XCP-ng（基于CentOS的Xen服务器）上Fail2Ban服务频繁崩溃无法稳定运行求助

各位大佬好，我在XCP-ng 8.3 alpha2上折腾Fail2Ban的时候遇到了棘手的问题——服务总是刚启动就被杀死，反复几次后触发启动限制直接失败了，实在找不到原因，来求助大家！

我的操作过程 #

1. 源码安装Fail2Ban #

因为系统默认的RHEL仓库是关闭的，我选择从源码安装了Fail2Ban 1.0.2，步骤如下：

wget https://github.com/fail2ban/fail2ban/archive/refs/tags/1.0.2.tar.gz
tar xzf 1.0.2.tar.gz
cd fail2ban-1.0.2/
sudo python setup.py install

安装全程没报错，看起来一切正常。

2. 配置规则与服务文件 #

我先修改了/etc/fail2ban/jail.conf，只启用了sshd的封禁规则：

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/secure
maxretry = 3
bantime = 1800

然后手动创建了systemd服务文件/etc/systemd/system/fail2ban.service，内容是：

[Unit]
Description=Fail2Ban Service
After=network.target

[Service]
Type=simple
ExecStart=/usr/bin/fail2ban-server -s /var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail2ban.pid -x
Restart=always
PrivateDevices=yes
PrivateTmp=yes
ProtectHome=read-only
ProtectSystem=strict
ReadWritePaths=-/var/run/fail2ban
ReadWritePaths=-/var/lib/fail2ban
ReadWritePaths=-/var/log/fail2ban
ReadWritePaths=-/var/spool/postfix/maildrop
ReadWritePaths=/run/xtables.lock
CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW

[Install]
WantedBy=multi-user.target

[Definition]
logtarget = /var/log/fail2ban/fail2ban.log

3. 启动后出现的问题 #

我执行了以下命令启动并启用服务：

sudo systemctl start fail2ban.service
sudo systemctl enable fail2ban.service

奇怪的是，虽然从/var/log/secure里能看到几秒钟内就有IP被封禁，但服务会立刻被杀死，反复几次后就触发了启动限制。

执行sudo systemctl status fail2ban.service的输出：

fail2ban.service - Fail2Ban Service
Loaded: loaded (/etc/systemd/system/fail2ban.service; disabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Fri 2023-05-05 14:49:02 CEST; 6h ago
Main PID: 3747 (code=exited, status=0/SUCCESS)

查看/var/log/fail2ban.log，日志显示服务启动后马上就开始关闭，没有明显的错误提示：

2023-05-05 14:49:01,357 fail2ban.server         [3737]: INFO    Starting Fail2ban v1.0.2
2023-05-05 14:49:01,357 fail2ban.server         [3737]: INFO    Daemon started
2023-05-05 14:49:01,357 fail2ban.observer       [3737]: INFO    Observer start...
2023-05-05 14:49:01,367 fail2ban.database       [3737]: INFO    Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
2023-05-05 14:49:01,369 fail2ban.jail           [3737]: INFO    Creating new jail 'sshd'
2023-05-05 14:49:01,372 fail2ban.jail           [3737]: INFO    Jail 'sshd' uses poller {}
2023-05-05 14:49:01,372 fail2ban.jail           [3737]: INFO    Initiated 'polling' backend
2023-05-05 14:49:01,375 fail2ban.filter         [3737]: INFO      maxLines: 1
2023-05-05 14:49:01,396 fail2ban.filter         [3737]: INFO      maxRetry: 3
2023-05-05 14:49:01,396 fail2ban.actions        [3737]: INFO      banTime: 1800
2023-05-05 14:49:01,396 fail2ban.filter         [3737]: INFO    Added logfile: '/var/log/secure' (pos = 4204377, hash = 1758915d47afccac75c40307f4f09edc)
2023-05-05 14:49:01,397 fail2ban.jail           [3737]: INFO    Jail 'sshd' started
2023-05-05 14:49:01,423 fail2ban.server         [3737]: INFO    Shutdown in progress...
2023-05-05 14:49:01,423 fail2ban.observer       [3737]: INFO    Observer stop ... try to end queue 5 seconds
2023-05-05 14:49:01,492 fail2ban.observer       [3737]: INFO    Observer stopped, 0 events remaining.
2023-05-05 14:49:01,523 fail2ban.server         [3737]: INFO    Stopping all jails
2023-05-05 14:49:01,523 fail2ban.filter         [3737]: INFO    Removed logfile: '/var/log/secure'
2023-05-05 14:49:01,599 fail2ban.jail           [3737]: INFO    Jail 'sshd' stopped
2023-05-05 14:49:01,599 fail2ban.database       [3737]: INFO    Connection to database closed.
2023-05-05 14:49:01,599 fail2ban.server         [3737]: INFO    Exiting Fail2ban

现在我完全摸不着头脑，明明启动后已经在工作了，但为什么会立刻自动关闭呢？有没有大佬能帮我分析下问题出在哪？

备注：内容来源于stack exchange，提问作者Richard Burkhardt