[Fail2ban-users] Re: Other Problem with Fail2Ban

[Cyril J. <cyr...@bl...>]

Hi,

If I refer to the first e-mail you send me, I notice that the name of
the month changed.

Before:
data=3DDez  1 08:04:19  fmt=3D%b %d %H:%M:%S
After:
data=3DDec 11 04:02:00  fmt=3D%b %d %H:%M:%S

You now have a "Dec" for December. Did you change something related to
locale on your system? With the CVS HEAD version, the locale are set
using your system default. So here, Fail2ban probably wait for "Dez"
(Dezembro) which should be correct for "pt_BR".

Could you try to set the environnement variable LC_ALL to "en_US", "C"
and "POSIX"?

# LC_ALL=3D"en_US" fail2ban -vv

I cc'ed this e-mail to the mailing-list. It is an interesting issue to
discuss ;) So please do not forget to reply to the list too.

Thank you

Cyril

Fernando Jos=E9 wrote:
> Hi again Cyril, i tested the CVS version of fail2ban, and now fail2ban
> its running again.... but... other error has ocurried now, the software
> has running ok but its not blocking not at all... in the logs has other
> error with the data, the error in fail2ban logs its this:
>=20
> 2005-12-17 00:15:25,817 ERROR: Please check the format and your locale
> settings.
> 2005-12-17 00:15:25,818 ERROR: time data did not match format:  data=3D=
Dec
> 17 00:00:00  fmt=3D%b %d %H:%M:%S
> 2005-12-17 00:15:25,819 ERROR: Please check the format and your locale
> settings.
> 2005-12-17 00:15:49,813 ERROR: time data did not match format:  data=3D=
Dec
> 11 04:02:00  fmt=3D%b %d %H:%M:%S
> 2005-12-17 00:15:49,813 ERROR: Please check the format and your locale
> settings.
> 2005-12-17 00:15:49,814 ERROR: time data did not match format:  data=3D=
Dec
> 17 00:15:48  fmt=3D%b %d %H:%M:%S
> 2005-12-17 00:15:49,815 ERROR: Please check the format and your locale
> settings.
> 2005-12-17 00:15:49,816 ERROR: time data did not match format:  data=3D=
Dec
> 17 00:15:48  fmt=3D%b %d %H:%M:%S
> 2005-12-17 00:15:49,816 ERROR: Please check the format and your locale
> settings.
>=20
> Im using new fail2ban.conf from CVS and i tested too with my original
> fail2ban.conf from 0.6.0 version and the error persists, my locale
> settings have this:
>=20
> LANG=3Dpt_BR
> LC_CTYPE=3D"pt_BR"
> LC_NUMERIC=3D"pt_BR"
> LC_TIME=3D"pt_BR"
> LC_COLLATE=3D"pt_BR"
> LC_MONETARY=3D"pt_BR"
> LC_MESSAGES=3D"pt_BR"
> LC_PAPER=3D"pt_BR"
> LC_NAME=3D"pt_BR"
> LC_ADDRESS=3D"pt_BR"
> LC_TELEPHONE=3D"pt_BR"
> LC_MEASUREMENT=3D"pt_BR"
> LC_IDENTIFICATION=3D"pt_BR"
> LC_ALL=3Dpt_BR
>=20
> and in my logs have this:
>=20
> Dec 16 23:59:59 saturno sshd[30882]: Failed password for myuser from
> xxx.xxx.xxx.xxx  port 41473 ssh2
> Dec 17 00:00:00 saturno sshd[30882]: Failed password for myuser from
> xxx.xxx.xxx.xxx  port 41473 ssh2
> Dec 17 00:00:00 saturno sshd(pam_unix)[30882]: 2 more authentication
> failures; logname=3D uid=3D0 euid=3D0 tty=3DNODEVssh ruser=3D
> rhost=3Dmyhost.mydomain  user=3Dmyuser
> Dec 17 00:15:48 saturno sshd(pam_unix)[31324]: authentication failure;
> logname=3D uid=3D0 euid=3D0 tty=3DNODEVssh ruser=3D rhost=3Dmyhost.mydo=
main=20
> user=3Dmyuser
> Dec 17 00:15:48 saturno sshd[31324]: Failed password for myuser from
> xxx.xxx.xxx.xxx  port 43831 ssh2
>=20
> I waiting your return for this message, thanks for your time, and
> sorry... i don't have a minimal time to send my logs (messages arquive)
> for you, but now its here :)
>=20
> PS: in the again i've retired my ips and my users
>=20
> Fernando Jos=E9 - Linux User 357026
>=20
>=20
>=20