Re: [Fail2ban-users] Gam_server vs Polling

[Arthur Dent <misc.lists@bl...>]

On Wed, 2009-12-09 at 13:52 +0000, Arthur Dent wrote:
> Hello All,
> 
> As a result of some investigations I have been doing into getting F2B to play
> nicely with selinux on my Fedora 11 box, I have been advised not to use
> gam_server but to use polling mode instead.
> 
> My question is:
> Is there a performance issue in this choice?
> 
> I have "auto" set as the back-end in my jail.conf which, according to the
> comments will select gam_server if available, otherwise polling.
> 
> As it is, on some of my apache based jails some attacks get as far as 9 or 10
> (obviously script-based) attacks before they get banned, even though "maxtry"
> is set at 3.
> 
> Would this be better or worse with polling (as opposed to gamin)?
> 
> Thanks for all suggestions...
> 
> Mark
> 

Any thoughts - pro or contra?

Mark

[Fail2ban-users] Gam_server vs Polling

[Arthur Dent <misc.lists@bl...>]

Hello All,

As a result of some investigations I have been doing into getting F2B to play
nicely with selinux on my Fedora 11 box, I have been advised not to use
gam_server but to use polling mode instead.

My question is:
Is there a performance issue in this choice?

I have "auto" set as the back-end in my jail.conf which, according to the
comments will select gam_server if available, otherwise polling.

As it is, on some of my apache based jails some attacks get as far as 9 or 10
(obviously script-based) attacks before they get banned, even though "maxtry"
is set at 3.

Would this be better or worse with polling (as opposed to gamin)?

Thanks for all suggestions...

Mark

Re: [Fail2ban-users] Gam_server vs Polling

[Arthur Dent <misc.lists@bl...>]

On Wed, 2009-12-09 at 13:52 +0000, Arthur Dent wrote:
> Hello All,
> 
> As a result of some investigations I have been doing into getting F2B to play
> nicely with selinux on my Fedora 11 box, I have been advised not to use
> gam_server but to use polling mode instead.
> 
> My question is:
> Is there a performance issue in this choice?
> 
> I have "auto" set as the back-end in my jail.conf which, according to the
> comments will select gam_server if available, otherwise polling.
> 
> As it is, on some of my apache based jails some attacks get as far as 9 or 10
> (obviously script-based) attacks before they get banned, even though "maxtry"
> is set at 3.
> 
> Would this be better or worse with polling (as opposed to gamin)?
> 
> Thanks for all suggestions...
> 
> Mark
> 

Any thoughts - pro or contra?

Mark

Re: [Fail2ban-users] Gam_server vs Polling

[Cyril Jaquier <cyril.jaquier@fa...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Mark (or Arthur!?),

> As a result of some investigations I have been doing into getting F2B to play
> nicely with selinux on my Fedora 11 box, I have been advised not to use
> gam_server but to use polling mode instead.
> 
> My question is:
> Is there a performance issue in this choice?
> 

It depends. If the files get a lot of modifications (e.g. lots of hits
in Apache), then polling may be better in term of CPU usage. The polling
time is set to 1 second so if the file is modified more often than
once/second, polling would be a reasonable choice. On the other hand,
the "reaction" time is ~1 second (worst case) which may be quite long
for automated break-in attempts. Using gamin improves this a bit (it
reacts on file modification) but "maxretry" could also get exceeded.

Btw I will look at this SELinux issue.

Regards,
Cyril

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAksoCz8ACgkQlYy8cEwUMaRVmACfSxqs5djtMh48h9eBJd+f+zu1
o7AAnAlGrFyteQlqeaoDeD3nfbhnksIm
=uPAY
-----END PGP SIGNATURE-----

Re: [Fail2ban-users] Gam_server vs Polling

[Cyril Jaquier <cyril.jaquier@fa...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Btw I will look at this SELinux issue.
> 

So I had a look at this SELinux issue. People seems to have had
interesting discussions about it :-) I committed a patch that should
already be integrated into Fedora:

https://bugzilla.redhat.com/show_bug.cgi?id=230191#c24

and found this:

http://www.mail-archive.com/gamin-list@.../msg00475.html
https://bugzilla.redhat.com/show_bug.cgi?id=437633

I also tried the set CLOEXEC on the socket in asyncserver.py like this:

Index: asyncserver.py
===================================================================
- --- asyncserver.py	(revision 750)
+++ asyncserver.py	(working copy)
@@ -126,6 +126,10 @@
 				raise AsyncServerException("Server already running")
 		# Creates the socket.
 		self.create_socket(socket.AF_UNIX, socket.SOCK_STREAM)
+		# Set the file descriptor to be FD_CLOEXEC
+		import fcntl
+		fd = self.socket.fileno()
+		fcntl.fcntl(fd, fcntl.F_SETFD, fd | fcntl.FD_CLOEXEC)
 		self.set_reuse_addr()
 		try:
 			self.bind(sock)

but this does not seem to work (I would expect CX in the FILE-FLAG list):

COMMAND     PID  USER   FD   TYPE FILE-FLAG             DEVICE SIZE/OFF
   NODE NAME
fail2ban- 27594 cyril    3u  unix     RW,ND 0xffff880065875200      0t0
5510428 /tmp/fail2ban.sock

SELinux and CLOEXEC are quite new to me so I'm not sure about anything
here :/ To clarify the situation a bit:

Arthur, do you still have SELinux issues with fail2ban when using
polling (and not gamin)? For all your jails?

When SELinux people are talking about file descriptor leaks for a socket
in fail2ban are they talking about the socket used by fail2ban-server to
allow the communication with fail2ban-client? Or are they talking about
the sockets created by gamin?

If polling solves this issue, we should probably drop gamin support and
use pyinotify instead.

http://trac.dbzteam.org/pyinotify

Regards,
Cyril

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAksoJAsACgkQlYy8cEwUMaRsVgCffb0UtKwlfkNLgjm7CretDq/p
vGIAn0MLRysRuaAzpA+mClHz0xBkEWXK
=whoG
-----END PGP SIGNATURE-----