* 'bf+enh/cyrus-imap' of https://github.com/yarikoptic/fail2ban:
ENH: cyrus-imap -- catch also 'user not found' attempts
BF: cyrus-imaps -- catch also for secured daemons
Conflicts:
ChangeLog
Added Vagrantfile with Ubuntu Trusty64 configured.
Both VMs are sharing the same network 192.168.200.0/24. Options for using
saltstack are pre-configured but commented out.
VM "secure" can be used for testing fail2ban code.
VM "attacker" can be used to perform attack against our "secure" VM.
Vagrant will provide you with a default devel box where code
can be tested. No further arguments like "On my system it is
running. Has to be yours".
I choosed a Debian wheezy based box with saltstack installed.
Wheezy because it is stable and ships mostly older packages
than other distros. Saltstack is used for pre-installing
packeges when bringing up our box. So any requierements from
fail2ban can be saved here and shipped out with git.
You can add multiple other boxes. For example adding CentOS
to check if the tests are passing also there.
* 'ainfo-copy' of https://github.com/kwirk/fail2ban:
TST: actions modifying aInfo test more robust
TST: Test for actions modifying (un)ban aInfo
BF: aInfo could be modified by actions, causing unexpected behaviour
* 'sebres-strptime-bug' of https://github.com/kwirk/fail2ban:
DOC: Tweak ChangeLog and THANKS
DOC: Update docs in reference to time zone related fix
TST: Fix tests due to @sebres fix and based from gh-349 reverts
strptime bug fix: if gmtoff is None we have 1 hour increment of time (through utctimetuple), compare: >>>> datetime.datetime.fromtimestamp(time.mktime(datetime.datetime.now().timetuple())).strftime("%Y-%m-%d %H:%M:%S") '2014-04-29 17:26:31' >>>> datetime.datetime.fromtimestamp(time.mktime(datetime.datetime.now().utctimetuple())).strftime("%Y-%m-%d %H:%M:%S") '2014-04-29 18:26:37'
Conflicts:
ChangeLog
* enh/oracle_msg_server:
ENH: make oracleims failregex better anchored (more explicit)
Update oracleims.conf to be 'less greedy'
Update THANKS
Update jail.conf for oracleims filter.
Create test for oracleims filter
Create oracleims.conf in filter.d for new filter
This assumes that the protocol is always a string, which it always is, and that the other four fields in the "tr" are always numeric (which they always are). See port_access documentation at http://docs.oracle.com/cd/E19563-01/819-4428/bgaur/index.html
This test file shows configuration information for the application, three log lines that DO match the pattern, and one log line that does NOT match the pattern (the first one).
* 'recursive-tag-fix' of https://github.com/kwirk/fail2ban:
ENH: explicitly define tags which should be escaped
DOC: ChangeLog update for recursive tag bug fix
BF: Tags not fully recursively substituted
Conflicts:
ChangeLog -- kept all as is
* 'master' of github.com:fail2ban/fail2ban:
ENH: Match non "Bye Bye" for sshd locked accounts failregex
Even stricter monit regex, now covers entire line
Tidy up filter.d/monit.conf, make regex more complete. Add ChangeLog / THANKS entry. Add test cases.
ENH: Move traceback formatter to from tests.utils to helpers
Block brute-force attempts against the Monit gui
* 'database-persistent-bans' of https://github.com/kwirk/fail2ban:
BF: bantime < 0 database should return all bans, as they are persistent
Conflicts:
ChangeLog - kept all ;)
Note: recursive check ignored for "matches", as tags would be escaped,
and hence shouldn't match "<%s>" as "<ip>" would become "\<ip\>". This
therefore maintains advantage of delayed call for {ip,jail,}matches.
Fixes gh-713
(a) use static-network-up, since it is more generic than the started networking event
(b) do not hook into network deconfiguration to speed up shutdown
(c) expect fork, per the use of the "-f" option
(d) use a variable for the run directory to make changing it simpler
(e) handle the situation of a left over socket file
(f) use the -f option to be able to track the PID
The reason is that internally it does round, so even 1.005 then would not
be equal to 1. Making it spaces==1 should be sufficient for up to 1.05
i.e. we would allow 50ms "drift"
No longer directly exec the server, do not remove the PID file because it is unnecessary to do so. No longer respawns because Upstart can not track the process with the starter command.
As documented at
http://nginx.org/en/docs/http/server_names.html#miscellaneous_names "If
no server_name is defined in a server block then nginx uses the empty
name as the server name." This regex change allows us to match error
output for such a configuration.
The log line added to the tests was lifted from our logs verbatim; it
did not match without the patched regex.
Signed-off-by: Yung-Chin Oei <yungchin@yungchin.nl>
* commit '0.9.0-48-gabcab00':
Fix a few typos
BF: Ignored IPs no longer being banned from database on restart
ENH: Add iptables and firewalld to "After" for systemd service file.
DOC: Add database settings for fail2ban.conf to jail.conf(5) man page
TST: Skip badips.py test is no network option set
TST: Skip SYSLOG log target test if '/dev/log' not present
BF: fail2ban.conf reader expected "int" type for `loglevel`
DOC: Update ChangeLog fixes
BF: Handle case when no sqlite library is available for the database
* commit '0.9.0-654-gc8694d8':
Add news entry for 0.9.0
use upstream jail.conf, paths are now defined in paths-debian.conf
enable systemd integration
remove /var/lib/fail2ban/fail2ban.sqlite3 when purging
move renamed conffiles in maintscripts
refresh patch deb_manpages_reportbug
remove changeset_d4f6ca4f8531f332bcb7ce3a89102f60afaaa08e.diff, applied upstream
Update debian packaging to dh compat 9
Conflicts:
debian/jail.conf -- removed also in this branch
debian/postinst -- took changes for courier renames + adjusted version to 0.9.0-1~
debian/postrm
debian/preinst
* commit '0.9.0-37-gdeb5924': (449 commits)
Fix typo in comment
DOC: note to have release tagged by a signed/annotated tag
DOC: ChangeLog for gh-652
Add a --print-all-matched option.
DOC: Add DEVELOP documentation on use of pyflakes
TST: Unused import in test_smtp
DOC: Document recent changes
DOC: Document recent fixes
DOC: syntax
DOC: new ChangeLog header
TST: Fix test failing due to wrapping of long subject lines v2
TST: Fix test failing due to wrapping of log subject lines
BF: fail2ban-regex mix of tabs and spaces
Changelog entry
BF(PY2.4,2.5): provide bin() function (introduced in 2.6)
BF: python 2.4 and 2.5 compatibility -- no "except ... as ..." yet
BF: Remove unused imports and variables.
BF: badips.py action methods not static due to use of self._logSys
BF: FilterSystemd.formatJournalEntry is a classmethod, not staticmethod
BF: Remove "/var/run/fail2ban" from setup.py
...
* commit '0.8.13-5-gdfac2f7':
Changelog entry
BF(PY2.4,2.5): provide bin() function (introduced in 2.6)
BF: python 2.4 and 2.5 compatibility -- no "except ... as ..." yet
* tag '0.8.13': (48 commits)
DOC: DEVELOP release note changes
PKG: version release
PKG: include nagios filter/log
DOC/ENH: update man pages for release
ENH: pull asterisk filter change to support syslog from 0.9 branch
Sanity-check print-all-* vs print-no-* options.
Add --print-no-{missed,ignored} and restore -all.
Only remember log lines we need to print later.
Fix the --print-all-{missed,ignored} options.
ENH: sendmail-reject for all smtp ports.
ENH: more sendmail-reject filter items thanks to fab23
BF: move to right location
ENH: rename sendmail-spam to sendmail-reject
BF: email address as arg1 in sendmail filters
ENH: wider regex for RBL and sendmail-spam
DOC: Add reference to action argument values which contain ","
BF: add jail.conf definitions for sendmail* filters
ENH: add filter for sendmail-{auth,spam}. Closes gh-20
ENH: Allow 255.255.255.0 style mask for ignoreip
BF: Fix complain action for multiple recipients and misplaced ";"
...
As the contents of /var/run are lost on reboot, it doesn't make sense to
install it. This is already patched out in some distros (gentoo, arch,
debian, gentoo, …) as causes a headache with package managment tracking
installed files.
Includes:
- documentation to new format and use of properties
- change isActive->is_active as former no longer documented for
python3, and later introduction and documented in python2.6
- status formatter in beautifier somewhat more automatically
formatted; no changes are required for additional status elements
- JailThread now set to active within `start` method, complimenting
`stop` method
Conflicts:
ChangeLog
Spelling correction of 0.8.13 fixed in master
config/jail.conf
Added nagios and duplicate php-url removal in master
Just nagios added, duplicate not issue in 0.9
* tag '0.8.12': (177 commits)
DOC: version and release date to 0.8.12 on 2014-01-22
DOC/ENH: update man pages for release
DOC: ChangeLog dateing and normalisation
ENH: continue with rest of fail2ban config even if errors. Closes gh-585
DOC: ChangeLog. Note incompatible changes and group new filters and actions under New Features
BF: complete MANIFEST
DOC: note in man page about "last message repeated" syslog compression. Closes Debian bug #620364
DOC: credits for action.d/badips
BF: dovecot filters, session characters and order of session/tls in log messages
BF Dovecot auth failures
Matching any Exim authentication name
Update exim
ENH: add improper command pipelining postfix filter
Support ACL-events without AccountID. Typically happens when a registration from an unknown domain is performed.
BF: Add ejabberd-auth to jail.conf
ENH: ejabberd filter
TST: for tag substition, multiple on same line
DOC: spelling + GPL2+ for license
DOC: fixing formatting in the section names of the manpage - \fB to return into bold
DOC: some typos, fixes from Vincent Lefevre
...
Python actions are imported from action.d config folder, which have .py
file extension. This imports and creates an instance of the Action class
(Action can be a variable that points to a class of another name).
fail2ban.server.action.ActionBase is a base class which can be inherited
from or as a minimum has a subclass hook which is used to ensure any
imported actions implements the methods required.
All calls to the execAction are also wrapped in a try except such that
any errors won't cripple the jail.
Action is renamed CommandAction, to clearly distinguish it from other
actions.
Include is an example smtp.py python action for sending emails via smtp.
This is work in progress, as looking to add the <matches> and whois
elements, and also SSL/TLS support.
Clean up ChangeLog and README.md to reflect these changes.
Remove credit from developers for individual changes to be consistent
with the 0.8.12 ChangeLog. Update summary and priority of items listed
in ChangeLog.
Previously only the last line of the match was being saved, not all
lines involved in matching.
Log lines are now broken into 3 part tuple, with the line pre-datetime,
the datetime, and post-datetime. Allows reformation of full line, but
also use of the line without the datetime present.
Attempting to use the term "tupleLine(s)" where possible, to avoid
confusion with normal read lines.
May also wish to consider that regexs could be made to capture more
lines of interest if some form of unique reference is available. This
may allow more lines of interest to be captured, which may not be picked
up by the traditional "grep <ip>" approach i.e. ones which do not have
the ip address in.
This also simplified the fail2ban-regex statistics for missed lines.
Also resolved bug with missed lines time extracted for debuggex having
some lines present which were captured in a multiline regex.
Also resolved independent issue with ignored line check including the
datetime, which raised assertion error in the rare case the datetime
matched the ignore regex, and the rest of line only matched a failregex
* tag '0.8.11':
DOC: finalise 0.8.11 release
BF/ENH: DoS resistant roundcube-auth with test cases and more variation in IMAP error given
BF: exim filter to be DoS resistant
ENH: DoS resistant dropbear filter
BF/ENH: asterisk connection ID is a hex not decimal number. Add "Rejecting unknown SIP connection from <HOST>" regex thanks to Jonathan Lanning
ENH: apache-2.4 message IDs for filter apache-noscript
TST: change source URL
ENH: apache-overflow filter to have HTTP-2.4 message IDs and test samples
ENH: apache-overflows - more detail on "request failed: URI too long (longer than %d)" with test case
TST: end of json in sshd sample log
TST: fix space in sshd sample log
TST: test case that shows injection
DOC: more on filter regexes - DEVELOP
DOC: filter regex debugging
BF: anchor introduced nginx-http-auth at the end
* commit '0.8.11.pre1-29-gccd2657': (363 commits)
DOC: minor typos in ChangeLog
DOC: adding DEV Notes for for non-greedy matchin within sshd.conf
BF: disallow exploiting of non-greedy .* in previous fix by providing too long rhost -- do not impose length limits for user-provided input
BF: fixing injection for OpenSSH 6.3 -- making .* before <HOST> non-greedy
Changelog for prior changes (gen_buildbots)
ENH: condense asterisk regexs for speed
BF: missed action in nginx-http-auth
ENH: add filter.d/nginx-http-auth. Partially forfills #405
ENH: regenerated config/filter.d/apache-badbots.conf
NF: gen_badbots script to (re)generate/update config/filter.d/apache-badbots.conf
DOC: keeping Changelog release-phrases uniform, simplified intro, unified
DOC: Untabifying and reindenting a bit ChangeLog
DOC: few more links for DEVELOP
BF: fix dovecot filter for newer failure message. Closes Debian bug #709324
BF: fix to filter.d/wuftp to support pam authentication - Debian bug #665925
Add Fedora git repo of fail2ban package to DEVELOP
firewalld-0.3.8 release that support --remove-rules out so documenting this.
BF: remove duplication definition secion in webmin-auth
DOC: alter release notes a bit more and versions in README.md
BF/DOC: fix hopefully final MANIFEST and release instructions
...
ISO8601 and %z based timezones now fully supported.
Restructured so log lines are also only parsed once and return
a unixtime and a pattern match.
Fix all test cases to adjust for the change in return value.
Multi line regex currently only flags on last line, and other lines must
be labelled as not matched.
TODO: Create extension to fail JSON data to allow tying together of
multiple lines
* commit '0.8.10-31-g1ab0f0f': (24 commits)
BF/ENH: Incorrect authentication data doesn't need tailier so that's optional. Also gained log entry for Unrouteable address
ENH: readibility thanks to Yaroslav
DOC: Changelog for fail2ban-regex RF
DOC: Changelog for asterisk hardening
ENH: fail2ban-regex -- add specification of loglevels to enable
RF: reworked -regex cmdline tool to use optparse, some unification and enhancement of outputs
ENH: 'heavydebug' level == 5 for even more debugging in tricky cases
ENH: asterisk -- use \S instead of [^:] + prefix failregex with ^\[
BF: missed a space
BF: [SSL-out] is optional in assp
ENH: regex hardening on assp
ENH: anchor a bit mor. Use \d and \w where possible. Escape a literal .
TST: attempts at injection with username=rhost=1.2.3.4 have no user= logged in dovecot-1.2.15
ENH: proftpd chan accept usernames with spaces
ENH: injection of fail data into USER field
ENH: dovecot regexs rewritten and extra failures
ENH: proftp regex hardening and log messages
ENH/BF: exim improvements with sample
BF: fix to proxy port in 3proxy example
ENH: sample log + more specific regex
...
Conflicts: -- it was a messy merge/resolution.
ChangeLog
bin/fail2ban-regex
fail2ban-testcases
fail2ban/server/filter.py
* commit '0.8.10-1-g460e09a':
it was not the end of the world and we should continue
DOC: add information on where to report vulnerabilities + pointer to HOWTO_Seek_Help
Changes for 0.8.10 release (changelog, version, etc)
BF: anchor apache- filters. Close#248
DOC: credits for gh-244
Filter Asterisk: Add sample log entry to testcase.
Filter Asterisk: Add AUTH_UNKNOWN_DOMAIN error to list
ENH: purge a few more .*
DOC: credits
DOC: how to do filter enhancements
TST: normalize logs to use example.com and 1.2.3.4 as IP
ENH/BF: constrain regex. Fix ACL error regex
ENH: port optional
Update asterisk
Update asterisk.conf
Conflicts:
ChangeLog
DEVELOP
README.md
fail2ban/version.py
Release 0.8.10 -- wanna-be-secure, addresses possible DoS with apache- filters
* tag '0.8.10': (25 commits)
DOC: add information on where to report vulnerabilities + pointer to HOWTO_Seek_Help
Changes for 0.8.10 release (changelog, version, etc)
BF: anchor apache- filters. Close#248
DOC: credits for gh-244
Filter Asterisk: Add sample log entry to testcase.
Filter Asterisk: Add AUTH_UNKNOWN_DOMAIN error to list
ENH: purge a few more .*
DOC: credits
DOC: how to do filter enhancements
TST: normalize logs to use example.com and 1.2.3.4 as IP
ENH/BF: constrain regex. Fix ACL error regex
ENH: port optional
Changelog for previous PR
DOC: Changelog entry fro preceeding merge from Terence
TST: Fix fail2ban.conf reader test for unreliable dictionary order
failregex when roundcube log driver is set to 'syslog'
fixed failregex line for roundcube 0.9+
TST: test all stock jails to have actions and correctly specifying blocktype
CFG: assure actions for all the jails
BF: blocktype must be defined within [Init] -- adding [Init] section. Close#232
...
* commit '0.8.9-13-g39d32e0':
Changelog for previous PR
DOC: Changelog entry fro preceeding merge from Terence
TST: Fix fail2ban.conf reader test for unreliable dictionary order
failregex when roundcube log driver is set to 'syslog'
fixed failregex line for roundcube 0.9+
TST: test all stock jails to have actions and correctly specifying blocktype
CFG: assure actions for all the jails
BF: blocktype must be defined within [Init] -- adding [Init] section. Close#232
ENH: since it seems the default is to use file based logging, $syslog is in Should-{Start|Stop} like Debian https://github.com/fail2ban/fail2ban/blob/debian/debian/fail2ban.init
ENH: opensuse script from opensuse: https://build.opensuse.org/package/view_file?expand=1&file=fail2ban.init&package=fail2ban&project=openSUSE%3AFactory
Conflicts:
ChangeLog
config/jail.conf
testcases/clientreadertestcase.py -- had to "git show XXX | patch -p2" under tests/ 2 commits: 8a57ffd7a4db4b
* origin/0.9:
TST: Fix TraceBack tests when running via "setup"
Conflicts:
fail2ban/tests/misctestcase.py -- choose my version since it also could
be ran 'nosetests' or probably even some other tester, so better just to check
if it is a straight invocation of the fail2ban-tests
* 'sshd-locked' of https://github.com/kwirk/fail2ban:
DOC: Update man page for <SKIPLINES> usage
ENH: Add new regex for locked accounts for sshd
BF: fail2ban-regex adding duplicate lines with each regex
This issue was caused by the fact that every "line" is processed for each
regex, meaning each line was duplicated for every regex. This caused
duplicate fail matches and the buffer filling too quickly and possibly
missing failures.
Previous fix attempted shlex split which whilst worked for reading from
config file, failed when using fail2ban-client, as the input is already
effectively shelx split by the executing shell.
FilterSystemd journal match methods now handle list structures which
should be shlex split when reading from config file, and simply pass all
the relevant arguments from the shell when using fail2ban-client
Release 0.8.9
* tag '0.8.9':
BF: add missing files to MANIFEST (I think we shoult not rely on sdist anyways -- 'git tag' tarballs are more thorough ;) )
All the (version) updates for the release of 0.8.9
BF: (travis) relax the test for needed to be presented installed directories -- allow new
BF: (travis) if tests ran under coverage -- there is a traceback parts to report (thus > would be present)
ENH: also print the failing traceback line in case of failure
ENH: include explicit list of new files which should not be there upon "install --root"
ENH: now we know that logging handlers closing was still buggy in 2.6.2
ENH: issue a warning if jail name is longer than 19 symbols (Close#222)
DOC: inline commends with ';' are in effect only if ';' follows as space
BF: Fix for filterpoll incorrectly checking for jailless state
ENH: strengthen detection of working pyinotify
ENH: use the same python executable for setup.py test
ENH: actually tune up TraceBack to determine "unittest" portions of the stack across all python releases
TST: Some primarily smoke tests for tests utils
TST: cover few more lines in fail2banreader.py
ENH: basic test for setup.py itself (when applicable, should greatly improve coverage ;) )
ENH: consistent operation of formatExceptionInfo + unittest for it
ENH: point to the status of master branch on travis
Conflicts:
ChangeLog
MANIFEST
README.md
fail2ban/version.py -- all of the above obvious version changes
below files primarily needed just a bit of help in resolution
config/jail.conf
fail2ban/server/filterpoll.py
fail2ban/server/server.py
fail2ban/tests/servertestcase.py
and following were more difficult -- git wasn't able to track renames/moves of the code
fail2ban-testcases -- needed to introduce those changes to tests/utils.py
testcases/clientreadertestcase.py -- manually applied patch from master
testcases/utils.py -- manually applied patch from master
Release 0.8.9
* tag '0.8.9':
BF: add missing files to MANIFEST (I think we shoult not rely on sdist anyways -- 'git tag' tarballs are more thorough ;) )
Releasing 0.8.9
* tag '0.8.9': (46 commits)
All the (version) updates for the release of 0.8.9
BF: (travis) relax the test for needed to be presented installed directories -- allow new
BF: (travis) if tests ran under coverage -- there is a traceback parts to report (thus > would be present)
ENH: also print the failing traceback line in case of failure
ENH: include explicit list of new files which should not be there upon "install --root"
ENH: now we know that logging handlers closing was still buggy in 2.6.2
ENH: issue a warning if jail name is longer than 19 symbols (Close#222)
DOC: inline commends with ';' are in effect only if ';' follows as space
BF: Fix for filterpoll incorrectly checking for jailless state
ENH: strengthen detection of working pyinotify
ENH: use the same python executable for setup.py test
ENH: actually tune up TraceBack to determine "unittest" portions of the stack across all python releases
TST: Some primarily smoke tests for tests utils
TST: cover few more lines in fail2banreader.py
ENH: basic test for setup.py itself (when applicable, should greatly improve coverage ;) )
ENH: consistent operation of formatExceptionInfo + unittest for it
ENH: point to the status of master branch on travis
ENH: close open file in a test
Previous coverage was 56% (without disregarding any pragma)
ENH: close files in _test_move_into_file
...
* master:
Previous coverage was 56% (without disregarding any pragma)
Changelog for preceeding commit
ENH: strip CR and LF while analyzing the lines (processLine) (Close#202)
Conflicts:
fail2ban/server/filter.py
* master:
ENH: close files in _test_move_into_file
ENH: remove use of $Revision and $Date SVN tags
Add README.Solaris into distribution
Conflicts:
client/actionreader.py
* master: (51 commits)
ENH: Use real (resolving) example.com instead of test.example.com
DOC: Slight tune ups to ChangeLog -- we must release!
Changelog entries for the latest merges
BF: add bash-completion to MANIFEST
DOC: ChangeLog for default action type change
ENH: consolidate where blocktype is defined for iptables rules
BF: default type to unreachable
ENH: separate out regex and escape a .
ENH: logs/sshd -- have ":" after [daemon] (other uses are uncommon)
ENH: logs/sshd -- use example.com as the resolved hostname in sample log lines
ENH: filter.d/sshd.conf -- allow for trailing "via IP" in logs
DOC: Drop sudo from bash-completion
DOC: Added bash-completion script
ENH: add blocktype to all relevant actions. Also default the rejection to a ICMP reject rather than a drop
ENH: Removed unused log line
ENH: logrotate file
BF: missed MANIFEST include
BF: missed MANIFEST include
BF: missed MANIFEST include
ENH: some form of logrotate based on what distros are doing
...
Conflicts:
ChangeLog
MANIFEST
client/actionreader.py
config/jail.conf
fail2ban/server/datedetector.py
fail2ban/tests/datedetectortestcase.py
* commit '0.8.8-276-g5e1d8b0': (103 commits)
ENH: logs/sshd -- have ":" after [daemon] (other uses are uncommon)
ENH: logs/sshd -- use example.com as the resolved hostname in sample log lines
ENH: filter.d/sshd.conf -- allow for trailing "via IP" in logs
ENH: Removed unused log line
ENH: logrotate file
ENH: some form of logrotate based on what distros are doing
DOC: macports distribution of fail2ban
TST: test case for <br> tags in action
DOC: credits for BSD ssh filter changes
EHN: enhance sshd filter for bsd.
DOC: purge of svn tags
Slight tune up of changelog entry (treeish change due to squashing)
fixed test date thx to steven
tight control of the filter for ASSP
as yaroslav wishes
as daniel desires
changed from DateASSPlike class to DateStrptime
fixed little things
added new date format support for ASSP SMTP Proxy
Forgotten Changelog entry for "is None" changes
...
* 'cmd-timeout' of https://github.com/kwirk/fail2ban:
NF: For action execution, log stdout and stderr if debug or cmd error
NF: Allow setting of timeout for execution of action commands
Conflicts:
fail2ban/client/actionreader.py
fail2ban/server/action.py
* master:
ENH: "is None" instead of "== None" + tune ups in headers
BF: log error only if there were missed config files that couldn't be read
DOC: missing cinfo tags are ok. Log error for self referencing definitions
DOC: s/defination/definition/g learn to spell
Changelog entry for the previous commit and some untabify
BF: pyinotify backend should also handle IN_MOVED_TO events
ENH: remove stats of config files and use results of SafeConfigParserWithIncludes.read to facilitate meaningful error messages
DOC: credits for gh-70 fix
BF: ensure dates in email are in the C locale. Thanks iGeorgeX
DOC: ChangeLog for recursive tag substition
ENH: allow recursive tag substitution in action files.
DOC: document <br> tag
DOC: ChangeLog for named-refused entry
ENH: Account for views in named filter. By Romain Riviere in gentoo bug #259458
DOC: release documentation and distributor contacts
DOC: changelog entry for enhanced ssh filter
BF: Rename mentioning of README to README.md (Fixes#187)
updated README.md to hyperlink, add travis and coversall
Moving README into a markup README.md for github's goodnesses
Conflicts:
DEVELOP
README.md
fail2ban/client/configreader.py
fail2ban/server/datedetector.py
This uses subprocess.Popen, polling until `timeout` seconds has passed
or the command has exit. If the command has not exited, fail2ban then
sends SIGTERM, and if this is unsuccessful, SIGKILL.
The timeout can be changed for an entire action via action [Init]
options, or via jail.conf override, or fail2ban-client. The default
timeout period is 60 seconds.
This reverts commit 47a62b6072.
Enabling any jail by default should be a prerogative of particular
distributions (thanks Fabian Wenk for the discussion)
Conflicts:
config/jail.conf
* 0.9: (45 commits)
Beef up changelog for 0.9
ENH: make fail2ban-regex aware of possible maxlines in the filter config file
BF+TST: Correctly reset time in tearDownMyTime
ENH: Reimplement warning suppression of setup.py test --quiet
ENH: Renamed OptionConfigReader to DefinitionInitConfigReader
ENH: Rename splitAction to extractOptions in jailreader
ENH: Use os.path.join for filter/action config readers
BF: Remove warnings handler which breaks setup.py python2<2.7 and python3<3.2
ENH: For python3.2+ use ConfigPaser which replaces SafeConfigParser
TST: Change depreciated unittest assertEquals method to assertEqual
TST: Ensure files are closed in tests to remove ResourceWarnings
BF: Change logging instance logSys `warn` method to `warning`
ENH: use os.path.join for consistency -- add "Contributors" to authors
RF: setup.py now imports version number again
DOC: tune up formatting (spaces) and prelude for the changelog entry
TST+RF: Add ability to execute test from setup.py with setuptools
TST: Move test gathering to function is test utils
TST: Move test TZ changes to setUp and tearDown methods
ENH: Remove redundant `maxlines` option from jail reader
TST: Add test for FilterReader [Init] `maxlines` override
...
Conflicts:
config/jail.conf
* commit '0.8.8-212-gf6f30f1': (24 commits)
DOC: tune up formatting (spaces) and prelude for the changelog entry
DOC: more ChangeLog entries all the way back to 0.8.8
DOC: move new actions and filters to New Features in ChangeLog
DOC: tomcat and Guacmole are next release
DOC: credit man page edits
DOC: developers please rebase and use a single commit
DOC: post release ChangeLog entry
DOC: ChangeLog - current HEAD back to ce3ab34
DOC: begining of ChangeLog
DOC: version/date of release
DOC: ChangeLog versions and dates for Releasing
DOC: guidance for pull requests
BF: filter.d/sshd "Did not receive identification string" relates to an exploit so document this in sshd-ddos.conf but leave it out of authentication based blocks in sshd.conf
DOC: a plugin to thanks for the community support
Add After, PIDFile, and change WantedBy to multi-user.target in fail2ban.server
DOC: slight tune ups to README (we are no longer compatible with python 2.3 ;) )
ENH: more openssh fail messages from openssh source code (CVS 20121205)
Add systemd unit file and tmpfiles.d configuration files
BF: do not rely on scripts being under /usr -- might differ eg on Fedora -- rely on import of common.version (Closes gh-112)
RF: move exceptions used by both client and server into common/exceptions.py
...
Conflicts:
ChangeLog
README
* github_kwirk_fail2ban/filter-init:
ENH: Renamed OptionConfigReader to DefinitionInitConfigReader
ENH: Rename splitAction to extractOptions in jailreader
ENH: Use os.path.join for filter/action config readers
ENH: Remove redundant `maxlines` option from jail reader
TST: Add test for FilterReader [Init] `maxlines` override
ENH: Move jail `maxlines` to filter config
NF: Filters now allow adding of [Init] section similar to actions
Conflicts:
fail2ban/tests/clientreadertestcase.py
* github_kwirk_fail2ban/warnings-fix:
BF+TST: Correctly reset time in tearDownMyTime
ENH: Reimplement warning suppression of setup.py test --quiet
BF: Remove warnings handler which breaks setup.py python2<2.7 and python3<3.2
ENH: For python3.2+ use ConfigPaser which replaces SafeConfigParser
TST: Change depreciated unittest assertEquals method to assertEqual
TST: Ensure files are closed in tests to remove ResourceWarnings
BF: Change logging instance logSys `warn` method to `warning`
* master:
DOC: initiated changelog (but not juice left to actually fill it up ;-))
TST: test all valid loglevels in server testcases
TST: Add tag replace and escape test for actions
ENH: Minor change to action for consistency of execStart/Stop
TST: Coverage for coveralls.io should only be run on success
TST: no cover additions to server, primarily daemon creation
DOC: thanks @kwirk for spotting the typos in exception message
FD_CLOEXEC support
Typo in default pidfile in fail2ban.conf
Conflicts:
.travis.yml -- after_success
ChangeLog -- added perspective changelog for 0.8.9
fail2ban/server/asyncserver.py -- imports
fail2ban/server/server.py -- no pragma (if I got it right ;-) )
* 'py3' of https://github.com/kwirk/fail2ban: (38 commits)
DOC: Add python3 to requirements
ENH: Clarify use of bytes in csocket and asyncserver for python3
DOC: Revert dnsToIp error change, seperate log message for socket.error
TST: Tweak python3 open statement to resolve python2.5 SyntaxError
TST: Revert changes for filter testcase open statement
DOC: Revert setup.py messages to use print statement
Add *.bak files generated by 2to3 to gitignore
TST: Fix up fail2ban python3 scripts
TST: Fix issues in tests which assumed dictionary's order
ENH: setup.py now automatically runs 2to3 for python3.x
TST: Remove Travis CI unsupported versions of python from Travis config
add fail2ban-2to3 to MANIFEST file
ENH: Add python3 versions to Travis CI config
BF: Handle expected errors for python3.{0,1} when changing log target
Minor tweaks to fail2ban-regex for encoding
Added ability to set log file encoding with fail2ban-regex
Add ability to set log encoding for jail
Move handling of unicode decoding to FileContainer readline
Fix incorrect exit code from fail2ban-2to3
Remove redundant reassignment of variable
...
Conflicts:
fail2ban/tests/servertestcase.py -- both branches added a new unittest at the same point
AKA: Merge remote-tracking branch 'github_kwirk_fail2ban/module' into 0.9
* github_kwirk_fail2ban/module:
BF: Added test filter.d files to setup.py package data
TST: Fix up tests from multiline elements broken in previous merge
TST: clientreader test now use /etc/fail2ban/ if no local config/
ENH+TST: Move fail2ban-* scripts to bin/
TST+ENH: Move testcases to part of fail2ban module
TST: Update Travis CI coverage config for python module structure
ENH+BF+TST+DOC: Make fail2ban a python module
Conflicts:
.travis.yml -- the line for PYTHONPATH
.travis_coveragerc -- now we do cover gamin tests
* master:
ENH: for consistency (and future expansion ;)) -- rename to mysqld-auth
Adjusting previous PR (MySQL logs) according to my comments
TST: Add gamin testing for and only coveralls coverage for python2.7
change the license to GPLv2 + adapat text
TST: Add gamin support for Travis CI
fix the script name to check_fail2ban everywhere
Replace the check_fail2ban script by a new one which respects the Nagios specs (like status, output, perfdata, help...). Also add a README which includes the content of f2ban.txt (which is now removed)
Added testcase for MySQL date format to testcases/datedetectortestcase.py and example of MySQL log file.
Added support for MySQL logfiles
* commit '0.8.8-160-g74e76e0': (65 commits)
TST+BF: Use separate coveragerc for Travis CI
RF+TST: bring inBanList back from private to protected and enabled its rudimentary unittests
TST: coverage ignore Travis CI python virtual environments
ENH: increase waiting to 4 sec for gamin/pyinotify
TST+BF: Fix incorrect commands for coveralls support
TST: Add support for coveralls for python 2.6 and python 2.7
ENH: deleted trailing spaces in fail2ban- cmdline tools
DOC: minor change -- refer to the fail2ban manpage
TST: be more aggressive in cleanup of temp files + use mktemp instead of mkstemp
ENH(BF?): overload open() (for buffering) within filtertestcase to guarantee atomic writing
BF: delay check for the existence of config directory until read()
DOC: minor fix ups of manpages. fixes#159
non-static (get|set)BaseDir for Configurator. fixes#160
ENH: Slight tune ups for fresh SOGo filter + comment into the sample log file
ENH: postfix filter -- react also on (450 4.7.1) with empty from/to. fixes#126
TST: basic testing of reading the shipped jail.conf (forcing all jails to be enabled)
ENH: allow to force enable all jails (for testing), do not crash for jails without actions (just warn)
ENH: minor -- add default value into the warning if option had none provided
ENH: _copy_lines_between_files -- read all needed, and only then write/flush at once
ENH: move pyinotify callback debug message into callback + delay string interpolations
...
Conflicts:
fail2ban-testcases
testcases/clientreadertestcase.py -- fix for setBaseDir will follow
* commit '0.8.8-145-g72b0647': (114 commits)
ENH: Slight tune ups for fresh SOGo filter + comment into the sample log file
ENH: postfix filter -- react also on (450 4.7.1) with empty from/to. fixes#126
TST: basic testing of reading the shipped jail.conf (forcing all jails to be enabled)
ENH: allow to force enable all jails (for testing), do not crash for jails without actions (just warn)
ENH: minor -- add default value into the warning if option had none provided
ENH: _copy_lines_between_files -- read all needed, and only then write/flush at once
ENH: move pyinotify callback debug message into callback + delay string interpolations
ENH: adding ability to incorporate tracebacks into log lines while running tests
ENH: FailManager -- improve log message to report total # of detected failures as well
BF: allow to wait longer for FilterPoll in test_move_file
ENH: elaborated debug log message about already detected failures
BF: Remove custom __str__ for MonitorFailures and just adjust __name__ of the generated class
DOC: Added suggested by @beilber description of .d/ + added I formatting to all filenames
ENH: increase timeout to 20 sec from 10 sec in assert_correct_last_attempt
BF: fixing up for handling of TAI64N timestamps and adding some unittest for prev commit (not effective much though)
An example of failed logins against sogo
Update sogo-auth.conf
Added Daniel and Steven to THANKS
My improvements to manpages
PKG: change email that I want in RPMs
...
* master: (26 commits)
DOC: added a note that coverage script is python-coverage on Debian systems
Fixed typos
Added additional Transmitter tests, and some associated fixes
TODO: test filters/examples files
add corresponding ChangeLog entry
do catch all exception
ENH: typo + head -1 has been deprecated for 10+ years.
ENH: add help command
BF: allow more than single word for command action[start,stop,ban,unban,check] and for setcinfo too
BF: general Exception catch was excessive. Only IOError and OSError are possible and has different meanings
Add development documentation and framework for code coverage measurement
FSF address changes missing from previous
refresh generated manpages (since 0.8.2 state)
Downgrade log rotation detection message to DEBUG level from INFO. Closes: gh-129
BF: do not shutdown logging until all jails stop -- so move into Server.quit()
BF: safeguard closing of log handlers + close in reverse order
Added transmitter get cinfo option for action
Fix for missing value in transmitter delaction
Rewrite and enable server testcase for Transmitter
ENH: adding more of diagnostic messages into -client while starting the daemon
...
* github_kwirk_fail2ban/multi-line:
Revert changes to man/fail2ban-client.1
Removed "common.local" include for FilterReader test
Added 'maxlines' option to fail2ban-regex
Regex get(Un)MatchedLines now returns whole lines only
Added FilterReader test
Added multiregex test for multi-line filter
ignoreregex now functions correctly with multiline
Minor typo in server/failregex.py
Added <SKIPLINES> regex applicable for multi-line
Sanitise testcase log 04
Changed multi-line test to provided example
Filter for multi-line now stores last time match
Simplify and change some filter line buffer
Initial changes and test for multi-line filtering
Ignore regexs are now only compared to lines that match the failregex.
Supporting test also added for multiline regex and overlapping
multiline regex matches.
Primarily a bugfix release 0.8.8
* tag '0.8.8': (31 commits)
Getting ready for 0.8.8 release (changelog, version boost)
BF: guarantee that IP is stored as a base, non-unicode str (Closes gh-91)
ENH: BF (forgotten import) for prev commit + removed duplicate Author, adjusted __ fields for that in fail2ban-* scripts
ENH: until we make it proper module -- adjust sys.path only if system-wide run
ENH: fail2ban-testcases-all -- pass cmdline options to fail2ban-testcases
ENH: To help with gh-87 added hints into the log on some failure return codes (e.g. 0x7f00 for this one)
ENH: trying to go native travis-ci python way to take advantage of virtualenv's with older pythons
BF: typo
BF: added a little shell script to excercise tests against all available Python versions
ENH: travis -- try to run tests against all available python versions
NF: rudimentary .travis.yml for travis-ci.org service
BF: do not enable pyinotify backend if pyinotify is too old (Closes gh-80)
DOC: forgotten --help entry for " unban "
ENH: downgrade "already banned" from WARN to INFO level (Closes gh-79)
minor: added a note on now "negative" log entries on "POSSIBLE BREAK-IN ATTEMPT"
DOC: minor "fixes" in DEVELOP
Added in while loop to process the Fail Manager after the requested banned IP was added to its queue. This solves the issue of needing to touch the log file that is being monitored to get the IP to be banned accordingly. Added in import of FailManagerEmpty exception class.
ENH: refactored previous commit to make it more Pythonic (With prev commit closes gh-86, gh-81)
Added in command option to unban and IP, just like using 'banip'. Command looks like: fail2ban-client set <jail name> unbanip <ip>
BF: in code we should use MyTime wrapper instead of time module directly
...
Re-tagging 0.8.7 with hope to do that last time ;)
* tag '0.8.7':
ENH: match possibly present "pam_unix(sshd:auth):" portion for sshd (Closes: #648020)
ENH: add wu-ftpd failregex for use against syslog (Closes: #514239)
BF: anchor chain name in actioncheck's for iptables actions (Closes: #672228)
BF: inline comments must use ; not # -- recidive jail
* commit '0.8.6-100-gdca5634':
RF: reordered tests + enabled gamin now that its fix is pending in Debian
ENH+BF: filtergamin -- to be more inline with current design of filterinotify
ENH: 1 more sleep_4_poll to guarantee difference in time stamp
ENH: few more delays for cases relying on time stamps
* commit '0.8.6-95-gc0c1232':
ENH: tests much more robust now across pythons 2.4 -- 2.7
BF+RF: pyinotify refreshes watcher upon CREATE, unified/simplified *(add|del)LogPath among *Filters
Ask users to report bugs to github's issues
Replace "|" with "_" in ipmasq-ZZZzzz|fail2ban.rul (Closes gh-66)
* commit '0.8.6-90-g08564bd':
ENH: fail2ban-testcases -- custom logging format to ease debugging, non-0 exit code in case of failure
ENH: Filter's testcases -- rename, del + list again --- a bit unstable, might still fail from time to time
BF: pyinotify -- monitor the parent directory for IN_CREATE + process freshly added file (Closes gh-44)
ENH: first working unittest for checking polling and inotify backends
RF/BF: just use pyinotify.ThreadedNotifier thread in filterpyinotify
RF: filter.py -- single readline in a loop
ENH: FilterPoll -- adjusted some msgs + allowed to operate without jail (for testing)
Minor additional comment to DEVELOP
ENH: extended test LogfileMonitor
ENH: add more verbosity levels to be controlled while running unittests
Added few tests of FileFilter. yet to place them into a Jail-ed execution test
DOC: distilling some of server "design" into DEVELOP notes for common good
ENH: minor, just trailing spaces/tabs + reformated a string
ENH: added a basic test for FilterPoll for detection of modifications
clarified that the are existing test cases and the 'coming soon' is about creating new ones.
Added beginnings of documentation for developers
BF: usedns=no was not working at all
RF: filtertestcase.py to put common testing into a helping subroutine
ENH: be able to control verbosity from cmdline for fail2ban-testcases
* commit '0.8.6-69-gb4099da': (57 commits)
DOC: Adjusted header for config/*.conf to mention .local and way to comment
Fixed addBannedIP to add enough failures to trigger a ban, rather than just one failure.
Fix Gentoo initd script (drop extra_commands)
ENH: catch failed ssh logins due to being listed in DenyUsers. Close gh-47 (Closes: #669063)
DOC: comment in jail.conf for the need of multiple jails for asterisk
Add the INCLUDE section to use __pid_re feature
Disable asterisk jail by default
Change jail for asterisk, add support for SIP and SIP-TLS on TCP and UDP ports
Change NOTICE by NOTICE%(__pid_re)s
Added a warning for the recidive jail
BF: fail2ban-regex -- adding forgotten char for -v
Remove custom bantime
Add sample log file for asterisk
Add $ at the end of the failregex
ENH: fail2ban-regex -- quieter by default and added --verbose mode
ENH: minor, just pythonized some parts of fail2ban-regex summary
ENH: rudimentary __repr__ for Filter and Jail + moved usedns into set method
BF: allow trailing whitespace in few missing it regexes for sshd.conf
BF+ENH: added %m-%d-%Y pattern + do not add %Y for Feb 29 fix if already present in the pattern
minor comment into TODO
...
* commit '0.8.6':
Changelog and version changes for 0.8.6
Revert "ENH: server.py -- addLogPath with tail=True"
DOC: updated contact information to direct to github and mailing list
ENH: added custom timeformat with '.' as separator. Close gh-1
BF: stop all communications before stopping the jails (Close gh-7)
ENH: added logging while stopping the jails
Add Date: header for sendmail*.conf actions
BF: gentoo-initd assure /var/run dir + remove stale sock file
ENH: fix of syntax for compatibility with Python 2.4
ENH: stay compatible with python < 2.5 (use md5 if hashlib is N/A)
BF: use hashlib instead of deprecated md5
ENH: Remove obsolete code from gentoo init script. Bug gentoo#367819.
* 'master' (early part):
Adding log samples accumulated in Debian branch
BF: removing minor bashism in ipmasq example file (closes: #530078). Thanks Raphael Geissert
Added ipmasq rule file to restart fail2ban when iptables are wiped out (closes: #461417). Thanks Guido Bozzetto
added rudimentary .gitignore
BF: be able to detect time for VNC recording only 2 letters of year (closes: #537610)
* master: (27 commits)
ENH: server.py -- addLogPath with tail=True
ENH: set/getFile for ticket.py -- found in source distribution of 0.8.4
NF: adding unittests for previous commit
ENH: removed expansion for few Date and Revision SVN keywords
ENH: sshd.conf -- allow user names to have spaces and trailing spaces in the line
Removed duplicate entry for DataCha0s/2\.0 in badbots (closes: #519557)
BF: return declaration of TABLE back (thanks to michaelberg79)
Update server/datetemplate.py
format output of matches data.
ENH: minor unittest to see if tickets carry correct 'matches'
ENH: introduced usa of Ticket.__matches throughout
ENH: added 'matches' to the Ticket(s) and deprecated "custom" constructors for derived *Tickets
ENH: modelines for emacs and vim to assure consistent indentation scheme (tabs)
ENH: failmanager -- additional debug message about # of known failures
ENH: rudimentary __str__ for the ticket
ENH: more human-accessible printout of the dates if any comparison fails
ENH: few debug messages and use MyTime.localtime instead of straight time.time
ENH: Added localtime() to MyTime
BF: set TZ to CEST while unittesting so dates matching would work
ENH: added a .pylintrc to help with consistent appearance and catch obvious problems
...
Conflicts:
MANIFEST -- wasn't present before due to base on source distribution
server/ticket.py -- strange conflict -- should be benign
* upstream:
for 0.8.5 release -- changelog + version
BF: use addfailregex instead of failregex while processing per-jail "failregex" parameter (Closes: #635830) (LP: #635036)
BF: use os.path.join to generate full path - fixes includes in configs given local filename
very minor -- uniform indentation in example
BF: use standard/reserved example.com instead of mail.com
ENH: Adding author for dovecot filter and prunning unneeded space in the regexp
* commit 'remotes/upstream-repo/tags/FAIL2BAN-0_8_5^':
for 0.8.5 release -- changelog + version
BF: use addfailregex instead of failregex while processing per-jail "failregex" parameter (Closes: #635830) (LP: #635036)
BF: use os.path.join to generate full path - fixes includes in configs given local filename
very minor -- uniform indentation in example
BF: use standard/reserved example.com instead of mail.com
ENH: Adding author for dovecot filter and prunning unneeded space in the regexp
Conflicts:
common/version.py -- my added copyright
* debian: (21 commits)
debian/jail.conf: got 'chain' parameter to be specified for iptables actions (Closes: #515599)
debian/jail.conf: closing " for protocol specification
BF: proftpd filter -- if login failed -- count regardless of the reason for failure
BF: Allow for trailing spaces in proftpd logs
BF: escaping () in pure-ftpd filter. Thanks Teodor
BF: allow space in the trailing of failregex for sasl.conf: see http://bugs.debian.org/573314
ENH: add <chain> to action.d/iptables*. Thanks Matthijs Kooijman: see http://bugs.debian.org/515599
NF: Adding found on a drive filter.d/dovecot.conf
ENH: make filter.d/apache-overflows.conf catch more: see http://bugs.debian.org/574182
ENH: dropbear filter: see http://bugs.debian.org/546913
BF: Use /var/run/fail2ban instead of /tmp for temp files in actions: see http://bugs.debian.org/544232
ENH: adjusted description for sasl jail (Closes: #615952)
ENH: slight rewordings of the long description (Closes: #588176)
debian/copyright: updated copyright years
Boosted policy compliance version to 3.9.1 (no changes seems to be due)
spellcheck jail.conf. Thanks Christoph Anton Mitterer
spellcheck debian/jail.conf (Closes: #598206). Thanks Christoph Anton Mitterer
debian: default ignoreip to ignore entire loopback zone (/8): see http://bugs.debian.org/598200
default ignoreip to ignore entire loopback zone (/8): see http://bugs.debian.org/598200
Tai64N stores time in GMT, we need to convert to local time before returning
...
+ trailing whitespaces were removed
Thanks to Christoph Anton Mitterer for the original bugreport raising the
concern and Matthijs Kooijman for giving 'chains parameter' idea
* commit 'upstream/0.8.4+svn20110323': (37 commits)
BF: proftpd filter -- if login failed -- count regardless of the reason for failure
BF: Allow for trailing spaces in proftpd logs
BF: escaping () in pure-ftpd filter. Thanks Teodor
BF: allow space in the trailing of failregex for sasl.conf: see http://bugs.debian.org/573314
ENH: add <chain> to action.d/iptables*. Thanks Matthijs Kooijman: see http://bugs.debian.org/515599
NF: Adding found on a drive filter.d/dovecot.conf
ENH: make filter.d/apache-overflows.conf catch more: see http://bugs.debian.org/574182
ENH: dropbear filter: see http://bugs.debian.org/546913
BF: Use /var/run/fail2ban instead of /tmp for temp files in actions: see http://bugs.debian.org/544232
spellcheck jail.conf. Thanks Christoph Anton Mitterer
default ignoreip to ignore entire loopback zone (/8): see http://bugs.debian.org/598200
Tai64N stores time in GMT, we need to convert to local time before returning
debug entry for lines ignored due to falling below findtime (v2)
disabling entirely named-refused-udp jail with a big fat warning
added time module. bug reported in buanzo's blog at http://blogs.buanzo.com.ar/2009/04/fail2ban-patch-ban-ip-address-manually.html
- Patch to make log file descriptors cloexec to stop leaking file descriptors on fork/exec. Thanks to Jonathan Underwood. https://bugzilla.redhat.com/show_bug.cgi?id=230191#c24
- Changed to SVN version.
- Release 0.8.4.
- Oups... Forgot the ChangeLog...
- Check the inode number for rotation in addition to checking the first line of the file. Thanks to Jonathan Kamens. - Red Hat Bugzilla - Bug 503852 - SF.net Bug #2800279.
...
* upstream-0.8:
BF: proftpd filter -- if login failed -- count regardless of the reason for failure
BF: Allow for trailing spaces in proftpd logs
BF: escaping () in pure-ftpd filter. Thanks Teodor
BF: allow space in the trailing of failregex for sasl.conf: see http://bugs.debian.org/573314
ENH: add <chain> to action.d/iptables*. Thanks Matthijs Kooijman: see http://bugs.debian.org/515599
NF: Adding found on a drive filter.d/dovecot.conf
ENH: make filter.d/apache-overflows.conf catch more: see http://bugs.debian.org/574182
ENH: dropbear filter: see http://bugs.debian.org/546913
BF: Use /var/run/fail2ban instead of /tmp for temp files in actions: see http://bugs.debian.org/544232
* upstream-0.8:
spellcheck jail.conf. Thanks Christoph Anton Mitterer
default ignoreip to ignore entire loopback zone (/8): see http://bugs.debian.org/598200
Tai64N stores time in GMT, we need to convert to local time before returning
debug entry for lines ignored due to falling below findtime (v2)
disabling entirely named-refused-udp jail with a big fat warning
added time module. bug reported in buanzo's blog at http://blogs.buanzo.com.ar/2009/04/fail2ban-patch-ban-ip-address-manually.html
Should have been done long before -- debian/ branch tracks source
releases of fail2ban, and there was 0.8.4 which was at once merged into
debian-release (debian branch + patches/fixes) but not into debian
* commit 'upstream/0.8.4':
Imported Upstream version 0.8.4
- Use 80 columns.
- Fixed maxretry/findtime rate. Many thanks to Christos Psonis. Tracker #2019714.
- Made the named-refused regex a bit less restrictive in order to match logs with "view". Thanks to Stephen Gildea.
- Use timetuple instead of utctimetuple for ISO 8601. Maybe not a 100% correct fix but seems to work. Tracker #2500276.
- Changed <HOST> template to be more restrictive. Debian bug #514163.
- Added cyrus-imap and sieve filters. Thanks to Jan Wagner. Debian bug #513953.
- Pull a commit from Yaroslav git repo. BF: addressing added bang to ssh log (closes: #512193).
- Added missing semi-colon in the bind9 example. Thanks to Yaroslav Halchenko.
- Added NetBSD ipfilter (ipf command) action. Thanks to Ed Ravin. Tracker #2484115.
- Improved SASL filter. Thanks to Loic Pefferkorn. Tracker #2310410.
- Added CPanel date format. Thanks to David Collins. Tracker #1967610.
- Added nagios script. Thanks to Sebastian Mueller.
- Removed print.
- Removed begin-line anchor for "standard" timestamp. Fixed Debian bug #500824.
- Remove socket file on startup is fail2ban crashed. Thanks to Detlef Reichelt.
* debian:
Replacing word of caution with big fat warning and commenting out named-refused-udp completely (Closes: #583364)
Adding arno-iptables-firewall (no deprecation of ipmasq per Joey Hess mentioning, which still could be used on lenny systems)
* up/fixes:
BF: proftpd filter -- if login failed -- count regardless of the reason for failure
BF: Allow for trailing spaces in proftpd logs (closes: #507986)
BF: be able to detect time for VNC recording only 2 letters of year (closes: #537610)
BF: escaping (). Thanks Teodor (Closes: #544744)
Conflicts:
config/filter.d/proftpd.conf
* debian:
actually boosting policy
BF: use "set logtartet" instead of "reload" while logrotate. Thanks J.M.Roth (Closes: #537773)
BF: adjusted README.Debian - multiport is default (closes: #545971)
* up/log_examples:
added proftpd examples from wiki
NF: few examples for pure-ftpd
* upstream: (21 commits)
Imported Upstream version 0.8.4
- Release 0.8.4.
- Oups... Forgot the ChangeLog...
- Check the inode number for rotation in addition to checking the first line of the file. Thanks to Jonathan Kamens.
- Fixed typo. Thanks to Dudi Goldenberg.
added traceback to asyncserver.py's import.
Added item about logging subsystem shutdown being moved, to Changelog.
moved logging shutdown out of quit(), into end of start() in server.py
Disabled jail lighttpd-fastcgi by default.
- Added entry for "Ban IP" command.
added "Ban IP" command to fail2ban branch 0.8
- Added two new filters: lighttpd-fastcgi and php-url-fopen.
- Moved last entries in the config/ part.
added two new filter files (PHP url_fopen, lighttpd fastcgi alerts), updated MANIFEST and jail.conf accordingly
- Added svn:keywords property.
- Added helper module in common.
added 'unexpected communication error' fix to ChangeLog. Added formatExceptionInfo to server/asyncserver.py
added missing import sys to asyncserver.py
more readable code for python version comparison
added python version detection to asyncore.loop(use_poll=True|False)
...
* commit '0_8_4':
- Release 0.8.4.
- Oups... Forgot the ChangeLog...
- Check the inode number for rotation in addition to checking the first line of the file. Thanks to Jonathan Kamens.
- Fixed typo. Thanks to Dudi Goldenberg.
added traceback to asyncserver.py's import.
Added item about logging subsystem shutdown being moved, to Changelog.
moved logging shutdown out of quit(), into end of start() in server.py
Disabled jail lighttpd-fastcgi by default.
- Added entry for "Ban IP" command.
added "Ban IP" command to fail2ban branch 0.8
- Added two new filters: lighttpd-fastcgi and php-url-fopen.
- Moved last entries in the config/ part.
added two new filter files (PHP url_fopen, lighttpd fastcgi alerts), updated MANIFEST and jail.conf accordingly
- Added svn:keywords property.
- Added helper module in common.
added 'unexpected communication error' fix to ChangeLog. Added formatExceptionInfo to server/asyncserver.py
added missing import sys to asyncserver.py
more readable code for python version comparison
added python version detection to asyncore.loop(use_poll=True|False)
Fix for python 2.6 / 3.0 incompatibility
* debian:
BF: thanks lintian -- removing stale /var/run/fail2ban from dirs -- should be created by init script
Thanks lintian for catching a misspell in README.Debian
boosted debhelper compatibility to 5
* up/fixes:
Removed duplicate entry for DataCha0s/2\.0 in badbots (closes: #519557)
BF: Allow for trailing spaces in proftpd logs (closes: #507986)
* up/log_examples:
added sasl example log file
* debian:
Added a comment into Debian-shipped jail.conf about sasl logpath -- it might preferable to monitor warn.log in case of postfix
* up/ipmasq:
BF: removing minor bashism in ipmasq example file (closes: #530078). Thanks Raphael Geissert
* upstream:
- Use 80 columns.
- Fixed maxretry/findtime rate. Many thanks to Christos Psonis. Tracker #2019714.
- Made the named-refused regex a bit less restrictive in order to match logs with "view". Thanks to Stephen Gildea.
- Use timetuple instead of utctimetuple for ISO 8601. Maybe not a 100% correct fix but seems to work. Tracker #2500276.
- Changed <HOST> template to be more restrictive. Debian bug #514163.
- Added cyrus-imap and sieve filters. Thanks to Jan Wagner. Debian bug #513953.
- Pull a commit from Yaroslav git repo. BF: addressing added bang to ssh log (closes: #512193).
- Added missing semi-colon in the bind9 example. Thanks to Yaroslav Halchenko.
- Added NetBSD ipfilter (ipf command) action. Thanks to Ed Ravin. Tracker #2484115.
- Improved SASL filter. Thanks to Loic Pefferkorn. Tracker #2310410.
- Added CPanel date format. Thanks to David Collins. Tracker #1967610.
- Added nagios script. Thanks to Sebastian Mueller.
- Removed print.
- Removed begin-line anchor for "standard" timestamp. Fixed Debian bug #500824.
- Remove socket file on startup is fail2ban crashed. Thanks to Detlef Reichelt.
Conflicts:
config/filter.d/sshd.conf
server/filter.py
* commit 'upstream-repo/FAIL2BAN-0_8':
- Use 80 columns.
- Fixed maxretry/findtime rate. Many thanks to Christos Psonis. Tracker #2019714.
- Made the named-refused regex a bit less restrictive in order to match logs with "view". Thanks to Stephen Gildea.
- Use timetuple instead of utctimetuple for ISO 8601. Maybe not a 100% correct fix but seems to work. Tracker #2500276.
- Changed <HOST> template to be more restrictive. Debian bug #514163.
- Added cyrus-imap and sieve filters. Thanks to Jan Wagner. Debian bug #513953.
- Pull a commit from Yaroslav git repo. BF: addressing added bang to ssh log (closes: #512193).
- Added missing semi-colon in the bind9 example. Thanks to Yaroslav Halchenko.
- Added NetBSD ipfilter (ipf command) action. Thanks to Ed Ravin. Tracker #2484115.
- Improved SASL filter. Thanks to Loic Pefferkorn. Tracker #2310410.
- Added CPanel date format. Thanks to David Collins. Tracker #1967610.
- Added nagios script. Thanks to Sebastian Mueller.
- Removed print.
- Removed begin-line anchor for "standard" timestamp. Fixed Debian bug #500824.
- Remove socket file on startup is fail2ban crashed. Thanks to Detlef Reichelt.
Conflicts:
MANIFEST
TODO
to forbid matching IPs encoded in the hostname (like
1.2.3.4.xxx.yyyyy.zzz) prior doing actual DNS lookup.
It is quite important and actually security hazard: DoS is easy to
perform...
Since now we don't do \S matching in <HOST> regexp, in the development
branches we should also allow for unicode characters by adding 're.U' to HOST's
regexp
* added example for BREAK-IN in ssh
* Syncing current debian revision to FAIL2BAN-0_8@717 of upstream,
since it includes fixes to some forwarded bugs. Total list of
functional changes
- Added actions to report abuse to ISP, DShield and myNetWatchman.
Thanks to Russell Odom.
- Added apache-nohome.conf. Thanks to Yaroslav Halchenko.
- Added new time format. No idea from where it comes...
- Added new regex. Thanks to Tobias Offermann.
- Try to match the regex even if the line does not contain a valid
date/time. Described in Debian #491253. Thanks to Yaroslav
Halchenko.
- Removed "timeregex" and "timepattern" stuff that is not needed
anymore.
- Added date template for Day-Month-Year Hour:Minute:Second
(closes: #491253)
- Added date pattern for Hour:Minute:Second. Thanks to Andreas
Itzchak Rehberg.
- Use current day and month instead of Jan 1st if both are not
available in the log. Thanks to Andreas Itzchak Rehberg.
- Improved pattern. Thanks to Yaroslav Halchenko.
- Merged patches from Debian package. Thanks to Yaroslav Halchenko.
* debian:
- Added actions to report abuse to ISP, DShield and myNetWatchman. Thanks to Russell Odom.
- Added svn:keywords property.
- Added apache-nohome.conf. Thanks to Yaroslav Halchenko.
- Added new time format. No idea from where it comes...
- Added new regex. Thanks to Tobias Offermann.
- Try to match the regex even if the line does not contain a valid date/time. Described in Debian #491253. Thanks to Yaroslav Halchenko.
- Removed "timeregex" and "timepattern" stuff that is not needed anymore.
- Added date template for Day-Month-Year Hour:Minute:Second.
- Added date pattern for Hour:Minute:Second. Thanks to Andreas Itzchak Rehberg.
- Use current day and month instead of Jan 1st if both are not available in the log. Thanks to Andreas Itzchak Rehberg.
- Improved pattern. Thanks to Yaroslav Halchenko.
- Merged patches from Debian package. Thanks to Yaroslav Halchenko.
- Changed to SVN version.
Conflicts:
config/filter.d/sshd.conf
* upstream:
- Added actions to report abuse to ISP, DShield and myNetWatchman. Thanks to Russell Odom.
- Added svn:keywords property.
- Added apache-nohome.conf. Thanks to Yaroslav Halchenko.
- Added new time format. No idea from where it comes...
- Added new regex. Thanks to Tobias Offermann.
- Try to match the regex even if the line does not contain a valid date/time. Described in Debian #491253. Thanks to Yaroslav Halchenko.
- Removed "timeregex" and "timepattern" stuff that is not needed anymore.
- Added date template for Day-Month-Year Hour:Minute:Second.
- Added date pattern for Hour:Minute:Second. Thanks to Andreas Itzchak Rehberg.
- Use current day and month instead of Jan 1st if both are not available in the log. Thanks to Andreas Itzchak Rehberg.
- Improved pattern. Thanks to Yaroslav Halchenko.
- Merged patches from Debian package. Thanks to Yaroslav Halchenko.
- Changed to SVN version.
* commit 'remotes/upstream-repo/FAIL2BAN-0_8':
- Added actions to report abuse to ISP, DShield and myNetWatchman. Thanks to Russell Odom.
- Added svn:keywords property.
- Added apache-nohome.conf. Thanks to Yaroslav Halchenko.
- Added new time format. No idea from where it comes...
- Added new regex. Thanks to Tobias Offermann.
- Try to match the regex even if the line does not contain a valid date/time. Described in Debian #491253. Thanks to Yaroslav Halchenko.
- Removed "timeregex" and "timepattern" stuff that is not needed anymore.
- Added date template for Day-Month-Year Hour:Minute:Second.
- Added date pattern for Hour:Minute:Second. Thanks to Andreas Itzchak Rehberg.
- Use current day and month instead of Jan 1st if both are not available in the log. Thanks to Andreas Itzchak Rehberg.
- Improved pattern. Thanks to Yaroslav Halchenko.
- Merged patches from Debian package. Thanks to Yaroslav Halchenko.
- Changed to SVN version.
Conflicts:
MANIFEST
* up/sshd_fixes:
BF: Specify explicitely facilities in "Failed .. for". Thanks Dean Gaudet. (closes: #481760)
Added failregex for "User not known" in sshd.conf. thanks Alexander Gerasiov (closes: #479966)
* debian: (23 commits)
Imported Upstream version 0.8.3
- Prepared for 0.8.3.
Adjusted vcs paths
- Prepared for 0.8.3
- Send file if the number of lines is greater or equal and not only equal to the limit.
- Use poll instead of select in asyncore.loop. This should solve the "Unknown error 514". Thanks to Michael Geiger and Klaus Lehmann.
- Added missing ignoreregex to filters. Thanks to Klaus Lehmann.
- Added and changed some logging level and messages.
- Added svn:keywords.
- Added ISO 8601 date/time format.
- Better (correct) fix for ignoreregex in jail.[conf|local].
- Fixed ignoreregex processing in fail2ban-client. Thanks to René Berber.
- Added "Day/Month/Year Hour:Minute:Second" date template. Thanks to Dennis Winter.
- Added svn:keywords.
- Added gssftpd filter. Thanks to Kevin Zembower.
- Changed some log level.
- Fixed "fail2ban-client get <jail> logpath". Bug #1916986.
- Fixed PID file while started in daemon mode. Thanks to Christian Jobic who submitted a similar patch.
- Fixed socket path in redhat and suse init script. Thanks to Jim Wight.
- Create /var/run/fail2ban during install.
...
Conflicts:
ChangeLog
config/filter.d/gssftpd.conf
config/filter.d/pam-generic.conf
debian/changelog
* upstream: (22 commits)
Imported Upstream version 0.8.3
- Prepared for 0.8.3.
- Prepared for 0.8.3
- Send file if the number of lines is greater or equal and not only equal to the limit.
- Use poll instead of select in asyncore.loop. This should solve the "Unknown error 514". Thanks to Michael Geiger and Klaus Lehmann.
- Added missing ignoreregex to filters. Thanks to Klaus Lehmann.
- Added and changed some logging level and messages.
- Added svn:keywords.
- Added ISO 8601 date/time format.
- Better (correct) fix for ignoreregex in jail.[conf|local].
- Fixed ignoreregex processing in fail2ban-client. Thanks to René Berber.
- Added "Day/Month/Year Hour:Minute:Second" date template. Thanks to Dennis Winter.
- Added svn:keywords.
- Added gssftpd filter. Thanks to Kevin Zembower.
- Changed some log level.
- Fixed "fail2ban-client get <jail> logpath". Bug #1916986.
- Fixed PID file while started in daemon mode. Thanks to Christian Jobic who submitted a similar patch.
- Fixed socket path in redhat and suse init script. Thanks to Jim Wight.
- Create /var/run/fail2ban during install.
- Added "pam-generic" filter and more configuration fixes. Thanks to Yaroslav Halchenko.
...
* commit '0_8_3': (21 commits)
- Prepared for 0.8.3.
- Prepared for 0.8.3
- Send file if the number of lines is greater or equal and not only equal to the limit.
- Use poll instead of select in asyncore.loop. This should solve the "Unknown error 514". Thanks to Michael Geiger and Klaus Lehmann.
- Added missing ignoreregex to filters. Thanks to Klaus Lehmann.
- Added and changed some logging level and messages.
- Added svn:keywords.
- Added ISO 8601 date/time format.
- Better (correct) fix for ignoreregex in jail.[conf|local].
- Fixed ignoreregex processing in fail2ban-client. Thanks to René Berber.
- Added "Day/Month/Year Hour:Minute:Second" date template. Thanks to Dennis Winter.
- Added svn:keywords.
- Added gssftpd filter. Thanks to Kevin Zembower.
- Changed some log level.
- Fixed "fail2ban-client get <jail> logpath". Bug #1916986.
- Fixed PID file while started in daemon mode. Thanks to Christian Jobic who submitted a similar patch.
- Fixed socket path in redhat and suse init script. Thanks to Jim Wight.
- Create /var/run/fail2ban during install.
- Added "pam-generic" filter and more configuration fixes. Thanks to Yaroslav Halchenko.
- Process failtickets as long as failmanager is not empty.
...
* debian:
2 new jails: xinetd-fail, apache-overflows added to jails.conf
minor: adjusted comment for named jails to come closer to upstream
BF: apache-* jails -- authentication failures are recorded in *error.log files, thus paths were adjusted
* debian:
Confirms to policy 3.7.3 (no changes)
Bye Bye dpatch: now everything is handled in git branches
removing patches from dpatch system since they are in branches now
added a comment to README.Debian and to the list of examples for ipmasq example file
Fixed == bashism (Closes: #464647). Thanks Raphael Geisser
* deb/specifics:
slight tune ups in upstream sources destined only for debian are kept in this branch
* up/0.9-0.8:
* up/apache_noscript_extend:
Extended apache-noscript filter with more file extensions and to react to "script not found or unable to stat" log message (closes: #456565). Thanks Tim Connors
* up/ipmasq:
Added ipmasq rule file to restart fail2ban when iptables are wiped out (closes: #461417). Thanks Guido Bozzetto
* up/log_examples:
up/log_examples: moved vsftpd log from up/vsftpd_optional_user
added examples of log lines (for named-refused, pam-generic, sshd) under files/logs for easy testing
* up/mail_whois_lines:
mail-whois-lines: moved fix for proper names from dpatch
* up/named_refused_fixed:
named_refused: moved fix for proper config+filters from dpatch
* up/pam_generic:
added pam-generic from dpatch
* up/proftpd_fix+extend:
Fix/extension of proftpd failrexes (Closes: #461412). Thanks Guido Bozzetto
* up/sshd_refused_connect:
* up/vsftpd_optional_user:
up/vsftpd_optional_user: moving examples into up/examples branch
BF: vsftp anchoring
- anchored properly at the end of line, and source code has .examples
files to perform testing of the rules.
- added new explicit rule for users not in the AllowUsers lists
- Removed obsolete Build-Depends-Indep on help2man, python-dev
- Explicit removal of *.pyc files compiled during build
- Invoke 'python setup.py clean' in clean target, which required also
to move python into Build-Depends
* Minor clean up of debian/rules
with multiport module. That is to address the fact that most services
listen on multiple port (for encrypted and non-encrypted connections)
* Added [courierauth] jail (First 2 items are to partially address #407404
non-released versions (which were suggested to the users to overcome
problems reported in bug reports). In particular attention should be paid
to upstream changelog entries
- Several "failregex" and "ignoreregex" are now accepted.
Creation of rules should be easier now.
This is an alternative solution to 'multiple <HOST>' entries fix,
which is not applied to this shipped version - pay cautios if upgrading
from 0.7.5-3~pre?
- Allow comma in action options. The value of the option must
be escaped with " or '.
That allowed to implement requested ability to ban multiple ports
at once (See 373592). README.Debian and jail.conf adjusted to reflect
possible use of iptables-mport
- Now Fail2ban goes in /usr/share/fail2ban instead of
/usr/lib/fail2ban. This is more compliant with FHS.
Patch 00_share_insteadof_lib no longer applied
* Refactored installed by debian package jail.conf:
- Added option banaction which is to incorporate banning agent
(usually some flavor of iptables rule), which can then be easily
overriden globally or per section
- Multiple actions are defined as action_* to serve as shortcuts
rephrased (Closes: #402350)
* Added mail-whois-lines action, which emails log lines containing abuser
IP. Those lines are often required for proper abuse reports sent to the
Internet providers. Forwarding of such received emails to the email
addresses of abuse departments present in the output of whois is a
tentative solution for semi-automatic abuse reporting (Closes: #358810)
from jail.{conf,local} into an action or a filter definition (closes:
#398739)
* Removed Uploaded field from control since I am a DD now. Big thanks to
Barak Pearlmutter for being the sponsor of my packages for few
years.
invoking mail actions (closes: #396668)
* Removed obsolete entries in TODO and README
* README.Debian describes a bit issue of interpolations vs parameters
passed from jail.{conf,local} into an action or a filter definition
(closes: #398739)
* Initial version of postfix filter (closes: #377711)
react to client command to stop. Handling of status was adjusted as well
* Added apache-noscript to jail.conf
* Default action does not send emails to be inline with previous (0.6.x)
behavior
* Robust startup: if iptables module gets fully initialized after
startup of fail2ban, fail2ban will do "maxreinit" attempts to
initialize its own firewall. It will sleep between attempts for
"polltime" number of seconds (closes: #334272).
* To overcome possible conflict with other firewall solutions and as a
secondary solution for the bug 334272, fail2ban startup is moved
during bootup to the latest (S99) sequenece position. That should not
cause any discomfort I believe.
* Fixed handling of SYSLOG logging target. Now it can log
to any SYSLOG target and facility as directed by the
config
* Format of SYSLOG entries fixed to look closer to standard
* Fixed errata in config/gentoo-confd
* Introduced findtime configuration variable to control the
lifetime of caught "failed" log entries
git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@195 a942ae1a-1317-0410-a47c-b1dcaea8d605
Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser remoteuser
As we assume username can include anything including spaces its prudent to put
.* here. The remote user can also exist as anything so lets not make assumptions again.
.* here. The remote user can also exist as anything so lets not make assumptions again::
failregex = ^%(__prefix_line)sFailed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
So this works. The problem is if the .* after remote user is injected by the
user to be 'from 1.2.3.4'. The resultant log line is.
user to be 'from 1.2.3.4'. The resultant log line is::
Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4
Testing with:
Testing with::
fail2ban-regex -v 'Sep 29 17:15:02 Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4' '^ Failed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$'
TIP: I've removed the bit that matches __prefix_line from the regex and log.
.. TIP:: I've removed the bit that matches __prefix_line from the regex and log.
Shows:
Shows::
1) [1] ^ Failed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
1.2.3.4 Sun Sep 29 17:15:02 2013
@@ -412,14 +426,14 @@ The result was that 1.2.3.4 was matched, injected by the user, and the wrong IP
was banned.
The solution here is to make the first .* non-greedy with .*?. Here it matches
as little as required and the fail2ban-regex tool shows the output:
as little as required and the fail2ban-regex tool shows the output::
fail2ban-regex -v 'Sep 29 17:15:02 Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4' '^ Failed \S+ for .*? from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$'
1) [1] ^ Failed \S+ for .*? from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
127.0.0.1 Sun Sep 29 17:15:02 2013
So the general case here is a log line that contains:
So the general case here is a log line that contains::
message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to abusix.com is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process.)\n\n This mail was generated by Fail2Ban in a X-ARF format! You can find more information about x-arf at http://www.x-arf.org/specification.html.\n\nThe recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here: https://abusix.com/global-reporting/abuse-contact-db\nabusix.com is neither responsible nor liable for the content or accuracy of this message.\n
# Option: loglines
# Notes.: The number of log lines to search for the IP for the report
loglines = 9000
# Option: mailcmd
# Notes.: Your system mail command. It is passed the recipient
# Values: CMD
#
mailcmd = /usr/sbin/sendmail
# Option: mailargs
# Notes.: Additional arguments to mail command. e.g. for standard Unix mail:
# CC reports to another address:
# -c me@example.com
# Appear to come from a different address - the '--' indicates
# arguments to be passed to Sendmail:
# -- -f me@example.com
# Values: [ STRING ]
#
mailargs = -f <sender>
# Option: tlp
# Notes.: Traffic light protocol defining the sharing of this information.
# http://www.trusted-introducer.org/ISTLPv11.pdf
# green is share to those involved in network security but it is not
# to be released to the public.
tlp = green
# ALL of the following parameters should be set so the report contains
# meaningful information
# Option: service
# Notes.: This is the service type that was attacked. e.g. ssh, pop3
service = unspecified
# Option: logpath
# Notes: Path to the log files which contain relevant lines for the abuser IP
# Values: Filename(s) space separated and can contain wildcards (these are
# greped for the IP so make sure these aren't too long
logpath = /dev/null
# Option: sender
# Notes.: This is the sender that is included in the XARF report
sender = fail2ban@`uname -n`
# Option: port
# Notes.: This is the port number that received the login-attack
# Fail2Ban filter to match web requests for selected URLs that don't exist
#
# This filter is aimed at blocking specific URLs that don't exist. This
# could be a set of URLs places in a Disallow: directive in robots.txt or
# just some web services that don't exist caused bots are searching for
# exploitable content. This filter is designed to have a low false postitive
# rate due.
#
# An alternative to this is the apache-noscript filter which blocks all
# types of scripts that don't exist.
#
#
# This is normally a predefined list of exploitable or valuable web services
# that are hidden or aren't actually installed.
#
[INCLUDES]
# overwrite with apache-common.local if _apache_error_client is incorrect.
before = apache-common.conf
[Definition]
failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): <webroot><block>(, referer: \S+)?\s*$
^%(_apache_error_client)s script '<webroot><block>' not found or unable to stat(, referer: \S+)?\s*$
ignoreregex =
[Init]
# Webroot represents the webroot on which all other files are based
webroot = /var/www/
# Block is the actual non-found directories to block
block = (<webmail>|<phpmyadmin>|<wordpress>)[^,]*
# These are just convient definitions that assist the blocking of stuff that
# searched for other failures. This tag can be used multiple times.
# Values: TEXT
#
failregex = ^(?:\.\d+)? \[info\] <0\.\d+\.\d>@ejabberd_c2s:wait_for_feature_request:\d+ \([^\)]+\) Failed authentication for \S+ from IP <HOST>$
failregex = ^=INFO REPORT==== ===\nI\(<0\.\d+\.0>:ejabberd_c2s:\d+\) : \([^)]+\) Failed authentication for .+ from IP <HOST> \({{(?:\d+,){3}\d+},\d+}\)$
^(?:\.\d+)? \[info\] <0\.\d+\.\d>@ejabberd_c2s:wait_for_feature_request:\d+ \([^\)]+\) Failed authentication for \S+ from IP <HOST>$
ignoreregex =
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
[Init]
# "maxlines" is number of log lines to buffer for multi-line regex searches
maxlines = 2
# Option: journalmatch
# Notes.: systemd journalctl style match filter for journal based backend
^%(pid)s \S+ %(host_info)sF=(<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$
^%(pid)s \S+ SA: Action: flagged as Spam but accepted: score=\d+\.\d+ required=\d+\.\d+ \(scanned in \d+/\d+ secs \| Message-Id: \S+\)\. From \S+ \(host=\S+ \[<HOST>\]\) for <honeypot>$
^%(pid)s \S+ SA: Action: silently tossed message: score=\d+\.\d+ required=\d+\.\d+ trigger=\d+\.\d+ \(scanned in \d+/\d+ secs \| Message-Id: \S+\)\. From \S+ \(host=(\S+ )?\[<HOST>\]\) for \S+$
ignoreregex =
[Init]
# Option: honeypot
# Notes.: honeypot is an email address that isn't published anywhere that a
# legitimate email sender would send email too.
# Values: email address
honeypot = trap@example.com
# DEV Notes:
# The %(host_info) defination contains a <HOST> match
__errmsg = (?:�ϥΪ�\[.*\]���ҥ���|ʹ����\[.*\]��֤ʧ��|\[.*\] kullan�c�s� i�in giri� hatal�|�������������������������������� \[.*\]|Godkjennelse mislyktes for \[.*\]|Beh�righetskontroll misslyckas f�r anv�ndare \[.*\]|Autentifikacia uzivatela zlyhala \[.*\]|Autentificare esuata pentru utilizatorul \[.*\]|Autentica��o falhou para usu�rio \[.*\]|Autentyfikacja nie powiod�a si� dla u�ytkownika \[.*\]|Autorisatie faalde voor gebruiker \[.*\]|\[.*\] �����������|Autenticazione falita per l'utente \[.*\]|Azonos�t�s sikertelen \[.*\] felhaszn�l�nak|\[.*\] c'est un batard, il connait pas son code|Erreur d'authentification pour l'utilisateur \[.*\]|Autentificaci�n fallida para el usuario \[.*\]|Authentication failed for user \[.*\]|Authentifizierung fehlgeschlagen f�r Benutzer \[.*\].|Godkendelse mislykkedes for \[.*\]|Autentifikace u�ivatele selhala \[.*\])
__errmsg = (?:Godkendelse mislykkedes for \[.*\]|Authentifizierung fehlgeschlagen für Benutzer \[.*\].|Authentication failed for user \[.*\]|Autentificación fallida para el usuario \[.*\]|\[.*\] c'est un batard, il connait pas son code|Erreur d'authentification pour l'utilisateur \[.*\]|Azonosítás sikertelen \[.*\] felhasználónak|Autenticazione falita per l'utente \[.*\]|Autorisatie faalde voor gebruiker \[.*\]|Godkjennelse mislyktes for \[.*\]|\[.*\] kullanýcýsý için giriþ hatalý|Autenticação falhou para usuário \[.*\]|Autentificare esuata pentru utilizatorul \[.*\]|Autentifikace uživatele selhala \[.*\]|Autentyfikacja nie powiodła się dla użytkownika \[.*\]|Autentifikacia uzivatela zlyhala \[.*\]|Behörighetskontroll misslyckas för användare \[.*\]|Авторизация не удалась пользователю \[.*\]|\[.*\] 嶸盪 檣隸 褒ぬ|妏蚚氪\[.*\]桄痐囮啖|使用者\[.*\]驗證失敗)
failregex = ^\s*(\[(\s[+-][0-9]{4})?\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. .* in .*?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
failregex = ^\s*(\[\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. .* in .*?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
^(?P<__prefix>%(__prefix_line)s\w+: )<[^@]+@[^>]+>\.\.\. No such user here<SKIPLINES>(?P=__prefix)from=<[^@]+@[^>]+>, size=\d+, class=\d+, nrcpts=\d+, bodytype=\w+, proto=E?SMTP, daemon=MTA, relay=\S+ \[<HOST>\]$
ignoreregex =
# DEV Notes:
[Init]
# "maxlines" is number of log lines to buffer for multi-line regex searches
maxlines = 10
# DEV NOTES:
#
# Regarding the last multiline regex:
#
# There can be a nunber of non-related lines between the first and second part
# of this regex maxlines of 10 is quite generious. Only one of the
# "No such user" lines needs to be matched before the line with the HOST.
#
# Note the capture __prefix, includes both the __prefix_lines (which includes
# the sendmail PID), but also the \w+ which the the sendmail assigned mail ID.
^%(__prefix_line)sReceived disconnect from <HOST>: 3: \S+: Auth fail$
^%(__prefix_line)sUser .+ from <HOST> not allowed because a group is listed in DenyGroups\s*$
^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked<SKIPLINES>(?P=__prefix)(?:error: )?Received disconnect from <HOST>: 11: .+ \[preauth\]$
^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\]<SKIPLINES>(?P=__prefix)(?:error: )?Connection closed by <HOST> \[preauth\]$
^(?P<__prefix>%(__prefix_line)s)Connection from <HOST> port \d+(?: on \S+ port \d+)?<SKIPLINES>(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$
ignoreregex =
[Init]
# "maxlines" is number of log lines to buffer for multi-line regex searches
failregex = ^ LOG\d\[\d+:\d+\]:\ SSL_accept from <HOST>:\d+ : (?P<CODE>[\dA-F]+): error:(?P=CODE):SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate$
# DEV NOTES:
#
# Author: Daniel Black
#
# Based off: http://www.fail2ban.org/wiki/index.php/Fail2ban:Community_Portal#stunnel4
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Vid Luther