disabling entirely named-refused-udp jail with a big fat warning

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@762 a942ae1a-1317-0410-a47c-b1dcaea8d605

.project

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>fail2ban-head</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.python.pydev.PyDevBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.python.pydev.pythonNature</nature>
+	</natures>
+</projectDescription>

.pydevproject

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<?eclipse-pydev version="1.0"?>
+
+<pydev_project>
+<pydev_property name="org.python.pydev.PYTHON_PROJECT_VERSION">python 2.3</pydev_property>
+<pydev_pathproperty name="org.python.pydev.PROJECT_SOURCE_PATH">
+<path>/fail2ban-head/client</path>
+<path>/fail2ban-head/server</path>
+<path>/fail2ban-head/testcases</path>
+<path>/fail2ban-head</path>
+</pydev_pathproperty>
+</pydev_project>

.settings/org.eclipse.core.resources.prefs

@@ -0,0 +1,3 @@
+#Wed Sep 20 22:14:25 GMT 2006
+eclipse.preferences.version=1
+encoding//server/datestrptime.py=UTF-8

CHANGELOG

@@ -1,45 +0,0 @@
-               __      _ _ ___ _               
-              / _|__ _(_) |_  ) |__  __ _ _ _  
-             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
-             |_| \__,_|_|_/___|_.__/\__,_|_||_|
-
-=============================================================
-Fail2Ban (version 0.3.0)                           02/24/2005
-=============================================================
-
-ver. 0.3.0 (02/24/2005) - beta
-----------
-- Re-writting of parts of the code in order to handle several
-  log files with different rules
-- Removed sshd.py because it is no more needed
-- Fixed a bug when exiting with IP in the ban list
-- Added PID lock file
-- Improved some parts of the code
-- Added ipfw-start-rule option (thanks to Robert Edeker)
-- Added -k option which kills a currently running Fail2Ban
-
-ver. 0.1.2 (11/21/2004) - beta
-----------
-- Add ipfw and ipfwadm support. The rules are taken from
-  BlockIt. Thanks to Robert Edeker
-- Add -e option which allows to set the interface. Thanks to
-  Robert Edeker who reminded me this
-- Small code cleaning
-
-ver. 0.1.1 (10/23/2004) - beta
-----------
-- Add SIGTERM handler in order to exit nicely when in daemon
-  mode
-- Add -r option which allows to set the maximum number of
-  login failures
-- Remove the Metalog class as the log file are not so syslog
-  daemon specific
-- Rewrite log reader to be service centered. Sshd support
-  added. Match "Failed password" and "Illegal user"
-- Add /etc/fail2ban.conf configuration support
-- Code documentation
-
-
-ver. 0.1.0 (10/12/2004) - alpha
-----------
-- Initial release

COPYING

@@ -0,0 +1,368 @@
+The following copyright applies to all files present in the Fail2ban package,
+except if a different copyright is explicitly defined in this file.
+
+
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
+
+---------------------------------
+The file server/iso8601.py is licensed under the following terms.
+
+
+Copyright (c) 2007 Michael Twomey
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be included
+in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

ChangeLog

@@ -0,0 +1,423 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.9.0)                           2009/??/??
+=============================================================
+
+ver. 0.9.0 (2009/??/??) - alpha
+----------
+- Added new prefix remover.
+- Added ISO 8601 date/time format.
+- Removed deprecated mail*.conf actions.
+
+ver. 0.8.4 (2009/??/??) - beta
+----------
+- Added "banip" command to fail2ban-client. Manually ban a given IP for a given jail.
+- Added jails lighttpd-fastci and php-url-fopen
+
+ver. 0.8.3 (2008/07/18) - stable
+----------
+- Process failtickets as long as failmanager is not empty.
+- Added "pam-generic" filter and more configuration fixes.
+  Thanks to Yaroslav Halchenko.
+- Fixed socket path in redhat and suse init script. Thanks to
+  Jim Wight.
+- Fixed PID file while started in daemon mode. Thanks to
+  Christian Jobic who submitted a similar patch.
+- Fixed "fail2ban-client get <jail> logpath". Bug #1916986.
+- Changed some log levels.
+- Added gssftpd filter. Thanks to Kevin Zembower.
+- Added "Day/Month/Year Hour:Minute:Second" date template.
+  Thanks to Dennis Winter.
+
+ver. 0.8.2 (2008/03/06) - stable
+----------
+- Fixed named filter. Thanks to Yaroslav Halchenko
+- Fixed wrong path for apache-auth in jail.conf. Thanks to
+  Vincent Deffontaines
+- Fixed timezone bug with epoch date template. Thanks to
+  Michael Hanselmann
+- Added "full line failregex" patch. Thanks to Yaroslav
+  Halchenko. It will be possible to create stronger failregex
+  against log injection
+- Fixed ipfw action script. Thanks to Nick Munger
+- Removed date from logging message when using SYSLOG. Thanks
+  to Iain Lea
+- Fixed "ignore IPs". Only the first value was taken into
+  account. Thanks to Adrien Clerc
+- Moved socket to /var/run/fail2ban.
+- Rewrote the communication server.
+- Refactoring. Reduced number of files.
+- Removed Python 2.4. Minimum required version is now Python
+  2.3.
+- New log rotation detection algorithm.
+- Print monitored files in status.
+- Create a PID file in /var/run/fail2ban/. Thanks to Julien
+  Perez.
+- Fixed "Feb 29" bug. Thanks to James Andrewartha who pointed
+  this out. Thanks to Yaroslav Halchenko for the fix.
+- "reload <jail>" reloads a single jail and the parameters in
+  fail2ban.conf.
+- Added Mac OS/X startup script. Thanks to Bill Heaton.
+- Absorbed some Debian patches. Thanks to Yaroslav Halchenko.
+- Replaced "echo" with "printf" in actions. Fix #1839673
+- Replaced "reject" with "drop" in shorwall action. Fix
+  #1854875
+- Fixed Debian bug #456567, #468477, #462060, #461426
+- readline is now optional in fail2ban-client (not needed in
+  fail2ban-server).
+
+ver. 0.8.1 (2007/08/14) - stable
+----------
+- Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
+- Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko
+- Improved regular expressions. Thanks to Yaroslav Halchenko
+  and others
+- Added sendmail actions. The action started with "mail" are
+  now deprecated. Thanks to Raphaël Marichez
+- Added "ignoreregex" support to fail2ban-regex
+- Updated suse-initd and added it to MANIFEST. Thanks to
+  Christian Rauch
+- Tightening up the pid check in redhat-initd. Thanks to
+  David Nutter
+- Added webmin authentication filter. Thanks to Guillaume
+  Delvit
+- Removed textToDns() which is not required anymore. Thanks
+  to Yaroslav Halchenko
+- Added new action iptables-allports. Thanks to Yaroslav
+  Halchenko
+- Added "named" date format to date detector. Thanks to
+  Yaroslav Halchenko
+- Added filter file for named (bind9). Thanks to Yaroslav
+  Halchenko
+- Fixed vsftpd filter. Thanks to Yaroslav Halchenko
+
+ver. 0.8.0 (2007/05/03) - stable
+----------
+- Fixed RedHat init script. Thanks to Jonathan Underwood
+- Added Solaris 10 files. Thanks to Hanno 'Rince' Wagner
+
+ver. 0.7.9 (2007/04/19) - release candidate
+----------
+- Close opened handlers. Thanks to Yaroslav Halchenko
+- Fixed "reload" bug. Many many thanks to Yaroslav Halchenko
+- Added date format for asctime without year
+- Modified filters config. Thanks to Michael C. Haller
+- Fixed a small bug in mail-buffered.conf
+
+ver. 0.7.8 (2007/03/21) - release candidate
+----------
+- Fixed asctime pattern in datedetector.py
+- Added new filters/actions. Thanks to Yaroslav Halchenko
+- Added Suse init script and modified gentoo-initd. Thanks to
+  Christian Rauch
+- Moved every locking statements in a try..finally block
+
+ver. 0.7.7 (2007/02/08) - release candidate
+----------
+- Added signal handling in fail2ban-client
+- Added a wonderful visual effect when waiting on the server
+- fail2ban-client returns an error code if configuration is
+  not valid
+- Added new filters/actions. Thanks to Yaroslav Halchenko
+- Call Python interpreter directly (instead of using "env")
+- Added file support to fail2ban-regex. Benchmark feature has
+  been removed
+- Added cacti script and template.
+- Added IP list in "status <JAIL>". Thanks to Eric Gerbier
+
+ver. 0.7.6 (2007/01/04) - beta
+----------
+- Added a "sleep 1" in redhat-initd. Thanks to Jim Wight
+- Use /dev/log for SYSLOG output. Thanks to Joerg Sommrey
+- Use numeric output for iptables in "actioncheck"
+- Fixed removal of host in hosts.deny. Thanks to René Berber
+- Added new date format (2006-12-21 06:43:20) and Exim4
+  filter. Thanks to mEDI
+- Several "failregex" and "ignoreregex" are now accepted.
+  Creation of rules should be easier now.
+- Added license in COPYING. Thanks to Axel Thimm
+- Allow comma in action options. The value of the option must
+  be escaped with " or '. Thanks to Yaroslav Halchenko
+- Now Fail2ban goes in /usr/share/fail2ban instead of
+  /usr/lib/fail2ban. This is more compliant with FHS. Thanks
+  to Axel Thimm and Yaroslav Halchenko
+
+ver. 0.7.5 (2006/12/07) - beta
+----------
+- Do not ban a host that is currently banned. Thanks to
+  Yaroslav Halchenko
+- The supported tags in "action(un)ban" are <ip>, <failures>
+  and <time>
+- Fixed refactoring bug (getLastcommand -> getLastAction)
+- Added option "ignoreregex" in filter scripts and jail.conf.
+  Feature Request #1283304
+- Fixed a bug in user defined time regex/pattern
+- Improved documentation
+- Moved version.py and protocol.py to common/
+- Merged "maxtime" option with "findtime"
+- Added "<HOST>" tag support in failregex which matches
+  default IP address/hostname. "(?P<host>\S)" is still valid
+  and supported
+- Fixed exception when calling fail2ban-server with unknown
+  option
+- Fixed Debian bug 400162. The "socket" option is now handled
+  correctly by fail2ban-client
+- Fixed RedHat init script. Thanks to Justin Shore
+- Changed timeout to 30 secondes before assuming the server
+  cannot be started. Thanks to Joël Bertrand
+
+ver. 0.7.4 (2006/11/01) - beta
+----------
+- Improved configuration files. Thanks to Yaroslav Halchenko
+- Added man page for "fail2ban-regex"
+- Moved ban/unban messages from "info" level to "warn"
+- Added "-s" option to specify the socket path and "socket"
+  option in "fail2ban.conf"
+- Added "backend" option in "jail.conf"
+- Added more filters/actions and jail samples. Thanks to Nick
+  Munger, Christoph Haas
+- Improved testing framework
+- Fixed a bug in the return code handling of the executed
+  commands. Thanks to Yaroslav Halchenko
+- Signal handling. There is a bug with join() and signal in
+  Python
+- Better debugging output for "fail2ban-regex"
+- Added support for more date format
+- cPickle does not work with Python 2.5. Use pickle instead
+  (performance is not a problem in our case)
+
+ver. 0.7.3 (2006/09/28) - beta
+----------
+- Added man pages. Thanks to Yaroslav Halchenko
+- Added wildcard support for "logpath"
+- Added Gamin (file and directory monitoring system) support
+- (Re)added "ignoreip" option
+- Added more concurrency protection
+- First attempt at solving bug #1457620 (locale issue)
+- Performance improvements
+- (Re)added permanent banning with banTime < 0
+- Added DNS support to "ignoreip". Feature Request #1285859
+
+ver. 0.7.2 (2006/09/10) - beta
+----------
+- Refactoring and code cleanup
+- Improved client output
+- Added more get/set commands
+- Added more configuration templates
+- Removed "logpath" and "maxretry" from filter templates.
+  They must be defined in jail.conf now
+- Added interactive mode. Use "-i"
+- Added a date detector. "timeregex" and "timepattern" are no
+  more needed
+- Added "fail2ban-regex". This is a tool to help finding
+  "failregex"
+- Improved server communication. Start a new thread for each
+  incoming request. Fail2ban is not really thread-safe yet
+
+ver. 0.7.1 (2006/08/23) - alpha
+----------
+- Fixed daemon mode bug
+- Added Gentoo init.d script
+- Fixed path bug when trying to start "fail2ban-server"
+- Fixed reload command
+
+ver. 0.7.0 (2006/08/23) - alpha
+----------
+- Almost a complete rewrite :) Fail2ban design is really
+  better (IMHO). There is a lot of new features
+- Client/Server architecture
+- Multithreading. Each jail has its own threads: one for the
+  log reading and another for the actions
+- Execute several actions
+- Split configuration files. They are more readable and easy
+  to use
+- failregex uses group (<host>) now. This feature was already
+  present in the Debian package
+- lots of things...
+
+ver. 0.6.1 (2006/03/16) - stable
+----------
+- Added permanent banning. Set banTime to a negative value to
+  enable this feature (-1 is perfect). Thanks to Mannone
+- Fixed locale bug. Thanks to Fernando José
+- Fixed crash when time format does not match data
+- Propagated patch from Debian to fix fail2ban search path 
+  addition to the path search list: now it is added first. 
+  Thanks to Nick Craig-Wood
+- Added SMTP authentification for mail notification. Thanks
+  to Markus Hoffmann
+- Removed debug mode as it is confusing for people
+- Added parsing of timestamp in TAI64N format (#1275325).
+  Thanks to Mark Edgington
+- Added patch #1382936 (Default formatted syslog logging).
+  Thanks to Patrick B�rjesson
+- Removed 192.168.0.0/16 from ignoreip. Attacks could also
+  come from the local network.
+- Robust startup: if iptables module does not get fully
+  initialized after startup of fail2ban, fail2ban will do
+  "maxreinit" attempts to initialize its own firewall. It
+  will sleep between attempts for "polltime" number of
+  seconds (closes Debian: #334272). Thanks to Yaroslav
+  Halchenko
+- Added "interpolations" in fail2ban.conf. This is provided
+  by the ConfigParser module. Old configuration files still
+  work. Thanks to Yaroslav Halchenko
+- Added initial support for hosts.deny and shorewall. Need
+  more testing. Please test. Thanks to kojiro from Gentoo
+  forum for hosts.deny support
+- Added support for vsftpd. Thanks to zugeschmiert
+
+ver. 0.6.0 (2005/11/20) - stable
+----------
+- Propagated patches introduced by Debian maintainer 
+  (Yaroslav Halchenko):
+  * Added an option to report local time (including timezone)
+    or GMT in mail notification.
+
+ver. 0.5.5 (2005/10/26) - beta
+----------
+- Propagated patches introduced by Debian maintainer 
+  (Yaroslav Halchenko):
+  * Introduced fwcheck option to verify consistency of the
+    chains. Implemented automatic restart of fail2ban main
+    function in case check of fwban or fwunban command failed
+    (closes: #329163, #331695). (Introduced patch was further
+    adjusted by upstream author).
+  * Added -f command line parameter for [findtime].
+  * Added a cleanup of firewall rules on emergency shutdown
+    when unknown exception is catched.
+  * Fail2ban should not crash now if a wrong file name is
+    specified in config.
+  * reordered code a bit so that log targets are setup right
+    after background and then only loglevel (verbose, debug)
+    is processed, so the warning could be seen in the logs
+  * Added a keyword <section> in parsing of the subject and
+    the body of an email sent out by fail2ban (closes:
+    #330311)
+
+ver. 0.5.4 (2005/09/13) - beta
+----------
+- Fixed bug #1286222.
+- Propagated patches introduced by Debian maintainer 
+  (Yaroslav Halchenko):
+  * Fixed handling of SYSLOG logging target. Now it can log
+    to any SYSLOG target and facility as directed by the 
+    config
+  * Format of SYSLOG entries fixed to look closer to standard
+  * Fixed errata in config/gentoo-confd
+  * Introduced findtime configuration variable to control the
+    lifetime of caught "failed" log entries
+	
+ver. 0.5.3 (2005/09/08) - beta
+----------
+- Fixed a bug when overriding "maxfailures" or "bantime".
+  Thanks to Yaroslav Halchenko
+- Added more debug output if an error occurs when sending
+  mail. Thanks to Stephen Gildea
+- Renamed "maxretry" to "maxfailures" and changed default
+  value to 5. Thanks to Stephen Gildea
+- Hopefully fixed bug #1256075
+- Fixed bug #1262345
+- Fixed exception handling in PIDLock
+- Removed warning when using "-V" or "-h" with no config
+  file. Thanks to Yaroslav Halchenko
+- Removed "-i eth0" from config file. Thanks to Yaroslav
+  Halchenko
+
+ver. 0.5.2 (2005/08/06) - beta
+----------
+- Better PID lock file handling. Should close #1239562
+- Added man pages
+- Removed log4py dependency. Use logging module instead
+- "maxretry" and "bantime" can be overridden in each section
+- Fixed bug #1246278 (excessive memory usage)
+- Fixed crash on wrong option value in configuration file
+- Changed custom chains to lowercase
+
+ver. 0.5.1 (2005/07/23) - beta
+----------
+- Fixed bugs #1241756, #1239557
+- Added log targets in configuration file. Removed -l option
+- Changed iptables rules in order to create a separated chain
+  for each section
+- Fixed static banList in firewall.py
+- Added an initd script for Debian. Thanks to Yaroslav
+  Halchenko
+- Check for obsolete files after install
+
+ver. 0.5.0 (2005/07/12) - beta
+----------
+- Added support for CIDR mask in ignoreip
+- Added mail notification support
+- Fixed bug #1234699
+- Added tags replacement in rules definition. Should allow a
+  clean solution for Feature Request #1229479
+- Removed "interface" and "firewall" options
+- Added start and end commands in the configuration file.
+  Thanks to Yaroslav Halchenko
+- Added firewall rules definition in the configuration file
+- Cleaned fail2ban.py
+- Added an initd script for RedHat/Fedora. Thanks to Andrey
+  G. Grozin
+
+ver. 0.4.1 (2005/06/30) - stable
+----------
+- Fixed textToDNS method which generated wrong matches for
+  "rhost=12-xyz...". Thanks to Tom Pike
+- fail2ban.conf modified for readability. Thanks to Iain Lea
+- Added an initd script for Gentoo
+- Changed default PID lock file location from /tmp to
+  /var/run
+
+ver. 0.4.0 (2005/04/24) - stable
+----------
+- Fixed textToDNS which did not recognize strings like
+  "12-345-67-890.abcd.mnopqr.xyz"
+
+ver. 0.3.1 (2005/03/31) - beta
+----------
+- Corrected level of messages
+- Added DNS lookup support
+- Improved parsing speed. Only parse the new log messages
+- Added a second verbose level (-vv)
+
+ver. 0.3.0 (2005/02/24) - beta
+----------
+- Re-writting of parts of the code in order to handle several
+  log files with different rules
+- Removed sshd.py because it is no more needed
+- Fixed a bug when exiting with IP in the ban list
+- Added PID lock file
+- Improved some parts of the code
+- Added ipfw-start-rule option (thanks to Robert Edeker)
+- Added -k option which kills a currently running Fail2Ban
+
+ver. 0.1.2 (2004/11/21) - beta
+----------
+- Add ipfw and ipfwadm support. The rules are taken from
+  BlockIt. Thanks to Robert Edeker
+- Add -e option which allows to set the interface. Thanks to
+  Robert Edeker who reminded me this
+- Small code cleaning
+
+ver. 0.1.1 (2004/10/23) - beta
+----------
+- Add SIGTERM handler in order to exit nicely when in daemon
+  mode
+- Add -r option which allows to set the maximum number of
+  login failures
+- Remove the Metalog class as the log file are not so syslog
+  daemon specific
+- Rewrite log reader to be service centered. Sshd support
+  added. Match "Failed password" and "Illegal user"
+- Add /etc/fail2ban.conf configuration support
+- Code documentation
+
+
+ver. 0.1.0 (2004/10/12) - alpha
+----------
+- Initial release

MANIFEST

@@ -1,17 +1,111 @@
 README
-CHANGELOG
+ChangeLog
 TODO
-setup.cfg
+COPYING
+fail2ban-client
+fail2ban-server
+fail2ban-testcases
+fail2ban-regex
+client/configreader.py
+client/configparserinc.py
+client/jailreader.py
+client/fail2banreader.py
+client/jailsreader.py
+client/beautifier.py
+client/filterreader.py
+client/actionreader.py
+client/__init__.py
+client/configurator.py
+client/csocket.py
+server/asyncserver.py
+server/filter.py
+server/filtergamin.py
+server/filterpoll.py
+server/server.py
+server/iso8601.py
+server/actions.py
+server/faildata.py
+server/failmanager.py
+server/jailthread.py
+server/transmitter.py
+server/template.py
+server/hosttemplate.py
+server/action.py
+server/ticket.py
+server/jail.py
+server/jails.py
+server/__init__.py
+server/banmanager.py
+server/timetemplate.py
+server/prefixtemplate.py
+server/mytime.py
+server/failregex.py
+testcases/banmanagertestcase.py
+testcases/failmanagertestcase.py
+testcases/clientreadertestcase.py
+testcases/filtertestcase.py
+testcases/__init__.py
+testcases/actiontestcase.py
+testcases/servertestcase.py
+testcases/files/testcase01.log
+testcases/files/testcase02.log
+testcases/files/testcase03.log
+testcases/files/testcase04.log
 setup.py
-version.py
-fail2ban.py
-firewall/__init__.py
-firewall/firewall.py
-firewall/iptables.py
-firewall/ipfw.py
-firewall/ipfwadm.py
-logreader/__init__.py
-logreader/logreader.py
-confreader/__init__.py
-confreader/configreader.py
-config/fail2ban.conf.default
+setup.cfg
+common/__init__.py
+common/version.py
+common/protocol.py
+config/jail.conf
+config/filter.d/common.conf
+config/filter.d/apache-auth.conf
+config/filter.d/apache-badbots.conf
+config/filter.d/apache-noscript.conf
+config/filter.d/apache-overflows.conf
+config/filter.d/courierlogin.conf
+config/filter.d/couriersmtp.conf
+config/filter.d/exim.conf
+config/filter.d/gssftpd.conf
+config/filter.d/named-refused.conf
+config/filter.d/postfix.conf
+config/filter.d/proftpd.conf
+config/filter.d/pure-ftpd.conf
+config/filter.d/qmail.conf
+config/filter.d/pam-generic.conf
+config/filter.d/sasl.conf
+config/filter.d/sshd.conf
+config/filter.d/sshd-ddos.conf
+config/filter.d/vsftpd.conf
+config/filter.d/webmin-auth.conf
+config/filter.d/wuftpd.conf
+config/filter.d/xinetd-fail.conf
+config/action.d/hostsdeny.conf
+config/action.d/ipfw.conf
+config/action.d/iptables.conf
+config/action.d/iptables-allports.conf
+config/action.d/iptables-multiport.conf
+config/action.d/iptables-multiport-log.conf
+config/action.d/iptables-new.conf
+config/action.d/sendmail.conf
+config/action.d/sendmail-buffered.conf
+config/action.d/sendmail-whois.conf
+config/action.d/sendmail-whois-lines.conf
+config/action.d/shorewall.conf
+config/fail2ban.conf
+man/fail2ban-client.1
+man/fail2ban-client.h2m
+man/fail2ban-server.1
+man/fail2ban-server.h2m
+man/fail2ban-regex.1
+man/fail2ban-regex.h2m
+man/generate-man
+files/gentoo-initd
+files/gentoo-confd
+files/redhat-initd
+files/macosx-initd
+files/solaris-fail2ban.xml
+files/solaris-svc-fail2ban
+files/suse-initd
+files/cacti/fail2ban_stats.sh
+files/cacti/cacti_host_template_fail2ban.xml
+files/cacti/README

README

@@ -4,114 +4,79 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.3.0)                           02/24/2005
+Fail2Ban (version 0.8.3)                           2008/??/??
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
-that makes too much password failures. It updates firewall
-rules to reject the IP address. Currently iptables, ipfw and
-ipfwadm are supported. Fail2Ban can read multiple log files
-such as sshd or Apache web server ones. It needs log4py.
-
-This is my first Python program. I began learning Python for
-less than one week so please be understanding ;-) English is
-not either my mother tongue...
-
-
-More details:
--------------
-
-Fail2Ban is rather simple. I have a home server connected to
-the Internet which runs apache, samba, sshd, ... I see in my
-logs that people are trying to log into my box using "manual"
-brute force or scripts. They try 10, 20 and sometimes more
-user/password (without success anyway). In order to
-discourage these script kiddies, I wanted that sshd refuse
-login from a specific ip after 3 password failures. After
-some google searches, I found that sshd was not able of that.
-So I search for a script or program that do it. Found
-nothing :-( So I decide to write mine and to learn Python :-)
-
-For each sections defined in the configuration file, Fail2Ban
-tries to find lines which match the failregex. Then it
-retrieves the message time using timeregex and timepattern.
-It finally gets the ip and if it has already done 3 or more
-password failures in the last banTime, the ip is banned for
-banTime using a iptable rule. After banTime, the rule is
-deleted.
-
-Sections can be freely added so it is possible to monitor
-several daemons at the same time.
-
-Runs on my server and does its job rather well :-) The idea
-is to make fail2ban usable with daemons and services that
-require a login (sshd, telnetd, ...). It should also support
-others firewalls than iptables.
+that makes too many password failures. It updates firewall
+rules to reject the IP address. These rules can be defined by
+the user. Fail2Ban can read multiple log files such as sshd
+or Apache web server ones.
 
+This README is a quick introduction to Fail2ban. More
+documentation, FAQ, HOWTOs are available on the project
+website: http://www.fail2ban.org
 
 Installation:
 -------------
 
-Require: python-2.3 (http://www.python.org)
-         log4py-1.1 (http://sourceforge.net/projects/log4py)
+Required:
+   >=python-2.3 (http://www.python.org)
+
+Optional:
+   >=gamin-0.0.21 (http://www.gnome.org/~veillard/gamin)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.3.0.tar.bz2
-> cd fail2ban-0.3.0
+> tar xvfj fail2ban-0.8.3.tar.bz2
+> cd fail2ban-0.8.3
 > python setup.py install
 
-This will install Fail2Ban into /usr/lib/fail2ban. The
-fail2ban.py executable is placed into /usr/bin.
+This will install Fail2Ban into /usr/share/fail2ban. The
+executable scripts are placed into /usr/bin.
 
-Fail2Ban should now be correctly installed. Just type:
+It is possible that Fail2ban is already packaged for your
+distribution. In this case, you should use it.
 
-> fail2ban.py -h
+Fail2Ban should be correctly installed now. Just type:
 
-to see if everything is alright. You can configure fail2ban
-with a config file. Copy config/fail2ban.conf.default to
-/etc/fail2ban.conf.
+> fail2ban-client -h
 
+to see if everything is alright. You should always use
+fail2ban-client and never call fail2ban-server directly.
 
 Configuration:
 --------------
 
-You can configure fail2ban using the file /etc/fail2ban.conf
-or using command line options. Command line options override
-the value stored in fail2ban.conf. Here are the command line
-options:
-
-  -b         start fail2ban in background
-  -d         start fail2ban in debug mode
-  -e <INTF>  ban IP on the INTF interface
-  -c <FILE>  read configuration file FILE
-  -p <FILE>  create PID lock in FILE
-  -h         display this help message
-  -i <IP(s)> IP(s) to ignore
-  -k         kill a currently running Fail2Ban instance
-  -l <FILE>  log message in FILE
-  -r <VALUE> allow a max of VALUE password failure
-  -t <TIME>  ban IP for TIME seconds
-  -v         verbose
-  -w <FIWA>  select the firewall to use. Can be iptables,
-             ipfwadm or ipfw
+You can configure Fail2ban using the files in /etc/fail2ban.
+It is possible to configure the server using commands sent to
+it by fail2ban-client. The available commands are described
+in the man page of fail2ban-client. Please refer to it or to
+the website: http://www.fail2ban.org
 
 Contact:
 --------
 
 You need some new features, you found bugs or you just
-appreciate this program, you can contact me at :
+appreciate this program, you can contact me at:
 
-Website: http://www.sourceforge.net/projects/fail2ban
-
-Cyril Jaquier: <lostcontrol@users.sourceforge.net>
+Website: http://www.fail2ban.org
 
+Cyril Jaquier: <cyril.jaquier@fail2ban.org>
 
 Thanks:
 -------
 
-Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker
-
+Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
+Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
+Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
+Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
+Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
+René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch,
+Michael C. Haller, Jonathan Underwood, Hanno 'Rince' Wagner,
+Daniel B. Cid, David Nutter, Raphaël Marichez, Guillaume
+Delvit, Vaclav Misek, Adrien Clerc, Michael Hanselmann,
+Vincent Deffontaines, Bill Heaton and many others.
 
 License:
 --------

TODO

@@ -4,11 +4,53 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-ToDo
+ToDo                                         $Revision$
 =============================================================
 
-- cleanup fail2ban.py
-- resolve DNS with 'host' and os.popen (???)
-- improve configuration file and command line options
-  handling
-- improve installation process
+Legend:
+- not yet done
+? maybe
+# partially done
+* done
+
+- Removed relative imports
+
+- Cleanup fail2ban-client and fail2ban-server. Move code to
+  server/ and client/
+
+- Add timeout to external commands (signal alarm, watchdog
+  thread, etc)
+
+- New backend: pyinotify
+
+- Uniformize filters and actions name. Use the software name
+  (openssh, postfix, proftp)
+
+- Added <USER> tag for failregex. Add features using this
+  information. Maybe add more tags
+
+- Look at the memory consumption. Decrease memory usage
+
+- More detailed statistics
+
+- Auto-enable function (search for log files), check
+  modification date to see if service is still in use
+
+- Improve parsing of the action parameters in jailreader.py
+
+- Better handling of the protocol in transmitter.py
+
+- Add gettext support (I18N)
+
+- Multiline log reading
+
+- Improve execution of action. Why does subprocess.call
+  deadlock with multi-jails?
+
+# see Feature Request Tracking System at SourceForge.net
+
+# improve documentation and website for user
+
+# better return values in function
+
+# refactoring in server.py, actions.py, filter.py

client/__init__.py

@@ -22,4 +22,4 @@ __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
 __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
+__license__ = "GPL"

client/actionreader.py

@@ -0,0 +1,90 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class ActionReader(ConfigReader):
+	
+	def __init__(self, action, name):
+		ConfigReader.__init__(self)
+		self.__file = action[0]
+		self.__cInfo = action[1]
+		self.__name = name
+	
+	def setFile(self, fileName):
+		self.__file = fileName
+	
+	def getFile(self):
+		return self.__file
+	
+	def setName(self, name):
+		self.__name = name
+	
+	def getName(self):
+		return self.__name
+	
+	def read(self):
+		return ConfigReader.read(self, "action.d/" + self.__file)
+	
+	def getOptions(self, pOpts):
+		opts = [["string", "actionstart", ""],
+				["string", "actionstop", ""],
+				["string", "actioncheck", ""],
+				["string", "actionban", ""],
+				["string", "actionunban", ""]]
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
+		
+		if self.has_section("Init"):
+			for opt in self.options("Init"):
+				if not self.__cInfo.has_key(opt):
+					self.__cInfo[opt] = self.get("Init", opt)
+	
+	def convert(self):
+		head = ["set", self.__name]
+		stream = list()
+		stream.append(head + ["addaction", self.__file])
+		for opt in self.__opts:
+			if opt == "actionstart":
+				stream.append(head + ["actionstart", self.__file, self.__opts[opt]])
+			elif opt == "actionstop":
+				stream.append(head + ["actionstop", self.__file, self.__opts[opt]])
+			elif opt == "actioncheck":
+				stream.append(head + ["actioncheck", self.__file, self.__opts[opt]])
+			elif opt == "actionban":
+				stream.append(head + ["actionban", self.__file, self.__opts[opt]])
+			elif opt == "actionunban":
+				stream.append(head + ["actionunban", self.__file, self.__opts[opt]])
+		# cInfo
+		if self.__cInfo:
+			for p in self.__cInfo:
+				stream.append(head + ["setcinfo", self.__file, p, self.__cInfo[p]])
+
+		return stream
+		

client/beautifier.py

@@ -0,0 +1,151 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from server.jails import UnknownJailException
+from server.jails import DuplicateJailException
+import logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+##
+# Beautify the output of the client.
+#
+# Fail2ban server only return unformatted return codes which need to be
+# converted into user readable messages.
+
+class Beautifier:
+	
+	def __init__(self, cmd = None):
+		self.__inputCmd = cmd
+
+	def setInputCmd(self, cmd):
+		self.__inputCmd = cmd
+		
+	def getInputCmd(self):
+		return self.__inputCmd
+		
+	def beautify(self, response):
+		logSys.debug("Beautify " + `response` + " with " + `self.__inputCmd`)
+		inC = self.__inputCmd
+		msg = response
+		try:
+			if inC[0] == "ping":
+				msg = "Server replied: " + response
+			elif inC[0] == "start":
+				msg = "Jail started"
+			elif inC[0] == "stop":
+				if len(inC) == 1:
+					if response == None:
+						msg = "Shutdown successful"
+				else:
+					if response == None:
+						msg = "Jail stopped"
+			elif inC[0] == "add":
+				msg = "Added jail " + response
+			elif inC[0:1] == ['status']:
+				if len(inC) > 1:
+					# Create IP list
+					ipList = ""
+					for ip in response[1][1][2][1]:
+						ipList += ip + " "
+					# Creates file list.
+					fileList = ""
+					for f in response[0][1][2][1]:
+						fileList += f + " "
+					# Display information
+					msg = "Status for the jail: " + inC[1] + "\n"
+					msg = msg + "|- " + response[0][0] + "\n"
+					msg = msg + "|  |- " + response[0][1][2][0] + ":\t" + fileList + "\n"
+					msg = msg + "|  |- " + response[0][1][0][0] + ":\t" + `response[0][1][0][1]` + "\n"
+					msg = msg + "|  `- " + response[0][1][1][0] + ":\t" + `response[0][1][1][1]` + "\n"
+					msg = msg + "`- " + response[1][0] + "\n"
+					msg = msg + "   |- " + response[1][1][0][0] + ":\t" + `response[1][1][0][1]` + "\n"
+					msg = msg + "   |  `- " + response[1][1][2][0] + ":\t" + ipList + "\n"
+					msg = msg + "   `- " + response[1][1][1][0] + ":\t" + `response[1][1][1][1]`
+				else:
+					msg = "Status\n"
+					msg = msg + "|- " + response[0][0] + ":\t" + `response[0][1]` + "\n"
+					msg = msg + "`- " + response[1][0] + ":\t\t" + response[1][1]
+			elif inC[1] == "logtarget":
+				msg = "Current logging target is:\n"
+				msg = msg + "`- " + response
+			elif inC[1:2] == ['loglevel']:
+				msg = "Current logging level is "
+				if response == 1:
+					msg = msg + "ERROR"
+				elif response == 2:
+					msg = msg + "WARN"
+				elif response == 3:
+					msg = msg + "INFO"
+				elif response == 4:
+					msg = msg + "DEBUG"
+				else:
+					msg = msg + `response`
+			elif inC[2] in ("logpath", "addlogpath", "dellogpath"):
+				if len(response) == 0:
+					msg = "No file is currently monitored"
+				else:
+					msg = "Current monitored log file(s):\n"
+					for path in response[:-1]:
+						msg = msg + "|- " + path + "\n"
+					msg = msg + "`- " + response[len(response)-1]
+			elif inC[2] in ("ignoreip", "addignoreip", "delignoreip"):
+				if len(response) == 0:
+					msg = "No IP address/network is ignored"
+				else:
+					msg = "These IP addresses/networks are ignored:\n"
+					for ip in response[:-1]:
+						msg = msg + "|- " + ip + "\n"
+					msg = msg + "`- " + response[len(response)-1]
+			elif inC[2] in ("failregex", "addfailregex", "delfailregex",
+							"ignoreregex", "addignoreregex", "delignoreregex"):
+				if len(response) == 0:
+					msg = "No regular expression is defined"
+				else:
+					msg = "The following regular expression are defined:\n"
+					c = 0
+					for ip in response[:-1]:
+						msg = msg + "|- [" + str(c) + "]: " + ip + "\n"
+						c += 1
+					msg = msg + "`- [" + str(c) + "]: " + response[len(response)-1]
+		except Exception:
+			logSys.warn("Beautifier error. Please report the error")
+			logSys.error("Beautify " + `response` + " with " + `self.__inputCmd` +
+						 " failed")
+			msg = msg + `response`
+		return msg
+
+	def beautifyError(self, response):
+		logSys.debug("Beautify (error) " + `response` + " with " + `self.__inputCmd`)
+		msg = response
+		if isinstance(response, UnknownJailException):
+			msg = "Sorry but the jail '" + response[0] + "' does not exist"
+		elif isinstance(response, IndexError):
+			msg = "Sorry but the command is invalid"
+		elif isinstance(response, DuplicateJailException):
+			msg = "The jail '" + response[0] + "' already exists"
+		return msg

client/configparserinc.py

@@ -0,0 +1,108 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Yaroslav Halchenko
+# Modified: Cyril Jaquier
+# $Revision: 656 $
+
+__author__ = 'Yaroslav Halhenko'
+__revision__ = '$Revision: $'
+__date__ = '$Date:  $'
+__copyright__ = 'Copyright (c) 2007 Yaroslav Halchenko'
+__license__ = 'GPL'
+
+import logging, os
+from ConfigParser import SafeConfigParser
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class SafeConfigParserWithIncludes(SafeConfigParser):
+	"""
+	Class adds functionality to SafeConfigParser to handle included
+	other configuration files (or may be urls, whatever in the future)
+
+	File should have section [includes] and only 2 options implemented
+	are 'files_before' and 'files_after' where files are listed 1 per
+	line.
+
+	Example:
+
+[INCLUDES]
+before = 1.conf
+			   3.conf
+
+after = 1.conf
+
+	It is a simple implementation, so just basic care is taken about
+	recursion. Includes preserve right order, ie new files are
+	inserted to the list of read configs before original, and their
+	includes correspondingly so the list should follow the leaves of
+	the tree.
+
+	I wasn't sure what would be the right way to implement generic (aka c++
+    template) so we could base at any *configparser class... so I will
+    leave it for the future
+
+	"""
+
+	SECTION_NAME = "INCLUDES"
+
+	#@staticmethod
+	def getIncludes(resource, seen = []):
+		"""
+		Given 1 config resource returns list of included files
+		(recursively) with the original one as well
+		Simple loops are taken care about
+		"""
+		
+		# Use a short class name ;)
+		SCPWI = SafeConfigParserWithIncludes
+		
+		parser = SafeConfigParser()
+		parser.read(resource)
+		
+		resourceDir = os.path.dirname(resource)
+
+		newFiles = [ ('before', []), ('after', []) ]
+		if SCPWI.SECTION_NAME in parser.sections():
+			for option_name, option_list in newFiles:
+				if option_name in parser.options(SCPWI.SECTION_NAME):
+					newResources = parser.get(SCPWI.SECTION_NAME, option_name)
+					for newResource in newResources.split('\n'):
+						if os.path.isabs(newResource):
+							r = newResource
+						else:
+							r = "%s/%s" % (resourceDir, newResource)
+						if r in seen:
+							continue
+						s = seen + [resource]
+						option_list += SCPWI.getIncludes(r, s)
+		# combine lists
+		return newFiles[0][1] + [resource] + newFiles[1][1]
+		#print "Includes list for " + resource + " is " + `resources`
+	getIncludes = staticmethod(getIncludes)
+
+
+	def read(self, filenames):
+		fileNamesFull = []
+		if not isinstance(filenames, list):
+			filenames = [ filenames ]
+		for filename in filenames:
+			fileNamesFull += SafeConfigParserWithIncludes.getIncludes(filename)
+		logSys.debug("Reading files: %s" % fileNamesFull)
+		return SafeConfigParser.read(self, fileNamesFull)
+

client/configreader.py

@@ -0,0 +1,101 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# Modified by: Yaroslav Halchenko (SafeConfigParserWithIncludes)
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging, os
+from configparserinc import SafeConfigParserWithIncludes
+from ConfigParser import NoOptionError, NoSectionError
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class ConfigReader(SafeConfigParserWithIncludes):
+	
+	BASE_DIRECTORY = "/etc/fail2ban/"
+	
+	def __init__(self):
+		SafeConfigParserWithIncludes.__init__(self)
+		self.__opts = None
+	
+	#@staticmethod
+	def setBaseDir(folderName):
+		path = folderName.rstrip('/')
+		ConfigReader.BASE_DIRECTORY = path + '/'
+	setBaseDir = staticmethod(setBaseDir)
+		
+	#@staticmethod
+	def getBaseDir():
+		return ConfigReader.BASE_DIRECTORY
+	getBaseDir = staticmethod(getBaseDir)
+	
+	def read(self, filename):
+		basename = ConfigReader.BASE_DIRECTORY + filename
+		logSys.debug("Reading " + basename)
+		bConf = basename + ".conf"
+		bLocal = basename + ".local"
+		if os.path.exists(bConf) or os.path.exists(bLocal):
+			SafeConfigParserWithIncludes.read(self, [bConf, bLocal])
+			return True
+		else:
+			logSys.error(bConf + " and " + bLocal + " do not exist")
+			return False
+	
+	##
+	# Read the options.
+	#
+	# Read the given option in the configuration file. Default values
+	# are used...
+	# Each optionValues entry is composed of an array with:
+	# 0 -> the type of the option
+	# 1 -> the name of the option
+	# 2 -> the default value for the option
+	
+	def getOptions(self, sec, options, pOptions = None):
+		values = dict()
+		for option in options:
+			try:
+				if option[0] == "bool":
+					v = self.getboolean(sec, option[1])
+				elif option[0] == "int":
+					v = self.getint(sec, option[1])
+				else:
+					v = self.get(sec, option[1])
+				if not pOptions == None and option[1] in pOptions:
+					continue
+				values[option[1]] = v
+			except NoSectionError, e:
+				# No "Definition" section or wrong basedir
+				logSys.error(e)
+				values[option[1]] = option[2]
+			except NoOptionError:
+				if not option[2] == None:
+					logSys.warn("'%s' not defined in '%s'. Using default value"
+								% (option[1], sec))
+					values[option[1]] = option[2]
+			except ValueError:
+				logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +
+							"'. Using default one: '" + `option[2]` + "'")
+				values[option[1]] = option[2]
+		return values

client/configurator.py

@@ -0,0 +1,78 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+from fail2banreader import Fail2banReader
+from jailsreader import JailsReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class Configurator:
+	
+	def __init__(self):
+		self.__settings = dict()
+		self.__streams = dict()
+		self.__fail2ban = Fail2banReader()
+		self.__jails = JailsReader()
+	
+	#@staticmethod
+	def setBaseDir(folderName):
+		ConfigReader.setBaseDir(folderName)
+	setBaseDir = staticmethod(setBaseDir)
+	
+	#@staticmethod
+	def getBaseDir():
+		return ConfigReader.getBaseDir()
+	getBaseDir = staticmethod(getBaseDir)
+	
+	def readEarly(self):
+		self.__fail2ban.read()
+	
+	def readAll(self):
+		self.readEarly()
+		self.__jails.read()
+	
+	def getEarlyOptions(self):
+		return self.__fail2ban.getEarlyOptions()
+
+	def getOptions(self, jail = None):
+		self.__fail2ban.getOptions()
+		return self.__jails.getOptions(jail)
+		
+	def convertToProtocol(self):
+		self.__streams["general"] = self.__fail2ban.convert()
+		self.__streams["jails"] = self.__jails.convert()
+	
+	def getConfigStream(self):
+		cmds = list()
+		for opt in self.__streams["general"]:
+			cmds.append(opt)
+		for opt in self.__streams["jails"]:
+			cmds.append(opt)
+		return cmds
+	

client/csocket.py

@@ -0,0 +1,59 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+#from cPickle import dumps, loads, HIGHEST_PROTOCOL
+from pickle import dumps, loads, HIGHEST_PROTOCOL
+import socket
+
+class CSocket:
+	
+	END_STRING = "<F2B_END_COMMAND>"
+	
+	def __init__(self, sock = "/var/run/fail2ban/fail2ban.sock"):
+		# Create an INET, STREAMing socket
+		#self.csock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+		self.__csock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+		#self.csock.connect(("localhost", 2222))
+		self.__csock.connect(sock)
+	
+	def send(self, msg):
+		# Convert every list member to string
+		obj = dumps([str(m) for m in msg], HIGHEST_PROTOCOL)
+		self.__csock.send(obj + CSocket.END_STRING)
+		ret = self.receive(self.__csock)
+		self.__csock.close()
+		return ret
+	
+	#@staticmethod
+	def receive(sock):
+		msg = ''
+		while msg.rfind(CSocket.END_STRING) == -1:
+			chunk = sock.recv(6)
+			if chunk == '':
+				raise RuntimeError, "socket connection broken"
+			msg = msg + chunk
+		return loads(msg)
+	receive = staticmethod(receive)

client/fail2banreader.py

@@ -0,0 +1,58 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class Fail2banReader(ConfigReader):
+	
+	def __init__(self):
+		ConfigReader.__init__(self)
+	
+	def read(self):
+		ConfigReader.read(self, "fail2ban")
+	
+	def getEarlyOptions(self):
+		opts = [["string", "socket", "/tmp/fail2ban.sock"]]
+		return ConfigReader.getOptions(self, "Definition", opts)
+	
+	def getOptions(self):
+		opts = [["int", "loglevel", 1],
+				["string", "logtarget", "STDERR"]]
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts)
+	
+	def convert(self):
+		stream = list()
+		for opt in self.__opts:
+			if opt == "loglevel":
+				stream.append(["set", "loglevel", self.__opts[opt]])
+			elif opt == "logtarget":
+				stream.append(["set", "logtarget", self.__opts[opt]])
+		return stream
+	

client/filterreader.py

@@ -0,0 +1,80 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class FilterReader(ConfigReader):
+	
+	def __init__(self, fileName, name):
+		ConfigReader.__init__(self)
+		self.__file = fileName
+		self.__name = name
+	
+	def setFile(self, fileName):
+		self.__file = fileName
+	
+	def getFile(self):
+		return self.__file
+	
+	def setName(self, name):
+		self.__name = name
+	
+	def getName(self):
+		return self.__name
+	
+	def read(self):
+		return ConfigReader.read(self, "filter.d/" + self.__file)
+	
+	def getOptions(self, pOpts):
+		opts = [["string", "timeregex", None],
+				["string", "timepattern", None],
+				["string", "ignoreregex", ""],
+				["string", "failregex", ""]]
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
+	
+	def convert(self):
+		stream = list()
+		for opt in self.__opts:
+			if opt == "timeregex":
+				stream.append(["set", self.__name, "timeregex", self.__opts[opt]])
+			elif opt == "timepattern":
+				stream.append(["set", self.__name, "timepattern", self.__opts[opt]])
+			elif opt == "failregex":
+				for regex in self.__opts[opt].split('\n'):
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addfailregex", regex])
+			elif opt == "ignoreregex":
+				for regex in self.__opts[opt].split('\n'):
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addignoreregex", regex])		
+		return stream
+		

client/jailreader.py

@@ -0,0 +1,171 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging, re, glob
+
+from configreader import ConfigReader
+from filterreader import FilterReader
+from actionreader import ActionReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class JailReader(ConfigReader):
+	
+	actionCRE = re.compile("^((?:\w|-|_|\.)+)(?:\[(.*)\])?$")
+	
+	def __init__(self, name):
+		ConfigReader.__init__(self)
+		self.__name = name
+		self.__filter = None
+		self.__actions = list()
+	
+	def setName(self, value):
+		self.__name = value
+	
+	def getName(self):
+		return self.__name
+	
+	def read(self):
+		ConfigReader.read(self, "jail")
+	
+	def isEnabled(self):
+		return self.__opts["enabled"]
+	
+	def getOptions(self):
+		opts = [["bool", "enabled", "false"],
+				["string", "logpath", "/var/log/messages"],
+				["string", "backend", "auto"],
+				["int", "maxretry", 3],
+				["int", "findtime", 600],
+				["int", "bantime", 600],
+				["string", "failregex", None],
+				["string", "ignoreregex", None],
+				["string", "ignoreip", None],
+				["string", "filter", ""],
+				["string", "action", ""]]
+		self.__opts = ConfigReader.getOptions(self, self.__name, opts)
+		
+		if self.isEnabled():
+			# Read filter
+			self.__filter = FilterReader(self.__opts["filter"], self.__name)
+			ret = self.__filter.read()
+			if ret:
+				self.__filter.getOptions(self.__opts)
+			else:
+				logSys.error("Unable to read the filter")
+				return False
+			
+			# Read action
+			for act in self.__opts["action"].split('\n'):
+				try:
+					splitAct = JailReader.splitAction(act)
+					action = ActionReader(splitAct, self.__name)
+					ret = action.read()
+					if ret:
+						action.getOptions(self.__opts)
+						self.__actions.append(action)
+					else:
+						raise AttributeError("Unable to read action")
+				except Exception, e:
+					logSys.error("Error in action definition " + act)
+					logSys.debug(e)
+					return False
+		return True
+	
+	def convert(self):
+		stream = []
+		for opt in self.__opts:
+			if opt == "logpath":
+				for path in self.__opts[opt].split("\n"):
+					pathList = glob.glob(path)
+					if len(pathList) == 0:
+						logSys.error("No file found for " + path)
+					for p in pathList:
+						stream.append(["set", self.__name, "addlogpath", p])
+			elif opt == "backend":
+				backend = self.__opts[opt]
+			elif opt == "maxretry":
+				stream.append(["set", self.__name, "maxretry", self.__opts[opt]])
+			elif opt == "ignoreip":
+				for ip in self.__opts[opt].split():
+					# Do not send a command if the rule is empty.
+					if ip != '':
+						stream.append(["set", self.__name, "addignoreip", ip])
+			elif opt == "findtime":
+				stream.append(["set", self.__name, "findtime", self.__opts[opt]])
+			elif opt == "bantime":
+				stream.append(["set", self.__name, "bantime", self.__opts[opt]])
+			elif opt == "failregex":
+				stream.append(["set", self.__name, "failregex", self.__opts[opt]])
+			elif opt == "ignoreregex":
+				for regex in self.__opts[opt].split('\n'):
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addignoreregex", regex])
+		stream.extend(self.__filter.convert())
+		for action in self.__actions:
+			stream.extend(action.convert())
+		stream.insert(0, ["add", self.__name, backend])
+		return stream
+	
+	#@staticmethod
+	def splitAction(action):
+		m = JailReader.actionCRE.match(action)
+		d = dict()
+		if not m.group(2) == None:
+			# Huge bad hack :( This method really sucks. TODO Reimplement it.
+			actions = ""
+			escapeChar = None
+			allowComma = False
+			for c in m.group(2):
+				if c in ('"', "'") and not allowComma:
+					# Start
+					escapeChar = c
+					allowComma = True
+				elif c == escapeChar:
+					# End
+					escapeChar = None
+					allowComma = False
+				else:
+					if c == ',' and allowComma:
+						actions += "<COMMA>"
+					else:
+						actions += c
+			
+			# Split using ,
+			actionsSplit = actions.split(',')
+			# Replace the tag <COMMA> with ,
+			actionsSplit = [n.replace("<COMMA>", ',') for n in actionsSplit]
+			
+			for param in actionsSplit:
+				p = param.split('=')
+				try:
+					d[p[0].strip()] = p[1].strip()
+				except IndexError:
+					logSys.error("Invalid argument %s in '%s'" % (p, m.group(2)))
+		return [m.group(1), d]
+	splitAction = staticmethod(splitAction)

client/jailsreader.py

@@ -0,0 +1,87 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+from jailreader import JailReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class JailsReader(ConfigReader):
+	
+	def __init__(self):
+		ConfigReader.__init__(self)
+		self.__jails = list()
+	
+	def read(self):
+		ConfigReader.read(self, "jail")
+	
+	def getOptions(self, section = None):
+		opts = []
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts)
+
+		if section:
+			# Get the options of a specific jail.
+			jail = JailReader(section)
+			jail.read()
+			ret = jail.getOptions()
+			if ret:
+				if jail.isEnabled():
+					# We only add enabled jails
+					self.__jails.append(jail)
+			else:
+				logSys.error("Errors in jail '%s'. Skipping..." % section)
+				return False
+		else:
+			# Get the options of all jails.
+			for sec in self.sections():
+				jail = JailReader(sec)
+				jail.read()
+				ret = jail.getOptions()
+				if ret:
+					if jail.isEnabled():
+						# We only add enabled jails
+						self.__jails.append(jail)
+				else:
+					logSys.error("Errors in jail '" + sec + "'. Skipping...")
+					return False
+		return True
+	
+	def convert(self):
+		stream = list()
+		for opt in self.__opts:
+			if opt == "":
+				stream.append([])
+		# Convert jails
+		for jail in self.__jails:
+			stream.extend(jail.convert())
+		# Start jails
+		for jail in self.__jails:
+			stream.append(["start", jail.getName()])
+		
+		return stream
+		

common/__init__.py

@@ -22,4 +22,4 @@ __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
 __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
+__license__ = "GPL"

common/protocol.py

@@ -0,0 +1,136 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import textwrap
+
+##
+# Describes the protocol used to communicate with the server.
+
+protocol = [
+['', "BASIC", ""],
+["start", "starts the server and the jails"], 
+["reload", "reloads the configuration"], 
+["reload <JAIL>", "reloads the jail <JAIL>"], 
+["stop", "stops all jails and terminate the server"], 
+["status", "gets the current status of the server"], 
+["ping", "tests if the server is alive"], 
+['', "LOGGING", ""],
+["set loglevel <LEVEL>", "sets logging level to <LEVEL>. 0 is minimal, 4 is debug"], 
+["get loglevel", "gets the logging level"], 
+["set logtarget <TARGET>", "sets logging target to <TARGET>. Can be STDOUT, STDERR, SYSLOG or a file"], 
+["get logtarget", "gets logging target"], 
+['', "JAIL CONTROL", ""],
+["add <JAIL> <BACKEND>", "creates <JAIL> using <BACKEND>"], 
+["start <JAIL>", "starts the jail <JAIL>"], 
+["stop <JAIL>", "stops the jail <JAIL>. The jail is removed"], 
+["status <JAIL>", "gets the current status of <JAIL>"],
+['', "JAIL CONFIGURATION", ""],
+["set <JAIL> idle on|off", "sets the idle state of <JAIL>"], 
+["set <JAIL> addignoreip <IP>", "adds <IP> to the ignore list of <JAIL>"], 
+["set <JAIL> delignoreip <IP>", "removes <IP> from the ignore list of <JAIL>"], 
+["set <JAIL> addlogpath <FILE>", "adds <FILE> to the monitoring list of <JAIL>"], 
+["set <JAIL> dellogpath <FILE>", "removes <FILE> to the monitoring list of <JAIL>"],
+["set <JAIL> addfailregex <REGEX>", "adds the regular expression <REGEX> which must match failures for <JAIL>"], 
+["set <JAIL> delfailregex <INDEX>", "removes the regular expression at <INDEX> for failregex"], 
+["set <JAIL> addignoreregex <REGEX>", "adds the regular expression <REGEX> which should match pattern to exclude for <JAIL>"],
+["set <JAIL> delignoreregex <INDEX>", "removes the regular expression at <INDEX> for ignoreregex"], 
+["set <JAIL> findtime <TIME>", "sets the number of seconds <TIME> for which the filter will look back for <JAIL>"], 
+["set <JAIL> bantime <TIME>", "sets the number of seconds <TIME> a host will be banned for <JAIL>"], 
+["set <JAIL> banip <IP>", "manually Ban <IP> for <JAIL>"], 
+["set <JAIL> maxretry <RETRY>", "sets the number of failures <RETRY> before banning the host for <JAIL>"], 
+["set <JAIL> addaction <ACT>", "adds a new action named <NAME> for <JAIL>"], 
+["set <JAIL> delaction <ACT>", "removes the action <NAME> from <JAIL>"], 
+["set <JAIL> setcinfo <ACT> <KEY> <VALUE>", "sets <VALUE> for <KEY> of the action <NAME> for <JAIL>"], 
+["set <JAIL> delcinfo <ACT> <KEY>", "removes <KEY> for the action <NAME> for <JAIL>"], 
+["set <JAIL> actionstart <ACT> <CMD>", "sets the start command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actionstop <ACT> <CMD>", "sets the stop command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actioncheck <ACT> <CMD>", "sets the check command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actionban <ACT> <CMD>", "sets the ban command <CMD> of the action <ACT> for <JAIL>"],
+["set <JAIL> actionunban <ACT> <CMD>", "sets the unban command <CMD> of the action <ACT> for <JAIL>"], 
+['', "JAIL INFORMATION", ""],
+["get <JAIL> logpath", "gets the list of the monitored files for <JAIL>"],
+["get <JAIL> ignoreip", "gets the list of ignored IP addresses for <JAIL>"],
+["get <JAIL> timeregex", "gets the regular expression used for the time detection for <JAIL>"],
+["get <JAIL> timepattern", "gets the pattern used for the time detection for <JAIL>"],
+["get <JAIL> failregex", "gets the list of regular expressions which matches the failures for <JAIL>"],
+["get <JAIL> ignoreregex", "gets the list of regular expressions which matches patterns to ignore for <JAIL>"],
+["get <JAIL> findtime", "gets the time for which the filter will look back for failures for <JAIL>"],
+["get <JAIL> bantime", "gets the time a host is banned for <JAIL>"],
+["get <JAIL> maxretry", "gets the number of failures allowed for <JAIL>"],
+["get <JAIL> addaction", "gets the last action which has been added for <JAIL>"],
+["get <JAIL> actionstart <ACT>", "gets the start command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionstop <ACT>", "gets the stop command for the action <ACT> for <JAIL>"],
+["get <JAIL> actioncheck <ACT>", "gets the check command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionban <ACT>", "gets the ban command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionunban <ACT>", "gets the unban command for the action <ACT> for <JAIL>"],
+]
+
+##
+# Prints the protocol in a "man" format. This is used for the
+# "-h" output of fail2ban-client.
+
+def printFormatted():
+	INDENT=4
+	MARGIN=41
+	WIDTH=34
+	firstHeading = False
+	for m in protocol:
+		if m[0] == '' and firstHeading:
+			print
+		firstHeading = True
+		first = True
+		for n in textwrap.wrap(m[1], WIDTH):
+			if first:
+				line = ' ' * INDENT + m[0] + ' ' * (MARGIN - len(m[0])) + n
+				first = False
+			else:
+				line = ' ' * (INDENT + MARGIN) + n
+			print line
+
+##
+# Prints the protocol in a "mediawiki" format.
+
+def printWiki():
+	firstHeading = False
+	for m in protocol:
+		if m[0] == '':
+			if firstHeading:
+				print "|}"
+			__printWikiHeader(m[1], m[2])
+			firstHeading = True
+		else:
+			print "|-"
+			print "| <span style=\"white-space:nowrap;\"><tt>" + m[0] + "</tt></span> || || " + m[1]
+	print "|}"
+
+def __printWikiHeader(section, desc):
+	print
+	print "=== " + section + " ==="
+	print
+	print desc
+	print
+	print "{|"
+	print "| '''Command''' || || '''Description'''"

common/version.py

@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.3.0"
+version = "0.9-SVN"

config/action.d/dummy.conf

@@ -0,0 +1,52 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = touch /tmp/fail2ban.dummy
+              printf %%b "<init>\n" >> /tmp/fail2ban.dummy
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = rm -f /tmp/fail2ban.dummy
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = printf %%b "+<ip>\n" >> /tmp/fail2ban.dummy
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = printf %%b "-<ip>\n" >> /tmp/fail2ban.dummy
+
+[Init]
+
+init = 123
+

config/action.d/hostsdeny.conf

@@ -0,0 +1,55 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = 
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = 
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = IP=<ip> &&
+            printf %%b "ALL: $IP\n" >> <file>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = IP=<ip> && sed -i.old /ALL:\ $IP/d <file>
+
+[Init]
+
+# Option:  file
+# Notes.:  hosts.deny file path.
+# Values:  STR  Default:  /etc/hosts.deny
+#
+file = /etc/hosts.deny

config/action.d/ipfw.conf

@@ -0,0 +1,65 @@
+# Fail2Ban configuration file
+#
+# Author: Nick Munger
+# Modified by: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = 
+
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = 
+
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = ipfw add deny tcp from <ip> to <localhost> <port>
+
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
+
+[Init]
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]
+#
+port = ssh
+
+# Option:  localhost
+# Notes.:  the local IP address of the network interface
+# Values:  IP
+#
+localhost = 127.0.0.1

config/action.d/iptables-allports.conf

@@ -0,0 +1,65 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
+# 			made active on all ports from original iptables.conf
+#
+# $Revision: 658 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I INPUT -p <protocol> -j fail2ban-<name>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -p <protocol> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+

config/action.d/iptables-multiport-log.conf

@@ -0,0 +1,78 @@
+# Fail2Ban configuration file
+#
+# Author: Guido Bozzetto
+# Modified: Cyril Jaquier
+#
+# make "fail2ban-<name>" chain to match drop IP
+# make "fail2ban-<name>-log" chain to log and drop
+# insert a jump to fail2ban-<name> from -I INPUT if proto/port match
+#
+# $Revision: 668 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I INPUT 1 -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+              iptables -N fail2ban-<name>-log
+              iptables -I fail2ban-<name>-log -j LOG --log-prefix "$(expr fail2ban-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
+              iptables -A fail2ban-<name>-log -j DROP
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -F fail2ban-<name>-log
+             iptables -X fail2ban-<name>
+             iptables -X fail2ban-<name>-log
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L fail2ban-<name>-log >/dev/null
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j fail2ban-<name>-log
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp

config/action.d/iptables-multiport.conf

@@ -0,0 +1,69 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified by Yaroslav Halchenko for multiport banning
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+

config/action.d/iptables-new.conf

@@ -0,0 +1,71 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Copied from iptables.conf and modified by Yaroslav Halchenko 
+#  to fullfill the needs of bugreporter dbts#350746.
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I INPUT -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+

config/action.d/iptables.conf

@@ -0,0 +1,69 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I INPUT -p <protocol> --dport <port> -j fail2ban-<name>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -p <protocol> --dport <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+

config/action.d/sendmail-buffered.conf

@@ -0,0 +1,105 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 660 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Output will be buffered until <lines> lines are available.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = if [ -f <tmpfile> ]; then
+                 printf %%b "Subject: [Fail2Ban] <name>: summary
+                 From: Fail2Ban <<sender>>
+                 To: <dest>\n
+                 Hi,\n
+                 These hosts have been banned by Fail2Ban.\n
+                 `cat <tmpfile>`
+                 Regards,\n
+                 Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+                 rm <tmpfile>
+             fi
+             printf %%b "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
+            LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
+            if [ $LINE -eq <lines> ]; then
+                printf %%b "Subject: [Fail2Ban] <name>: summary
+                From: Fail2Ban <<sender>>
+                To: <dest>\n
+                Hi,\n
+                These hosts have been banned by Fail2Ban.\n
+                `cat <tmpfile>`
+                Regards,\n
+                Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+                rm <tmpfile>
+            fi
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
+# Default number of lines that are buffered
+#
+lines = 5
+
+# Default temporary file
+#
+tmpfile = /tmp/fail2ban-mail.txt
+

config/action.d/sendmail-whois-lines.conf

@@ -0,0 +1,88 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 660 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+            From: Fail2Ban <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n
+            `/usr/bin/whois <ip>`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `/bin/grep '\<<ip>\>' <logpath>`\n\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
+# Path to the log files which contain relevant lines for the abuser IP
+#
+logpath = /dev/null
+

config/action.d/sendmail-whois.conf

@@ -0,0 +1,82 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 660 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+            From: Fail2Ban <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n
+            `/usr/bin/whois <ip>`\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+

config/action.d/sendmail.conf

@@ -0,0 +1,80 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 660 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+            From: Fail2Ban <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+

config/action.d/shorewall.conf

@@ -0,0 +1,46 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = 
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = 
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = shorewall reject <ip>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = shorewall allow <ip>

config/fail2ban.conf

@@ -0,0 +1,34 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  loglevel
+# Notes.:  Set the log level output.
+#          1 = ERROR
+#          2 = WARN
+#          3 = INFO
+#          4 = DEBUG
+# Values:  NUM  Default:  3
+#
+loglevel = 3
+
+# Option:  logtarget
+# Notes.:  Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
+#          Only one log target can be specified.
+# Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+#
+logtarget = /var/log/fail2ban.log
+
+# Option: socket
+# Notes.: Set the socket file. This is used to communicate with the daemon. Do
+#         not remove this file when Fail2ban runs. It will not be possible to
+#         communicate with the server afterwards.
+# Values: FILE  Default:  /var/run/fail2ban/fail2ban.sock
+#
+socket = /var/run/fail2ban/fail2ban.sock
+

config/fail2ban.conf.default

@@ -1,96 +0,0 @@
-# Fail2Ban configuration file
-#
-# $Revision$
-
-[DEFAULT]
-
-# firewall: select the firewall system to use. Actually,
-# the available options are: iptables, ipfwadm, ipfw
-firewall = iptables
-
-# ipfw-start-rule: set the first rule number used by Fail2Ban.
-# This option is only used if firewall = ipfw.
-ipfw-start-rule = 100
-
-# background: true to start fail2ban as a daemon. Output
-# is redirect to logfile.
-background = false
-
-# debug: true to enable debug mode. More verbose output
-# and bypass root user test.
-debug = false
-
-# pidlock: the path of the PID lock file. Fail2Ban must be
-# able to write into that file.
-#pidlock = /var/run/fail2ban.pid
-
-# logfile: the path of the file for logging messages of
-# fail2ban.
-logfile = /var/log/fail2ban.log
-
-# maxretry: the number of retry before IP gets ban.
-maxretry = 3
-
-# bantime: the number of seconds an IP will be ban.
-bantime = 600
-
-# ignoreip: a space separated list that contains IP which
-# will be ignore by fail2ban. Example:
-# ignoreip = 192.168.0.1 123.45.235.65
-ignoreip = 
-
-# interface: the interface name on which the IP will be
-# banned.
-interface = eth0
-
-# polltime: the number of seconds that fail2ban sleeps
-# between two iteration (check for IP to unban - parse
-# log file). 1 is a good value.
-polltime = 1
-
-# You can define a new section for each log file to check for
-# password failure. Each section has to define the following
-# options: logfile, timeregex, timepattern, failregex.
-
-[Apache]
-# enabled: is this section active ?
-enabled = true
-
-# logfile: file to monitor.
-logfile = log-test/apache
-
-# timeregex: regular expression which have to match the
-# timestamp of an Apache log event.
-# [Wed Jan 05 15:08:01 2005]
-timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
-
-# timepattern: indicates the "timeregex" fields signification.
-# Notice that '%' must be espaced with '%'.
-# See syntax here: http://rgruet.free.fr/PQR2.3.html#timeModule
-timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
-
-# failregex: regular expression which have to match the
-# message written in the log file in case of password failure.
-failregex = authentication failure|user .* not found
-
-[SSH]
-# enabled: is this section active ?
-enabled = true
-
-# logfile: file to monitor.
-logfile = log-test/current
-
-# timeregex: regular expression which have to match the
-# timestamp of an Apache log event.
-# Mar  7 17:53:28
-timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-
-# timepattern: indicates the "timeregex" fields signification.
-# Notice that '%' must be espaced with '%'.
-# See syntax here: http://rgruet.free.fr/PQR2.3.html#timeModule
-timepattern = %%b %%d %%H:%%M:%%S
-
-# failregex: regular expression which have to match the
-# message written in the log file in case of password failure.
-failregex = Authentication failure|Failed password
-

config/filter.d/apache-auth.conf

@@ -0,0 +1,25 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = [[]client <HOST>[]] user .* authentication failure
+            [[]client <HOST>[]] user .* not found
+            [[]client <HOST>[]] user .* password mismatch
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/apache-badbots.conf

@@ -0,0 +1,28 @@
+# Fail2Ban configuration file
+#
+# List of bad bots fetched from http://www.user-agents.org
+# Generated on Sun Feb 11 01:09:15 EST 2007 by gen_badbots
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision: 668 $
+#
+
+[Definition]
+
+badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider
+badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|DataCha0s/2\.0|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|MVAClient|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|sogou spider|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|WebVulnCrawl\.blogspot\.com/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
+
+# Option:  failregex
+# Notes.:  Regexp to catch known spambots and software alike. Please verify
+#          that it is your intent to block IPs which were driven by
+#          abovementioned bots.
+# Values:  TEXT
+#
+failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex =

config/filter.d/apache-noscript.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = [[]client <HOST>[]] (File does not exist|script not found or unable to stat): .*(\.php|\.asp|\.exe|\.pl)
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/apache-overflows.conf

@@ -0,0 +1,20 @@
+# Fail2Ban configuration file
+#
+# Author: Tim Connors
+#
+# $Revision: 668 $
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  Regexp to catch Apache overflow attempts.
+# Values:  TEXT
+#
+failregex = [[]client <HOST>[]] (Invalid method in request|request failed: URI too long|erroneous characters after protocol string)
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex =

config/filter.d/common.conf

@@ -0,0 +1,41 @@
+# Generic configuration items (to be used as interpolations) in other
+# filters  or actions configurations
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision:  $
+#
+
+[INCLUDES]
+
+# Load customizations if any available
+after = common.local
+
+
+[DEFAULT]
+
+# Daemon definition is to be specialized (if needed) in .conf file
+_daemon = \S*
+
+#
+# Shortcuts for easier comprehension of the failregex
+#
+# PID.
+# EXAMPLES: [123]
+__pid_re = (?:\[\d+\])
+
+# Daemon name (with optional source_file:line or whatever)
+# EXAMPLES: pam_rhosts_auth, [sshd], pop(pam_unix)
+__daemon_re = [\[\(]?%(_daemon)s(?:\(\S+\))?[\]\)]?:?
+
+# Combinations of daemon name and PID
+# EXAMPLES: sshd[31607], pop(pam_unix)[4920]
+__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
+
+#
+# Common line prefixes (beginnings) which could be used in filters
+#
+#       [hostname] [vserver tag] daemon_id spaces
+# this can be optional (for instance if we match named native log files)
+__prefix_line = \s*(?:\S+ )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*
+

config/filter.d/courierlogin.conf

@@ -0,0 +1,24 @@
+# Fail2Ban configuration file
+#
+# Author: Christoph Haas
+# Modified by: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = LOGIN FAILED, .*, ip=\[<HOST>\]$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/couriersmtp.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = error,relay=<HOST>,.*550 User unknown
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/exim.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = \[<HOST>\] .*(?:rejected by local_scan|Unrouteable address)
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/gssftpd.conf

@@ -0,0 +1,20 @@
+# Fail2Ban configuration file for wuftpd
+#
+# Author: Kevin Zembower (copied from wsftpd.conf)
+#
+# $Revision: 684 $
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = ftpd(?:\[\d+\])?:\s+repeated login failures from <HOST> \(\S+\)$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/lighttpd-fastcgi.conf

@@ -0,0 +1,18 @@
+# Fail2Ban configuration file
+#
+# Author: Arturo 'Buanzo' Busleiman <buanzo@buanzo.com.ar>
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match ALERTS as notified by lighttpd's FastCGI Module
+# Values:  TEXT
+#
+failregex = .*ALERT\ -\ .*attacker\ \'<HOST>\'
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/named-refused.conf

@@ -0,0 +1,35 @@
+# Fail2Ban configuration file for named (bind9). Trying to generalize the
+#          structure which is general to capture general patterns in log
+#          lines to cover different configurations/distributions
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision: 616 $
+#
+
+[Definition]
+
+# 
+# Daemon name
+_daemon=named
+
+#
+# Shortcuts for easier comprehension of the failregex
+__pid_re=(?:\[\d+\])
+__daemon_re=\(?%(_daemon)s(?:\(\S+\))?\)?:?
+__daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
+#       hostname       daemon_id         spaces
+# this can be optional (for instance if we match named native log files)
+__line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = %(__line_prefix)sclient <HOST>#\S+: query(?: \(cache\))? '.*' denied\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/pam-generic.conf

@@ -0,0 +1,31 @@
+# Fail2Ban configuration file for generic PAM authentication errors
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision:  $
+#
+
+[Definition]
+
+# if you want to catch only login erros from specific daemons, use smth like
+#_ttys_re=(?:ssh|pure-ftpd|ftp)
+# To catch all failed logins
+_ttys_re=\S*
+
+#
+# Shortcuts for easier comprehension of the failregex
+__pid_re=(?:\[\d+\])
+__pam_re=\(?pam_unix(?:\(\S+\))?\)?:?
+__pam_combs_re=(?:%(__pid_re)s?:\s+%(__pam_re)s|%(__pam_re)s%(__pid_re)s?:)
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = \s\S+ \S+%(__pam_combs_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=%(_ttys_re)s ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/php-url-fopen.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Arturo 'Buanzo' Busleiman <buanzo@buanzo.com.ar>
+# Version 2
+# fixes the failregex so REFERERS that contain =http:// don't get blocked
+# (mentioned by "fasuto" (no real email provided... blog comment) in this entry:
+# http://blogs.buanzo.com.ar/2009/04/fail2ban-filter-for-php-injection-attacks.html#comment-1489
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match this kind of request:
+#
+# 66.185.212.172 - - [26/Mar/2009:08:44:20 -0500] "GET /index.php?n=http://eatmyfood.hostinginfive.com/pizza.htm? HTTP/1.1" 200 114 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
+#
+failregex = ^<HOST> -.*"(GET|POST).*\?.*\=http\:\/\/.* HTTP\/.*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/postfix.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = reject: RCPT from (.*)\[<HOST>\]: 554
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/proftpd.conf

@@ -0,0 +1,26 @@
+# Fail2Ban configuration file
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values: TEXT
+#
+failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+$
+            \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect password\.$
+            \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\.$
+            \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/psad.conf

@@ -0,0 +1,19 @@
+# Fail2Ban configuration file
+#
+# Author: Arturo 'Buanzo' Busleiman <buanzo@buanzo.com.ar>
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match psad "scan detected" line, example:
+#
+# Apr 30 23:35:06 mx4 psad: scan detected: 221.192.199.49 -> 85.13.200.90 tcp: [8000] flags: SYN tcp pkts: 1 DL: 2
+#
+failregex = ^.*\ psad\:\ scan\ detected\:\ <HOST>\ \-\>\ .*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/pure-ftpd.conf

@@ -0,0 +1,29 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified: Yaroslav Halchenko for pure-ftpd
+#
+# $Revision: 3$
+#
+
+[Definition]
+
+# Error message specified in multiple languages
+__errmsg = (?:Authentication failed for user|Erreur d'authentification pour l'utilisateur)
+
+#
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile. The
+#         host must be matched by a group named "host". The tag "<HOST>" can
+#         be used for standard IP/hostname matching and is only an alias for
+#         (?:::f{4,6}:)?(?P<host>\S+)
+# Values: TEXT
+#
+failregex = pure-ftpd(?:\[\d+\])?: (.+?@<HOST>) \[WARNING\] %(__errmsg)s \[.+\]$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
+

config/filter.d/qmail.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip )<HOST>
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/sasl.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values: TEXT
+#
+failregex = : warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/sshd-ddos.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = <TIME> <PREFIX> Did not receive identification string from <HOST>$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/sshd.conf

@@ -0,0 +1,30 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = <TIME> <PREFIX> (?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
+            <TIME> <PREFIX> Failed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
+            <TIME> <PREFIX> ROOT LOGIN REFUSED.* FROM <HOST>\s*$
+            <TIME> <PREFIX> [iI](?:llegal|nvalid) user .* from <HOST>\s*$
+            <TIME> <PREFIX> User \S+ from <HOST> not allowed because not listed in AllowUsers$
+            <TIME> <PREFIX> authentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
+            <TIME> <PREFIX> refused connect from \S+ \(<HOST>\)\s*$
+            <TIME> <PREFIX> Address <HOST> .* POSSIBLE BREAK-IN ATTEMPT\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/vsftpd.conf

@@ -0,0 +1,24 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values: TEXT
+#
+failregex = vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=<HOST>(?:\s+user=\S*)?\s*$
+            \[.+\] FAIL LOGIN: Client "<HOST>"\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/webmin-auth.conf

@@ -0,0 +1,28 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Rule by : Delvit Guillaume
+#
+# $Revision: 601 $
+#
+
+[Definition]
+
+# patern :      webmin[15673]: Non-existent login as toto from 86.0.6.217
+#               webmin[29544]: Invalid login as root from 86.0.6.217
+#
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = webmin.* Non-existent login as .+ from <HOST>$
+            webmin.* Invalid login as .+ from <HOST>$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/wuftpd.conf

@@ -0,0 +1,20 @@
+# Fail2Ban configuration file for wuftpd
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = wu-ftpd(?:\[\d+\])?:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/xinetd-fail.conf

@@ -0,0 +1,30 @@
+# Fail2Ban configuration file
+#
+# Author: Guido Bozzetto
+#
+# $Revision: 668 $
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+# Cfr.: /var/log/(daemon\.|sys)log
+# libwrap => tcp wrappers: hosts.(allow|deny)
+# address => xinetd: deny_from|only_from
+# load => xinetd: max_load (temporary problem)
+#
+
+failregex = xinetd(?:\[\d{1,5}\])?: FAIL: \S+ address from=<HOST>$
+            xinetd(?:\[\d{1,5}\])?: FAIL: \S+ libwrap from=<HOST>$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/jail.conf

@@ -0,0 +1,255 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+# The DEFAULT allows a global definition of the options. They can be override
+# in each jail afterwards.
+
+[DEFAULT]
+
+# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
+# ban a host which matches an address in this list. Several addresses can be
+# defined using space separator.
+ignoreip = 127.0.0.1
+
+# "bantime" is the number of seconds that a host is banned.
+bantime  = 600
+
+# A host is banned if it has generated "maxretry" during the last "findtime"
+# seconds.
+findtime  = 600
+
+# "maxretry" is the number of failures before a host get banned.
+maxretry = 3
+
+# "backend" specifies the backend used to get files modification. Available
+# options are "gamin", "polling" and "auto". This option can be overridden in
+# each jail too (use "gamin" for a jail and "polling" for another).
+#
+# gamin:   requires Gamin (a file alteration monitor) to be installed. If Gamin
+#          is not installed, Fail2ban will use polling.
+# polling: uses a polling algorithm which does not require external libraries.
+# auto:    will choose Gamin if available and polling otherwise.
+backend = auto
+
+
+# This jail corresponds to the standard configuration in Fail2ban 0.6.
+# The mail-whois action send a notification e-mail with a whois request
+# in the body.
+
+[ssh-iptables]
+
+enabled  = false
+filter   = sshd
+action   = iptables[name=SSH, port=ssh, protocol=tcp]
+           sendmail-whois[name=SSH, dest=you@mail.com, sender=fail2ban@mail.com]
+logpath  = /var/log/sshd.log
+maxretry = 5
+
+[proftpd-iptables]
+
+enabled  = false
+filter   = proftpd
+action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
+           sendmail-whois[name=ProFTPD, dest=you@mail.com]
+logpath  = /var/log/proftpd/proftpd.log
+maxretry = 6
+
+# This jail forces the backend to "polling".
+
+[sasl-iptables]
+
+enabled  = false
+filter   = sasl
+backend  = polling
+action   = iptables[name=sasl, port=smtp, protocol=tcp]
+           sendmail-whois[name=sasl, dest=you@mail.com]
+logpath  = /var/log/mail.log
+
+# Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
+# used to avoid banning the user "myuser".
+
+[ssh-tcpwrapper]
+
+enabled     = false
+filter      = sshd
+action      = hostsdeny
+              sendmail-whois[name=SSH, dest=you@mail.com]
+ignoreregex = for myuser from
+logpath     = /var/log/sshd.log
+
+# This jail demonstrates the use of wildcards in "logpath".
+# Moreover, it is possible to give other files on a new line.
+
+[apache-tcpwrapper]
+
+enabled  = false
+filter	 = apache-auth
+action   = hostsdeny
+logpath  = /var/log/apache*/*error.log
+           /home/www/myhomepage/error.log
+maxretry = 6
+
+# The hosts.deny path can be defined with the "file" argument if it is
+# not in /etc.
+
+[postfix-tcpwrapper]
+
+enabled  = false
+filter   = postfix
+action   = hostsdeny[file=/not/a/standard/path/hosts.deny]
+           sendmail[name=Postfix, dest=you@mail.com]
+logpath  = /var/log/postfix.log
+bantime  = 300
+
+# Do not ban anybody. Just report information about the remote host.
+# A notification is sent at most every 600 seconds (bantime).
+
+[vsftpd-notification]
+
+enabled  = false
+filter   = vsftpd
+action   = sendmail-whois[name=VSFTPD, dest=you@mail.com]
+logpath  = /var/log/vsftpd.log
+maxretry = 5
+bantime  = 1800
+
+# Same as above but with banning the IP address.
+
+[vsftpd-iptables]
+
+enabled  = false
+filter   = vsftpd
+action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
+           sendmail-whois[name=VSFTPD, dest=you@mail.com]
+logpath  = /var/log/vsftpd.log
+maxretry = 5
+bantime  = 1800
+
+# Ban hosts which agent identifies spammer robots crawling the web
+# for email addresses. The mail outputs are buffered.
+
+[apache-badbots]
+
+enabled  = false
+filter   = apache-badbots
+action   = iptables-multiport[name=BadBots, port="http,https"]
+           sendmail-buffered[name=BadBots, lines=5, dest=you@mail.com]
+logpath  = /var/www/*/logs/access_log
+bantime  = 172800
+maxretry = 1
+
+# Use shorewall instead of iptables.
+
+[apache-shorewall]
+
+enabled  = false
+filter   = apache-noscript
+action   = shorewall
+           sendmail[name=Postfix, dest=you@mail.com]
+logpath  = /var/log/apache2/error_log
+
+# Ban attackers that try to use PHP's URL-fopen() functionality
+# through GET/POST variables.
+# Make sure you edit the filter if you need to allow certain requests.
+# Adapt logpath as required!
+
+[php-url-fopen]
+
+enabled = false
+port    = http,https
+filter  = php-url-fopen
+logpath = /var/www/*/logs/access_log
+maxretry = 1
+
+# A simple PHP-fastcgi jail which works with lighttpd.
+# If you run a lighttpd server, then you probably will
+# find these kinds of messages in your error_log:
+# ALERT – tried to register forbidden variable ‘GLOBALS’
+# through GET variables (attacker '1.2.3.4', file '/var/www/default/htdocs/index.php')
+# This jail would block the IP 1.2.3.4.
+
+[lighttpd-fastcgi]
+
+enabled = true
+port    = http,https
+filter  = lighttpd-fastcgi
+# adapt the following two items as needed
+logpath = /var/log/lighttpd/error.log
+maxretry = 2
+
+# This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
+# option is overridden in this jail. Moreover, the action "mail-whois" defines
+# the variable "name" which contains a comma using "". The characters '' are
+# valid too.
+
+[ssh-ipfw]
+
+enabled  = false
+filter   = sshd
+action   = ipfw[localhost=192.168.0.1]
+           sendmail-whois[name="SSH,IPFW", dest=you@mail.com]
+logpath  = /var/log/auth.log
+ignoreip = 168.192.0.1
+
+# These jails block attacks against named (bind9). By default, logging is off
+# with bind9 installation. You will need something like this:
+#
+# logging {
+#     channel security_file {
+#         file "/var/log/named/security.log" versions 3 size 30m;
+#         severity dynamic;
+#         print-time yes;
+#     };
+#     category security {
+#         security_file;
+#     };
+# }
+#
+# in your named.conf to provide proper logging.
+# This jail blocks UDP traffic for DNS requests.
+
+# !!! WARNING !!!
+#   Since UDP is connectionless protocol, spoofing of IP and immitation
+#   of illegal actions is way too simple.  Thus enabling of this filter
+#   might provide an easy way for implementing a DoS against a chosen
+#   victim. See
+#    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
+#   Please DO NOT USE this jail unless you know what you are doing.
+#
+# [named-refused-udp]
+#
+# enabled  = false
+# filter   = named-refused
+# action   = iptables-multiport[name=Named, port="domain,953", protocol=udp]
+#            sendmail-whois[name=Named, dest=you@mail.com]
+# logpath  = /var/log/named/security.log
+# ignoreip = 168.192.0.1
+
+# This jail blocks TCP traffic for DNS requests.
+
+[named-refused-tcp]
+
+enabled  = false
+filter   = named-refused
+action   = iptables-multiport[name=Named, port="domain,953", protocol=tcp]
+           sendmail-whois[name=Named, dest=you@mail.com]
+logpath  = /var/log/named/security.log
+ignoreip = 168.192.0.1
+
+
+# PSAD support for fail2ban by Buanzo.
+# psad detects portscans, and logs the details to /var/log/messages
+# With this jail, you can ban attackers that portscan you (for example, with the excellent Nmap)
+# TODO: It needs a proper action, and decide on default port range/list
+
+[psad]
+
+enabled	= false
+port	= ssh,http,https,smtp,ftp
+filter	= psad
+logpath	= /var/log/messages
+maxretry = 1

confreader/configreader.py

@@ -1,82 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import os, sys, time
-
-from ConfigParser import *
-
-class ConfigReader:
-	""" This class allow the handling of the configuration options.
-		The DEFAULT section contains the global information about
-		Fail2Ban. Each other section is for a different log file.
-	"""
-	
-	# Each optionValues entry is composed of an array with:
-	# 0 -> the type of the option
-	# 1 -> the name of the option
-	# 2 -> the default value for the option
-	optionValues = (["bool", "enabled", True],
-					["str", "logfile", "/dev/null"],
-					["str", "timeregex", ""],
-					["str", "timepattern", ""],
-					["str", "failregex", ""])
-	
-	def __init__(self, logSys, confPath):
-		self.confPath = confPath
-		self.configParser = SafeConfigParser()
-		self.logSys = logSys
-		
-	def openConf(self):
-		""" Opens the configuration file.
-		"""
-		self.configParser.read(self.confPath)
-	
-	def getSections(self):
-		""" Returns all the sections present in the configuration
-			file except the DEFAULT section.
-		"""
-		return self.configParser.sections()
-		
-	def getLogOptions(self, sec):
-		""" Gets all the options of a given section. The options
-			are defined in the optionValues list.
-		"""
-		values = dict()
-		for option in self.optionValues:
-			try:
-				if option[0] == "bool":
-					v = self.configParser.getboolean(sec, option[1])
-				elif option[0] == "int":
-					v = self.configParser.getint(sec, option[1])
-				else:
-					v = self.configParser.get(sec, option[1])
-				
-				values[option[1]] = v
-			except NoOptionError:
-				self.logSys.info("No '"+option[1]+"' defined in '"+sec+"'")
-				values[option[1]] = option[2]
-		return values
-		

fail2ban-client

@@ -0,0 +1,404 @@
+#!/usr/bin/python
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import sys, string, os, pickle, re, logging, signal
+import getopt, time, shlex, socket
+
+# Inserts our own modules path first in the list
+# fix for bug #343821
+sys.path.insert(1, "/usr/share/fail2ban")
+
+# Now we can import our modules
+from common.version import version
+from common.protocol import printFormatted
+from client.csocket import CSocket
+from client.configurator import Configurator
+from client.beautifier import Beautifier
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client")
+
+##
+#
+# @todo This class needs cleanup.
+
+class Fail2banClient:
+
+	SERVER = "fail2ban-server"
+	PROMPT = "fail2ban> "
+
+	def __init__(self):
+		self.__argv = None
+		self.__stream = None
+		self.__configurator = Configurator()
+		self.__conf = dict()
+		self.__conf["conf"] = "/etc/fail2ban"
+		self.__conf["dump"] = False
+		self.__conf["force"] = False
+		self.__conf["verbose"] = 1
+		self.__conf["interactive"] = False
+		self.__conf["socket"] = None
+		
+	def dispVersion(self):
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2008 Cyril Jaquier"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+	
+	def dispUsage(self):
+		""" Prints Fail2Ban command line options and exits
+		"""
+		print "Usage: "+self.__argv[0]+" [OPTIONS] <COMMAND>"
+		print
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+		print "Options:"
+		print "    -c <DIR>                configuration directory"
+		print "    -s <FILE>               socket path"
+		print "    -d                      dump configuration. For debugging"
+		print "    -i                      interactive mode"
+		print "    -v                      increase verbosity"
+		print "    -q                      decrease verbosity"
+		print "    -x                      force execution of the server (remove socket file)"
+		print "    -h, --help              display this help message"
+		print "    -V, --version           print the version"
+		print
+		print "Command:"
+		
+		# Prints the protocol
+		printFormatted()
+		
+		print
+		print "Report bugs to <cyril.jaquier@fail2ban.org>"
+	
+	def dispInteractive(self):
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print 
+
+	def __sigTERMhandler(self, signum, frame):
+		# Print a new line because we probably come from wait
+		print
+		logSys.warn("Caught signal %d. Exiting" % signum)
+		sys.exit(-1)
+
+	def __getCmdLineOptions(self, optList):
+		""" Gets the command line options
+		"""
+		for opt in optList:
+			if opt[0] == "-c":
+				self.__conf["conf"] = opt[1]
+			elif opt[0] == "-s":
+				self.__conf["socket"] = opt[1]
+			elif opt[0] == "-d":
+				self.__conf["dump"] = True
+			elif opt[0] == "-v":
+				self.__conf["verbose"] = self.__conf["verbose"] + 1
+			elif opt[0] == "-q":
+				self.__conf["verbose"] = self.__conf["verbose"] - 1
+			elif opt[0] == "-x":
+				self.__conf["force"] = True
+			elif opt[0] == "-i":
+				self.__conf["interactive"] = True
+			elif opt[0] in ["-h", "--help"]:
+	 			self.dispUsage()
+	 			sys.exit(0)
+	 		elif opt[0] in ["-V", "--version"]:
+	 			self.dispVersion()
+	 			sys.exit(0)
+	
+	def __ping(self):
+		return self.__processCmd([["ping"]], False)
+	
+	def __processCmd(self, cmd, showRet = True):
+		beautifier = Beautifier()
+		for c in cmd:
+			beautifier.setInputCmd(c)
+			try:
+				client = CSocket(self.__conf["socket"])
+				ret = client.send(c)
+				if ret[0] == 0:
+					logSys.debug("OK : " + `ret[1]`)
+					if showRet:
+						print beautifier.beautify(ret[1])
+				else:
+					logSys.debug("NOK: " + `ret[1].args`)
+					print beautifier.beautifyError(ret[1])
+					return False
+			except socket.error:
+				if showRet:
+					logSys.error("Unable to contact server. Is it running?")
+				return False
+			except Exception, e:
+				if showRet:
+					logSys.error(e)
+				return False
+		return True
+		
+	##
+	# Process a command line.
+	#
+	# Process one command line and exit.
+	# @param cmd the command line
+
+	def __processCommand(self, cmd):
+		if len(cmd) == 1 and cmd[0] == "start":
+			if self.__ping():
+				logSys.error("Server already running")
+				return False
+			else:
+				# Read the config
+				ret = self.__readConfig()
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
+				# Start the server
+				self.__startServerAsync(self.__conf["socket"],
+										self.__conf["force"])
+				try:
+					# Wait for the server to start
+					self.__waitOnServer()
+					# Configure the server
+					self.__processCmd(self.__stream, False)
+					return True
+				except ServerExecutionException:
+					logSys.error("Could not start server. Maybe an old " +
+								 "socket file is still present. Try to " +
+								 "remove " + self.__conf["socket"] + ". If " +
+								 "you used fail2ban-client to start the " +
+								 "server, adding the -x option will do it")
+					return False
+		elif len(cmd) == 1 and cmd[0] == "reload":
+			if self.__ping():
+				ret = self.__readConfig()
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
+				self.__processCmd([['stop', 'all']], False)
+				# Configure the server
+				return self.__processCmd(self.__stream, False)
+			else:
+				logSys.error("Could not find server")
+				return False
+		elif len(cmd) == 2 and cmd[0] == "reload":
+			if self.__ping():
+				jail = cmd[1]
+				ret = self.__readJailConfig(jail)
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
+				self.__processCmd([['stop', jail]], False)
+				# Configure the server
+				return self.__processCmd(self.__stream, False)
+			else:
+				logSys.error("Could not find server")
+				return False
+		else:
+			return self.__processCmd([cmd])
+	
+	
+	##
+	# Start Fail2Ban server.
+	#
+	# Start the Fail2ban server in daemon mode.
+	
+	def __startServerAsync(self, socket, force = False):
+		# Forks the current process.
+		pid = os.fork()
+		if pid == 0:
+			args = list()
+			args.append(self.SERVER)
+			# Start in background mode.
+			args.append("-b")
+			# Set the socket path.
+			args.append("-s")
+			args.append(socket)
+			# Force the execution if needed.
+			if force:
+				args.append("-x")
+			try:
+				# Use the current directory.
+				exe = os.path.abspath(os.path.join(sys.path[0], self.SERVER))
+				os.execv(exe, args)
+			except OSError:
+				try:
+					# Use the PATH env.
+					os.execvp(self.SERVER, args)
+				except OSError:
+					print "Could not find %s" % self.SERVER
+					os.exit(-1)
+						
+			
+	def __waitOnServer(self):
+		# Wait for the server to start
+		cnt = 0
+		if self.__conf["verbose"] > 1:
+			pos = 0
+			delta = 1
+			mask = "[          ]"
+		while not self.__ping():
+			# Wonderful visual :)
+			if self.__conf["verbose"] > 1:
+				pos += delta
+				sys.stdout.write("\rINFO   " + mask[:pos] + '#' + mask[pos+1:] +
+								 " Waiting on the server...")
+				sys.stdout.flush()
+				if pos > len(mask)-3:
+					delta = -1
+				elif pos < 2:
+					delta = 1
+			# The server has 30 secondes to start.
+			if cnt >= 300:
+				if self.__conf["verbose"] > 1:
+					sys.stdout.write('\n')
+				raise ServerExecutionException("Failed to start server")
+			time.sleep(0.1)
+			cnt += 1
+		if self.__conf["verbose"] > 1:
+			sys.stdout.write('\n')
+			
+	
+	def start(self, argv):
+		# Command line options
+		self.__argv = argv
+		
+		# Install signal handlers
+		signal.signal(signal.SIGTERM, self.__sigTERMhandler)
+		signal.signal(signal.SIGINT, self.__sigTERMhandler)
+		
+		# Reads the command line options.
+		try:
+			cmdOpts = 'hc:s:xdviqV'
+			cmdLongOpts = ['help', 'version']
+			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
+		except getopt.GetoptError:
+			self.dispUsage()
+			return False
+			
+		self.__getCmdLineOptions(optList)
+		
+		verbose = self.__conf["verbose"]
+		if verbose <= 0:
+			logSys.setLevel(logging.ERROR)
+		elif verbose == 1:
+			logSys.setLevel(logging.WARN)
+		elif verbose == 2:
+			logSys.setLevel(logging.INFO)
+		else:
+			logSys.setLevel(logging.DEBUG)
+		# Add the default logging handler
+		stdout = logging.StreamHandler(sys.stdout)
+		# set a format which is simpler for console use
+		formatter = logging.Formatter('%(levelname)-6s %(message)s')
+		# tell the handler to use this format
+		stdout.setFormatter(formatter)
+		logSys.addHandler(stdout)
+
+		# Set the configuration path
+		self.__configurator.setBaseDir(self.__conf["conf"])
+		
+		# Set socket path
+		self.__configurator.readEarly()
+		socket = self.__configurator.getEarlyOptions()
+		if self.__conf["socket"] == None:
+			self.__conf["socket"] = socket["socket"]
+		logSys.info("Using socket file " + self.__conf["socket"])
+
+		if self.__conf["dump"]:
+			ret = self.__readConfig()
+			self.dumpConfig(self.__stream)
+			return ret
+		
+		# Interactive mode
+		if self.__conf["interactive"]:
+			try:
+				import readline
+			except ImportError:
+				logSys.error("Readline not available")
+				return False
+			try:
+				ret = True
+				if len(args) > 0:
+					ret = self.__processCommand(args)
+				if ret:
+					readline.parse_and_bind("tab: complete")
+					self.dispInteractive()
+					while True:
+						cmd = raw_input(self.PROMPT)
+						if cmd == "exit" or cmd == "quit":
+							# Exit
+							return True
+						if not cmd == "":
+							self.__processCommand(shlex.split(cmd))
+			except (EOFError, KeyboardInterrupt):
+				print
+				return True
+		# Single command mode
+		else:
+			if len(args) < 1:
+				self.dispUsage()
+				return False
+			return self.__processCommand(args)
+
+	def __readConfig(self):
+		# Read the configuration
+		self.__configurator.readAll()
+		ret = self.__configurator.getOptions()
+		self.__configurator.convertToProtocol()
+		self.__stream = self.__configurator.getConfigStream()
+		return ret
+	
+	def __readJailConfig(self, jail):
+		self.__configurator.readAll()
+		ret = self.__configurator.getOptions(jail)
+		self.__configurator.convertToProtocol()
+		self.__stream = self.__configurator.getConfigStream()
+		return ret
+	
+	#@staticmethod
+	def dumpConfig(cmd):
+		for c in cmd:
+			print c
+		return True
+	dumpConfig = staticmethod(dumpConfig)
+
+
+class ServerExecutionException(Exception):
+	pass
+
+if __name__ == "__main__":
+	client = Fail2banClient()
+	# Exit with correct return value
+	if client.start(sys.argv):
+		sys.exit(0)
+	else:
+		sys.exit(-1)

fail2ban-regex

@@ -0,0 +1,395 @@
+#!/usr/bin/python
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import getopt, sys, time, logging, os
+
+# Inserts our own modules path first in the list
+# fix for bug #343821
+sys.path.insert(1, "/usr/share/fail2ban")
+
+from client.configparserinc import SafeConfigParserWithIncludes
+from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
+from common.version import version
+from server.filter import Filter
+from server.failregex import RegexException
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.regex")
+
+class RegexStat:
+
+	def __init__(self, failregex):
+		self.__stats = 0
+		self.__failregex = failregex
+		self.__ipList = list()
+	
+	def inc(self):
+		self.__stats += 1
+	
+	def getStats(self):
+		return self.__stats
+
+	def getFailRegex(self):
+		return self.__failregex
+	
+	def appendIP(self, value):
+		self.__ipList.extend(value)
+	
+	def getIPList(self):
+		return self.__ipList
+
+class Fail2banRegex:
+	
+	test = None
+
+	CONFIG_DEFAULTS = {'configpath' : "/etc/fail2ban/"}
+
+	def __init__(self):
+		self.__filter = Filter(None)
+		self.__ignoreregex = list()
+		self.__failregex = list()
+		# Setup logging
+		logging.getLogger("fail2ban").handlers = []
+		self.__hdlr = logging.StreamHandler(Fail2banRegex.test)
+		# set a format which is simpler for console use
+		formatter = logging.Formatter("%(message)s")
+		# tell the handler to use this format
+		self.__hdlr.setFormatter(formatter)
+		logging.getLogger("fail2ban").addHandler(self.__hdlr)
+		logging.getLogger("fail2ban").setLevel(logging.ERROR)
+	
+	#@staticmethod
+	def dispVersion():
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2008 Cyril Jaquier"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+	dispVersion = staticmethod(dispVersion)
+	
+	#@staticmethod
+	def dispUsage():
+		print "Usage: "+sys.argv[0]+" [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]"
+		print
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+		print "This tools can test regular expressions for \"fail2ban\"."
+		print
+		print "Options:"
+		print "    -h, --help              display this help message"
+		print "    -V, --version           print the version"
+		print
+		print "Log:"
+		print "    string                  a string representing a log line"
+		print "    filename                path to a log file (/var/log/auth.log)"
+		print
+		print "Regex:"
+		print "    string                  a string representing a 'failregex'"
+		print "    filename                path to a filter file (filter.d/sshd.conf)"
+		print
+		print "IgnoreRegex:"
+		print "    string                  a string representing an 'ignoreregex'"
+		print "    filename                path to a filter file (filter.d/sshd.conf)"
+		print
+		print "Report bugs to <cyril.jaquier@fail2ban.org>"
+	dispUsage = staticmethod(dispUsage)
+	
+	def getCmdLineOptions(self, optList):
+		""" Gets the command line options
+		"""
+		for opt in optList:
+			if opt[0] in ["-h", "--help"]:
+				self.dispUsage()
+				sys.exit(0)
+			elif opt[0] in ["-V", "--version"]:
+				self.dispVersion()
+				sys.exit(0)
+
+	#@staticmethod
+	def logIsFile(value):
+		return os.path.isfile(value)
+	logIsFile = staticmethod(logIsFile)
+
+	def readIgnoreRegex(self, value):
+		if os.path.isfile(value):
+			reader = SafeConfigParserWithIncludes(defaults=self.CONFIG_DEFAULTS)
+			try:
+				reader.read(value)
+				print "Use ignoreregex file : " + value
+				self.__ignoreregex = [RegexStat(m)
+									for m in reader.get("Definition", "ignoreregex").split('\n')]
+			except NoSectionError:
+				print "No [Definition] section in " + value
+				print
+				return False
+			except NoOptionError:
+				print "No failregex option in " + value
+				print
+				return False
+			except MissingSectionHeaderError:
+				print "No section headers in " + value
+				print
+				return False
+		else:
+			if len(value) > 53:
+				stripReg = value[0:50] + "..."
+			else:
+				stripReg = value
+			print "Use ignoreregex line : " + stripReg
+			self.__ignoreregex = [RegexStat(value)]
+		return True
+
+	def readRegex(self, value):
+		if os.path.isfile(value):
+			reader = SafeConfigParserWithIncludes(defaults=self.CONFIG_DEFAULTS)
+			try:
+				reader.read(value)
+				print "Use regex file : " + value
+				self.__failregex = [RegexStat(m)
+									for m in reader.get("Definition", "failregex").split('\n')]
+			except NoSectionError:
+				print "No [Definition] section in " + value
+				print
+				return False
+			except NoOptionError:
+				print "No failregex option in " + value
+				print
+				return False
+			except MissingSectionHeaderError:
+				print "No section headers in " + value
+				print
+				return False
+		else:
+			if len(value) > 53:
+				stripReg = value[0:50] + "..."
+			else:
+				stripReg = value
+			print "Use regex line : " + stripReg
+			self.__failregex = [RegexStat(value)]
+		return True
+	
+	def testIgnoreRegex(self, line):
+		found = False
+		for regex in self.__ignoreregex:
+			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
+			try:
+				self.__filter.addIgnoreRegex(regex.getFailRegex())
+				try:
+					ret = self.__filter.ignoreLine(line)
+					if ret:
+						regex.inc()
+				except RegexException, e:
+					print e
+					return False
+			finally:
+				self.__filter.delIgnoreRegex(0)
+				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
+	
+	def testRegex(self, line):
+		found = False
+		for regex in self.__ignoreregex:
+			self.__filter.addIgnoreRegex(regex.getFailRegex())
+		for regex in self.__failregex:
+			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
+			try:
+				self.__filter.addFailRegex(regex.getFailRegex())
+				try:
+					try:
+						# Decode line to UTF-8
+						l = line.decode('utf-8')
+					except UnicodeDecodeError:
+						l = line
+					ret = self.__filter.findFailure(l)
+					if not len(ret) == 0:
+						if found == True:
+							ret[0].append(True)
+						else:
+							found = True
+							ret[0].append(False)
+						regex.inc()
+						regex.appendIP(ret)
+				except RegexException, e:
+					print e
+					return False
+				except IndexError:
+					print "Sorry, but no <host> found in regex"
+					return False
+			finally:
+				self.__filter.delFailRegex(0)
+				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
+		for regex in self.__ignoreregex:
+					self.__filter.delIgnoreRegex(0)
+	
+	def printStats(self):
+		print
+		print "Results"
+		print "======="
+		print
+		
+		# Print title
+		cnt = 1
+		print "Failregex"
+		print "|- Regular expressions:"
+		for failregex in self.__failregex:
+			print "|  [" + str(cnt) + "] " + failregex.getFailRegex()
+			cnt += 1
+		cnt = 1
+		
+		print "|"
+		
+		# Print stats
+		cnt = 1
+		total = 0
+		print "`- Number of matches:"
+		for failregex in self.__failregex:
+			match = failregex.getStats()
+			total += match
+			print "   [" + str(cnt) + "] " + str(match) + " match(es)"
+			cnt += 1
+		
+		print
+		
+		# Print title
+		cnt = 1
+		print "Ignoreregex"
+		print "|- Regular expressions:"
+		for failregex in self.__ignoreregex:
+			print "|  [" + str(cnt) + "] " + failregex.getFailRegex()
+			cnt += 1
+		cnt = 1
+		
+		print "|"
+		
+		# Print stats
+		cnt = 1
+		print "`- Number of matches:"
+		for failregex in self.__ignoreregex:
+			match = failregex.getStats()
+			print "   [" + str(cnt) + "] " + str(match) + " match(es)"
+			cnt += 1
+		
+		print
+		print "Summary"
+		print "======="
+		print
+		
+		if total == 0:
+			print "Sorry, no match"
+			print
+			print "Look at the above section 'Running tests' which could contain important"
+			print "information."
+			return False
+		else:
+			# Print stats
+			cnt = 1
+			print "Addresses found:"
+			for failregex in self.__failregex:
+				print "[" + str(cnt) + "]"
+				for ip in failregex.getIPList():
+					timeTuple = time.localtime(ip[1])
+					timeString = time.strftime("%a %b %d %H:%M:%S %Y", timeTuple)
+					if ip[2]:
+						dup = " (already matched)"
+					else:
+						dup = ""
+					print "    " + ip[0] + " (" + timeString + ")" + dup
+				cnt += 1
+			
+			print
+			
+			print "Success, the total number of match is " + str(total)
+			print
+			print "However, look at the above section 'Running tests' which could contain important"
+			print "information."
+			return True
+
+			
+def main():
+	fail2banRegex = Fail2banRegex()
+	# Reads the command line options.
+	try:
+		cmdOpts = 'hV'
+		cmdLongOpts = ['help', 'version']
+		optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
+	except getopt.GetoptError:
+		fail2banRegex.dispUsage()
+		sys.exit(-1)
+	# Process command line
+	fail2banRegex.getCmdLineOptions(optList)
+	# We need exactly 3 parameters
+	if not len(sys.argv) in (3, 4):
+		fail2banRegex.dispUsage()
+		sys.exit(-1)
+	else:
+		print
+		print "Running tests"
+		print "============="
+		print
+
+		if len(sys.argv) == 4:
+			if fail2banRegex.readIgnoreRegex(sys.argv[3]) == False:
+				sys.exit(-1)
+
+		if fail2banRegex.readRegex(sys.argv[2]) == False:
+			sys.exit(-1)
+
+		if fail2banRegex.logIsFile(sys.argv[1]):
+			try:
+				hdlr = open(sys.argv[1])
+				print "Use log file   : " + sys.argv[1]
+				print
+				for line in hdlr:
+					fail2banRegex.testIgnoreRegex(line)
+					fail2banRegex.testRegex(line)
+			except IOError, e:
+				print e
+				print
+				sys.exit(-1)
+		else:
+			if len(sys.argv[1]) > 53:
+				stripLog = sys.argv[1][0:50] + "..."
+			else:
+				stripLog = sys.argv[1]
+			print "Use single line: " + stripLog
+			print
+			fail2banRegex.testIgnoreRegex(sys.argv[1])
+			fail2banRegex.testRegex(sys.argv[1])
+		
+		if fail2banRegex.printStats():
+			sys.exit(0)
+		else:
+			sys.exit(-1)
+
+if __name__ == "__main__":
+	try:
+		main()
+	except KeyboardInterrupt:
+		print "Interrupted by the user"

fail2ban-server

@@ -0,0 +1,138 @@
+#!/usr/bin/python
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import getopt, sys, logging
+
+# Inserts our own modules path first in the list
+# fix for bug #343821
+sys.path.insert(1, "/usr/share/fail2ban")
+
+from common.version import version
+from server.server import Server
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+##
+# \mainpage Fail2Ban
+#
+# \section Introduction
+#
+# Fail2ban is designed to protect your server against brute force attacks.
+# Its first goal was to protect a SSH server.
+
+class Fail2banServer:
+	
+	def __init__(self):
+		self.__server = None
+		self.__argv = None
+		self.__conf = dict()
+		self.__conf["background"] = True
+		self.__conf["force"] = False
+		self.__conf["socket"] = "/var/run/fail2ban/fail2ban.sock"
+	
+	def dispVersion(self):
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2008 Cyril Jaquier"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+	
+	def dispUsage(self):
+		""" Prints Fail2Ban command line options and exits
+		"""
+		print "Usage: "+self.__argv[0]+" [OPTIONS]"
+		print
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+		print "Only use this command for debugging purpose. Start the server with"
+		print "fail2ban-client instead. The default behaviour is to start the server"
+		print "in background."
+		print
+		print "Options:"
+		print "    -b                   start in background"
+		print "    -f                   start in foreground"
+		print "    -s <FILE>            socket path"
+		print "    -x                   force execution of the server (remove socket file)"
+		print "    -h, --help           display this help message"
+		print "    -V, --version        print the version"
+		print
+		print "Report bugs to <cyril.jaquier@fail2ban.org>"
+	
+	def __getCmdLineOptions(self, optList):
+		""" Gets the command line options
+		"""
+		for opt in optList:
+			if opt[0] == "-b":
+				self.__conf["background"] = True
+			if opt[0] == "-f":
+				self.__conf["background"] = False
+			if opt[0] == "-s":
+				self.__conf["socket"] = opt[1]
+			if opt[0] == "-x":
+				self.__conf["force"] = True
+			if opt[0] in ["-h", "--help"]:
+	 			self.dispUsage()
+				sys.exit(0)
+			if opt[0] in ["-V", "--version"]:
+	 			self.dispVersion()
+				sys.exit(0)
+		
+	def start(self, argv):
+		# Command line options
+		self.__argv = argv
+		
+		# Reads the command line options.
+		try:
+			cmdOpts = 'bfs:xhV'
+			cmdLongOpts = ['help', 'version']
+			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
+		except getopt.GetoptError:
+			self.dispUsage()
+			sys.exit(-1)
+			
+		self.__getCmdLineOptions(optList)
+		
+		try:
+			self.__server = Server(self.__conf["background"])
+			self.__server.start(self.__conf["socket"], self.__conf["force"])
+			return True
+		except Exception, e:
+			logSys.exception(e)
+			self.__server.quit()
+			return False
+		
+if __name__ == "__main__":
+	server = Fail2banServer()
+	if server.start(sys.argv):
+		sys.exit(0)
+	else:
+		sys.exit(-1)

fail2ban-testcases

@@ -0,0 +1,72 @@
+#!/usr/bin/python
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+
+import unittest, logging, sys
+
+from common.version import version
+from testcases import banmanagertestcase
+from testcases import clientreadertestcase
+from testcases import failmanagertestcase
+from testcases import filtertestcase
+from testcases import servertestcase
+from testcases import actiontestcase
+from server.mytime import MyTime
+
+# Set the time to a fixed, known value
+# Sun Aug 14 12:00:00 CEST 2005
+MyTime.setTime(1124013600)
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+# Add the default logging handler
+stdout = logging.StreamHandler(sys.stdout)
+logSys.addHandler(stdout)
+logSys.setLevel(logging.FATAL)
+
+print "Fail2ban " + version + " test suite. Please wait..."
+
+tests = unittest.TestSuite()
+
+# Filter
+tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
+tests.addTest(unittest.makeSuite(filtertestcase.LogFile))
+tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
+# Server
+#tests.addTest(unittest.makeSuite(servertestcase.StartStop))
+#tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
+tests.addTest(unittest.makeSuite(actiontestcase.ExecuteAction))
+# FailManager
+tests.addTest(unittest.makeSuite(failmanagertestcase.AddFailure))
+# BanManager
+tests.addTest(unittest.makeSuite(banmanagertestcase.AddFailure))
+# ClientReader
+tests.addTest(unittest.makeSuite(clientreadertestcase.JailReaderTest))
+
+# Tests runner
+testRunner = unittest.TextTestRunner()
+testRunner.run(tests)

fail2ban.py

@@ -1,527 +0,0 @@
-#!/usr/bin/env python
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import time, sys, getopt, os, signal, string
-from ConfigParser import *
-
-# Checks if log4py is present.
-try:
-	import log4py
-except:
-	print "log4py is needed (see README)"
-	sys.exit(-1)
-
-# Appends our own modules path
-sys.path.append('/usr/lib/fail2ban')
-
-from firewall.iptables import Iptables
-from firewall.ipfw import Ipfw
-from firewall.ipfwadm import Ipfwadm
-from logreader.logreader import LogReader
-from confreader.configreader import ConfigReader
-from version import version
-
-def usage():
-	print "Usage: fail2ban.py [OPTIONS]"
-	print
-	print "Fail2Ban v"+version+" reads log file that contains password failure report"
-	print "and bans the corresponding IP address using iptables."
-	print
-	print "  -b         start fail2ban in background"
-	print "  -d         start fail2ban in debug mode"
-	print "  -e <INTF>  ban IP on the INTF interface"
-	print "  -c <FILE>  read configuration file FILE"
-	print "  -p <FILE>  create PID lock in FILE"
-	print "  -h         display this help message"
-	print "  -i <IP(s)> IP(s) to ignore"
-	print "  -k         kill a currently running Fail2Ban instance"
-	print "  -l <FILE>  log message in FILE"
-	print "  -r <VALUE> allow a max of VALUE password failure"
-	print "  -t <TIME>  ban IP for TIME seconds"
-	print "  -v         verbose"
-	print "  -w <FIWA>  select the firewall to use. Can be iptables,"
-	print "             ipfwadm or ipfw"
-	print
-	print "Report bugs to <lostcontrol@users.sourceforge.net>"
-	sys.exit(0)
-
-def checkForRoot():
-	""" Check for root user.
-	"""
-	uid = `os.getuid()`
-	if uid == '0':
-		return True
-	else:
-		return False
-
-def createDaemon():
-	"""Detach a process from the controlling terminal and run it in the
-	background as a daemon.
-	
-	http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
-	"""
-
-	try:
-		# Fork a child process so the parent can exit.  This will return control
-		# to the command line or shell.  This is required so that the new process
-		# is guaranteed not to be a process group leader.  We have this guarantee
-		# because the process GID of the parent is inherited by the child, but
-		# the child gets a new PID, making it impossible for its PID to equal its
-		# PGID.
-		pid = os.fork()
-	except OSError, e:
-		return((e.errno, e.strerror))	 # ERROR (return a tuple)
-
-	if (pid == 0):	   # The first child.
-
-		# Next we call os.setsid() to become the session leader of this new
-		# session.  The process also becomes the process group leader of the
-		# new process group.  Since a controlling terminal is associated with a
-		# session, and this new session has not yet acquired a controlling
-		# terminal our process now has no controlling terminal.  This shouldn't
-		# fail, since we're guaranteed that the child is not a process group
-		# leader.
-		os.setsid()
-	
-		# When the first child terminates, all processes in the second child
-		# are sent a SIGHUP, so it's ignored.
-		signal.signal(signal.SIGHUP, signal.SIG_IGN)
-	
-		try:
-			# Fork a second child to prevent zombies.  Since the first child is
-			# a session leader without a controlling terminal, it's possible for
-			# it to acquire one by opening a terminal in the future.  This second
-			# fork guarantees that the child is no longer a session leader, thus
-			# preventing the daemon from ever acquiring a controlling terminal.
-			pid = os.fork()		# Fork a second child.
-		except OSError, e:
-			return((e.errno, e.strerror))  # ERROR (return a tuple)
-	
-		if (pid == 0):	  # The second child.
-			# Ensure that the daemon doesn't keep any directory in use.  Failure
-			# to do this could make a filesystem unmountable.
-			os.chdir("/")
-			# Give the child complete control over permissions.
-			os.umask(0)
-		else:
-			os._exit(0)	  # Exit parent (the first child) of the second child.
-	else:
-		os._exit(0)		 # Exit parent of the first child.
-
-	# Close all open files.  Try the system configuration variable, SC_OPEN_MAX,
-	# for the maximum number of open files to close.  If it doesn't exist, use
-	# the default value (configurable).
-	try:
-		maxfd = os.sysconf("SC_OPEN_MAX")
-	except (AttributeError, ValueError):
-		maxfd = 256	   # default maximum
-
-	for fd in range(0, maxfd):
-		try:
-			os.close(fd)
-		except OSError:   # ERROR (ignore)
-			pass
-
-	# Redirect the standard file descriptors to /dev/null.
-   	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
-	os.open("/dev/null", os.O_RDWR)		# standard output (1)
-	os.open("/dev/null", os.O_RDWR)		# standard error (2)
-
-	return(0)
-
-def sigTERMhandler(signum, frame):
-	""" Handles the TERM signal when in daemon mode in order to
-		exit properly.
-	"""
-	logSys.debug("Signal handler called with sig "+`signum`)
-	logSys.info("Restoring iptables...")
-	fireWall.flushBanList(conf["debug"])
-	logSys.info("Exiting...")
-	sys.exit(0)
-	
-def checkForPID(lockfile):
-	""" Checks for running Fail2Ban.
-	
-		Returns the current PID if Fail2Ban is running or False
-		if no instance found.
-	"""
-	try:
-		fileHandler = open(lockfile)
-		pid = fileHandler.readline()
-		return pid
-	except IOError:
-		return False
-		
-def createPID(lockfile):
-	""" Creates a PID lock file with the current PID.
-	"""
-	fileHandler = open(lockfile, mode='w')
-	pid = os.getpid()
-	fileHandler.write(`pid`+'\n')
-	fileHandler.close()
-	logSys.debug("Created PID lock ("+`pid`+") in "+lockfile)
-		
-def removePID(lockfile):
-	""" Remove PID lock.
-	"""
-	os.remove(lockfile)
-	logSys.debug("Removed PID lock "+lockfile)
-
-def killPID(pid):
-	""" Kills the process with the given PID using the
-		INT signal (same effect as <ctrl>+<c>).
-	"""
-	return os.kill(pid, 2)
-
-if __name__ == "__main__":
-	
-	# Gets an instance of log4py.
-	logSys = log4py.Logger().get_instance()
-	logSys.set_formatstring("%T %L %M")
-	
-	conf = dict()
-	conf["verbose"] = False
-	conf["background"] = False
-	conf["debug"] = False
-	conf["conffile"] = "/etc/fail2ban.conf"
-	conf["pidlock"] = "/tmp/fail2ban.pid"
-	conf["logging"] = False
-	conf["logfile"] = "/var/log/fail2ban.log"
-	conf["maxretry"] = 3
-	conf["bantime"] = 600
-	conf["ignoreip"] = ''
-	conf["interface"] = "eth0"
-	conf["firewall"] = "iptables"
-	conf["ipfw-start-rule"] = 0
-	conf["polltime"] = 1
-	
-	# Reads the command line options.
-	try:
-		optList, args = getopt.getopt(sys.argv[1:], 'hvbdkc:l:t:i:r:e:w:p:')
-	except getopt.GetoptError:
-		usage()
-	
-	# Pre-parsing of command line options for the -c option
-	for opt in optList:
-		if opt[0] == "-c":
-			conf["conffile"] = opt[1]
-	
-	# Config file
-	configParser = SafeConfigParser()
-	configParser.read(conf["conffile"])
-	
-	# background
-	try:
-		conf["background"] = configParser.getboolean("DEFAULT", "background")
-	except ValueError:
-		logSys.warn("background option should be a boolean")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("background option not in config file")
-		logSys.warn("Using default value")
-
-	# debug
-	try:
-		conf["debug"] = configParser.getboolean("DEFAULT", "debug")
-	except ValueError:
-		logSys.warn("debug option should be a boolean")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("debug option not in config file")
-		logSys.warn("Using default value")
-
-	# logfile
-	try:
-		conf["logfile"] = configParser.get("DEFAULT", "logfile")
-	except ValueError:
-		logSys.warn("logfile option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("logfile option not in config file")
-		logSys.warn("Using default value")
-		
-	# pidlock
-	try:
-		conf["pidlock"] = configParser.get("DEFAULT", "pidlock")
-	except ValueError:
-		logSys.warn("pidlock option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("pidlock option not in config file")
-		logSys.warn("Using default value")
-		
-	# maxretry
-	try:
-		conf["maxretry"] = configParser.getint("DEFAULT", "maxretry")
-	except ValueError:
-		logSys.warn("maxretry option should be an integer")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("maxretry option not in config file")
-		logSys.warn("Using default value")
-
-	# bantime
-	try:
-		conf["bantime"] = configParser.getint("DEFAULT", "bantime")
-	except ValueError:
-		logSys.warn("bantime option should be an integer")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("bantime option not in config file")
-		logSys.warn("Using default value")
-
-	# ignoreip
-	try:
-		conf["ignoreip"] = configParser.get("DEFAULT", "ignoreip")
-	except ValueError:
-		logSys.warn("ignoreip option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("ignoreip option not in config file")
-		logSys.warn("Using default value")
-		
-	# interface
-	try:
-		conf["interface"] = configParser.get("DEFAULT", "interface")
-	except ValueError:
-		logSys.warn("interface option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("interface option not in config file")
-		logSys.warn("Using default value")
-		
-	# firewall
-	try:
-		conf["firewall"] = configParser.get("DEFAULT", "firewall")
-	except ValueError:
-		logSys.warn("firewall option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("firewall option not in config file")
-		logSys.warn("Using default value")
-	
-	# ipfw-start-rule
-	try:
-		conf["ipfw-start-rule"] = configParser.getint("DEFAULT",
-													"ipfw-start-rule")
-	except ValueError:
-		logSys.warn("ipfw-start-rule option should be an integer")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("ipfw-start-rule option not in config file")
-		logSys.warn("Using default value")
-
-	# polltime
-	try:
-		conf["polltime"] = configParser.getint("DEFAULT", "polltime")
-	except ValueError:
-		logSys.warn("polltime option should be an integer")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("polltime option not in config file")
-		logSys.warn("Using default value")
-	
-	for opt in optList:
-		if opt[0] == "-h":
-			usage()
-		if opt[0] == "-v":
-			conf["verbose"] = True
-		if opt[0] == "-b":
-			conf["background"] = True
-		if opt[0] == "-d":
-			conf["debug"] = True
-		if opt[0] == "-e":
-			conf["interface"] = opt[1]
-		if opt[0] == "-l":
-			conf["logging"] = True
-			conf["logfile"] = opt[1]
-		if opt[0] == "-t":
-			try:
-				conf["bantime"] = int(opt[1])
-			except ValueError:
-				logSys.warn("banTime must be an integer")
-				logSys.warn("Using default value")
-		if opt[0] == "-i":
-			conf["ignoreip"] = opt[1]
-		if opt[0] == "-r":
-			conf["retrymax"] = int(opt[1])
-		if opt[0] == "-w":
-			conf["firewall"] = opt[1]
-		if opt[0] == "-p":
-			conf["pidlock"] = opt[1]
-		if opt[0] == "-k":
-			pid = checkForPID(conf["pidlock"])
-			if pid:
-				killPID(int(pid))
-				logSys.warn("Killed Fail2Ban with PID "+pid)
-				sys.exit(0)
-			else:
-				logSys.error("No running Fail2Ban found")
-				sys.exit(-1)
-
-	# Process some options
-	for c in conf:
-		if c == "verbose" and conf[c]:
-			logSys.set_loglevel(log4py.LOGLEVEL_VERBOSE)
-		elif c == "debug" and conf[c]:
-			logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
-			logSys.set_formatstring(log4py.FMT_DEBUG)
-		elif c == "background" and conf[c]:
-			retCode = createDaemon()
-			signal.signal(signal.SIGTERM, sigTERMhandler)
-			logSys.set_target(conf["logfile"])
-			if retCode != 0:
-				logSys.error("Unable to start daemon")
-				sys.exit(-1)
-		elif c == "logging" and conf[c]:
-			try:
-				open(conf["logfile"], "a")
-				logSys.set_target(conf["logfile"])
-			except IOError:
-				logSys.warn("Unable to log to "+conf["logfile"])
-				logSys.warn("Using default output for logging")
-		elif c == "ignoreip":
-			ignoreIPList = conf[c].split(' ')
-		elif c == "firewall":
-			conf[c] = string.lower(conf[c])
-			if conf[c] == "ipfw":
-				fireWallName = "Ipfw"
-			elif conf[c] == "ipfwadm":
-				fireWallName = "Ipfwadm"
-			else:
-				fireWallName = "Iptables"
-	
-	# Checks for root user. This is necessary because log files
-	# are owned by root and firewall needs root access.
-	if not checkForRoot():
-		logSys.error("You must be root")
-		if not conf["debug"]:
-			sys.exit(-1)
-			
-	# Checks that no instance of Fail2Ban is currently running.
-	pid = checkForPID(conf["pidlock"])
-	if pid:
-		logSys.error("Fail2Ban already running with PID "+pid)
-		sys.exit(-1)
-	else:
-		createPID(conf["pidlock"])
-	
-	logSys.debug("ConfFile is "+conf["conffile"])
-	logSys.debug("BanTime is "+`conf["bantime"]`)
-	logSys.debug("retryAllowed is "+`conf["maxretry"]`)
-	
-	# Reads the config file and create a LogReader instance for
-	# each log file to check.
-	confReader = ConfigReader(logSys, conf["conffile"]);
-	confReader.openConf()
-	logList = list()
-	for t in confReader.getSections():
-		l = confReader.getLogOptions(t)
-		if l["enabled"]:
-			lObj = LogReader(logSys, l["logfile"], l["timeregex"],
-							l["timepattern"], l["failregex"], conf["bantime"])
-			lObj.setName(t)
-			logList.append(lObj)
-	
-	# Creates one instance of Iptables (thanks to Pyhton dynamic
-	# features).
-	fireWallObj = eval(fireWallName)
-	fireWall = fireWallObj(conf["bantime"], logSys, conf["interface"])
-	
-	# IPFW needs rules number. The configuration option "ipfw-start-rule"
-	# defines the first rule number used by Fail2Ban.
-	if fireWallName == "Ipfw":
-		fireWall.setCrtRuleNbr(conf["ipfw-start-rule"])
-	
-	# We add 127.0.0.1 to the ignore list has we do not want
-	# to be ban ourself.
-	for element in logList:
-		element.addIgnoreIP("127.0.0.1")
-	while len(ignoreIPList) > 0:
-		ip = ignoreIPList.pop()
-		for element in logList:
-			element.addIgnoreIP(ip)
-	
-	logSys.warn("Fail2Ban v"+version+" is running")
-	# Main loop
-	while True:
-		try:
-			sys.stdout.flush()
-			sys.stderr.flush()
-			
-			# Checks if some IP have to be remove from ban
-			# list.
-			fireWall.checkForUnBan(conf["debug"])
-			
-			# If the log file has not been modified since the
-			# last time, we sleep for 1 second. This is active
-			# polling so not very effective.
-			modList = list()
-			for element in logList:
-				if element.isModified():
-					modList.append(element)
-			
-			if len(modList) == 0:
-				time.sleep(conf["polltime"])
-				continue
-			
-			# Gets the failure list from the log file. For a given IP,
-			# takes only the service which has the most password failures.
-			failList = dict()
-			for element in modList:
-				e = element.getFailures()
-				iter = e.iterkeys()
-				for i in range(len(e)):
-					key = iter.next()
-					if failList.has_key(key):
-						if failList[key][0] < e[key][0]:
-							failList[key] = (e[key][0], e[key][1],
-											element.getName())
-					else:
-						failList[key] = (e[key][0], e[key][1],
-										element.getName())
-				
-			
-			# We iterate the failure list and ban IP that make
-			# *retryAllowed* login failures.
-			iterFailList = failList.iteritems()
-			for i in range(len(failList)):
-				element = iterFailList.next()
-				if element[1][0] >= conf["maxretry"]:
-					logSys.warn(`element[1][2]`+": "+element[0]+" has "+
-								`element[1][0]`+" login failure(s). Banned.")
-					fireWall.addBanIP(element[0], conf["debug"])
-			
-		except KeyboardInterrupt:
-			# When the user press <ctrl>+<c> we flush the ban list
-			# and exit nicely.
-			logSys.info("Restoring firewall rules...")
-			fireWall.flushBanList(conf["debug"])
-			removePID(conf["pidlock"])
-			logSys.warn("Exiting...")
-			sys.exit(0)

files/cacti/README

@@ -0,0 +1,53 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.8.2)                           2008/03/06
+=============================================================
+
+Cacti is a graphing solution using RRDTool. It is possible to
+use Cacti to display statistics about Fail2ban.
+
+Installation:
+-------------
+
+1/ Install Fail2ban version 0.8 or higher and ensure that it
+   works properly.
+2/ The user running poller.php must have read and write
+   access to the socket used by Fail2ban.
+3/ Copy fail2ban_stats.sh to scripts/. You can test it with
+   bash scripts/fail2ban_stats.sh
+4/ Import the template cacti_host_template_fail2ban.xml
+5/ TO BE CONTINUED...
+
+Contact:
+--------
+
+You need some new features, you found bugs or you just
+appreciate this program, you can contact me at:
+
+Website: http://www.fail2ban.org
+
+Cyril Jaquier: <cyril.jaquier@fail2ban.org>
+
+License:
+--------
+
+Fail2Ban is free software; you can redistribute it
+and/or modify it under the terms of the GNU General Public
+License as published by the Free Software Foundation; either
+version 2 of the License, or (at your option) any later
+version.
+
+Fail2Ban is distributed in the hope that it will be
+useful, but WITHOUT ANY WARRANTY; without even the implied
+warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public
+License along with Fail2Ban; if not, write to the Free
+Software Foundation, Inc., 59 Temple Place, Suite 330,
+Boston, MA  02111-1307  USA

files/cacti/cacti_host_template_fail2ban.xml

@@ -0,0 +1,297 @@
+<cacti>	
+	<hash_02001346a4e9f7498a8129f0dfc2e1c8c7b35a>
+		<name>Fail2ban</name>
+		<graph_templates>hash_0000132fe631a3ac1f1705e332d0aee925d21b</graph_templates>
+		<data_queries></data_queries>
+	</hash_02001346a4e9f7498a8129f0dfc2e1c8c7b35a>
+	<hash_0000132fe631a3ac1f1705e332d0aee925d21b>
+		<name>Fail2ban - Statistics</name>
+		<graph>
+			<t_title>on</t_title>
+			<title>|host_description| - Statistics</title>
+			<t_image_format_id></t_image_format_id>
+			<image_format_id>1</image_format_id>
+			<t_height></t_height>
+			<height>120</height>
+			<t_width></t_width>
+			<width>500</width>
+			<t_auto_scale></t_auto_scale>
+			<auto_scale>on</auto_scale>
+			<t_auto_scale_opts></t_auto_scale_opts>
+			<auto_scale_opts>2</auto_scale_opts>
+			<t_auto_scale_log></t_auto_scale_log>
+			<auto_scale_log></auto_scale_log>
+			<t_auto_scale_rigid></t_auto_scale_rigid>
+			<auto_scale_rigid></auto_scale_rigid>
+			<t_auto_padding></t_auto_padding>
+			<auto_padding>on</auto_padding>
+			<t_export></t_export>
+			<export>on</export>
+			<t_upper_limit></t_upper_limit>
+			<upper_limit>100</upper_limit>
+			<t_lower_limit></t_lower_limit>
+			<lower_limit>0</lower_limit>
+			<t_base_value></t_base_value>
+			<base_value>1000</base_value>
+			<t_unit_value></t_unit_value>
+			<unit_value></unit_value>
+			<t_unit_exponent_value></t_unit_exponent_value>
+			<unit_exponent_value></unit_exponent_value>
+			<t_vertical_label></t_vertical_label>
+			<vertical_label>hits/5min</vertical_label>
+		</graph>
+		<items>
+			<hash_100013f76575fdcd7f2684843e8f2cbae4ef96>
+				<task_item_id>hash_0800132d7bfb27a7ecb33f23433863e6f90612</task_item_id>
+				<color_id>00CF00</color_id>
+				<graph_type_id>4</graph_type_id>
+				<consolidation_function_id>1</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Failed</text_format>
+				<hard_return></hard_return>
+				<sequence>1</sequence>
+			</hash_100013f76575fdcd7f2684843e8f2cbae4ef96>
+			<hash_100013ca0d59c48dde83a1753e21eb1f44a396>
+				<task_item_id>hash_0800132d7bfb27a7ecb33f23433863e6f90612</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>4</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Current:</text_format>
+				<hard_return></hard_return>
+				<sequence>2</sequence>
+			</hash_100013ca0d59c48dde83a1753e21eb1f44a396>
+			<hash_1000132f8d371932ebedbb665f80abf427ffb4>
+				<task_item_id>hash_0800132d7bfb27a7ecb33f23433863e6f90612</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>1</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Average:</text_format>
+				<hard_return></hard_return>
+				<sequence>3</sequence>
+			</hash_1000132f8d371932ebedbb665f80abf427ffb4>
+			<hash_1000131b8e847f7be22014f1f0b3d098c9e702>
+				<task_item_id>hash_0800132d7bfb27a7ecb33f23433863e6f90612</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>3</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Maximum:</text_format>
+				<hard_return>on</hard_return>
+				<sequence>4</sequence>
+			</hash_1000131b8e847f7be22014f1f0b3d098c9e702>
+			<hash_1000130e6084fd4ed86d8c86dea8f84b115eaa>
+				<task_item_id>hash_080013b224f2764ba5a827de959b1ff44cbc1d</task_item_id>
+				<color_id>FF0000</color_id>
+				<graph_type_id>5</graph_type_id>
+				<consolidation_function_id>1</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Banned</text_format>
+				<hard_return></hard_return>
+				<sequence>5</sequence>
+			</hash_1000130e6084fd4ed86d8c86dea8f84b115eaa>
+			<hash_1000132812e5f3ee8261819268854c67093b94>
+				<task_item_id>hash_080013b224f2764ba5a827de959b1ff44cbc1d</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>4</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Current:</text_format>
+				<hard_return></hard_return>
+				<sequence>6</sequence>
+			</hash_1000132812e5f3ee8261819268854c67093b94>
+			<hash_10001336fcfc1d017e975fa22a3ce0d0492daf>
+				<task_item_id>hash_080013b224f2764ba5a827de959b1ff44cbc1d</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>1</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Average:</text_format>
+				<hard_return></hard_return>
+				<sequence>7</sequence>
+			</hash_10001336fcfc1d017e975fa22a3ce0d0492daf>
+			<hash_100013e5fddd5da42b9bf296d7f344b2a00446>
+				<task_item_id>hash_080013b224f2764ba5a827de959b1ff44cbc1d</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>3</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Maximum:</text_format>
+				<hard_return>on</hard_return>
+				<sequence>8</sequence>
+			</hash_100013e5fddd5da42b9bf296d7f344b2a00446>
+		</items>
+		<inputs>
+			<hash_090013a5d69bc5ca8b53ef62b61221a69b8055>
+				<name>Data Source [banned]</name>
+				<description></description>
+				<column_name>task_item_id</column_name>
+				<items>hash_0000130e6084fd4ed86d8c86dea8f84b115eaa|hash_0000132812e5f3ee8261819268854c67093b94|hash_00001336fcfc1d017e975fa22a3ce0d0492daf|hash_000013e5fddd5da42b9bf296d7f344b2a00446</items>
+			</hash_090013a5d69bc5ca8b53ef62b61221a69b8055>
+			<hash_0900132cee6f79f051b0dd39cafcbfcfd87960>
+				<name>Data Source [failed]</name>
+				<description></description>
+				<column_name>task_item_id</column_name>
+				<items>hash_000013f76575fdcd7f2684843e8f2cbae4ef96|hash_000013ca0d59c48dde83a1753e21eb1f44a396|hash_0000131b8e847f7be22014f1f0b3d098c9e702|hash_0000132f8d371932ebedbb665f80abf427ffb4</items>
+			</hash_0900132cee6f79f051b0dd39cafcbfcfd87960>
+		</inputs>
+	</hash_0000132fe631a3ac1f1705e332d0aee925d21b>
+	<hash_0100130fce21647570158d210c7832cd50e98a>
+		<name>Fail2ban - Statistics</name>
+		<ds>
+			<t_name></t_name>
+			<name>|host_description| - Statistics</name>
+			<data_input_id>hash_030013a3adf3f2607747859b08262d972eabf0</data_input_id>
+			<t_rra_id></t_rra_id>
+			<t_rrd_step></t_rrd_step>
+			<rrd_step>300</rrd_step>
+			<t_active></t_active>
+			<active>on</active>
+			<rra_items>hash_150013c21df5178e5c955013591239eb0afd46|hash_1500130d9c0af8b8acdc7807943937b3208e29|hash_1500136fc2d038fb42950138b0ce3e9874cc60|hash_150013e36f3adb9f152adfa5dc50fd2b23337e</rra_items>
+		</ds>
+		<items>
+			<hash_0800132d7bfb27a7ecb33f23433863e6f90612>
+				<t_data_source_name></t_data_source_name>
+				<data_source_name>failed</data_source_name>
+				<t_rrd_minimum></t_rrd_minimum>
+				<rrd_minimum>0</rrd_minimum>
+				<t_rrd_maximum></t_rrd_maximum>
+				<rrd_maximum>0</rrd_maximum>
+				<t_data_source_type_id></t_data_source_type_id>
+				<data_source_type_id>2</data_source_type_id>
+				<t_rrd_heartbeat></t_rrd_heartbeat>
+				<rrd_heartbeat>600</rrd_heartbeat>
+				<t_data_input_field_id></t_data_input_field_id>
+				<data_input_field_id>hash_0700134027ae7d3baefb02f510c09de07d159f</data_input_field_id>
+			</hash_0800132d7bfb27a7ecb33f23433863e6f90612>
+			<hash_080013b224f2764ba5a827de959b1ff44cbc1d>
+				<t_data_source_name></t_data_source_name>
+				<data_source_name>banned</data_source_name>
+				<t_rrd_minimum></t_rrd_minimum>
+				<rrd_minimum>0</rrd_minimum>
+				<t_rrd_maximum></t_rrd_maximum>
+				<rrd_maximum>0</rrd_maximum>
+				<t_data_source_type_id></t_data_source_type_id>
+				<data_source_type_id>2</data_source_type_id>
+				<t_rrd_heartbeat></t_rrd_heartbeat>
+				<rrd_heartbeat>600</rrd_heartbeat>
+				<t_data_input_field_id></t_data_input_field_id>
+				<data_input_field_id>hash_07001319c32c9466152aa6cfc2bbc639a246d8</data_input_field_id>
+			</hash_080013b224f2764ba5a827de959b1ff44cbc1d>
+		</items>
+		<data>
+			<item_000>
+				<data_input_field_id>hash_0700131cda0f872b68c87e508a29e8976a6a7a</data_input_field_id>
+				<t_value>on</t_value>
+				<value>ssh-iptables</value>
+			</item_000>
+		</data>
+	</hash_0100130fce21647570158d210c7832cd50e98a>
+	<hash_030013a3adf3f2607747859b08262d972eabf0>
+		<name>Fail2ban - Get statistics</name>
+		<type_id>1</type_id>
+		<input_string>bash &lt;path_cacti&gt;/scripts/fail2ban_stats.sh &lt;jail&gt;</input_string>
+		<fields>
+			<hash_0700131cda0f872b68c87e508a29e8976a6a7a>
+				<name>Jail name</name>
+				<update_rra></update_rra>
+				<regexp_match></regexp_match>
+				<allow_nulls></allow_nulls>
+				<type_code></type_code>
+				<input_output>in</input_output>
+				<data_name>jail</data_name>
+			</hash_0700131cda0f872b68c87e508a29e8976a6a7a>
+			<hash_0700134027ae7d3baefb02f510c09de07d159f>
+				<name>Total of failed logins</name>
+				<update_rra>on</update_rra>
+				<regexp_match></regexp_match>
+				<allow_nulls></allow_nulls>
+				<type_code></type_code>
+				<input_output>out</input_output>
+				<data_name>failed</data_name>
+			</hash_0700134027ae7d3baefb02f510c09de07d159f>
+			<hash_07001319c32c9466152aa6cfc2bbc639a246d8>
+				<name>Total of banned hosts</name>
+				<update_rra>on</update_rra>
+				<regexp_match></regexp_match>
+				<allow_nulls></allow_nulls>
+				<type_code></type_code>
+				<input_output>out</input_output>
+				<data_name>banned</data_name>
+			</hash_07001319c32c9466152aa6cfc2bbc639a246d8>
+		</fields>
+	</hash_030013a3adf3f2607747859b08262d972eabf0>
+	<hash_150013c21df5178e5c955013591239eb0afd46>
+		<name>Daily (5 Minute Average)</name>
+		<x_files_factor>0.5</x_files_factor>
+		<steps>1</steps>
+		<rows>600</rows>
+		<timespan>86400</timespan>
+		<cf_items>1|2|3|4</cf_items>
+	</hash_150013c21df5178e5c955013591239eb0afd46>
+	<hash_1500130d9c0af8b8acdc7807943937b3208e29>
+		<name>Weekly (30 Minute Average)</name>
+		<x_files_factor>0.5</x_files_factor>
+		<steps>6</steps>
+		<rows>700</rows>
+		<timespan>604800</timespan>
+		<cf_items>1|2|3|4</cf_items>
+	</hash_1500130d9c0af8b8acdc7807943937b3208e29>
+	<hash_1500136fc2d038fb42950138b0ce3e9874cc60>
+		<name>Monthly (2 Hour Average)</name>
+		<x_files_factor>0.5</x_files_factor>
+		<steps>24</steps>
+		<rows>775</rows>
+		<timespan>2678400</timespan>
+		<cf_items>1|2|3|4</cf_items>
+	</hash_1500136fc2d038fb42950138b0ce3e9874cc60>
+	<hash_150013e36f3adb9f152adfa5dc50fd2b23337e>
+		<name>Yearly (1 Day Average)</name>
+		<x_files_factor>0.5</x_files_factor>
+		<steps>288</steps>
+		<rows>797</rows>
+		<timespan>33053184</timespan>
+		<cf_items>1|2|3|4</cf_items>
+	</hash_150013e36f3adb9f152adfa5dc50fd2b23337e>
+	<hash_050013e961cc8ec04fda6ed4981cf5ad501aa5>
+		<name>Make Per 5 Minutes</name>
+		<items>
+			<hash_14001340bb7a1143b0f2e2efca14eb356236de>
+				<sequence>1</sequence>
+				<type>4</type>
+				<value>CURRENT_DATA_SOURCE</value>
+			</hash_14001340bb7a1143b0f2e2efca14eb356236de>
+			<hash_140013faf1b148b2c0e0527362ed5b8ca1d351>
+				<sequence>2</sequence>
+				<type>6</type>
+				<value>300</value>
+			</hash_140013faf1b148b2c0e0527362ed5b8ca1d351>
+			<hash_14001342686ea0925c0220924b7d333599cd67>
+				<sequence>3</sequence>
+				<type>2</type>
+				<value>3</value>
+			</hash_14001342686ea0925c0220924b7d333599cd67>
+		</items>
+	</hash_050013e961cc8ec04fda6ed4981cf5ad501aa5>
+	<hash_060013e9c43831e54eca8069317a2ce8c6f751>
+		<name>Normal</name>
+		<gprint_text>%8.2lf %s</gprint_text>
+	</hash_060013e9c43831e54eca8069317a2ce8c6f751>
+</cacti>

files/cacti/fail2ban_stats.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# This script can be used to collect data for Cacti. One parameter is needed,
+# the jail name. It must be a currently running jail. The script returns two
+# value: the number of failures and the number of banned host.
+#
+# If Fail2ban is not available in the path, you can change the value of the
+# variable FAIL2BAN below.. You can add option to this variable too. Please
+# look at the man page of fail2ban-client for more information.
+#
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+FAIL2BAN="fail2ban-client"
+
+JAIL=$1
+
+if [ -z $JAIL ]; then
+	echo "Usage:" `basename $0` "<jail>"
+	exit
+fi
+
+IFS=""
+
+STATS=$($FAIL2BAN status $JAIL)
+
+TOTAL_FAILED=$(echo $STATS | grep "Total failed:" | awk '{ print $5 }')
+TOTAL_BANNED=$(echo $STATS | grep "Total banned:" | awk '{ print $4 }')
+
+echo "failed:"$TOTAL_FAILED "banned:"$TOTAL_BANNED
+

files/gen_badbots

@@ -0,0 +1,83 @@
+#!/bin/bash
+#-------------------------- =+- Shell script -+= --------------------------
+#
+# @file      badbots.sh
+# @date      Sun Feb 11 00:49:53 2007
+# @brief
+#
+#
+#  Yaroslav Halchenko                                      CS@UNM, CS@NJIT
+#  web:     http://www.onerussian.com                      & PSYCH@RUTGERS
+#  e-mail:  yoh@onerussian.com                              ICQ#: 60653192
+#
+# DESCRIPTION (NOTES):
+# 
+# Script to fetch list of agent strings from http://www.user-agents.org
+# which are known to be from mailicious bots, and create apache-badbots.conf
+# filter for fail2ban
+#
+# COPYRIGHT: Yaroslav Halchenko 2007-2010
+#
+# LICENSE:
+#
+#  This program is free software; you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation; either version 2 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program; if not, write to the 
+#  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+#  MA 02110-1301, USA.
+#
+# On Debian system see /usr/share/common-licenses/GPL for the full license.
+#
+#-----------------\____________________________________/------------------
+
+url=http://www.user-agents.org/index.shtml
+badbots=$(
+for f in "" "?g_l" "?m" "?n_s" "?t_z"; do
+	wget -q -O- $url$f; 
+done \
+| grep -h -B4 '<td class="smallcell" nowrap>S&nbsp;</td>'\
+| sed -e 's/&nbsp;//g' \
+| awk '/^--/{getline; gsub("  ",""); print $0}' \
+| sed -e 's/\([.\:|()]\)/\\\1/g' \
+| tr '\n' '|' \
+| sed -e 's/|$//g'
+)
+
+echo $badbots >| /tmp/badbots.tmp
+
+cat >| apache-badbots.conf <<EOF
+# Fail2Ban configuration file
+#
+# List of bad bots fetched from http://www.user-agents.org
+# Generated on `date` by $0
+#
+# Author: Yaroslav Halchenko
+#
+#
+
+[Definition]
+badbotscustom = EmailCollector|WebEMailExtrac
+badbots = $badbots
+
+# Option:  failregex
+# Notes.:  Regexp to catch known spambots and software alike. Please verify that
+#          it is your intent to block IPs which were driven by abovementioned bots
+# Values:  TEXT
+#
+failregex = ^(?P<host>\S*) -.*"GET.*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"\$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex =
+EOF

files/gentoo-confd

@@ -0,0 +1,8 @@
+# Config file for /etc/init.d/fail2ban
+#
+# For information on options, see "/usr/bin/fail2ban-client -h".
+
+FAIL2BAN_OPTIONS=""
+
+# Force execution of the server even if the socket already exists:
+#FAIL2BAN_OPTIONS="-x"

files/gentoo-initd

@@ -0,0 +1,60 @@
+#!/sbin/runscript
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# Author: Sireyessire, Cyril Jaquier
+# 
+# $Revision$
+
+opts="start stop restart reload showlog"
+
+FAIL2BAN="/usr/bin/fail2ban-client ${FAIL2BAN_OPTIONS}"
+
+depend() {
+	need net
+	need logger
+	after iptables
+}
+
+start() {
+	ebegin "Starting fail2ban"
+	${FAIL2BAN} start &> /dev/null
+	eend $? "Failed to start fail2ban"
+}
+
+stop() {
+	ebegin "Stopping fail2ban"
+	${FAIL2BAN} stop &> /dev/null
+	eend $? "Failed to stop fail2ban"
+}
+
+restart() {
+	if ! service_stopped "${SVCNAME}" ; then
+		svc_stop || return "$?"
+		sleep 1
+	fi
+	svc_start
+}
+
+reload() {
+	ebegin "Reloading fail2ban"
+	${FAIL2BAN} reload > /dev/null
+	eend $? "Failed to reload fail2ban"
+}
+
+showlog(){
+	less /var/log/fail2ban.log
+}

files/macosx-initd

@@ -0,0 +1,19 @@
+/Library/LaunchDaemonsm/org.fail2ban.plist
+===================================
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+        <key>Disabled</key>
+        <false/>
+        <key>Label</key>
+        <string>fail2ban</string>
+        <key>ProgramArguments</key>
+        <array>
+                <string>/usr/local/bin/fail2ban-client</string>
+                <string>start</string>
+        </array>
+        <key>RunAtLoad</key>
+        <true/>
+</dict>
+</plist>

files/redhat-initd

@@ -0,0 +1,93 @@
+#!/bin/bash
+#
+# chkconfig: 345 92 08
+# description: Fail2ban daemon
+#              http://fail2ban.sourceforge.net/wiki/index.php/Main_Page
+# process name: fail2ban-server
+#
+#
+# Author: Tyler Owen
+#
+
+# Source function library.
+. /etc/init.d/functions
+
+# Check that the config file exists
+[ -f /etc/fail2ban/fail2ban.conf ] || exit 0
+
+FAIL2BAN="/usr/bin/fail2ban-client"
+
+RETVAL=0
+
+getpid() {
+    pid=`ps -eo pid,comm | grep fail2ban- | awk '{ print $1 }'`
+}
+
+start() {
+    echo -n $"Starting fail2ban: "
+    getpid
+    if [ -z "$pid" ]; then
+	rm -rf /var/run/fail2ban/fail2ban.sock # in case of unclean shutdown
+        $FAIL2BAN start > /dev/null
+        RETVAL=$?
+    fi
+    if [ $RETVAL -eq 0 ]; then
+        touch /var/lock/subsys/fail2ban
+        echo_success
+    else
+        echo_failure
+    fi
+    echo
+    return $RETVAL
+}
+
+stop() {
+    echo -n $"Stopping fail2ban: "
+    getpid
+    RETVAL=$?
+    if [ -n "$pid" ]; then
+        $FAIL2BAN stop > /dev/null
+    sleep 1
+    getpid
+    if [ -z "$pid" ]; then
+        rm -f /var/lock/subsys/fail2ban
+        echo_success
+    else
+        echo_failure
+    fi
+    else
+        echo_failure
+    fi
+    echo
+    return $RETVAL
+}
+
+# See how we were called.
+case "$1" in
+  start)
+        start
+        ;;
+  stop)
+        stop
+        ;;
+  status)
+        getpid
+        if [ -n "$pid" ]; then
+                echo "Fail2ban (pid $pid) is running..."
+                $FAIL2BAN status
+        else
+                RETVAL=1
+                echo "Fail2ban is stopped"
+        fi
+        ;;
+  restart)
+        stop
+        start
+        ;;
+  *)
+        echo $"Usage: $0 {start|stop|status|restart}"
+        exit 1
+        ;;
+esac
+
+exit $RETVAL

files/solaris-fail2ban.xml

@@ -0,0 +1,74 @@
+<?xml version='1.0'?>
+<!DOCTYPE service_bundle SYSTEM '/usr/share/lib/xml/dtd/service_bundle.dtd.1'>
+<!--
+	Hanno 'Rince' Wagner 03 2007
+	Service manifest for fail2ban
+	E-Mail: wagner@rince.de
+-->
+
+<service_bundle type='manifest' name='fail2ban:fail2ban'>
+
+<service
+	name='network/fail2ban'
+	type='service'
+	version='1'>
+	<create_default_instance enabled='false' />
+	<single_instance />
+
+	<dependency name='fs'
+		grouping='require_all'
+		restart_on='none'
+		type='service'>
+		<service_fmri value='svc:/system/filesystem/local' />
+	</dependency>
+
+	<dependency name='net'
+		grouping='require_all'
+		restart_on='none'
+		type='service'>
+		<service_fmri value='svc:/network/loopback' />
+	</dependency>
+
+
+	<exec_method
+		type='method'
+		name='start'
+		exec='/lib/svc/method/svc-fail2ban start'
+		timeout_seconds='-1'>
+		<method_context>
+			<method_credential user='root' group='root' />
+		</method_context>
+	</exec_method>
+
+	<exec_method
+		type='method'
+		name='stop'
+		exec='/lib/svc/method/svc-fail2ban stop'
+		timeout_seconds='-1'>
+	</exec_method>
+
+        <exec_method
+                type='method'
+                name='reload'
+                exec='/lib/svc/method/svc-fail2ban reload'
+                timeout_seconds='-1'>
+        </exec_method>
+
+       <exec_method
+                type='method'
+                name='refresh'
+                exec='/lib/svc/method/svc-fail2ban refresh'
+                timeout_seconds='-1'>
+        </exec_method>
+
+
+	<exec_method
+		type='method'
+		name='restart'
+		exec='/lib/svc/method/svc-fail2ban restart'
+		timeout_seconds='-1'>
+	</exec_method>
+
+</service>
+
+</service_bundle>

files/solaris-svc-fail2ban

@@ -0,0 +1,47 @@
+#!/usr/bin/bash -e
+#
+# fail2ban		This init.d script is used to start fail2ban.
+# (C) by Hanno Wagner <wagner@rince.de>, License is GPL
+ 
+#set -x
+
+. /lib/svc/share/smf_include.sh
+
+set -e
+
+
+F2B_CONF="/etc/fail2ban/fail2ban.conf"
+if [ -n "$2" ] && [ -f "$F2B_CONF" ]; then
+  F2B_CONF="$2"
+fi
+
+ENV="/usr/bin/env -i LANG=C PATH=/usr/local/bin:/usr/bin:/bin:/opt/sfw/bin:/usr/sfw/bin"
+
+case $1 in
+	start)
+		[ -f /etc/fail2ban.conf ] || touch /etc/fail2ban.conf
+		echo "Starting fail2ban-server with $F2B_CONF"
+		eval $ENV /usr/local/bin/fail2ban-client start &
+	;;
+	stop)
+		echo "Stopping fail2ban-server with $F2B_CONF"
+		eval $ENV /usr/local/bin/fail2ban-client stop &
+	;;
+	reload | refresh )
+		echo "Reloading fail2ban-server with $F2B_CONF"
+		eval $ENV /usr/local/bin/fail2ban-client reload &
+	;;
+	restart | force-reload)
+		echo "Forcing reload of fail2ban-server with $F2B_CONF"
+		eval $ENV /usr/local/bin/fail2ban-client stop &
+		sleep 2
+		eval $ENV /usr/local/bin/fail2ban-client start &
+	;;
+	status)
+		/usr/local/bin/fail2ban-client status &
+	;;
+	*)
+		echo "Usage: /lib/svc/method/svc-fail2ban start|stop|status|refresh|restart|reload|force-reload" >&2
+		exit 2
+	;;
+esac

files/suse-initd

@@ -0,0 +1,96 @@
+#!/bin/sh
+#
+# /etc/init.d/fail2ban
+#   and its symbolic link
+# /usr/sbin/rcfail2ban
+#
+### BEGIN INIT INFO
+# Provides:          fail2ban
+# Required-Start:    $syslog $remote_fs sendmail
+# Required-Stop:     $syslog $remote_fs
+# Should-Stop: $time ypbind sendmail
+# Default-Start:     3 5
+# Default-Stop:      0 1 2 6
+# Description:       startup Fail2Ban
+### END INIT INFO
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/sbin:/usr/bin:/bin
+FAIL2BAN_BIN=/usr/local/bin/fail2ban-client
+FAIL2BAN_SERVER=/usr/local/bin/fail2ban-server
+FAIL2BAN_SOCKET=/var/run/fail2ban/fail2ban.sock
+test -x $FAIL2BAN_BIN || { echo "$FAIL2BAN_BIN not installed";
+        if [ "$1" = "stop" ]; then exit 0;
+        else exit 5; fi; }
+
+# Check for existence of needed config file and read it
+FAIL2BAN_CONFIG=/etc/fail2ban/fail2ban.conf
+test -r $FAIL2BAN_CONFIG || { echo "$FAIL2BAN_CONFIG not existing";
+        if [ "$1" = "stop" ]; then exit 0;
+        else exit 6; fi; }
+
+. /etc/rc.status
+
+# Reset status of this service
+rc_reset
+
+case "$1" in
+    start)
+        echo -n "Starting Fail2Ban "
+        /sbin/startproc $FAIL2BAN_BIN start &>/dev/null
+        rc_status -v
+        ;;
+    stop)
+        echo -n "Shutting down Fail2ban "
+        /sbin/startproc $FAIL2BAN_BIN -q stop
+        rc_status -v
+        ;;
+    try-restart|condrestart)
+        if test "$1" = "condrestart"; then
+                echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}"
+        fi
+        $0 status
+        if test $? = 0; then
+                $0 restart
+        else
+                rc_reset        # Not running is not a failure.
+        fi
+        rc_status
+        ;;
+    restart)
+        $0 stop
+        echo -n "-wait a minute "
+        i=60
+        while [ -e $FAIL2BAN_SOCKET ] && [ $i -gt 0 ]; do
+                sleep 1
+                i=$[$i-1]
+                echo -n "."
+        done
+        echo "."
+        $0 start
+
+        # Remember status and be quiet
+        rc_status
+        ;;
+    force-reload)
+        echo -n "Reload service Fail2ban "
+        /sbin/startproc $FAIL2BAN_BIN -q reload
+        rc_status -v
+        ;;
+    reload)
+        echo -n "Reload service Fail2ban "
+        /sbin/startproc $FAIL2BAN_BIN -q reload
+        rc_status -v
+        ;;
+    status)
+        echo -n "Checking for service Fail2ban "
+        /sbin/checkproc $FAIL2BAN_SERVER
+        rc_status -v
+        ;;
+    probe)
+        test /etc/fail2ban/fail2ban.conf -nt /var/run/fail2ban.pid && echo reload
+        ;;
+    *)
+        echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}"
+        exit 1
+        ;;
+esac
+rc_exit

firewall/firewall.py

@@ -1,104 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import time, os
-
-class Firewall:
-	""" Manages the ban list and executes the command that ban
-		the IP.
-	"""
-	
-	banList = dict()
-	
-	def __init__(self, banTime, logSys, interface):
-		self.banTime = banTime
-		self.logSys = logSys
-		self.interface = interface
-	
-	def addBanIP(self, ip, debug):
-		""" Bans an IP.
-		"""
-		if not self.inBanList(ip):
-			self.logSys.info("Ban "+ip)
-			self.banList[ip] = time.time()
-			self.__executeCmd(self.banIP(ip), debug)
-		else:
-			self.logSys.info(ip+" already in ban list")
-	
-	def delBanIP(self, ip, debug):
-		""" Unban an IP.
-		"""
-		if self.inBanList(ip):
-			self.logSys.info("Unban "+ip)
-			del self.banList[ip]
-			self.__executeCmd(self.unBanIP(ip), debug)
-		else:
-			self.logSys.info(ip+" not in ban list")
-	
-	def inBanList(self, ip):
-		""" Checks if IP is in ban list.
-		"""
-		return self.banList.has_key(ip)
-	
-	def checkForUnBan(self, debug):
-		""" Check for IP to remove from ban list.
-		"""
-		banListTemp = self.banList.copy()
-		iterBanList = banListTemp.iteritems()
-		for i in range(len(self.banList)):
-			element = iterBanList.next()
-			ip = element[0]
-			btime = element[1]
-			if btime < time.time()-self.banTime:
-				self.delBanIP(ip, debug)
-	
-	def flushBanList(self, debug):
-		""" Flushes the ban list and of course the firewall rules.
-			Called when fail2ban exits.
-		"""
-		banListTemp = self.banList.copy()
-		iterBanList = banListTemp.iteritems()
-		for i in range(len(self.banList)):
-			element = iterBanList.next()
-			ip = element[0]
-			self.delBanIP(ip, debug)
-	
-	def __executeCmd(self, cmd, debug):
-		""" Executes an OS command.
-		"""
-		self.logSys.debug(cmd)
-		if not debug:
-			return os.system(cmd)
-		else:
-			return None
-		
-	def viewBanList(self):
-		""" Prints the ban list on screen. Usefull for debugging.
-		"""
-		iterBanList = self.banList.iteritems()
-		for i in range(len(self.banList)):
-			element = iterBanList.next()
-			print element

firewall/ipfw.py

@@ -1,72 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import os
-
-from firewall import Firewall
-
-class Ipfw(Firewall):
-	""" This class contains specific methods and variables for the
-		iptables firewall. Must implements the 'abstracts' methods
-		banIP(ip) and unBanIP(ip).
-		
-		Must adds abstract methods definition:
-		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
-	"""
-	
-	crtRuleNbr = 0
-	
-	def getCrtRuleNbr():
-		""" Gets the current rule number.
-		"""
-		return self.crtRuleNbr
-		
-	def setCrtRuleNbr(self, value):
-		""" Sets the current rule number.
-		"""
-		self.crtRuleNbr = value
-	
-	def banIP(self, ip):
-		""" Returns query to ban IP.
-		"""
-		query = "ipfw -q add "+`self.crtRuleNbr`+" deny ip from "+ip+" to any"
-		self.crtRuleNbr = self.crtRuleNbr + 1
-		return query
-	
-	def unBanIP(self, ip):
-		""" Returns query to unban IP.
-		"""
-		ruleNbr = str(self.__findRuleNumber(ip))
-		query = "ipfw -q delete "+ruleNbr
-		return query
-		
-	def __findRuleNumber(self, ip):
-		""" Uses shell commands in order to find the rule
-			number we want to delete.
-		"""
-		output = os.popen("ipfw list|grep \"from "+ip+" to\"|awk '{print $1}'",
-						  "r");
-		return output.read()

kill-server

@@ -0,0 +1,2 @@
+#!/bin/bash
+kill `ps ax|grep fail2ban|grep -v grep|awk '{print $1}'`

log-test/apache

@@ -1,102 +0,0 @@
-[Mon Jan 03 05:02:15 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:21 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/\xe0
-[Mon Jan 03 05:02:23 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msdac
-[Mon Jan 03 05:02:23 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msdac
-[Mon Jan 03 05:02:24 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/PBServer
-[Mon Jan 03 05:02:24 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/PBServer
-[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/Rpc
-[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/Rpc
-[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/samples
-[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/samples
-[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts..\xc1\x9c..
-[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:32 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:32 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:34 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:34 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:39 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:39 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 11:08:29 2005] [error] [client 128.178.150.127] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Mon Jan 03 20:08:52 2005] [error] [client 83.76.202.195] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:19:50 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:19:55 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:01 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:05 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:08 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:12 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:16 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:22 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:26 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:28 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:38 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 20:54:59 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 20:55:04 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 20:55:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 21:34:29 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 21:34:32 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 00:17:41 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 00:18:03 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 00:18:12 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:24:38 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:24:40 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:24:46 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:24:48 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:25:58 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:26:34 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:26:37 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 10:13:02 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 10:13:07 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 10:13:10 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 10:17:07 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:41:40 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:41:45 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:41:47 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:41:51 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:55:30 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:03:44 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:03:48 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:03:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:03:57 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:06:45 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Mar 05 15:07:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Jan 05 15:08:01 2005] [error] [client 192.168.0.128] user  not found: /phpinfo
-[Wed Jan 05 15:10:45 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/css/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
-[Wed Jan 05 15:10:45 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/images/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
-[Wed Jan 05 15:10:45 2005] [error] [client 192.168.0.128] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:11:09 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 05 15:11:10 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 06 15:11:11 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 06 15:11:13 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 06 15:11:14 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 05 15:11:15 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/css/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
-[Wed Jan 05 15:11:15 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/images/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
-[Wed Jan 05 15:11:15 2005] [error] [client 192.168.0.128] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:12:32 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:48 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:51 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:54 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:56 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:59 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:14:20 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:14:24 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:14:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:14:34 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Mar 05 15:08:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 05 15:09:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch

log-test/current

@@ -1,5 +0,0 @@
-Jan  7 17:53:15 [sshd] (pam_unix) 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.220.137.36  user=kevin
-Jan  7 17:53:26 [sshd] (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.220.137.36  user=kevin
-Mar  7 17:53:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
-Mar  7 17:55:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36

log-test/test

@@ -1,432 +0,0 @@
-Sep 28 13:18:43 [sshd] Failed password for illegal user test from 211.112.229.69 port 59506 ssh2
-Sep 28 13:18:45 [sshd] Failed password for illegal user guest from 211.112.229.69 port 59584 ssh2
-Sep 28 13:18:48 [sshd] Failed password for illegal user admin from 211.112.229.69 port 59668 ssh2
-Sep 28 13:18:51 [sshd] Failed password for illegal user admin from 211.112.229.69 port 59746 ssh2
-Sep 28 13:18:54 [sshd] Failed password for illegal user user from 211.112.229.69 port 59809 ssh2
-Sep 28 13:18:57 [sshd] Failed password for illegal user root from 211.112.229.69 port 59881 ssh2
-Sep 28 13:19:00 [sshd] Failed password for illegal user root from 211.112.229.69 port 59944 ssh2
-Sep 28 13:19:03 [sshd] Failed password for illegal user root from 211.112.229.69 port 59999 ssh2
-Sep 28 13:19:06 [sshd] Failed password for illegal user test from 211.112.229.69 port 60055 ssh2
-Sep 28 21:05:25 [sshd(pam_unix)] authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.128.local.home  user=cyril
-Sep 28 21:05:27 [sshd] error: PAM: Authentication failure for cyril from 192.168.0.128.local.home
-Sep 29 03:45:18 [sshd] Failed password for illegal user nobody from 203.198.168.66 port 55927 ssh2
-Sep 29 03:45:21 [sshd] Failed password for illegal user patrick from 203.198.168.66 port 55973 ssh2
-Sep 29 03:45:23 [sshd] Failed password for illegal user patrick from 203.198.168.66 port 56010 ssh2
-Sep 29 03:45:26 [sshd] Failed password for illegal user root from 203.198.168.66 port 56060 ssh2
-Sep 29 03:45:29 [sshd] Failed password for illegal user root from 203.198.168.66 port 56107 ssh2
-Sep 29 03:45:32 [sshd] Failed password for illegal user root from 203.198.168.66 port 56152 ssh2
-Sep 29 03:45:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 56200 ssh2
-Sep 29 03:45:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 56243 ssh2
-Sep 29 03:45:40 [sshd] Failed password for illegal user rolo from 203.198.168.66 port 56288 ssh2
-Sep 29 03:45:43 [sshd] Failed password for illegal user iceuser from 203.198.168.66 port 56333 ssh2
-Sep 29 03:45:46 [sshd] Failed password for illegal user horde from 203.198.168.66 port 56379 ssh2
-Sep 29 03:45:48 [sshd] Failed password for illegal user cyrus from 203.198.168.66 port 56425 ssh2
-Sep 29 03:45:52 [sshd] Failed password for illegal user www from 203.198.168.66 port 56470 ssh2
-Sep 29 03:45:55 [sshd] Failed password for illegal user wwwrun from 203.198.168.66 port 56534 ssh2
-Sep 29 03:45:58 [sshd] Failed password for illegal user matt from 203.198.168.66 port 56572 ssh2
-Sep 29 03:46:01 [sshd] Failed password for illegal user test from 203.198.168.66 port 56616 ssh2
-Sep 29 03:46:03 [sshd] Failed password for illegal user test from 203.198.168.66 port 56660 ssh2
-Sep 29 03:46:06 [sshd] Failed password for illegal user test from 203.198.168.66 port 56704 ssh2
-Sep 29 03:46:09 [sshd] Failed password for illegal user test from 203.198.168.66 port 56752 ssh2
-Sep 29 03:46:12 [sshd] Failed password for illegal user www-data from 203.198.168.66 port 56795 ssh2
-Sep 29 03:46:15 [sshd] Failed password for illegal user mysql from 203.198.168.66 port 56839 ssh2
-Sep 29 03:46:17 [sshd] Failed password for illegal user operator from 203.198.168.66 port 56882 ssh2
-Sep 29 03:46:20 [sshd] Failed password for illegal user adm from 203.198.168.66 port 56929 ssh2
-Sep 29 03:46:23 [sshd] Failed password for illegal user apache from 203.198.168.66 port 56971 ssh2
-Sep 29 03:46:26 [sshd] Failed password for illegal user irc from 203.198.168.66 port 57011 ssh2
-Sep 29 03:46:29 [sshd] Failed password for illegal user irc from 203.198.168.66 port 57060 ssh2
-Sep 29 03:46:31 [sshd] Failed password for illegal user adm from 203.198.168.66 port 57100 ssh2
-Sep 29 03:46:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 57148 ssh2
-Sep 29 03:46:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 57194 ssh2
-Sep 29 03:46:40 [sshd] Failed password for illegal user root from 203.198.168.66 port 57236 ssh2
-Sep 29 03:46:43 [sshd] Failed password for illegal user jane from 203.198.168.66 port 57281 ssh2
-Sep 29 03:46:45 [sshd] Failed password for illegal user pamela from 203.198.168.66 port 57328 ssh2
-Sep 29 03:46:48 [sshd] Failed password for illegal user root from 203.198.168.66 port 57372 ssh2
-Sep 29 03:46:51 [sshd] Failed password for illegal user root from 203.198.168.66 port 57418 ssh2
-Sep 29 03:46:54 [sshd] Failed password for illegal user root from 203.198.168.66 port 57463 ssh2
-Sep 29 03:46:57 [sshd] Failed password for illegal user root from 203.198.168.66 port 57506 ssh2
-Sep 29 03:46:59 [sshd] Failed password for illegal user root from 203.198.168.66 port 57549 ssh2
-Sep 29 03:47:02 [sshd] Failed password for illegal user cosmin from 203.198.168.66 port 57594 ssh2
-Sep 29 03:47:05 [sshd] Failed password for illegal user root from 203.198.168.66 port 57637 ssh2
-Sep 29 03:47:08 [sshd] Failed password for illegal user root from 203.198.168.66 port 57689 ssh2
-Sep 29 03:47:11 [sshd] Failed password for illegal user root from 203.198.168.66 port 57730 ssh2
-Sep 29 03:47:13 [sshd] Failed password for illegal user root from 203.198.168.66 port 57774 ssh2
-Sep 29 03:47:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 57820 ssh2
-Sep 29 03:47:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 57866 ssh2
-Sep 29 03:47:22 [sshd] Failed password for illegal user root from 203.198.168.66 port 57901 ssh2
-Sep 29 03:47:25 [sshd] Failed password for illegal user root from 203.198.168.66 port 57944 ssh2
-Sep 29 03:47:27 [sshd] Failed password for illegal user root from 203.198.168.66 port 57990 ssh2
-Sep 29 03:47:31 [sshd] Failed password for illegal user root from 203.198.168.66 port 58031 ssh2
-Sep 29 03:47:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 58098 ssh2
-Sep 29 03:47:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 58137 ssh2
-Sep 29 03:47:40 [sshd] Failed password for illegal user root from 203.198.168.66 port 58183 ssh2
-Sep 29 03:47:42 [sshd] Failed password for illegal user root from 203.198.168.66 port 58228 ssh2
-Sep 29 03:47:45 [sshd] Failed password for illegal user root from 203.198.168.66 port 58273 ssh2
-Sep 29 03:47:48 [sshd] Failed password for illegal user root from 203.198.168.66 port 58314 ssh2
-Sep 29 03:47:51 [sshd] Failed password for illegal user root from 203.198.168.66 port 58358 ssh2
-Sep 29 03:47:54 [sshd] Failed password for illegal user root from 203.198.168.66 port 58401 ssh2
-Sep 29 03:47:56 [sshd] Failed password for illegal user root from 203.198.168.66 port 58443 ssh2
-Sep 29 03:47:59 [sshd] Failed password for illegal user root from 203.198.168.66 port 58484 ssh2
-Sep 29 03:48:02 [sshd] Failed password for illegal user root from 203.198.168.66 port 58528 ssh2
-Sep 29 03:48:05 [sshd] Failed password for illegal user root from 203.198.168.66 port 58574 ssh2
-Sep 29 03:48:07 [sshd] Failed password for illegal user root from 203.198.168.66 port 58613 ssh2
-Sep 29 03:48:10 [sshd] Failed password for illegal user root from 203.198.168.66 port 58662 ssh2
-Sep 29 03:48:13 [sshd] Failed password for illegal user root from 203.198.168.66 port 58703 ssh2
-Sep 29 03:48:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 58748 ssh2
-Sep 29 03:48:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 58792 ssh2
-Sep 29 03:48:21 [sshd] Failed password for illegal user root from 203.198.168.66 port 58839 ssh2
-Sep 29 03:48:24 [sshd] Failed password for illegal user root from 203.198.168.66 port 58880 ssh2
-Sep 29 03:48:27 [sshd] Failed password for illegal user root from 203.198.168.66 port 58926 ssh2
-Sep 29 03:48:30 [sshd] Failed password for illegal user root from 203.198.168.66 port 58967 ssh2
-Sep 29 03:48:33 [sshd] Failed password for illegal user root from 203.198.168.66 port 59012 ssh2
-Sep 29 03:48:35 [sshd] Failed password for illegal user root from 203.198.168.66 port 59052 ssh2
-Sep 29 03:48:38 [sshd] Failed password for illegal user root from 203.198.168.66 port 59095 ssh2
-Sep 29 03:48:41 [sshd] Failed password for illegal user root from 203.198.168.66 port 59140 ssh2
-Sep 29 03:48:44 [sshd] Failed password for illegal user root from 203.198.168.66 port 59182 ssh2
-Sep 29 03:48:47 [sshd] Failed password for illegal user cip52 from 203.198.168.66 port 59222 ssh2
-Sep 29 03:48:49 [sshd] Failed password for illegal user cip51 from 203.198.168.66 port 59264 ssh2
-Sep 29 03:48:52 [sshd] Failed password for illegal user root from 203.198.168.66 port 59309 ssh2
-Sep 29 03:48:55 [sshd] Failed password for illegal user noc from 203.198.168.66 port 59351 ssh2
-Sep 29 03:48:58 [sshd] Failed password for illegal user root from 203.198.168.66 port 59395 ssh2
-Sep 29 03:49:01 [sshd] Failed password for illegal user root from 203.198.168.66 port 59432 ssh2
-Sep 29 03:49:04 [sshd] Failed password for illegal user root from 203.198.168.66 port 59479 ssh2
-Sep 29 03:49:07 [sshd] Failed password for illegal user root from 203.198.168.66 port 59951 ssh2
-Sep 29 03:49:11 [sshd] Failed password for illegal user webmaster from 203.198.168.66 port 60006 ssh2
-Sep 29 03:49:14 [sshd] Failed password for illegal user data from 203.198.168.66 port 60463 ssh2
-Sep 29 03:49:17 [sshd] Failed password for illegal user user from 203.198.168.66 port 60880 ssh2
-Sep 29 03:49:20 [sshd] Failed password for illegal user user from 203.198.168.66 port 60947 ssh2
-Sep 29 03:49:23 [sshd] Failed password for illegal user user from 203.198.168.66 port 33137 ssh2
-Sep 29 03:49:26 [sshd] Failed password for illegal user web from 203.198.168.66 port 33572 ssh2
-Sep 29 03:49:31 [sshd] Failed password for illegal user web from 203.198.168.66 port 33630 ssh2
-Sep 29 03:49:34 [sshd] Failed password for illegal user oracle from 203.198.168.66 port 34129 ssh2
-Sep 29 03:49:39 [sshd] Failed password for illegal user sybase from 203.198.168.66 port 34558 ssh2
-Sep 29 03:49:42 [sshd] Failed password for illegal user master from 203.198.168.66 port 35018 ssh2
-Sep 29 03:49:45 [sshd] Failed password for illegal user account from 203.198.168.66 port 35095 ssh2
-Sep 29 03:49:48 [sshd] Failed password for illegal user backup from 203.198.168.66 port 35506 ssh2
-Sep 29 03:49:51 [sshd] Failed password for illegal user server from 203.198.168.66 port 35935 ssh2
-Sep 29 03:49:54 [sshd] Failed password for illegal user adam from 203.198.168.66 port 36016 ssh2
-Sep 29 03:49:57 [sshd] Failed password for illegal user alan from 203.198.168.66 port 36399 ssh2
-Sep 29 03:49:59 [sshd] Failed password for illegal user frank from 203.198.168.66 port 36488 ssh2
-Sep 29 03:50:04 [sshd] Failed password for illegal user george from 203.198.168.66 port 36876 ssh2
-Sep 29 03:50:07 [sshd] Failed password for illegal user henry from 203.198.168.66 port 37333 ssh2
-Sep 29 03:50:11 [sshd] Failed password for illegal user john from 203.198.168.66 port 37423 ssh2
-Sep 29 03:50:14 [sshd] Failed password for illegal user root from 203.198.168.66 port 37837 ssh2
-Sep 29 03:50:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 38210 ssh2
-Sep 29 03:50:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 38286 ssh2
-Sep 29 03:50:22 [sshd] Failed password for illegal user root from 203.198.168.66 port 38653 ssh2
-Sep 29 03:50:26 [sshd] Failed password for illegal user root from 203.198.168.66 port 38749 ssh2
-Sep 29 03:50:29 [sshd] Failed password for illegal user test from 203.198.168.66 port 39162 ssh2
-Sep 29 10:19:26 [sshd] Failed password for illegal user test from 24.19.0.105 port 3765 ssh2
-Sep 29 10:19:32 [sshd] Failed password for illegal user guest from 24.19.0.105 port 3846 ssh2
-Sep 29 10:19:39 [sshd] Failed password for illegal user admin from 24.19.0.105 port 3929 ssh2
-Sep 29 10:19:45 [sshd] Failed password for illegal user admin from 24.19.0.105 port 3992 ssh2
-Sep 29 10:19:49 [sshd] Failed password for illegal user user from 24.19.0.105 port 4057 ssh2
-Sep 29 10:19:54 [sshd] Failed password for illegal user root from 24.19.0.105 port 4115 ssh2
-Sep 29 10:19:58 [sshd] Failed password for illegal user root from 24.19.0.105 port 4170 ssh2
-Sep 29 10:20:01 [sshd] Failed password for illegal user root from 24.19.0.105 port 4202 ssh2
-Sep 29 10:20:04 [sshd] Failed password for illegal user test from 24.19.0.105 port 4242 ssh2
-Oct  1 15:53:46 [sshd] Failed password for illegal user test from 210.51.173.75 port 40940 ssh2
-Oct  1 15:53:53 [sshd] Failed password for illegal user guest from 210.51.173.75 port 41196 ssh2
-Oct  1 15:53:59 [sshd] Failed password for illegal user admin from 210.51.173.75 port 41480 ssh2
-Oct  1 15:54:05 [sshd] Failed password for illegal user admin from 210.51.173.75 port 41738 ssh2
-Oct  1 15:54:12 [sshd] Failed password for illegal user user from 210.51.173.75 port 42036 ssh2
-Oct  1 15:54:18 [sshd] Failed password for illegal user root from 210.51.173.75 port 42393 ssh2
-Oct  1 15:54:24 [sshd] Failed password for illegal user root from 210.51.173.75 port 42721 ssh2
-Oct  1 15:54:30 [sshd] Failed password for illegal user root from 210.51.173.75 port 42984 ssh2
-Oct  1 15:54:36 [sshd] Failed password for illegal user test from 210.51.173.75 port 43299 ssh2
-Oct  2 20:24:36 [sshd] Failed password for illegal user test from 220.64.223.249 port 2460 ssh2
-Oct  2 20:24:39 [sshd] Failed password for illegal user guest from 220.64.223.249 port 2527 ssh2
-Oct  2 20:24:42 [sshd] Failed password for illegal user admin from 220.64.223.249 port 2584 ssh2
-Oct  2 20:24:45 [sshd] Failed password for illegal user admin from 220.64.223.249 port 2645 ssh2
-Oct  2 20:24:48 [sshd] Failed password for illegal user user from 220.64.223.249 port 2708 ssh2
-Oct  2 20:24:51 [sshd] Failed password for illegal user root from 220.64.223.249 port 2794 ssh2
-Oct  2 20:24:54 [sshd] Failed password for illegal user root from 220.64.223.249 port 2868 ssh2
-Oct  2 20:24:58 [sshd] Failed password for illegal user root from 220.64.223.249 port 2931 ssh2
-Oct  2 20:25:01 [sshd] Failed password for illegal user test from 220.64.223.249 port 2994 ssh2
-Oct  3 02:17:47 [sshd] Failed password for illegal user nobody from 216.65.197.170 port 54324 ssh2
-Oct  3 02:17:48 [sshd] Failed password for illegal user patrick from 216.65.197.170 port 54491 ssh2
-Oct  3 02:17:50 [sshd] Failed password for illegal user patrick from 216.65.197.170 port 54669 ssh2
-Oct  3 02:17:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 54845 ssh2
-Oct  3 02:17:53 [sshd] Failed password for illegal user root from 216.65.197.170 port 55021 ssh2
-Oct  3 02:17:55 [sshd] Failed password for illegal user root from 216.65.197.170 port 55201 ssh2
-Oct  3 02:17:57 [sshd] Failed password for illegal user root from 216.65.197.170 port 55381 ssh2
-Oct  3 02:17:59 [sshd] Failed password for illegal user root from 216.65.197.170 port 55553 ssh2
-Oct  3 02:18:00 [sshd] Failed password for illegal user rolo from 216.65.197.170 port 55730 ssh2
-Oct  3 02:18:02 [sshd] Failed password for illegal user iceuser from 216.65.197.170 port 55892 ssh2
-Oct  3 02:18:04 [sshd] Failed password for illegal user horde from 216.65.197.170 port 56054 ssh2
-Oct  3 02:18:05 [sshd] Failed password for illegal user cyrus from 216.65.197.170 port 56231 ssh2
-Oct  3 02:18:07 [sshd] Failed password for illegal user www from 216.65.197.170 port 56412 ssh2
-Oct  3 02:18:09 [sshd] Failed password for illegal user wwwrun from 216.65.197.170 port 56594 ssh2
-Oct  3 02:18:11 [sshd] Failed password for illegal user matt from 216.65.197.170 port 56755 ssh2
-Oct  3 02:18:12 [sshd] Failed password for illegal user test from 216.65.197.170 port 56928 ssh2
-Oct  3 02:18:14 [sshd] Failed password for illegal user test from 216.65.197.170 port 57112 ssh2
-Oct  3 02:18:16 [sshd] Failed password for illegal user test from 216.65.197.170 port 57292 ssh2
-Oct  3 02:18:17 [sshd] Failed password for illegal user test from 216.65.197.170 port 57465 ssh2
-Oct  3 02:18:19 [sshd] Failed password for illegal user www-data from 216.65.197.170 port 57631 ssh2
-Oct  3 02:18:21 [sshd] Failed password for illegal user mysql from 216.65.197.170 port 57802 ssh2
-Oct  3 02:18:22 [sshd] Failed password for illegal user operator from 216.65.197.170 port 57989 ssh2
-Oct  3 02:18:24 [sshd] Failed password for illegal user adm from 216.65.197.170 port 58151 ssh2
-Oct  3 02:18:26 [sshd] Failed password for illegal user apache from 216.65.197.170 port 58319 ssh2
-Oct  3 02:18:28 [sshd] Failed password for illegal user irc from 216.65.197.170 port 58492 ssh2
-Oct  3 02:18:29 [sshd] Failed password for illegal user irc from 216.65.197.170 port 58662 ssh2
-Oct  3 02:18:31 [sshd] Failed password for illegal user adm from 216.65.197.170 port 58818 ssh2
-Oct  3 02:18:33 [sshd] Failed password for illegal user root from 216.65.197.170 port 58976 ssh2
-Oct  3 02:18:34 [sshd] Failed password for illegal user root from 216.65.197.170 port 59147 ssh2
-Oct  3 02:18:36 [sshd] Failed password for illegal user root from 216.65.197.170 port 59306 ssh2
-Oct  3 02:18:38 [sshd] Failed password for illegal user jane from 216.65.197.170 port 59474 ssh2
-Oct  3 02:18:40 [sshd] Failed password for illegal user pamela from 216.65.197.170 port 59644 ssh2
-Oct  3 02:18:41 [sshd] Failed password for illegal user root from 216.65.197.170 port 59797 ssh2
-Oct  3 02:18:43 [sshd] Failed password for illegal user root from 216.65.197.170 port 59963 ssh2
-Oct  3 02:18:45 [sshd] Failed password for illegal user root from 216.65.197.170 port 60139 ssh2
-Oct  3 02:18:47 [sshd] Failed password for illegal user root from 216.65.197.170 port 60308 ssh2
-Oct  3 02:18:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 60479 ssh2
-Oct  3 02:18:50 [sshd] Failed password for illegal user cosmin from 216.65.197.170 port 60654 ssh2
-Oct  3 02:18:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 60830 ssh2
-Oct  3 02:18:54 [sshd] Failed password for illegal user root from 216.65.197.170 port 60992 ssh2
-Oct  3 02:18:55 [sshd] Failed password for illegal user root from 216.65.197.170 port 32945 ssh2
-Oct  3 02:18:58 [sshd] Failed password for illegal user root from 216.65.197.170 port 33101 ssh2
-Oct  3 02:18:59 [sshd] Failed password for illegal user root from 216.65.197.170 port 33343 ssh2
-Oct  3 02:19:02 [sshd] Failed password for illegal user root from 216.65.197.170 port 33501 ssh2
-Oct  3 02:19:03 [sshd] Failed password for illegal user root from 216.65.197.170 port 33733 ssh2
-Oct  3 02:19:05 [sshd] Failed password for illegal user root from 216.65.197.170 port 33892 ssh2
-Oct  3 02:19:07 [sshd] Failed password for illegal user root from 216.65.197.170 port 34066 ssh2
-Oct  3 02:19:08 [sshd] Failed password for illegal user root from 216.65.197.170 port 34212 ssh2
-Oct  3 02:19:10 [sshd] Failed password for illegal user root from 216.65.197.170 port 34376 ssh2
-Oct  3 02:19:12 [sshd] Failed password for illegal user root from 216.65.197.170 port 34535 ssh2
-Oct  3 02:19:14 [sshd] Failed password for illegal user root from 216.65.197.170 port 34704 ssh2
-Oct  3 02:19:16 [sshd] Failed password for illegal user root from 216.65.197.170 port 34853 ssh2
-Oct  3 02:19:18 [sshd] Failed password for illegal user root from 216.65.197.170 port 35092 ssh2
-Oct  3 02:19:19 [sshd] Failed password for illegal user root from 216.65.197.170 port 35261 ssh2
-Oct  3 02:19:21 [sshd] Failed password for illegal user root from 216.65.197.170 port 35425 ssh2
-Oct  3 02:19:23 [sshd] Failed password for illegal user root from 216.65.197.170 port 35583 ssh2
-Oct  3 02:19:24 [sshd] Failed password for illegal user root from 216.65.197.170 port 35753 ssh2
-Oct  3 02:19:26 [sshd] Failed password for illegal user root from 216.65.197.170 port 35901 ssh2
-Oct  3 02:19:28 [sshd] Failed password for illegal user root from 216.65.197.170 port 36068 ssh2
-Oct  3 02:19:30 [sshd] Failed password for illegal user root from 216.65.197.170 port 36227 ssh2
-Oct  3 02:19:33 [sshd] Failed password for illegal user root from 216.65.197.170 port 36453 ssh2
-Oct  3 02:19:34 [sshd] Failed password for illegal user root from 216.65.197.170 port 36673 ssh2
-Oct  3 02:19:36 [sshd] Failed password for illegal user root from 216.65.197.170 port 36823 ssh2
-Oct  3 02:19:38 [sshd] Failed password for illegal user root from 216.65.197.170 port 36981 ssh2
-Oct  3 02:19:39 [sshd] Failed password for illegal user root from 216.65.197.170 port 37152 ssh2
-Oct  3 02:19:41 [sshd] Failed password for illegal user root from 216.65.197.170 port 37310 ssh2
-Oct  3 02:19:43 [sshd] Failed password for illegal user root from 216.65.197.170 port 37484 ssh2
-Oct  3 02:19:45 [sshd] Failed password for illegal user root from 216.65.197.170 port 37644 ssh2
-Oct  3 02:19:46 [sshd] Failed password for illegal user root from 216.65.197.170 port 37827 ssh2
-Oct  3 02:19:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 37989 ssh2
-Oct  3 02:19:50 [sshd] Failed password for illegal user root from 216.65.197.170 port 38163 ssh2
-Oct  3 02:19:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 38329 ssh2
-Oct  3 02:19:54 [sshd] Failed password for illegal user root from 216.65.197.170 port 38559 ssh2
-Oct  3 02:19:56 [sshd] Failed password for illegal user root from 216.65.197.170 port 38735 ssh2
-Oct  3 02:19:58 [sshd] Failed password for illegal user cip52 from 216.65.197.170 port 38893 ssh2
-Oct  3 02:20:00 [sshd] Failed password for illegal user cip51 from 216.65.197.170 port 39109 ssh2
-Oct  3 02:20:01 [sshd] Failed password for illegal user root from 216.65.197.170 port 39282 ssh2
-Oct  3 02:20:03 [sshd] Failed password for illegal user noc from 216.65.197.170 port 39448 ssh2
-Oct  3 02:20:05 [sshd] Failed password for illegal user root from 216.65.197.170 port 39621 ssh2
-Oct  3 02:20:06 [sshd] Failed password for illegal user root from 216.65.197.170 port 39781 ssh2
-Oct  3 02:20:08 [sshd] Failed password for illegal user root from 216.65.197.170 port 39958 ssh2
-Oct  3 02:20:10 [sshd] Failed password for illegal user root from 216.65.197.170 port 40125 ssh2
-Oct  3 02:20:12 [sshd] Failed password for illegal user webmaster from 216.65.197.170 port 40316 ssh2
-Oct  3 02:20:13 [sshd] Failed password for illegal user data from 216.65.197.170 port 40473 ssh2
-Oct  3 02:20:15 [sshd] Failed password for illegal user user from 216.65.197.170 port 40645 ssh2
-Oct  3 02:20:17 [sshd] Failed password for illegal user user from 216.65.197.170 port 40800 ssh2
-Oct  3 02:20:19 [sshd] Failed password for illegal user user from 216.65.197.170 port 40965 ssh2
-Oct  3 02:20:20 [sshd] Failed password for illegal user web from 216.65.197.170 port 41120 ssh2
-Oct  3 02:20:22 [sshd] Failed password for illegal user web from 216.65.197.170 port 41300 ssh2
-Oct  3 02:20:24 [sshd] Failed password for illegal user oracle from 216.65.197.170 port 41468 ssh2
-Oct  3 02:20:25 [sshd] Failed password for illegal user sybase from 216.65.197.170 port 41642 ssh2
-Oct  3 02:20:27 [sshd] Failed password for illegal user master from 216.65.197.170 port 41809 ssh2
-Oct  3 02:20:29 [sshd] Failed password for illegal user account from 216.65.197.170 port 41987 ssh2
-Oct  3 02:20:31 [sshd] Failed password for illegal user backup from 216.65.197.170 port 42143 ssh2
-Oct  3 02:20:32 [sshd] Failed password for illegal user server from 216.65.197.170 port 42316 ssh2
-Oct  3 02:20:34 [sshd] Failed password for illegal user adam from 216.65.197.170 port 42481 ssh2
-Oct  3 02:20:36 [sshd] Failed password for illegal user alan from 216.65.197.170 port 42647 ssh2
-Oct  3 02:20:37 [sshd] Failed password for illegal user frank from 216.65.197.170 port 42817 ssh2
-Oct  3 02:20:39 [sshd] Failed password for illegal user george from 216.65.197.170 port 42993 ssh2
-Oct  3 02:20:41 [sshd] Failed password for illegal user henry from 216.65.197.170 port 43170 ssh2
-Oct  3 02:20:43 [sshd] Failed password for illegal user john from 216.65.197.170 port 43319 ssh2
-Oct  3 02:20:44 [sshd] Failed password for illegal user root from 216.65.197.170 port 43504 ssh2
-Oct  3 02:20:46 [sshd] Failed password for illegal user root from 216.65.197.170 port 43664 ssh2
-Oct  3 02:20:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 43844 ssh2
-Oct  3 02:20:49 [sshd] Failed password for illegal user root from 216.65.197.170 port 44008 ssh2
-Oct  3 02:20:51 [sshd] Failed password for illegal user root from 216.65.197.170 port 44182 ssh2
-Oct  3 02:20:53 [sshd] Failed password for illegal user test from 216.65.197.170 port 44338 ssh2
-Oct  3 06:37:34 [sshd] Failed password for illegal user nobody from 217.56.33.194 port 1969 ssh2
-Oct  3 06:37:36 [sshd] Failed password for illegal user patrick from 217.56.33.194 port 2002 ssh2
-Oct  3 06:37:37 [sshd] Failed password for illegal user patrick from 217.56.33.194 port 2039 ssh2
-Oct  3 06:37:38 [sshd] Failed password for illegal user root from 217.56.33.194 port 2070 ssh2
-Oct  3 06:37:40 [sshd] Failed password for illegal user root from 217.56.33.194 port 2109 ssh2
-Oct  3 06:37:41 [sshd] Failed password for illegal user root from 217.56.33.194 port 2142 ssh2
-Oct  3 06:37:42 [sshd] Failed password for illegal user root from 217.56.33.194 port 2173 ssh2
-Oct  3 06:37:44 [sshd] Failed password for illegal user root from 217.56.33.194 port 2211 ssh2
-Oct  3 06:37:45 [sshd] Failed password for illegal user rolo from 217.56.33.194 port 2244 ssh2
-Oct  3 06:37:46 [sshd] Failed password for illegal user iceuser from 217.56.33.194 port 2272 ssh2
-Oct  3 06:37:48 [sshd] Failed password for illegal user horde from 217.56.33.194 port 2305 ssh2
-Oct  3 06:37:49 [sshd] Failed password for illegal user cyrus from 217.56.33.194 port 2337 ssh2
-Oct  3 06:37:50 [sshd] Failed password for illegal user www from 217.56.33.194 port 2373 ssh2
-Oct  3 06:37:52 [sshd] Failed password for illegal user wwwrun from 217.56.33.194 port 2407 ssh2
-Oct  3 06:37:53 [sshd] Failed password for illegal user matt from 217.56.33.194 port 2439 ssh2
-Oct  3 06:37:55 [sshd] Failed password for illegal user test from 217.56.33.194 port 2466 ssh2
-Oct  3 06:37:56 [sshd] Failed password for illegal user test from 217.56.33.194 port 2501 ssh2
-Oct  3 06:37:57 [sshd] Failed password for illegal user test from 217.56.33.194 port 2533 ssh2
-Oct  3 06:37:59 [sshd] Failed password for illegal user test from 217.56.33.194 port 2567 ssh2
-Oct  3 06:38:00 [sshd] Failed password for illegal user www-data from 217.56.33.194 port 2605 ssh2
-Oct  3 06:38:01 [sshd] Failed password for illegal user mysql from 217.56.33.194 port 2635 ssh2
-Oct  3 06:38:03 [sshd] Failed password for illegal user operator from 217.56.33.194 port 2667 ssh2
-Oct  3 06:38:04 [sshd] Failed password for illegal user adm from 217.56.33.194 port 2697 ssh2
-Oct  3 06:38:05 [sshd] Failed password for illegal user apache from 217.56.33.194 port 2733 ssh2
-Oct  3 06:38:07 [sshd] Failed password for illegal user irc from 217.56.33.194 port 2768 ssh2
-Oct  3 06:38:08 [sshd] Failed password for illegal user irc from 217.56.33.194 port 2804 ssh2
-Oct  3 06:38:09 [sshd] Failed password for illegal user adm from 217.56.33.194 port 2837 ssh2
-Oct  3 06:38:11 [sshd] Failed password for illegal user root from 217.56.33.194 port 2872 ssh2
-Oct  3 06:38:13 [sshd] Failed password for illegal user root from 217.56.33.194 port 2907 ssh2
-Oct  3 06:38:14 [sshd] Failed password for illegal user root from 217.56.33.194 port 2950 ssh2
-Oct  3 06:38:16 [sshd] Failed password for illegal user jane from 217.56.33.194 port 2986 ssh2
-Oct  3 06:38:17 [sshd] Failed password for illegal user pamela from 217.56.33.194 port 3019 ssh2
-Oct  3 06:38:18 [sshd] Failed password for illegal user root from 217.56.33.194 port 3053 ssh2
-Oct  3 06:38:20 [sshd] Failed password for illegal user root from 217.56.33.194 port 3085 ssh2
-Oct  3 06:38:21 [sshd] Failed password for illegal user root from 217.56.33.194 port 3115 ssh2
-Oct  3 06:38:22 [sshd] Failed password for illegal user root from 217.56.33.194 port 3147 ssh2
-Oct  3 06:38:24 [sshd] Failed password for illegal user root from 217.56.33.194 port 3177 ssh2
-Oct  3 06:38:25 [sshd] Failed password for illegal user cosmin from 217.56.33.194 port 3208 ssh2
-Oct  3 06:38:26 [sshd] Failed password for illegal user root from 217.56.33.194 port 3239 ssh2
-Oct  3 06:38:28 [sshd] Failed password for illegal user root from 217.56.33.194 port 3272 ssh2
-Oct  3 06:38:29 [sshd] Failed password for illegal user root from 217.56.33.194 port 3302 ssh2
-Oct  3 06:38:30 [sshd] Failed password for illegal user root from 217.56.33.194 port 3336 ssh2
-Oct  3 06:38:32 [sshd] Failed password for illegal user root from 217.56.33.194 port 3367 ssh2
-Oct  3 06:38:33 [sshd] Failed password for illegal user root from 217.56.33.194 port 3403 ssh2
-Oct  3 06:38:34 [sshd] Failed password for illegal user root from 217.56.33.194 port 3432 ssh2
-Oct  3 06:38:36 [sshd] Failed password for illegal user root from 217.56.33.194 port 3458 ssh2
-Oct  3 06:38:37 [sshd] Failed password for illegal user root from 217.56.33.194 port 3494 ssh2
-Oct  3 06:38:38 [sshd] Failed password for illegal user root from 217.56.33.194 port 3525 ssh2
-Oct  3 06:38:40 [sshd] Failed password for illegal user root from 217.56.33.194 port 3554 ssh2
-Oct  3 06:38:41 [sshd] Failed password for illegal user root from 217.56.33.194 port 3590 ssh2
-Oct  3 06:38:42 [sshd] Failed password for illegal user root from 217.56.33.194 port 3623 ssh2
-Oct  3 06:38:44 [sshd] Failed password for illegal user root from 217.56.33.194 port 3654 ssh2
-Oct  3 06:38:45 [sshd] Failed password for illegal user root from 217.56.33.194 port 3690 ssh2
-Oct  3 06:38:46 [sshd] Failed password for illegal user root from 217.56.33.194 port 3720 ssh2
-Oct  3 06:38:48 [sshd] Failed password for illegal user root from 217.56.33.194 port 3752 ssh2
-Oct  3 06:38:49 [sshd] Failed password for illegal user root from 217.56.33.194 port 3785 ssh2
-Oct  3 06:38:51 [sshd] Failed password for illegal user root from 217.56.33.194 port 3817 ssh2
-Oct  3 06:38:52 [sshd] Failed password for illegal user root from 217.56.33.194 port 3853 ssh2
-Oct  3 06:38:53 [sshd] Failed password for illegal user root from 217.56.33.194 port 3886 ssh2
-Oct  3 06:38:55 [sshd] Failed password for illegal user root from 217.56.33.194 port 3923 ssh2
-Oct  3 06:38:56 [sshd] Failed password for illegal user root from 217.56.33.194 port 3955 ssh2
-Oct  3 06:38:57 [sshd] Failed password for illegal user root from 217.56.33.194 port 3983 ssh2
-Oct  3 06:38:59 [sshd] Failed password for illegal user root from 217.56.33.194 port 4016 ssh2
-Oct  3 06:39:00 [sshd] Failed password for illegal user root from 217.56.33.194 port 4045 ssh2
-Oct  3 06:39:01 [sshd] Failed password for illegal user root from 217.56.33.194 port 4073 ssh2
-Oct  3 06:39:03 [sshd] Failed password for illegal user root from 217.56.33.194 port 4110 ssh2
-Oct  3 06:39:04 [sshd] Failed password for illegal user root from 217.56.33.194 port 4140 ssh2
-Oct  3 06:39:05 [sshd] Failed password for illegal user root from 217.56.33.194 port 4171 ssh2
-Oct  3 06:39:07 [sshd] Failed password for illegal user root from 217.56.33.194 port 4201 ssh2
-Oct  3 06:39:08 [sshd] Failed password for illegal user root from 217.56.33.194 port 4235 ssh2
-Oct  3 06:39:09 [sshd] Failed password for illegal user root from 217.56.33.194 port 4267 ssh2
-Oct  3 06:39:11 [sshd] Failed password for illegal user root from 217.56.33.194 port 4300 ssh2
-Oct  3 06:39:12 [sshd] Failed password for illegal user root from 217.56.33.194 port 4326 ssh2
-Oct  3 06:39:13 [sshd] Failed password for illegal user root from 217.56.33.194 port 4358 ssh2
-Oct  3 06:39:15 [sshd] Failed password for illegal user cip52 from 217.56.33.194 port 4390 ssh2
-Oct  3 06:39:16 [sshd] Failed password for illegal user cip51 from 217.56.33.194 port 4427 ssh2
-Oct  3 06:39:18 [sshd] Failed password for illegal user root from 217.56.33.194 port 4459 ssh2
-Oct  3 06:39:19 [sshd] Failed password for illegal user noc from 217.56.33.194 port 4492 ssh2
-Oct  3 06:39:20 [sshd] Failed password for illegal user root from 217.56.33.194 port 4526 ssh2
-Oct  3 06:39:22 [sshd] Failed password for illegal user root from 217.56.33.194 port 4557 ssh2
-Oct  3 06:39:23 [sshd] Failed password for illegal user root from 217.56.33.194 port 4588 ssh2
-Oct  3 06:39:24 [sshd] Failed password for illegal user root from 217.56.33.194 port 4618 ssh2
-Oct  3 06:39:26 [sshd] Failed password for illegal user webmaster from 217.56.33.194 port 4652 ssh2
-Oct  3 06:39:27 [sshd] Failed password for illegal user data from 217.56.33.194 port 4679 ssh2
-Oct  3 06:39:28 [sshd] Failed password for illegal user user from 217.56.33.194 port 4716 ssh2
-Oct  3 06:39:30 [sshd] Failed password for illegal user user from 217.56.33.194 port 4744 ssh2
-Oct  3 06:39:31 [sshd] Failed password for illegal user user from 217.56.33.194 port 4777 ssh2
-Oct  3 06:39:32 [sshd] Failed password for illegal user web from 217.56.33.194 port 4808 ssh2
-Oct  3 06:39:34 [sshd] Failed password for illegal user web from 217.56.33.194 port 4842 ssh2
-Oct  3 06:39:35 [sshd] Failed password for illegal user oracle from 217.56.33.194 port 4869 ssh2
-Oct  3 06:39:36 [sshd] Failed password for illegal user sybase from 217.56.33.194 port 4899 ssh2
-Oct  3 06:39:38 [sshd] Failed password for illegal user master from 217.56.33.194 port 4933 ssh2
-Oct  3 06:39:39 [sshd] Failed password for illegal user account from 217.56.33.194 port 4969 ssh2
-Oct  3 06:39:40 [sshd] Failed password for illegal user backup from 217.56.33.194 port 4999 ssh2
-Oct  3 06:39:42 [sshd] Failed password for illegal user server from 217.56.33.194 port 1051 ssh2
-Oct  3 06:39:43 [sshd] Failed password for illegal user adam from 217.56.33.194 port 1082 ssh2
-Oct  3 06:39:44 [sshd] Failed password for illegal user alan from 217.56.33.194 port 1114 ssh2
-Oct  3 06:39:46 [sshd] Failed password for illegal user frank from 217.56.33.194 port 1141 ssh2
-Oct  3 06:39:47 [sshd] Failed password for illegal user george from 217.56.33.194 port 1174 ssh2
-Oct  3 06:39:49 [sshd] Failed password for illegal user henry from 217.56.33.194 port 1205 ssh2
-Oct  3 06:39:50 [sshd] Failed password for illegal user john from 217.56.33.194 port 1236 ssh2
-Oct  3 06:39:51 [sshd] Failed password for illegal user root from 217.56.33.194 port 1271 ssh2
-Oct  3 06:39:53 [sshd] Failed password for illegal user root from 217.56.33.194 port 1300 ssh2
-Oct  3 06:39:55 [sshd] Failed password for illegal user root from 217.56.33.194 port 1332 ssh2
-Oct  3 06:39:56 [sshd] Failed password for illegal user root from 217.56.33.194 port 1380 ssh2
-Oct  3 06:39:57 [sshd] Failed password for illegal user root from 217.56.33.194 port 1412 ssh2
-Oct  3 06:39:59 [sshd] Failed password for illegal user test from 217.56.33.194 port 1449 ssh2
-Oct  4 04:43:59 [sshd] Failed password for illegal user test from 212.204.226.21 port 60349 ssh2
-Oct  4 04:44:03 [sshd] Failed password for illegal user guest from 212.204.226.21 port 60394 ssh2
-Oct  4 04:44:06 [sshd] Failed password for illegal user admin from 212.204.226.21 port 60540 ssh2
-Oct  4 04:44:08 [sshd] Failed password for illegal user admin from 212.204.226.21 port 60620 ssh2
-Oct  4 04:44:11 [sshd] Failed password for illegal user user from 212.204.226.21 port 60679 ssh2
-Oct  4 04:44:14 [sshd] Failed password for illegal user root from 212.204.226.21 port 60773 ssh2
-Oct  4 04:44:15 [sshd] Failed password for illegal user root from 212.204.226.21 port 60828 ssh2
-Oct  4 04:44:18 [sshd] Failed password for illegal user root from 212.204.226.21 port 60880 ssh2
-Oct  4 04:44:21 [sshd] Failed password for illegal user test from 212.204.226.21 port 60957 ssh2
-Oct  4 09:32:21 [sshd] Failed password for illegal user test from 62.141.56.70 port 45600 ssh2
-Oct  4 09:32:27 [sshd] Failed password for illegal user guest from 62.141.56.70 port 47635 ssh2
-Oct  4 09:32:32 [sshd] Failed password for illegal user admin from 62.141.56.70 port 49967 ssh2
-Oct  4 09:32:37 [sshd] Failed password for illegal user admin from 62.141.56.70 port 52093 ssh2
-Oct  4 09:32:42 [sshd] Failed password for illegal user user from 62.141.56.70 port 53840 ssh2
-Oct  4 09:32:47 [sshd] Failed password for illegal user root from 62.141.56.70 port 55568 ssh2
-Oct  4 09:32:51 [sshd] Failed password for illegal user root from 62.141.56.70 port 57526 ssh2
-Oct  4 09:32:51 [sshd] Failed password for illegal user root from 62.141.56.70 port 58454 ssh2
-Oct  4 09:32:52 [sshd] Failed password for illegal user test from 62.141.56.70 port 58819 ssh2
-Oct  4 14:09:11 [sshd] Failed password for illegal user test from 211.234.125.100 port 46642 ssh2
-Oct  4 14:09:18 [sshd] Failed password for illegal user guest from 211.234.125.100 port 46788 ssh2
-Oct  4 14:09:23 [sshd] Failed password for illegal user admin from 211.234.125.100 port 46886 ssh2
-Oct  4 14:09:30 [sshd] Failed password for illegal user admin from 211.234.125.100 port 46960 ssh2
-Oct  4 14:09:43 [sshd] Failed password for illegal user user from 211.234.125.100 port 47025 ssh2
-Oct  6 04:13:11 [sshd] Failed password for illegal user test from 64.246.30.17 port 58277 ssh2
-Oct  6 04:13:13 [sshd] Failed password for illegal user guest from 64.246.30.17 port 58360 ssh2
-Oct  6 04:13:15 [sshd] Failed password for illegal user admin from 64.246.30.17 port 58428 ssh2
-Oct  6 04:13:17 [sshd] Failed password for illegal user admin from 64.246.30.17 port 58514 ssh2
-Oct  6 22:13:56 [sshd] Failed password for illegal user test from 61.11.98.217 port 45434 ssh2
-Oct  6 22:14:00 [sshd] Failed password for illegal user guest from 61.11.98.217 port 45586 ssh2
-Oct  6 22:14:05 [sshd] Failed password for illegal user admin from 61.11.98.217 port 45672 ssh2
-Oct  6 22:14:10 [sshd] Failed password for illegal user admin from 61.11.98.217 port 45748 ssh2
-Oct  6 22:14:18 [sshd] Failed password for illegal user user from 61.11.98.217 port 45833 ssh2
-Oct  7 00:25:34 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37086 ssh2
-Oct  7 00:25:34 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37086 ssh2
-                - Last output repeated twice -
-Oct  7 00:26:27 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37089 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:26:37 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37092 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:27:21 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37095 ssh2
-                - Last output repeated twice -
-Oct  7 00:51:31 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37130 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:51:48 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37138 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:52:02 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37141 ssh2
-Oct  7 00:56:10 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37153 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:56:41 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37156 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:57:00 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37159 ssh2
-Oct  7 00:58:17 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37162 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:58:29 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37165 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:58:39 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37168 ssh2
-Oct  7 01:00:32 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37171 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:00:44 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37175 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:01:23 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37178 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:03:01 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37181 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:03:12 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37184 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:03:20 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37187 ssh2
-                - Last output repeated 2 times -
-Nov 14 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
-Nov 14 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
-Nov 14 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
-Nov 15 11:12:11 yellow sshd[16069]: Failed password for cyril from 212.41.79.210 port 29404 ssh2
-Nov 15 21:54:11 yellow sshd[16069]: Illegal user for cyril from 212.41.79.210 port 29404 ssh2

logreader/logreader.py

@@ -1,160 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import os, sys, time, re
-
-class LogReader:
-	""" Reads a log file and reports information about IP that make password
-		failure, bad user or anything else that is considered as doubtful login
-		attempt.	
-	"""
-	
-	def __init__(self, logSys, logPath, timeregex, timepattern, failregex, findTime = 3600):
-		self.logPath = logPath
-		self.timeregex = timeregex
-		self.timepattern = timepattern
-		self.failregex = failregex
-		self.findTime = findTime
-		self.ignoreIpList = []
-		self.lastModTime = 0
-		self.logSys = logSys
-		
-	def setName(self, name):
-		""" Sets the name of the log reader.
-		"""
-		self.name = name
-		
-	def getName(self):
-		""" Gets the name of the log reader.
-		"""
-		return self.name
-	
-	def addIgnoreIP(self, ip):
-		""" Adds an IP to the ignore list.
-		"""
-		self.logSys.debug("Add "+ip+" to ignore list")
-		self.ignoreIpList.append(ip)
-		
-	def inIgnoreIPList(self, ip):
-		""" Checks if IP is in the ignore list.
-		"""
-		return ip in self.ignoreIpList
-	
-	def openLogFile(self):
-		""" Opens the log file specified on init.
-		"""
-		try:
-			fileHandler = open(self.logPath)
-		except OSError:
-			self.logSys.error("Unable to open "+self.logPath)
-			sys.exit(-1)
-		return fileHandler
-		
-	def isModified(self):
-		""" Checks if the log file has been modified using os.stat().
-		"""
-		try:
-			logStats = os.stat(self.logPath)
-		except OSError:
-			self.logSys.error("Unable to get stat on "+self.logPath)
-			sys.exit(-1)
-		
-		if self.lastModTime == logStats.st_mtime:
-			return False
-		else:
-			self.logSys.debug(self.logPath+" has been modified")
-			self.lastModTime = logStats.st_mtime
-			return True
-	
-	def getFailures(self):
-		""" Gets all the failure in the log file which are
-			newer than time.time()-self.findTime.
-			
-			Returns a dict with the IP, the number of failure
-			and the latest failure time.
-		"""
-		ipList = dict()
-		logFile = self.openLogFile()
-		for line in logFile.readlines():
-			value = self.findFailure(line)
-			if value:
-				ip = value[0]
-				unixTime = value[1]
-				if unixTime < time.time()-self.findTime:
-					continue
-				if self.inIgnoreIPList(ip):
-					self.logSys.debug("Ignore "+ip)
-					continue
-				self.logSys.debug("Found "+ip)
-				if ipList.has_key(ip):
-					ipList[ip] = (ipList[ip][0]+1, unixTime)
-				else:
-					ipList[ip] = (1, unixTime)
-		logFile.close()
-		return ipList
-
-	def findFailure(self, line):
-		""" Finds the failure in line. Uses the failregex pattern
-			to find it and timeregex in order to find the logging
-			time.
-			
-			Returns a dict with IP and timestamp.
-		"""
-		match = self.matchLine(self.failregex, line)
-		if match:
-			timeMatch = self.matchLine(self.timeregex, match.string)
-			if timeMatch:
-				date = self.getUnixTime(timeMatch.group())
-				ipMatch = self.matchAddress(match.string)
-				if ipMatch:
-					ip = ipMatch.group()
-					return [ip, date]
-		return None
-		
-	def getUnixTime(self, value):
-		""" Returns the Unix timestamp of the given value.
-			Pattern should describe the date construction of
-			value.
-		"""
-		date = list(time.strptime(value, self.timepattern))
-		if date[0] < 2000:
-			date[0] = time.gmtime()[0]
-		unixTime = time.mktime(date)
-		return unixTime
-	
-	def matchLine(self, pattern, line):
-		""" Checks if the line contains a pattern.
-			
-			Return a match object.
-		"""
-		return re.search(pattern, line)
-		
-	def matchAddress(self, line):
-		""" Return a match on the IP address present in
-			line.		
-		"""
-		return self.matchLine("(?:\d{1,3}\.){3}\d{1,3}", line)
-	

man/fail2ban-client.1

@@ -0,0 +1,270 @@
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
+.TH FAIL2BAN-CLIENT "1" "May 2007" "fail2ban-client v0.8.0" "User Commands"
+.SH NAME
+fail2ban-client \- configure and control the server
+.SH DESCRIPTION
+[?1034hUsage: ../fail2ban\-client [OPTIONS] <COMMAND>
+.PP
+Fail2Ban v0.8.0 reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules.
+.SH OPTIONS
+.TP
+\fB\-c\fR <DIR>
+configuration directory
+.TP
+\fB\-s\fR <FILE>
+socket path
+.TP
+\fB\-d\fR
+dump configuration. For debugging
+.TP
+\fB\-i\fR
+interactive mode
+.TP
+\fB\-v\fR
+increase verbosity
+.TP
+\fB\-q\fR
+decrease verbosity
+.TP
+\fB\-x\fR
+force execution of the server (remove socket file)
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+display this help message
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+print the version
+.SH COMMAND
+.IP
+BASIC
+.TP
+\fBstart\fR
+starts the server and the jails
+.TP
+\fBreload\fR
+reloads the configuration
+.TP
+\fBstop\fR
+stops all jails and terminate the
+server
+.TP
+\fBstatus\fR
+gets the current status of the
+server
+.TP
+\fBping\fR
+tests if the server is alive
+.IP
+LOGGING
+.TP
+\fBset loglevel <LEVEL>\fR
+sets logging level to <LEVEL>. 0
+is minimal, 4 is debug
+.TP
+\fBget loglevel\fR
+gets the logging level
+.TP
+\fBset logtarget <TARGET>\fR
+sets logging target to <TARGET>.
+Can be STDOUT, STDERR, SYSLOG or a
+file
+.TP
+\fBget logtarget\fR
+gets logging target
+.IP
+JAIL CONTROL
+.TP
+\fBadd <JAIL> <BACKEND>\fR
+creates <JAIL> using <BACKEND>
+.TP
+\fBstart <JAIL>\fR
+starts the jail <JAIL>
+.TP
+\fBstop <JAIL>\fR
+stops the jail <JAIL>. The jail is
+removed
+.TP
+\fBstatus <JAIL>\fR
+gets the current status of <JAIL>
+.IP
+JAIL CONFIGURATION
+.TP
+\fBset <JAIL> idle on|off\fR
+sets the idle state of <JAIL>
+.TP
+\fBset <JAIL> addignoreip <IP>\fR
+adds <IP> to the ignore list of
+<JAIL>
+.TP
+\fBset <JAIL> delignoreip <IP>\fR
+removes <IP> from the ignore list
+of <JAIL>
+.TP
+\fBset <JAIL> addlogpath <FILE>\fR
+adds <FILE> to the monitoring list
+of <JAIL>
+.TP
+\fBset <JAIL> dellogpath <FILE>\fR
+removes <FILE> to the monitoring
+list of <JAIL>
+.TP
+\fBset <JAIL> timeregex <REGEX>\fR
+sets the regular expression
+<REGEX> to match the date format
+for <JAIL>. This will disable the
+autodetection feature.
+.TP
+\fBset <JAIL> timepattern <PATTERN>\fR
+sets the pattern <PATTERN> to
+match the date format for <JAIL>.
+This will disable the
+autodetection feature.
+.TP
+\fBset <JAIL> addfailregex <REGEX>\fR
+adds the regular expression
+<REGEX> which must match failures
+for <JAIL>
+.TP
+\fBset <JAIL> delfailregex <INDEX>\fR
+removes the regular expression at
+<INDEX> for failregex
+.TP
+\fBset <JAIL> addignoreregex <REGEX>\fR
+adds the regular expression
+<REGEX> which should match pattern
+to exclude for <JAIL>
+.TP
+\fBset <JAIL> delignoreregex <INDEX>\fR
+removes the regular expression at
+<INDEX> for ignoreregex
+.TP
+\fBset <JAIL> findtime <TIME>\fR
+sets the number of seconds <TIME>
+for which the filter will look
+back for <JAIL>
+.TP
+\fBset <JAIL> bantime <TIME>\fR
+sets the number of seconds <TIME>
+a host will be banned for <JAIL>
+.TP
+\fBset <JAIL> maxretry <RETRY>\fR
+sets the number of failures
+<RETRY> before banning the host
+for <JAIL>
+.TP
+\fBset <JAIL> addaction <ACT>\fR
+adds a new action named <NAME> for
+<JAIL>
+.TP
+\fBset <JAIL> delaction <ACT>\fR
+removes the action <NAME> from
+<JAIL>
+.TP
+\fBset <JAIL> setcinfo <ACT> <KEY> <VALUE>\fR
+sets <VALUE> for <KEY> of the
+action <NAME> for <JAIL>
+.TP
+\fBset <JAIL> delcinfo <ACT> <KEY>\fR
+removes <KEY> for the action
+<NAME> for <JAIL>
+.TP
+\fBset <JAIL> actionstart <ACT> <CMD>\fR
+sets the start command <CMD> of
+the action <ACT> for <JAIL>
+.TP
+\fBset <JAIL> actionstop <ACT> <CMD>\fR
+sets the stop command <CMD> of the
+action <ACT> for <JAIL>
+.TP
+\fBset <JAIL> actioncheck <ACT> <CMD>\fR
+sets the check command <CMD> of
+the action <ACT> for <JAIL>
+.TP
+\fBset <JAIL> actionban <ACT> <CMD>\fR
+sets the ban command <CMD> of the
+action <ACT> for <JAIL>
+.TP
+\fBset <JAIL> actionunban <ACT> <CMD>\fR
+sets the unban command <CMD> of
+the action <ACT> for <JAIL>
+.IP
+JAIL INFORMATION
+.TP
+\fBget <JAIL> logpath\fR
+gets the list of the monitored
+files for <JAIL>
+.TP
+\fBget <JAIL> ignoreip\fR
+gets the list of ignored IP
+addresses for <JAIL>
+.TP
+\fBget <JAIL> timeregex\fR
+gets the regular expression used
+for the time detection for <JAIL>
+.TP
+\fBget <JAIL> timepattern\fR
+gets the pattern used for the time
+detection for <JAIL>
+.TP
+\fBget <JAIL> failregex\fR
+gets the list of regular
+expressions which matches the
+failures for <JAIL>
+.TP
+\fBget <JAIL> ignoreregex\fR
+gets the list of regular
+expressions which matches patterns
+to ignore for <JAIL>
+.TP
+\fBget <JAIL> findtime\fR
+gets the time for which the filter
+will look back for failures for
+<JAIL>
+.TP
+\fBget <JAIL> bantime\fR
+gets the time a host is banned for
+<JAIL>
+.TP
+\fBget <JAIL> maxretry\fR
+gets the number of failures
+allowed for <JAIL>
+.TP
+\fBget <JAIL> addaction\fR
+gets the last action which has
+been added for <JAIL>
+.TP
+\fBget <JAIL> actionstart <ACT>\fR
+gets the start command for the
+action <ACT> for <JAIL>
+.TP
+\fBget <JAIL> actionstop <ACT>\fR
+gets the stop command for the
+action <ACT> for <JAIL>
+.TP
+\fBget <JAIL> actioncheck <ACT>\fR
+gets the check command for the
+action <ACT> for <JAIL>
+.TP
+\fBget <JAIL> actionban <ACT>\fR
+gets the ban command for the
+action <ACT> for <JAIL>
+.TP
+\fBget <JAIL> actionunban <ACT>\fR
+gets the unban command for the
+action <ACT> for <JAIL>
+.SH FILES
+\fI/etc/fail2ban/*\fR
+.SH AUTHOR
+Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
+.SH "REPORTING BUGS"
+Report bugs to <lostcontrol@users.sourceforge.net>
+.SH COPYRIGHT
+Copyright \(co 2004-2006 Cyril Jaquier
+.br
+Copyright of modifications held by their respective authors.
+Licensed under the GNU General Public License v2 (GPL).
+.SH "SEE ALSO"
+.br 
+fail2ban-server(1)

man/fail2ban-client.h2m

@@ -0,0 +1,12 @@
+Include file for help2man man page
+$Id:  $
+
+[name]
+fail2ban-client \- configure and control the server
+
+[files]
+\fI/etc/fail2ban/*\fR
+
+[see also]
+.br 
+fail2ban-server(1)

man/fail2ban-regex.1

@@ -0,0 +1,47 @@
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
+.TH FAIL2BAN-REGEX "1" "May 2007" "fail2ban-regex v0.8.0" "User Commands"
+.SH NAME
+fail2ban-regex \- test Fail2ban "failregex" option
+.SH SYNOPSIS
+.B fail2ban-regex
+[\fIOPTIONS\fR] \fI<LOG> <REGEX>\fR
+.SH DESCRIPTION
+Fail2Ban v0.8.0 reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules.
+.PP
+This tools can test regular expressions for "fail2ban".
+.SH OPTIONS
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+display this help message
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+print the version
+.SH LOG
+.TP
+\fBstring\fR
+a string representing a log line
+.TP
+\fBfilename\fR
+path to a log file (/var/log/auth.log)
+.SH REGEX
+.TP
+\fBstring\fR
+a string representing a 'failregex'
+.TP
+\fBfilename\fR
+path to a filter file (filter.d/sshd.conf)
+.SH AUTHOR
+Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
+.SH "REPORTING BUGS"
+Report bugs to <lostcontrol@users.sourceforge.net>
+.SH COPYRIGHT
+Copyright \(co 2004-2006 Cyril Jaquier
+.br
+Copyright of modifications held by their respective authors.
+Licensed under the GNU General Public License v2 (GPL).
+.SH "SEE ALSO"
+.br 
+fail2ban-client(1)
+fail2ban-server(1)

man/fail2ban-regex.h2m

@@ -0,0 +1,10 @@
+Include file for help2man man page
+$Id:  $
+
+[name]
+fail2ban-regex \- test Fail2ban "failregex" option
+
+[see also]
+.br 
+fail2ban-client(1)
+fail2ban-server(1)

man/fail2ban-server.1

@@ -0,0 +1,46 @@
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
+.TH FAIL2BAN-SERVER "1" "May 2007" "fail2ban-server v0.8.0" "User Commands"
+.SH NAME
+fail2ban-server \- start the server
+.SH SYNOPSIS
+.B fail2ban-server
+[\fIOPTIONS\fR]
+.SH DESCRIPTION
+Fail2Ban v0.8.0 reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules.
+.PP
+Only use this command for debugging purpose. Start the server with
+fail2ban\-client instead. The default behaviour is to start the server
+in background.
+.SH OPTIONS
+.TP
+\fB\-b\fR
+start in background
+.TP
+\fB\-f\fR
+start in foreground
+.TP
+\fB\-s\fR <FILE>
+socket path
+.TP
+\fB\-x\fR
+force execution of the server (remove socket file)
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+display this help message
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+print the version
+.SH AUTHOR
+Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
+.SH "REPORTING BUGS"
+Report bugs to <lostcontrol@users.sourceforge.net>
+.SH COPYRIGHT
+Copyright \(co 2004-2006 Cyril Jaquier
+.br
+Copyright of modifications held by their respective authors.
+Licensed under the GNU General Public License v2 (GPL).
+.SH "SEE ALSO"
+.br 
+fail2ban-client(1)

man/fail2ban-server.h2m

@@ -0,0 +1,9 @@
+Include file for help2man man page
+$Id:  $
+
+[name]
+fail2ban-server \- start the server
+
+[see also]
+.br 
+fail2ban-client(1)

man/generate-man

@@ -0,0 +1,69 @@
+#!/bin/bash
+
+# fail2ban-client
+echo -n "Generating fail2ban-client "
+help2man --section=1 --no-info --include=fail2ban-client.h2m --output fail2ban-client.1 ../fail2ban-client
+echo "[done]"
+echo -n "Patching fail2ban-client   "
+# Changes the title.
+sed -i -e 's/.SS "Command:"/.SH COMMAND/' fail2ban-client.1
+# Sets bold font for commands.
+IFS="
+"
+NEXT=0
+FOUND=0
+LINES=$( cat fail2ban-client.1 )
+echo -n "" > fail2ban-client.1
+for LINE in $LINES; do
+	if [ "$LINE" = ".SH COMMAND" ]; then
+		FOUND=1
+	fi
+	if [ $NEXT -eq 1 ] && [ $FOUND -eq 1 ]; then
+		echo "\fB$LINE\fR" >> fail2ban-client.1
+	else
+		echo "$LINE" >> fail2ban-client.1
+	fi
+	if [ "$LINE" = ".TP" ]; then
+		NEXT=1
+	else
+		NEXT=0
+	fi
+done
+echo "[done]"
+
+# fail2ban-server
+echo -n "Generating fail2ban-server "
+help2man --section=1 --no-info --include=fail2ban-server.h2m --output fail2ban-server.1 ../fail2ban-server
+echo "[done]"
+
+# fail2ban-regex
+echo -n "Generating fail2ban-regex  "
+help2man --section=1 --no-info --include=fail2ban-regex.h2m --output fail2ban-regex.1 ../fail2ban-regex
+echo "[done]"
+echo -n "Patching fail2ban-regex    "
+# Changes the title.
+sed -i -e 's/.SS "Log:"/.SH LOG/' fail2ban-regex.1
+sed -i -e 's/.SS "Regex:"/.SH REGEX/' fail2ban-regex.1
+# Sets bold font for commands.
+IFS="
+"
+NEXT=0
+FOUND=0
+LINES=$( cat fail2ban-regex.1 )
+echo -n "" > fail2ban-regex.1
+for LINE in $LINES; do
+	if [ "$LINE" = ".SH LOG" ]; then
+		FOUND=1
+	fi
+	if [ $NEXT -eq 1 ] && [ $FOUND -eq 1 ]; then
+		echo "\fB$LINE\fR" >> fail2ban-regex.1
+	else
+		echo "$LINE" >> fail2ban-regex.1
+	fi
+	if [ "$LINE" = ".TP" ]; then
+		NEXT=1
+	else
+		NEXT=0
+	fi
+done
+echo "[done]"

server/__init__.py

@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"

server/action.py

@@ -0,0 +1,317 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging, os
+#from subprocess import call
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.actions.action")
+
+##
+# Execute commands.
+#
+# This class reads the failures from the Jail queue and decide if an
+# action has to be taken. A BanManager take care of the banned IP
+# addresses.
+
+class Action:
+	
+	def __init__(self, name):
+		self.__name = name
+		self.__cInfo = dict()
+		## Command executed in order to initialize the system.
+		self.__actionStart = ''
+		## Command executed when an IP address gets banned.
+		self.__actionBan = ''
+		## Command executed when an IP address gets removed.
+		self.__actionUnban = ''
+		## Command executed in order to check requirements.
+		self.__actionCheck = ''
+		## Command executed in order to stop the system.
+		self.__actionStop = ''
+		logSys.debug("Created Action")
+	
+	##
+	# Sets the action name.
+	#
+	# @param name the name of the action
+	
+	def setName(self, name):
+		self.__name = name
+	
+	##
+	# Returns the action name.
+	#
+	# @return the name of the action
+	
+	def getName(self):
+		return self.__name
+	
+	##
+	# Sets a "CInfo".
+	#
+	# CInfo are statically defined properties. They can be definied by
+	# the user and are used to set e-mail addresses, port, host or
+	# anything that should not change during the life of the server.
+	#
+	# @param key the property name
+	# @param value the property value
+	
+	def setCInfo(self, key, value):
+		self.__cInfo[key] = value
+	
+	##
+	# Returns a "CInfo".
+	#
+	# @param key the property name
+	
+	def getCInfo(self, key):
+		return self.__cInfo[key]
+	
+	##
+	# Removes a "CInfo".
+	#
+	# @param key the property name
+	
+	def delCInfo(self, key):
+		del self.__cInfo[key]
+	
+	##
+	# Set the "start" command.
+	#
+	# @param value the command
+		
+	def setActionStart(self, value):
+		self.__actionStart = value
+		logSys.debug("Set actionStart = %s" % value)
+	
+	##
+	# Get the "start" command.
+	#
+	# @return the command
+	
+	def getActionStart(self):
+		return self.__actionStart
+	
+	##
+	# Executes the action "start" command.
+	#
+	# Replaces the tags in the action command with value of "cInfo"
+	# and executes the resulting command.
+	#
+	# @return True if the command succeeded
+	
+	def execActionStart(self):
+		startCmd = Action.replaceTag(self.__actionStart, self.__cInfo)
+		return Action.executeCmd(startCmd)
+	
+	##
+	# Set the "ban" command.
+	#
+	# @param value the command
+	
+	def setActionBan(self, value):
+		self.__actionBan = value
+		logSys.debug("Set actionBan = %s" % value)
+	
+	##
+	# Get the "ban" command.
+	#
+	# @return the command
+	
+	def getActionBan(self):
+		return self.__actionBan
+	
+	##
+	# Executes the action "ban" command.
+	#
+	# @return True if the command succeeded
+	
+	def execActionBan(self, aInfo):
+		return self.__processCmd(self.__actionBan, aInfo)
+	
+	##
+	# Set the "unban" command.
+	#
+	# @param value the command
+	
+	def setActionUnban(self, value):
+		self.__actionUnban = value
+		logSys.debug("Set actionUnban = %s" % value)
+	
+	##
+	# Get the "unban" command.
+	#
+	# @return the command
+	
+	def getActionUnban(self):
+		return self.__actionUnban
+	
+	##
+	# Executes the action "unban" command.
+	#
+	# @return True if the command succeeded
+	
+	def execActionUnban(self, aInfo):
+		return self.__processCmd(self.__actionUnban, aInfo)
+	
+	##
+	# Set the "check" command.
+	#
+	# @param value the command
+	
+	def setActionCheck(self, value):
+		self.__actionCheck = value
+		logSys.debug("Set actionCheck = %s" % value)
+	
+	##
+	# Get the "check" command.
+	#
+	# @return the command
+	
+	def getActionCheck(self):
+		return self.__actionCheck
+	
+	##
+	# Set the "stop" command.
+	#
+	# @param value the command
+	
+	def setActionStop(self, value):
+		self.__actionStop = value
+		logSys.debug("Set actionStop = %s" % value)
+	
+	##
+	# Get the "stop" command.
+	#
+	# @return the command
+	
+	def getActionStop(self):
+		return self.__actionStop
+	
+	##
+	# Executes the action "stop" command.
+	#
+	# Replaces the tags in the action command with value of "cInfo"
+	# and executes the resulting command.
+	#
+	# @return True if the command succeeded
+	
+	def execActionStop(self):
+		stopCmd = Action.replaceTag(self.__actionStop, self.__cInfo)
+		return Action.executeCmd(stopCmd)
+	
+	##
+	# Replaces tags in query with property values in aInfo.
+	#
+	# @param query the query string with tags
+	# @param aInfo the properties
+	# @return a string
+	
+	#@staticmethod
+	def replaceTag(query, aInfo):
+		""" Replace tags in query
+		"""
+		string = query
+		for tag in aInfo:
+			string = string.replace('<' + tag + '>', str(aInfo[tag]))
+		# New line
+		string = string.replace("<br>", '\n')
+		return string
+	replaceTag = staticmethod(replaceTag)
+	
+	##
+	# Executes a command with preliminary checks and substitutions.
+	#
+	# Before executing any commands, executes the "check" command first
+	# in order to check if prerequirements are met. If this check fails,
+	# it tries to restore a sane environnement before executing the real
+	# command.
+	# Replaces "aInfo" and "cInfo" in the query too.
+	#
+	# @param cmd The command to execute
+	# @param aInfo Dynamic properties
+	# @return True if the command succeeded
+	
+	def __processCmd(self, cmd, aInfo = None):
+		""" Executes an OS command.
+		"""
+		if cmd == "":
+			logSys.debug("Nothing to do")
+			return True
+		
+		checkCmd = Action.replaceTag(self.__actionCheck, self.__cInfo)
+		if not Action.executeCmd(checkCmd):
+			logSys.error("Invariant check failed. Trying to restore a sane" +
+						 " environment")
+			stopCmd = Action.replaceTag(self.__actionStop, self.__cInfo)
+			Action.executeCmd(stopCmd)
+			startCmd = Action.replaceTag(self.__actionStart, self.__cInfo)
+			Action.executeCmd(startCmd)
+			if not Action.executeCmd(checkCmd):
+				logSys.fatal("Unable to restore environment")
+				return False
+
+		# Replace tags
+		if not aInfo == None:
+			realCmd = Action.replaceTag(cmd, aInfo)
+		else:
+			realCmd = cmd
+		
+		# Replace static fields
+		realCmd = Action.replaceTag(realCmd, self.__cInfo)
+		
+		return Action.executeCmd(realCmd)
+
+	##
+	# Executes a command.
+	#
+	# We need a shell here because commands are mainly shell script. They
+	# contain pipe, redirection, etc.
+	# 
+	# @todo Force the use of bash!?
+	# @todo Kill the command after a given timeout
+	#
+	# @param realCmd the command to execute
+	# @return True if the command succeeded
+
+	#@staticmethod
+	def executeCmd(realCmd):
+		logSys.debug(realCmd)
+		try:
+			# The following line gives deadlock with multiple jails
+			#retcode = call(realCmd, shell=True)
+			retcode = os.system(realCmd)
+			if retcode == 0:
+				logSys.debug("%s returned successfully" % realCmd)
+				return True
+			else:
+				logSys.error("%s returned %x" % (realCmd, retcode))
+		except OSError, e:
+			logSys.error("%s failed with %s" % (realCmd, e))
+		return False
+	executeCmd = staticmethod(executeCmd)
+	

server/actions.py

@@ -0,0 +1,217 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from banmanager import BanManager
+from jailthread import JailThread
+from action import Action
+from mytime import MyTime
+import time, logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.actions")
+
+##
+# Execute commands.
+#
+# This class reads the failures from the Jail queue and decide if an
+# action has to be taken. A BanManager take care of the banned IP
+# addresses.
+
+class Actions(JailThread):
+	
+	##
+	# Constructor.
+	#
+	# Initialize the filter object with default values.
+	# @param jail the jail object
+	
+	def __init__(self, jail):
+		JailThread.__init__(self)
+		## The jail which contains this action.
+		self.jail = jail
+		self.__actions = list()
+		## The ban manager.
+		self.__banManager = BanManager()
+	
+	##
+	# Adds an action.
+	#
+	# @param name The action name
+	
+	def addAction(self, name):
+		action = Action(name)
+		self.__actions.append(action)
+	
+	##
+	# Removes an action.
+	#
+	# @param name The action name
+	
+	def delAction(self, name):
+		for action in self.__actions:
+			if action.getName() == name:
+				self.__actions.remove(action)
+				break
+	
+	##
+	# Returns an action.
+	#
+	# Raises a KeyError exception if the action does not exist.
+	#
+	# @param name the action name
+	# @return the action
+	
+	def getAction(self, name):
+		for action in self.__actions:
+			if action.getName() == name:
+				return action
+		raise KeyError
+	
+	##
+	# Returns the last defined action.
+	#
+	# @return The last defined action.
+	
+	def getLastAction(self):
+		action = self.__actions.pop()
+		self.__actions.append(action)
+		return action
+	
+	##
+	# Set the ban time.
+	#
+	# @param value the time
+	
+	def setBanTime(self, value):
+		self.__banManager.setBanTime(value)
+		logSys.info("Set banTime = %s" % value)
+	
+	##
+	# Get the ban time.
+	#
+	# @return the time
+	
+	def getBanTime(self):
+		return self.__banManager.getBanTime()
+	
+	##
+	# Main loop.
+	#
+	# This function is the main loop of the thread. It checks the Jail
+	# queue and executes commands when an IP address is banned.
+	# @return True when the thread exits nicely
+	
+	def run(self):
+		self.setActive(True)
+		for action in self.__actions:
+			action.execActionStart()
+		while self._isActive():
+			if not self.getIdle():
+				#logSys.debug(self.jail.getName() + ": action")
+				ret = self.__checkBan()
+				if not ret:
+					self.__checkUnBan()
+					time.sleep(self.getSleepTime())
+			else:
+				time.sleep(self.getSleepTime())
+		self.__flushBan()
+		for action in self.__actions:
+			action.execActionStop()
+		logSys.debug(self.jail.getName() + ": action terminated")
+		return True
+
+	##
+	# Check for IP address to ban.
+	#
+	# Look in the Jail queue for FailTicket. If a ticket is available,
+	# it executes the "ban" command and add a ticket to the BanManager.
+	# @return True if an IP address get banned
+	
+	def __checkBan(self):
+		ticket = self.jail.getFailTicket()
+		if ticket != False:
+			aInfo = dict()
+			bTicket = BanManager.createBanTicket(ticket)
+			aInfo["ip"] = bTicket.getIP()
+			aInfo["failures"] = bTicket.getAttempt()
+			aInfo["time"] = bTicket.getTime()
+			if self.__banManager.addBanTicket(bTicket):
+				logSys.warn("[%s] Ban %s" % (self.jail.getName(), aInfo["ip"]))
+				for action in self.__actions:
+					action.execActionBan(aInfo)
+				return True
+			else:
+				logSys.warn("[%s] %s already banned" % (self.jail.getName(), 
+														aInfo["ip"]))
+		return False
+	
+	##
+	# Check for IP address to unban.
+	#
+	# Unban IP address which are outdated.
+	
+	def __checkUnBan(self):
+		for ticket in self.__banManager.unBanList(MyTime.time()):
+			self.__unBan(ticket)
+	
+	##
+	# Flush the ban list.
+	#
+	# Unban all IP address which are still in the banning list.
+	
+	def __flushBan(self):
+		logSys.debug("Flush ban list")
+		for ticket in self.__banManager.flushBanList():
+			self.__unBan(ticket)
+	
+	##
+	# Unbans host corresponding to the ticket.
+	#
+	# Executes the actions in order to unban the host given in the
+	# ticket.
+	
+	def __unBan(self, ticket):
+		aInfo = dict()
+		aInfo["ip"] = ticket.getIP()
+		aInfo["failures"] = ticket.getAttempt()
+		aInfo["time"] = ticket.getTime()
+		logSys.warn("[%s] Unban %s" % (self.jail.getName(), aInfo["ip"]))
+		for action in self.__actions:
+			action.execActionUnban(aInfo)
+			
+	
+	##
+	# Get the status of the filter.
+	#
+	# Get some informations about the filter state such as the total
+	# number of failures.
+	# @return a list with tuple
+	
+	def status(self):
+		ret = [("Currently banned", self.__banManager.size()), 
+			   ("Total banned", self.__banManager.getBanTotal()),
+			   ("IP list", self.__banManager.getBanList())]
+		return ret

server/asyncserver.py

@@ -0,0 +1,155 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 567 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 567 $"
+__date__ = "$Date: 2007-03-26 23:17:31 +0200 (Mon, 26 Mar 2007) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from pickle import dumps, loads, HIGHEST_PROTOCOL
+import asyncore, asynchat, socket, os, logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.server")
+
+##
+# Request handler class.
+#
+# This class extends asynchat in order to provide a request handler for
+# incoming query.
+
+class RequestHandler(asynchat.async_chat):
+	
+	END_STRING = "<F2B_END_COMMAND>"
+
+	def __init__(self, conn, transmitter):
+		asynchat.async_chat.__init__(self, conn)
+		self.__transmitter = transmitter
+		self.__buffer = []
+		# Sets the terminator.
+		self.set_terminator(RequestHandler.END_STRING)
+
+	def collect_incoming_data(self, data):
+		#logSys.debug("Received raw data: " + str(data))
+		self.__buffer.append(data)
+
+	##
+	# Handles a new request.
+	#
+	# This method is called once we have a complete request.
+
+	def found_terminator(self):
+		# Joins the buffer items.
+		message = loads("".join(self.__buffer))
+		# Gives the message to the transmitter.
+		message = self.__transmitter.proceed(message)
+		# Serializes the response.
+		message = dumps(message, HIGHEST_PROTOCOL)
+		# Sends the response to the client.
+		self.send(message + RequestHandler.END_STRING)
+		# Closes the channel.
+		self.close_when_done()
+		
+	def handle_error(self):
+		logSys.error("Unexpected communication error")
+		self.close()
+		
+##
+# Asynchronous server class.
+#
+# This class extends asyncore and dispatches connection requests to
+# RequestHandler.
+
+class AsyncServer(asyncore.dispatcher):
+
+	def __init__(self, transmitter):
+		asyncore.dispatcher.__init__(self)
+		self.__transmitter = transmitter
+		self.__sock = "/var/run/fail2ban/fail2ban.sock"
+		self.__init = False
+
+	##
+	# Returns False as we only read the socket first.
+
+	def writable(self):
+		return False
+
+	def handle_accept(self):
+		try:
+			conn, addr = self.accept()
+		except socket.error:
+			logSys.warning("Socket error")
+			return
+		except TypeError:
+			logSys.warning("Type error")
+			return
+		# Creates an instance of the handler class to handle the
+		# request/response on the incoming connection.
+		RequestHandler(conn, self.__transmitter)
+	
+	##
+	# Starts the communication server.
+	#
+	# @param sock: socket file.
+	# @param force: remove the socket file if exists.
+	
+	def start(self, sock, force):
+		self.__sock = sock
+		# Remove socket
+		if os.path.exists(sock):
+			logSys.error("Fail2ban seems to be already running")
+			if force:
+				logSys.warn("Forcing execution of the server")
+				os.remove(sock)
+			else:
+				raise AsyncServerException("Server already running")
+		# Creates the socket.
+		self.create_socket(socket.AF_UNIX, socket.SOCK_STREAM)
+		self.set_reuse_addr()
+		try:
+			self.bind(sock)
+		except Exception:
+			raise AsyncServerException("Unable to bind socket %s" % self.__sock)
+		self.listen(1)
+		# Sets the init flag.
+		self.__init = True
+		# TODO Add try..catch
+		asyncore.loop()
+	
+	##
+	# Stops the communication server.
+	
+	def stop(self):
+		if self.__init:
+			# Only closes the socket if it was initialized first.
+			self.close()
+		# Remove socket
+		if os.path.exists(self.__sock):
+			logSys.debug("Removed socket file " + self.__sock)
+			os.remove(self.__sock)
+		logSys.debug("Socket shutdown")
+
+
+##
+# AsyncServerException is used to wrap communication exceptions.
+
+class AsyncServerException(Exception):
+	pass