Fail2ban extension hangs: Failed to stop jail action 'iptables-multiport': Error stopping action

Symptoms

• After enabling a jail, the Fail2Ban service can't be restarted or stopped.

• The service status is shown incorrectly, without the jails list:

  # service fail2ban status
  fail2ban-server (pid 3291) is running

• /var/log/fail2ban.log shows that the service stopped when adding log files to its monitoring pool:

  CONFIG_TEXT: fail2ban.filter [25047]: INFO Added logfile = /var/www/vhosts/system/example.com/logs/proxy_access_log
  fail2ban.filter [25047]: INFO Added logfile = /var/www/vhosts/system/example.com/logs/proxy_access_ssl_log

• The following errors may appear in /var/log/fail2ban.log:

  CONFIG_TEXT: fail2ban.action [1130]: ERROR iptables -D INPUT -p tcp -m multiport --dports http,https,7080,7081 -j f2b-BadBots iptables -F f2b-BadBots iptables -X f2b-BadBots -- stdout: ''
  fail2ban.action [1130]: ERROR iptables -D INPUT -p tcp -m multiport --dports http,https,7080,7081 -j f2b-BadBots iptables -F f2b-BadBots iptables -X f2b-BadBots -- stderr: 'iptables: Too many links.\n'
  fail2ban.actions [2497]: ERROR Failed to stop jail 'plesk-wordpress' action 'iptables-multiport': Error stopping action

Cause

This is Plesk bug with ID #PPPM-4692 . It was fixed in Plesk Onyx 17.5.3.
Debian/Ubuntu distributions are not affected by the problem, as they use pyinotify as a monitoring backend.

Resolution

As a workaround, perform the following steps:

1. Connect to the server via SSH.

2. Find the location of database.py file:

   # ls $(ls -d $(ls -d /usr/lib/python2*)/*-packages)/fail2ban/server/database.py
   /usr/lib/python2.7/dist-packages/fail2ban/server/database.py

3. Edit file database.py by adding two lines, as follows:

   CONFIG_TEXT: cur = self._db.cursor()
   cur.execute("PRAGMA foreign_keys = ON;")
   cur.execute("PRAGMA synchronous = OFF;")
   cur.execute("PRAGMA journal_mode = MEMORY;")
   
   try:
   cur.execute("SELECT version FROM fail2banDb LIMIT 1")

4. Stop the fail2ban process and restart the service:

   # kill -9 (ps -ef | grep fail2ban | grep fail2 | grep python | awk '{ print $1 }')
   # service fail2ban restart