- Version 0.3.0. Named it 0.3 because there is a lot of changes in this release

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@73 a942ae1a-1317-0410-a47c-b1dcaea8d605

CHANGELOG

@@ -0,0 +1,45 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.3.0)                           02/24/2005
+=============================================================
+
+ver. 0.3.0 (02/24/2005) - beta
+----------
+- Re-writting of parts of the code in order to handle several
+  log files with different rules
+- Removed sshd.py because it is no more needed
+- Fixed a bug when exiting with IP in the ban list
+- Added PID lock file
+- Improved some parts of the code
+- Added ipfw-start-rule option (thanks to Robert Edeker)
+- Added -k option which kills a currently running Fail2Ban
+
+ver. 0.1.2 (11/21/2004) - beta
+----------
+- Add ipfw and ipfwadm support. The rules are taken from
+  BlockIt. Thanks to Robert Edeker
+- Add -e option which allows to set the interface. Thanks to
+  Robert Edeker who reminded me this
+- Small code cleaning
+
+ver. 0.1.1 (10/23/2004) - beta
+----------
+- Add SIGTERM handler in order to exit nicely when in daemon
+  mode
+- Add -r option which allows to set the maximum number of
+  login failures
+- Remove the Metalog class as the log file are not so syslog
+  daemon specific
+- Rewrite log reader to be service centered. Sshd support
+  added. Match "Failed password" and "Illegal user"
+- Add /etc/fail2ban.conf configuration support
+- Code documentation
+
+
+ver. 0.1.0 (10/12/2004) - alpha
+----------
+- Initial release

MANIFEST

@@ -0,0 +1,17 @@
+README
+CHANGELOG
+TODO
+setup.cfg
+setup.py
+version.py
+fail2ban.py
+firewall/__init__.py
+firewall/firewall.py
+firewall/iptables.py
+firewall/ipfw.py
+firewall/ipfwadm.py
+logreader/__init__.py
+logreader/logreader.py
+confreader/__init__.py
+confreader/configreader.py
+config/fail2ban.conf.default

README

@@ -0,0 +1,134 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.3.0)                           02/24/2005
+=============================================================
+
+Fail2Ban scans log files like /var/log/pwdfail and bans IP
+that makes too much password failures. It updates firewall
+rules to reject the IP address. Currently iptables, ipfw and
+ipfwadm are supported. Fail2Ban can read multiple log files
+such as sshd or Apache web server ones. It needs log4py.
+
+This is my first Python program. I began learning Python for
+less than one week so please be understanding ;-) English is
+not either my mother tongue...
+
+
+More details:
+-------------
+
+Fail2Ban is rather simple. I have a home server connected to
+the Internet which runs apache, samba, sshd, ... I see in my
+logs that people are trying to log into my box using "manual"
+brute force or scripts. They try 10, 20 and sometimes more
+user/password (without success anyway). In order to
+discourage these script kiddies, I wanted that sshd refuse
+login from a specific ip after 3 password failures. After
+some google searches, I found that sshd was not able of that.
+So I search for a script or program that do it. Found
+nothing :-( So I decide to write mine and to learn Python :-)
+
+For each sections defined in the configuration file, Fail2Ban
+tries to find lines which match the failregex. Then it
+retrieves the message time using timeregex and timepattern.
+It finally gets the ip and if it has already done 3 or more
+password failures in the last banTime, the ip is banned for
+banTime using a iptable rule. After banTime, the rule is
+deleted.
+
+Sections can be freely added so it is possible to monitor
+several daemons at the same time.
+
+Runs on my server and does its job rather well :-) The idea
+is to make fail2ban usable with daemons and services that
+require a login (sshd, telnetd, ...). It should also support
+others firewalls than iptables.
+
+
+Installation:
+-------------
+
+Require: python-2.3 (http://www.python.org)
+         log4py-1.1 (http://sourceforge.net/projects/log4py)
+
+To install, just do:
+
+> tar xvfj fail2ban-0.3.0.tar.bz2
+> cd fail2ban-0.3.0
+> python setup.py install
+
+This will install Fail2Ban into /usr/lib/fail2ban. The
+fail2ban.py executable is placed into /usr/bin.
+
+Fail2Ban should now be correctly installed. Just type:
+
+> fail2ban.py -h
+
+to see if everything is alright. You can configure fail2ban
+with a config file. Copy config/fail2ban.conf.default to
+/etc/fail2ban.conf.
+
+
+Configuration:
+--------------
+
+You can configure fail2ban using the file /etc/fail2ban.conf
+or using command line options. Command line options override
+the value stored in fail2ban.conf. Here are the command line
+options:
+
+  -b         start fail2ban in background
+  -d         start fail2ban in debug mode
+  -e <INTF>  ban IP on the INTF interface
+  -c <FILE>  read configuration file FILE
+  -p <FILE>  create PID lock in FILE
+  -h         display this help message
+  -i <IP(s)> IP(s) to ignore
+  -k         kill a currently running Fail2Ban instance
+  -l <FILE>  log message in FILE
+  -r <VALUE> allow a max of VALUE password failure
+  -t <TIME>  ban IP for TIME seconds
+  -v         verbose
+  -w <FIWA>  select the firewall to use. Can be iptables,
+             ipfwadm or ipfw
+
+Contact:
+--------
+
+You need some new features, you found bugs or you just
+appreciate this program, you can contact me at :
+
+Website: http://www.sourceforge.net/projects/fail2ban
+
+Cyril Jaquier: <lostcontrol@users.sourceforge.net>
+
+
+Thanks:
+-------
+
+Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker
+
+
+License:
+--------
+
+Fail2Ban is free software; you can redistribute it
+and/or modify it under the terms of the GNU General Public
+License as published by the Free Software Foundation; either
+version 2 of the License, or (at your option) any later
+version.
+
+Fail2Ban is distributed in the hope that it will be
+useful, but WITHOUT ANY WARRANTY; without even the implied
+warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public
+License along with Fail2Ban; if not, write to the Free
+Software Foundation, Inc., 59 Temple Place, Suite 330,
+Boston, MA  02111-1307  USA

TODO

@@ -0,0 +1,14 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+ToDo
+=============================================================
+
+- cleanup fail2ban.py
+- resolve DNS with 'host' and os.popen (???)
+- improve configuration file and command line options
+  handling
+- improve installation process

config/fail2ban.conf.default

@@ -0,0 +1,96 @@
+# Fail2Ban configuration file
+#
+# $Revision$
+
+[DEFAULT]
+
+# firewall: select the firewall system to use. Actually,
+# the available options are: iptables, ipfwadm, ipfw
+firewall = iptables
+
+# ipfw-start-rule: set the first rule number used by Fail2Ban.
+# This option is only used if firewall = ipfw.
+ipfw-start-rule = 100
+
+# background: true to start fail2ban as a daemon. Output
+# is redirect to logfile.
+background = false
+
+# debug: true to enable debug mode. More verbose output
+# and bypass root user test.
+debug = false
+
+# pidlock: the path of the PID lock file. Fail2Ban must be
+# able to write into that file.
+#pidlock = /var/run/fail2ban.pid
+
+# logfile: the path of the file for logging messages of
+# fail2ban.
+logfile = /var/log/fail2ban.log
+
+# maxretry: the number of retry before IP gets ban.
+maxretry = 3
+
+# bantime: the number of seconds an IP will be ban.
+bantime = 600
+
+# ignoreip: a space separated list that contains IP which
+# will be ignore by fail2ban. Example:
+# ignoreip = 192.168.0.1 123.45.235.65
+ignoreip = 
+
+# interface: the interface name on which the IP will be
+# banned.
+interface = eth0
+
+# polltime: the number of seconds that fail2ban sleeps
+# between two iteration (check for IP to unban - parse
+# log file). 1 is a good value.
+polltime = 1
+
+# You can define a new section for each log file to check for
+# password failure. Each section has to define the following
+# options: logfile, timeregex, timepattern, failregex.
+
+[Apache]
+# enabled: is this section active ?
+enabled = true
+
+# logfile: file to monitor.
+logfile = log-test/apache
+
+# timeregex: regular expression which have to match the
+# timestamp of an Apache log event.
+# [Wed Jan 05 15:08:01 2005]
+timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+
+# timepattern: indicates the "timeregex" fields signification.
+# Notice that '%' must be espaced with '%'.
+# See syntax here: http://rgruet.free.fr/PQR2.3.html#timeModule
+timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
+
+# failregex: regular expression which have to match the
+# message written in the log file in case of password failure.
+failregex = authentication failure|user .* not found
+
+[SSH]
+# enabled: is this section active ?
+enabled = true
+
+# logfile: file to monitor.
+logfile = log-test/current
+
+# timeregex: regular expression which have to match the
+# timestamp of an Apache log event.
+# Mar  7 17:53:28
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# timepattern: indicates the "timeregex" fields signification.
+# Notice that '%' must be espaced with '%'.
+# See syntax here: http://rgruet.free.fr/PQR2.3.html#timeModule
+timepattern = %%b %%d %%H:%%M:%%S
+
+# failregex: regular expression which have to match the
+# message written in the log file in case of password failure.
+failregex = Authentication failure|Failed password
+

confreader/__init__.py

@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"

confreader/configreader.py

@@ -0,0 +1,82 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os, sys, time
+
+from ConfigParser import *
+
+class ConfigReader:
+	""" This class allow the handling of the configuration options.
+		The DEFAULT section contains the global information about
+		Fail2Ban. Each other section is for a different log file.
+	"""
+	
+	# Each optionValues entry is composed of an array with:
+	# 0 -> the type of the option
+	# 1 -> the name of the option
+	# 2 -> the default value for the option
+	optionValues = (["bool", "enabled", True],
+					["str", "logfile", "/dev/null"],
+					["str", "timeregex", ""],
+					["str", "timepattern", ""],
+					["str", "failregex", ""])
+	
+	def __init__(self, logSys, confPath):
+		self.confPath = confPath
+		self.configParser = SafeConfigParser()
+		self.logSys = logSys
+		
+	def openConf(self):
+		""" Opens the configuration file.
+		"""
+		self.configParser.read(self.confPath)
+	
+	def getSections(self):
+		""" Returns all the sections present in the configuration
+			file except the DEFAULT section.
+		"""
+		return self.configParser.sections()
+		
+	def getLogOptions(self, sec):
+		""" Gets all the options of a given section. The options
+			are defined in the optionValues list.
+		"""
+		values = dict()
+		for option in self.optionValues:
+			try:
+				if option[0] == "bool":
+					v = self.configParser.getboolean(sec, option[1])
+				elif option[0] == "int":
+					v = self.configParser.getint(sec, option[1])
+				else:
+					v = self.configParser.get(sec, option[1])
+				
+				values[option[1]] = v
+			except NoOptionError:
+				self.logSys.info("No '"+option[1]+"' defined in '"+sec+"'")
+				values[option[1]] = option[2]
+		return values
+		

fail2ban

@@ -1,171 +0,0 @@
-#!/usr/bin/env python
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import posix,sys,os
-import string,re,time
-
-from firewall.iptables import Iptables
-
-def checkForRoot():
-	""" Check for root user.
-	"""
-	uid = `posix.getuid()`
-	if uid == '0':
-		return True
-	else:
-		return False
-
-# start: To be removed
-def executeCmd(cmd):
-	return #os.system(cmd)
-
-def unBanIP(ip):
-	iptables = 'iptables -D INPUT -i eth0 -s '+ip+' -j DROP'
-	executeCmd(iptables)
-	print iptables
-
-def banIP(ip):
-	iptables = 'iptables -I INPUT 1 -i eth0 -s '+ip+' -j DROP'
-	executeCmd(iptables)
-	print iptables
-# end:
-
-def checkForUnBan(banList, currentTime, banTime):
-	""" Check for user to remove from ban list.
-	"""
-	iterBanList = banList.iteritems()
-	for i in range(len(banList)):
-		element = iterBanList.next()
-		ip = element[0]
-		btime = element[1]
-		if btime < currentTime-banTime:
-			del banList[ip]
-			unBanIP(ip)
-			print '`->', currentTime
-	return banList
-
-def checkForBan(retryList, banList, currentTime):
-	iterRetry = retryList.iteritems()
-	for i in range(len(retryList)):
-		element = iterRetry.next()
-		retry = element[1][0]
-		ip = element[0]
-		if element[1][0] > 2 and not banList.has_key(ip):
-			banList[ip] = currentTime
-			banIP(ip)
-			print '`->', currentTime
-	return banList
-
-def flushBanList(banList):
-	iterBanList = banList.iteritems()
-	for i in range(len(banList)):
-		element = iterBanList.next()
-		ip = element[0]
-		unBanIP(ip)
-
-def parseLogLine(line):
-	""" Match sshd failed password log
-	"""
-	if re.search("Failed password", line):
-		matchIP = re.search("(?:\d{1,3}\.){3}\d{1,3}", line)
-		return matchIP
-
-if __name__ == "__main__":
-	
-	# start: For object oriented testing
-	f = Iptables()
-	f.banIP('11', 1231)
-	f.banIP('13', 1232)
-	f.banIP('13', 1233)
-	f.unBanIP('11')
-	f.viewBanList()
-	f.flushBanList()
-	# end:
-	
-	if not checkForRoot():
-		print "You must be root."
-		#sys.exit(-1)
-	
-	logPath = './log-test/test'
-	banTime = 60
-	ignoreIPs = '127.0.0.1'
-	
-	lastModTime = 0
-	banList = dict()
-	while True:
-		try:
-			currentTime = time.time()
-			
-			banList = checkForUnBan(banList, currentTime, banTime)
-			
-			try:
-				pwdFailStats = os.stat(logPath)
-			except OSError:
-				print "Unable to get stat on", logPath
-				sys.exit(-1)
-			
-			if lastModTime == pwdFailStats.st_mtime:
-				time.sleep(1)
-				continue
-			
-			print logPath, 'has been modified'
-			lastModTime = pwdFailStats.st_mtime
-			
-			try:
-				pwdfail = open(logPath)
-			except OSError:
-				print "Unable to open", logPath
-				sys.exit(-1)
-			
-			retryList = dict()
-			for line in pwdfail.readlines():
-				match = parseLogLine(line)
-				if match:
-					ip = match.group()
-					date = list(time.strptime(line[0:15], "%b %d %H:%M:%S"))
-					date[0] = time.gmtime()[0]
-					unixTime = time.mktime(date)
-					if unixTime < currentTime-banTime:
-						continue
-					if re.search(ip, ignoreIPs):
-						print 'Ignore ', ip
-						continue
-					print 'Found', ip, 'at', unixTime
-					if retryList.has_key(`ip`):
-						retryList[`ip`] = (retryList[`ip`][0]+1,unixTime)
-					else:
-						retryList[`ip`] = (1,unixTime)
-		
-			pwdfail.close()
-		
-			banList = checkForBan(retryList, banList, currentTime)
-		except KeyboardInterrupt:
-			print 'Restoring iptables...'
-			flushBanList(banList)
-			print 'Exiting...'
-			sys.exit(0)

fail2ban.py

@@ -0,0 +1,527 @@
+#!/usr/bin/env python
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time, sys, getopt, os, signal, string
+from ConfigParser import *
+
+# Checks if log4py is present.
+try:
+	import log4py
+except:
+	print "log4py is needed (see README)"
+	sys.exit(-1)
+
+# Appends our own modules path
+sys.path.append('/usr/lib/fail2ban')
+
+from firewall.iptables import Iptables
+from firewall.ipfw import Ipfw
+from firewall.ipfwadm import Ipfwadm
+from logreader.logreader import LogReader
+from confreader.configreader import ConfigReader
+from version import version
+
+def usage():
+	print "Usage: fail2ban.py [OPTIONS]"
+	print
+	print "Fail2Ban v"+version+" reads log file that contains password failure report"
+	print "and bans the corresponding IP address using iptables."
+	print
+	print "  -b         start fail2ban in background"
+	print "  -d         start fail2ban in debug mode"
+	print "  -e <INTF>  ban IP on the INTF interface"
+	print "  -c <FILE>  read configuration file FILE"
+	print "  -p <FILE>  create PID lock in FILE"
+	print "  -h         display this help message"
+	print "  -i <IP(s)> IP(s) to ignore"
+	print "  -k         kill a currently running Fail2Ban instance"
+	print "  -l <FILE>  log message in FILE"
+	print "  -r <VALUE> allow a max of VALUE password failure"
+	print "  -t <TIME>  ban IP for TIME seconds"
+	print "  -v         verbose"
+	print "  -w <FIWA>  select the firewall to use. Can be iptables,"
+	print "             ipfwadm or ipfw"
+	print
+	print "Report bugs to <lostcontrol@users.sourceforge.net>"
+	sys.exit(0)
+
+def checkForRoot():
+	""" Check for root user.
+	"""
+	uid = `os.getuid()`
+	if uid == '0':
+		return True
+	else:
+		return False
+
+def createDaemon():
+	"""Detach a process from the controlling terminal and run it in the
+	background as a daemon.
+	
+	http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
+	"""
+
+	try:
+		# Fork a child process so the parent can exit.  This will return control
+		# to the command line or shell.  This is required so that the new process
+		# is guaranteed not to be a process group leader.  We have this guarantee
+		# because the process GID of the parent is inherited by the child, but
+		# the child gets a new PID, making it impossible for its PID to equal its
+		# PGID.
+		pid = os.fork()
+	except OSError, e:
+		return((e.errno, e.strerror))	 # ERROR (return a tuple)
+
+	if (pid == 0):	   # The first child.
+
+		# Next we call os.setsid() to become the session leader of this new
+		# session.  The process also becomes the process group leader of the
+		# new process group.  Since a controlling terminal is associated with a
+		# session, and this new session has not yet acquired a controlling
+		# terminal our process now has no controlling terminal.  This shouldn't
+		# fail, since we're guaranteed that the child is not a process group
+		# leader.
+		os.setsid()
+	
+		# When the first child terminates, all processes in the second child
+		# are sent a SIGHUP, so it's ignored.
+		signal.signal(signal.SIGHUP, signal.SIG_IGN)
+	
+		try:
+			# Fork a second child to prevent zombies.  Since the first child is
+			# a session leader without a controlling terminal, it's possible for
+			# it to acquire one by opening a terminal in the future.  This second
+			# fork guarantees that the child is no longer a session leader, thus
+			# preventing the daemon from ever acquiring a controlling terminal.
+			pid = os.fork()		# Fork a second child.
+		except OSError, e:
+			return((e.errno, e.strerror))  # ERROR (return a tuple)
+	
+		if (pid == 0):	  # The second child.
+			# Ensure that the daemon doesn't keep any directory in use.  Failure
+			# to do this could make a filesystem unmountable.
+			os.chdir("/")
+			# Give the child complete control over permissions.
+			os.umask(0)
+		else:
+			os._exit(0)	  # Exit parent (the first child) of the second child.
+	else:
+		os._exit(0)		 # Exit parent of the first child.
+
+	# Close all open files.  Try the system configuration variable, SC_OPEN_MAX,
+	# for the maximum number of open files to close.  If it doesn't exist, use
+	# the default value (configurable).
+	try:
+		maxfd = os.sysconf("SC_OPEN_MAX")
+	except (AttributeError, ValueError):
+		maxfd = 256	   # default maximum
+
+	for fd in range(0, maxfd):
+		try:
+			os.close(fd)
+		except OSError:   # ERROR (ignore)
+			pass
+
+	# Redirect the standard file descriptors to /dev/null.
+   	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
+	os.open("/dev/null", os.O_RDWR)		# standard output (1)
+	os.open("/dev/null", os.O_RDWR)		# standard error (2)
+
+	return(0)
+
+def sigTERMhandler(signum, frame):
+	""" Handles the TERM signal when in daemon mode in order to
+		exit properly.
+	"""
+	logSys.debug("Signal handler called with sig "+`signum`)
+	logSys.info("Restoring iptables...")
+	fireWall.flushBanList(conf["debug"])
+	logSys.info("Exiting...")
+	sys.exit(0)
+	
+def checkForPID(lockfile):
+	""" Checks for running Fail2Ban.
+	
+		Returns the current PID if Fail2Ban is running or False
+		if no instance found.
+	"""
+	try:
+		fileHandler = open(lockfile)
+		pid = fileHandler.readline()
+		return pid
+	except IOError:
+		return False
+		
+def createPID(lockfile):
+	""" Creates a PID lock file with the current PID.
+	"""
+	fileHandler = open(lockfile, mode='w')
+	pid = os.getpid()
+	fileHandler.write(`pid`+'\n')
+	fileHandler.close()
+	logSys.debug("Created PID lock ("+`pid`+") in "+lockfile)
+		
+def removePID(lockfile):
+	""" Remove PID lock.
+	"""
+	os.remove(lockfile)
+	logSys.debug("Removed PID lock "+lockfile)
+
+def killPID(pid):
+	""" Kills the process with the given PID using the
+		INT signal (same effect as <ctrl>+<c>).
+	"""
+	return os.kill(pid, 2)
+
+if __name__ == "__main__":
+	
+	# Gets an instance of log4py.
+	logSys = log4py.Logger().get_instance()
+	logSys.set_formatstring("%T %L %M")
+	
+	conf = dict()
+	conf["verbose"] = False
+	conf["background"] = False
+	conf["debug"] = False
+	conf["conffile"] = "/etc/fail2ban.conf"
+	conf["pidlock"] = "/tmp/fail2ban.pid"
+	conf["logging"] = False
+	conf["logfile"] = "/var/log/fail2ban.log"
+	conf["maxretry"] = 3
+	conf["bantime"] = 600
+	conf["ignoreip"] = ''
+	conf["interface"] = "eth0"
+	conf["firewall"] = "iptables"
+	conf["ipfw-start-rule"] = 0
+	conf["polltime"] = 1
+	
+	# Reads the command line options.
+	try:
+		optList, args = getopt.getopt(sys.argv[1:], 'hvbdkc:l:t:i:r:e:w:p:')
+	except getopt.GetoptError:
+		usage()
+	
+	# Pre-parsing of command line options for the -c option
+	for opt in optList:
+		if opt[0] == "-c":
+			conf["conffile"] = opt[1]
+	
+	# Config file
+	configParser = SafeConfigParser()
+	configParser.read(conf["conffile"])
+	
+	# background
+	try:
+		conf["background"] = configParser.getboolean("DEFAULT", "background")
+	except ValueError:
+		logSys.warn("background option should be a boolean")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("background option not in config file")
+		logSys.warn("Using default value")
+
+	# debug
+	try:
+		conf["debug"] = configParser.getboolean("DEFAULT", "debug")
+	except ValueError:
+		logSys.warn("debug option should be a boolean")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("debug option not in config file")
+		logSys.warn("Using default value")
+
+	# logfile
+	try:
+		conf["logfile"] = configParser.get("DEFAULT", "logfile")
+	except ValueError:
+		logSys.warn("logfile option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("logfile option not in config file")
+		logSys.warn("Using default value")
+		
+	# pidlock
+	try:
+		conf["pidlock"] = configParser.get("DEFAULT", "pidlock")
+	except ValueError:
+		logSys.warn("pidlock option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("pidlock option not in config file")
+		logSys.warn("Using default value")
+		
+	# maxretry
+	try:
+		conf["maxretry"] = configParser.getint("DEFAULT", "maxretry")
+	except ValueError:
+		logSys.warn("maxretry option should be an integer")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("maxretry option not in config file")
+		logSys.warn("Using default value")
+
+	# bantime
+	try:
+		conf["bantime"] = configParser.getint("DEFAULT", "bantime")
+	except ValueError:
+		logSys.warn("bantime option should be an integer")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("bantime option not in config file")
+		logSys.warn("Using default value")
+
+	# ignoreip
+	try:
+		conf["ignoreip"] = configParser.get("DEFAULT", "ignoreip")
+	except ValueError:
+		logSys.warn("ignoreip option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("ignoreip option not in config file")
+		logSys.warn("Using default value")
+		
+	# interface
+	try:
+		conf["interface"] = configParser.get("DEFAULT", "interface")
+	except ValueError:
+		logSys.warn("interface option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("interface option not in config file")
+		logSys.warn("Using default value")
+		
+	# firewall
+	try:
+		conf["firewall"] = configParser.get("DEFAULT", "firewall")
+	except ValueError:
+		logSys.warn("firewall option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("firewall option not in config file")
+		logSys.warn("Using default value")
+	
+	# ipfw-start-rule
+	try:
+		conf["ipfw-start-rule"] = configParser.getint("DEFAULT",
+													"ipfw-start-rule")
+	except ValueError:
+		logSys.warn("ipfw-start-rule option should be an integer")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("ipfw-start-rule option not in config file")
+		logSys.warn("Using default value")
+
+	# polltime
+	try:
+		conf["polltime"] = configParser.getint("DEFAULT", "polltime")
+	except ValueError:
+		logSys.warn("polltime option should be an integer")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("polltime option not in config file")
+		logSys.warn("Using default value")
+	
+	for opt in optList:
+		if opt[0] == "-h":
+			usage()
+		if opt[0] == "-v":
+			conf["verbose"] = True
+		if opt[0] == "-b":
+			conf["background"] = True
+		if opt[0] == "-d":
+			conf["debug"] = True
+		if opt[0] == "-e":
+			conf["interface"] = opt[1]
+		if opt[0] == "-l":
+			conf["logging"] = True
+			conf["logfile"] = opt[1]
+		if opt[0] == "-t":
+			try:
+				conf["bantime"] = int(opt[1])
+			except ValueError:
+				logSys.warn("banTime must be an integer")
+				logSys.warn("Using default value")
+		if opt[0] == "-i":
+			conf["ignoreip"] = opt[1]
+		if opt[0] == "-r":
+			conf["retrymax"] = int(opt[1])
+		if opt[0] == "-w":
+			conf["firewall"] = opt[1]
+		if opt[0] == "-p":
+			conf["pidlock"] = opt[1]
+		if opt[0] == "-k":
+			pid = checkForPID(conf["pidlock"])
+			if pid:
+				killPID(int(pid))
+				logSys.warn("Killed Fail2Ban with PID "+pid)
+				sys.exit(0)
+			else:
+				logSys.error("No running Fail2Ban found")
+				sys.exit(-1)
+
+	# Process some options
+	for c in conf:
+		if c == "verbose" and conf[c]:
+			logSys.set_loglevel(log4py.LOGLEVEL_VERBOSE)
+		elif c == "debug" and conf[c]:
+			logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
+			logSys.set_formatstring(log4py.FMT_DEBUG)
+		elif c == "background" and conf[c]:
+			retCode = createDaemon()
+			signal.signal(signal.SIGTERM, sigTERMhandler)
+			logSys.set_target(conf["logfile"])
+			if retCode != 0:
+				logSys.error("Unable to start daemon")
+				sys.exit(-1)
+		elif c == "logging" and conf[c]:
+			try:
+				open(conf["logfile"], "a")
+				logSys.set_target(conf["logfile"])
+			except IOError:
+				logSys.warn("Unable to log to "+conf["logfile"])
+				logSys.warn("Using default output for logging")
+		elif c == "ignoreip":
+			ignoreIPList = conf[c].split(' ')
+		elif c == "firewall":
+			conf[c] = string.lower(conf[c])
+			if conf[c] == "ipfw":
+				fireWallName = "Ipfw"
+			elif conf[c] == "ipfwadm":
+				fireWallName = "Ipfwadm"
+			else:
+				fireWallName = "Iptables"
+	
+	# Checks for root user. This is necessary because log files
+	# are owned by root and firewall needs root access.
+	if not checkForRoot():
+		logSys.error("You must be root")
+		if not conf["debug"]:
+			sys.exit(-1)
+			
+	# Checks that no instance of Fail2Ban is currently running.
+	pid = checkForPID(conf["pidlock"])
+	if pid:
+		logSys.error("Fail2Ban already running with PID "+pid)
+		sys.exit(-1)
+	else:
+		createPID(conf["pidlock"])
+	
+	logSys.debug("ConfFile is "+conf["conffile"])
+	logSys.debug("BanTime is "+`conf["bantime"]`)
+	logSys.debug("retryAllowed is "+`conf["maxretry"]`)
+	
+	# Reads the config file and create a LogReader instance for
+	# each log file to check.
+	confReader = ConfigReader(logSys, conf["conffile"]);
+	confReader.openConf()
+	logList = list()
+	for t in confReader.getSections():
+		l = confReader.getLogOptions(t)
+		if l["enabled"]:
+			lObj = LogReader(logSys, l["logfile"], l["timeregex"],
+							l["timepattern"], l["failregex"], conf["bantime"])
+			lObj.setName(t)
+			logList.append(lObj)
+	
+	# Creates one instance of Iptables (thanks to Pyhton dynamic
+	# features).
+	fireWallObj = eval(fireWallName)
+	fireWall = fireWallObj(conf["bantime"], logSys, conf["interface"])
+	
+	# IPFW needs rules number. The configuration option "ipfw-start-rule"
+	# defines the first rule number used by Fail2Ban.
+	if fireWallName == "Ipfw":
+		fireWall.setCrtRuleNbr(conf["ipfw-start-rule"])
+	
+	# We add 127.0.0.1 to the ignore list has we do not want
+	# to be ban ourself.
+	for element in logList:
+		element.addIgnoreIP("127.0.0.1")
+	while len(ignoreIPList) > 0:
+		ip = ignoreIPList.pop()
+		for element in logList:
+			element.addIgnoreIP(ip)
+	
+	logSys.warn("Fail2Ban v"+version+" is running")
+	# Main loop
+	while True:
+		try:
+			sys.stdout.flush()
+			sys.stderr.flush()
+			
+			# Checks if some IP have to be remove from ban
+			# list.
+			fireWall.checkForUnBan(conf["debug"])
+			
+			# If the log file has not been modified since the
+			# last time, we sleep for 1 second. This is active
+			# polling so not very effective.
+			modList = list()
+			for element in logList:
+				if element.isModified():
+					modList.append(element)
+			
+			if len(modList) == 0:
+				time.sleep(conf["polltime"])
+				continue
+			
+			# Gets the failure list from the log file. For a given IP,
+			# takes only the service which has the most password failures.
+			failList = dict()
+			for element in modList:
+				e = element.getFailures()
+				iter = e.iterkeys()
+				for i in range(len(e)):
+					key = iter.next()
+					if failList.has_key(key):
+						if failList[key][0] < e[key][0]:
+							failList[key] = (e[key][0], e[key][1],
+											element.getName())
+					else:
+						failList[key] = (e[key][0], e[key][1],
+										element.getName())
+				
+			
+			# We iterate the failure list and ban IP that make
+			# *retryAllowed* login failures.
+			iterFailList = failList.iteritems()
+			for i in range(len(failList)):
+				element = iterFailList.next()
+				if element[1][0] >= conf["maxretry"]:
+					logSys.warn(`element[1][2]`+": "+element[0]+" has "+
+								`element[1][0]`+" login failure(s). Banned.")
+					fireWall.addBanIP(element[0], conf["debug"])
+			
+		except KeyboardInterrupt:
+			# When the user press <ctrl>+<c> we flush the ban list
+			# and exit nicely.
+			logSys.info("Restoring firewall rules...")
+			fireWall.flushBanList(conf["debug"])
+			removePID(conf["pidlock"])
+			logSys.warn("Exiting...")
+			sys.exit(0)

firewall/firewall.py

@@ -24,29 +24,81 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
+import time, os
+
 class Firewall:
+	""" Manages the ban list and executes the command that ban
+		the IP.
+	"""
 	
 	banList = dict()
 	
-	def addBanIP(self, ip, time):
-		self.banList[ip] = time
+	def __init__(self, banTime, logSys, interface):
+		self.banTime = banTime
+		self.logSys = logSys
+		self.interface = interface
 	
-	def delBanIP(self, ip):
-		del self.banList[ip]
+	def addBanIP(self, ip, debug):
+		""" Bans an IP.
+		"""
+		if not self.inBanList(ip):
+			self.logSys.info("Ban "+ip)
+			self.banList[ip] = time.time()
+			self.__executeCmd(self.banIP(ip), debug)
+		else:
+			self.logSys.info(ip+" already in ban list")
 	
-	def flushBanList(self):
-		iterBanList = self.banList.iteritems()
+	def delBanIP(self, ip, debug):
+		""" Unban an IP.
+		"""
+		if self.inBanList(ip):
+			self.logSys.info("Unban "+ip)
+			del self.banList[ip]
+			self.__executeCmd(self.unBanIP(ip), debug)
+		else:
+			self.logSys.info(ip+" not in ban list")
+	
+	def inBanList(self, ip):
+		""" Checks if IP is in ban list.
+		"""
+		return self.banList.has_key(ip)
+	
+	def checkForUnBan(self, debug):
+		""" Check for IP to remove from ban list.
+		"""
+		banListTemp = self.banList.copy()
+		iterBanList = banListTemp.iteritems()
 		for i in range(len(self.banList)):
 			element = iterBanList.next()
 			ip = element[0]
-			self.unBanIP(ip)
+			btime = element[1]
+			if btime < time.time()-self.banTime:
+				self.delBanIP(ip, debug)
 	
-	def executeCmd(self, cmd):
-		return #os.system(cmd)
+	def flushBanList(self, debug):
+		""" Flushes the ban list and of course the firewall rules.
+			Called when fail2ban exits.
+		"""
+		banListTemp = self.banList.copy()
+		iterBanList = banListTemp.iteritems()
+		for i in range(len(self.banList)):
+			element = iterBanList.next()
+			ip = element[0]
+			self.delBanIP(ip, debug)
+	
+	def __executeCmd(self, cmd, debug):
+		""" Executes an OS command.
+		"""
+		self.logSys.debug(cmd)
+		if not debug:
+			return os.system(cmd)
+		else:
+			return None
 		
 	def viewBanList(self):
+		""" Prints the ban list on screen. Usefull for debugging.
+		"""
 		iterBanList = self.banList.iteritems()
 		for i in range(len(self.banList)):
 			element = iterBanList.next()
 			print element
-		

firewall/ipfw.py

@@ -0,0 +1,72 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os
+
+from firewall import Firewall
+
+class Ipfw(Firewall):
+	""" This class contains specific methods and variables for the
+		iptables firewall. Must implements the 'abstracts' methods
+		banIP(ip) and unBanIP(ip).
+		
+		Must adds abstract methods definition:
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
+	"""
+	
+	crtRuleNbr = 0
+	
+	def getCrtRuleNbr():
+		""" Gets the current rule number.
+		"""
+		return self.crtRuleNbr
+		
+	def setCrtRuleNbr(self, value):
+		""" Sets the current rule number.
+		"""
+		self.crtRuleNbr = value
+	
+	def banIP(self, ip):
+		""" Returns query to ban IP.
+		"""
+		query = "ipfw -q add "+`self.crtRuleNbr`+" deny ip from "+ip+" to any"
+		self.crtRuleNbr = self.crtRuleNbr + 1
+		return query
+	
+	def unBanIP(self, ip):
+		""" Returns query to unban IP.
+		"""
+		ruleNbr = str(self.__findRuleNumber(ip))
+		query = "ipfw -q delete "+ruleNbr
+		return query
+		
+	def __findRuleNumber(self, ip):
+		""" Uses shell commands in order to find the rule
+			number we want to delete.
+		"""
+		output = os.popen("ipfw list|grep \"from "+ip+" to\"|awk '{print $1}'",
+						  "r");
+		return output.read()

firewall/ipfwadm.py

@@ -0,0 +1,48 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from firewall import Firewall
+
+class Ipfwadm(Firewall):
+	""" This class contains specific methods and variables for the
+		iptables firewall. Must implements the 'abstracts' methods
+		banIP(ip) and unBanIP(ip).
+		
+		Must adds abstract methods definition:
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
+	"""
+	
+	def banIP(self, ip):
+		""" Returns query to ban IP.
+		"""
+		query = "ipfwadm -I -a deny -W "+self.interface+" -S "+ip
+		return query
+	
+	def unBanIP(self, ip):
+		""" Returns query to unban IP.
+		"""
+		query = "ipfwadm -I -d deny -W "+self.interface+" -S "+ip
+		return query

firewall/iptables.py

@@ -27,15 +27,22 @@ __license__ = "GPL"
 from firewall import Firewall
 
 class Iptables(Firewall):
+	""" This class contains specific methods and variables for the
+		iptables firewall. Must implements the 'abstracts' methods
+		banIP(ip) and unBanIP(ip).
+		
+		Must adds abstract methods definition:
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
+	"""
 	
-	def banIP(self, ip, time):
-		query = 'iptables -I INPUT 1 -i eth0 -s '+str(ip)+' -j DROP'
-		self.addBanIP(ip, time)
-		self.executeCmd(query)
-		print query
+	def banIP(self, ip):
+		""" Returns query to ban IP.
+		"""
+		query = "iptables -I INPUT 1 -i "+self.interface+" -s "+ip+" -j DROP"
+		return query
 	
 	def unBanIP(self, ip):
-		query = 'iptables -D INPUT -i eth0 -s '+str(ip)+' -j DROP'
-		self.delBanIP(ip)
-		self.executeCmd(query)
-		print query
+		""" Returns query to unban IP.
+		"""
+		query = "iptables -D INPUT -i "+self.interface+" -s "+ip+" -j DROP"
+		return query

log-test/apache

@@ -0,0 +1,102 @@
+[Mon Jan 03 05:02:15 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:21 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/\xe0
+[Mon Jan 03 05:02:23 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msdac
+[Mon Jan 03 05:02:23 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msdac
+[Mon Jan 03 05:02:24 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/PBServer
+[Mon Jan 03 05:02:24 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/PBServer
+[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/Rpc
+[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/Rpc
+[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/samples
+[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/samples
+[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts..\xc1\x9c..
+[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:32 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:32 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:34 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:34 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:39 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:39 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 11:08:29 2005] [error] [client 128.178.150.127] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Mon Jan 03 20:08:52 2005] [error] [client 83.76.202.195] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:19:50 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:19:55 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:01 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:05 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:08 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:12 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:16 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:22 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:26 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:28 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:38 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 20:54:59 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 20:55:04 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 20:55:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 21:34:29 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 21:34:32 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 00:17:41 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 00:18:03 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 00:18:12 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:24:38 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:24:40 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:24:46 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:24:48 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:25:58 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:26:34 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:26:37 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 10:13:02 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 10:13:07 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 10:13:10 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 10:17:07 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:41:40 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:41:45 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:41:47 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:41:51 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:55:30 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:03:44 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:03:48 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:03:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:03:57 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:06:45 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Mar 05 15:07:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Jan 05 15:08:01 2005] [error] [client 192.168.0.128] user  not found: /phpinfo
+[Wed Jan 05 15:10:45 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/css/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
+[Wed Jan 05 15:10:45 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/images/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
+[Wed Jan 05 15:10:45 2005] [error] [client 192.168.0.128] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:11:09 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 05 15:11:10 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 06 15:11:11 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 06 15:11:13 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 06 15:11:14 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 05 15:11:15 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/css/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
+[Wed Jan 05 15:11:15 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/images/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
+[Wed Jan 05 15:11:15 2005] [error] [client 192.168.0.128] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:12:32 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:48 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:51 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:54 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:56 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:59 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:14:20 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:14:24 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:14:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:14:34 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Mar 05 15:08:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 05 15:09:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch

log-test/current

@@ -1,4 +1,5 @@
-                - Last output repeated 2 times -
-Oct  7 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
-Oct  7 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
-Oct  7 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
+Jan  7 17:53:15 [sshd] (pam_unix) 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.220.137.36  user=kevin
+Jan  7 17:53:26 [sshd] (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.220.137.36  user=kevin
+Mar  7 17:53:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
+Mar  7 17:55:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36

log-test/test

@@ -425,7 +425,8 @@ Oct  7 01:03:12 [sshd] Failed password for illegal user tata from 128.178.164.52
                 - Last output repeated 2 times -
 Oct  7 01:03:20 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37187 ssh2
                 - Last output repeated 2 times -
-Oct  8 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
-Oct  8 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
-Oct  8 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
-Oct  9 21:54:11 yellow sshd[16069]: Failed password for cyril from 212.41.79.210 port 29404 ssh2
+Nov 14 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
+Nov 14 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
+Nov 14 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
+Nov 15 11:12:11 yellow sshd[16069]: Failed password for cyril from 212.41.79.210 port 29404 ssh2
+Nov 15 21:54:11 yellow sshd[16069]: Illegal user for cyril from 212.41.79.210 port 29404 ssh2

logreader/logreader.py

@@ -24,44 +24,137 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import os, sys
+import os, sys, time, re
 
 class LogReader:
+	""" Reads a log file and reports information about IP that make password
+		failure, bad user or anything else that is considered as doubtful login
+		attempt.	
+	"""
 	
-	def __init__(self, logPath, findTime = 3600):
+	def __init__(self, logSys, logPath, timeregex, timepattern, failregex, findTime = 3600):
 		self.logPath = logPath
+		self.timeregex = timeregex
+		self.timepattern = timepattern
+		self.failregex = failregex
 		self.findTime = findTime
 		self.ignoreIpList = []
 		self.lastModTime = 0
+		self.logSys = logSys
+		
+	def setName(self, name):
+		""" Sets the name of the log reader.
+		"""
+		self.name = name
+		
+	def getName(self):
+		""" Gets the name of the log reader.
+		"""
+		return self.name
 	
 	def addIgnoreIP(self, ip):
+		""" Adds an IP to the ignore list.
+		"""
+		self.logSys.debug("Add "+ip+" to ignore list")
 		self.ignoreIpList.append(ip)
 		
 	def inIgnoreIPList(self, ip):
+		""" Checks if IP is in the ignore list.
+		"""
 		return ip in self.ignoreIpList
 	
 	def openLogFile(self):
+		""" Opens the log file specified on init.
+		"""
 		try:
 			fileHandler = open(self.logPath)
 		except OSError:
-			print "Unable to open", self.logPath
+			self.logSys.error("Unable to open "+self.logPath)
 			sys.exit(-1)
 		return fileHandler
 		
 	def isModified(self):
+		""" Checks if the log file has been modified using os.stat().
+		"""
 		try:
 			logStats = os.stat(self.logPath)
 		except OSError:
-			print "Unable to get stat on", logPath
+			self.logSys.error("Unable to get stat on "+self.logPath)
 			sys.exit(-1)
 		
 		if self.lastModTime == logStats.st_mtime:
 			return False
 		else:
-			print self.logPath, 'has been modified'
+			self.logSys.debug(self.logPath+" has been modified")
 			self.lastModTime = logStats.st_mtime
 			return True
 	
-	def getPwdFailure(self):
-		failList = self.getFailInfo(self.findTime)
-		return failList
+	def getFailures(self):
+		""" Gets all the failure in the log file which are
+			newer than time.time()-self.findTime.
+			
+			Returns a dict with the IP, the number of failure
+			and the latest failure time.
+		"""
+		ipList = dict()
+		logFile = self.openLogFile()
+		for line in logFile.readlines():
+			value = self.findFailure(line)
+			if value:
+				ip = value[0]
+				unixTime = value[1]
+				if unixTime < time.time()-self.findTime:
+					continue
+				if self.inIgnoreIPList(ip):
+					self.logSys.debug("Ignore "+ip)
+					continue
+				self.logSys.debug("Found "+ip)
+				if ipList.has_key(ip):
+					ipList[ip] = (ipList[ip][0]+1, unixTime)
+				else:
+					ipList[ip] = (1, unixTime)
+		logFile.close()
+		return ipList
+
+	def findFailure(self, line):
+		""" Finds the failure in line. Uses the failregex pattern
+			to find it and timeregex in order to find the logging
+			time.
+			
+			Returns a dict with IP and timestamp.
+		"""
+		match = self.matchLine(self.failregex, line)
+		if match:
+			timeMatch = self.matchLine(self.timeregex, match.string)
+			if timeMatch:
+				date = self.getUnixTime(timeMatch.group())
+				ipMatch = self.matchAddress(match.string)
+				if ipMatch:
+					ip = ipMatch.group()
+					return [ip, date]
+		return None
+		
+	def getUnixTime(self, value):
+		""" Returns the Unix timestamp of the given value.
+			Pattern should describe the date construction of
+			value.
+		"""
+		date = list(time.strptime(value, self.timepattern))
+		if date[0] < 2000:
+			date[0] = time.gmtime()[0]
+		unixTime = time.mktime(date)
+		return unixTime
+	
+	def matchLine(self, pattern, line):
+		""" Checks if the line contains a pattern.
+			
+			Return a match object.
+		"""
+		return re.search(pattern, line)
+		
+	def matchAddress(self, line):
+		""" Return a match on the IP address present in
+			line.		
+		"""
+		return self.matchLine("(?:\d{1,3}\.){3}\d{1,3}", line)
+	

logreader/metalog.py

@@ -1,65 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import re, time
-
-from logreader import LogReader
-
-class Metalog(LogReader):
-	
-	def getFailInfo(self, findTime):
-		ipList = dict()
-		logFile = self.openLogFile()
-		for line in logFile.readlines():
-			match = self.parseLogLine(line)
-			if match:
-				ip = match[0]
-				unixTime = match[1]
-				if unixTime < time.time()-self.findTime:
-					continue
-				if self.inIgnoreIPList(ip):
-					print 'Ignore', ip
-					continue
-				print 'Found', ip, 'at', unixTime
-				if ipList.has_key(ip):
-					ipList[ip] = (ipList[ip][0]+1, unixTime)
-				else:
-					ipList[ip] = (1, unixTime)
-		logFile.close()
-		return ipList
-	
-	def parseLogLine(self, line):
-		""" Match sshd failed password log
-		"""
-		if re.search("Failed password", line):
-			matchIP = re.search("(?:\d{1,3}\.){3}\d{1,3}", line)
-			if matchIP:
-				date = list(time.strptime(line[0:15], "%b %d %H:%M:%S"))
-				date[0] = time.gmtime()[0]
-				unixTime = time.mktime(date)
-				return [matchIP.group(), unixTime]
-			else:
-				return False

setup.cfg

@@ -0,0 +1,5 @@
+[install]
+install-purelib=/usr/lib/fail2ban
+
+[sdist]
+formats=bztar

setup.py

@@ -0,0 +1,42 @@
+#!/usr/bin/env python
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from distutils.core import setup
+from version import version
+
+setup(
+        name = "fail2ban",
+        version = version,
+        description = "Ban IPs that make too much password failure",
+        author = "Cyril Jaquier",
+        author_email = "lostcontrol@users.sourceforge.net",
+        url = "http://www.sourceforge.net/projects/fail2ban",
+        scripts = ['fail2ban.py'],
+        py_modules = ['version'],
+        packages = ['firewall', 'logreader', 'confreader']
+)

version.py

@@ -0,0 +1,27 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+version = "0.3.0"