писал 2014-12-26 20:39:

    Check your /etc/fail2ban/jail.local /etc/fail2ban/jail.conf. You have to provide valid email addresses for dest= and sender=
    parameters in sendmail-whois or mail-whois actions for enabled jails.

  • —–Original Message—–
    From: Александр Кириллов
    Reply-to: CentOS mailing list
    To: CentOS mailing list
    Subject: Re: [CentOS] Fail2ban mail failures ???
    Date: Fri, 26 Dec 2014 21:30:39 +0300

    Robert G. (Doc) Savage писал 2014-12-26 20:39:

    Check your /etc/fail2ban/jail.local /etc/fail2ban/jail.conf. You have to provide valid email addresses for dest= and sender=
    parameters in sendmail-whois or mail-whois actions for enabled jails. os.org/mailman/listinfo/CentOS

    Александр Кириллов,

    I should have made it clear that this is all on one machine. The jail.conf file is the default from the fail2ban package. It used to work perfectly, but now has the mail problem. All I’ve had to do for years is install the fail2ban package, start it, and make it autostart whenever I
    reboot. Now it’s misbehaving in a way that puzzles me.

    –Doc Savage
    Fairview Heights, IL

  • Robert,

    If you never changed fail2ban defaults you probably had email aliases defined somewhere in your configurations. Whatever you had it was incorrect and it’s not worth the effort to figure out why it ever worked if at all. The “right” way is to use email addresses in (at least locally) routable domains.

    Alexander

  • Just checking the obvious but can you confirm that you are not actually sending messages to example.com?