Package: fail2ban
Version: 1.1.0-6
Severity: normal

Dear Maintainer,

After changing to Daylight Savings time last Sunday, I see every day in my logs:

2024-10-06 00:20:07,998 fail2ban.server         [5294]: INFO    rollover 
performed on /var/log/fail2ban.log
2024-10-08 12:03:55,320 fail2ban.filter         [5294]: WARNING [sshd] Detected 
a log entry 1h before the current time in operation mode. This looks like a 
timezone problem. Treating such entries as if they just happened.
2024-10-08 12:03:55,320 fail2ban.filter         [5294]: WARNING [sshd] Please 
check a jail for a timing issue. Line with odd timestamp: 
2024-10-08T11:03:55.301723+10:00 login-keg sshd-session[54107]: Accepted 
publickey for USER from IPADDRESS port 38108 ssh2: ED25519 SHA256:KEYHASH

It's as if fail2ban is still running on standard time and 
hasn't noticed the change.  Restarting the fai2ban service fixes the issue.
-- System Information:
Debian Release: trixie/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 6.10.6-amd64 (SMP w/1 CPU thread; PREEMPT)
Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_AU:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages fail2ban depends on:
ii  python3          3.12.5-1
ii  python3-systemd  235-1+b4

Versions of packages fail2ban recommends:
ii  nftables           1.1.0-2
ii  python3-pyinotify  0.9.6-4
ii  whois              5.5.23

Versions of packages fail2ban suggests:
ii  bsd-mailx [mailx]            8.1.2-0.20220412cvs-1
pn  monit                        <none>
ii  rsyslog [system-log-daemon]  8.2406.0-1
pn  sqlite3                      <none>

-- no debconf information

Reply via email to