pristine-tar data for fail2ban_0.8.8.orig.tar.gz

.gitignore

@@ -1 +0,0 @@
-*~

.project

@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<projectDescription>
-	<name>fail2ban-unstable</name>
-	<comment></comment>
-	<projects>
-	</projects>
-	<buildSpec>
-		<buildCommand>
-			<name>org.python.pydev.PyDevBuilder</name>
-			<arguments>
-			</arguments>
-		</buildCommand>
-	</buildSpec>
-	<natures>
-		<nature>org.python.pydev.pythonNature</nature>
-	</natures>
-</projectDescription>

.pydevproject

@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<?eclipse-pydev version="1.0"?>
-
-<pydev_project>
-<pydev_property name="org.python.pydev.PYTHON_PROJECT_VERSION">python 2.3</pydev_property>
-<pydev_pathproperty name="org.python.pydev.PROJECT_SOURCE_PATH">
-<path>/fail2ban-0.8/client</path>
-<path>/fail2ban-0.8/server</path>
-<path>/fail2ban-0.8/testcases</path>
-<path>/fail2ban-0.8</path>
-</pydev_pathproperty>
-</pydev_project>

.pylintrc

@@ -1,37 +0,0 @@
-# Custom pylint configuration for the Fail2Ban project
-#
-# Set your PYLINTRC environment variable to point to this file
-# e.g.
-#      export PYLINTRC=$PWD/.pylintrc
-
-[FORMAT]
-indent-string='\t'
-
-[BASIC]
-# Fail2Ban uses non-conventional to Python world camel-casing
-# These regexps were originally borrowed from 0.4.x series of
-# PyMVPA which had similar conventions.
-
-# Regular expression which should only match correct module names
-module-rgx=(([a-z][a-z0-9_]*)|([A-Z][a-zA-Z0-9_]+))$
-
-attr-rgx=[a-z_][a-zA-Z0-9_]{2,30}
-
-# Regular expression which should only match correct class names
-class-rgx=[A-Z_]+[a-zA-Z0-9]+$
-
-# Regular expression which should only match correct function names
-function-rgx=[a-z_]+[a-z_][a-zA-Z0-9]*$
-
-# Regular expression which should only match correct method names
-method-rgx=([a-z_]|__)[a-zA-Z0-9]*(__)?$
-
-# Regular expression which should only match correct argument names
-argument-rgx=[a-z][a-zA-Z0-9]*_*[a-zA-Z0-9]*_*[a-zA-Z0-9]*_?$
-
-# Regular expression which should only match correct variable names
-variable-rgx=([a-z_]+[a-zA-Z0-9]*_*[a-zA-Z0-9]*_*[a-zA-Z0-9]*_?||(__.*__))$||[A-Z]
-
-# Regular expression which should only match correct module level names
-# Default: (([A-Z_][A-Z1-9_]*)|(__.*__))$
-const-rgx=([a-z_]+[a-zA-Z0-9]*_*[a-zA-Z0-9]*_*[a-zA-Z0-9]*_?|__.*__)$||[A-Z]

COPYING

@@ -1,368 +0,0 @@
-The following copyright applies to all files present in the Fail2ban package,
-except if a different copyright is explicitly defined in this file.
-
-
-		    GNU GENERAL PUBLIC LICENSE
-		       Version 2, June 1991
-
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-			    Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Lesser General Public License instead.)  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
-
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-		    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
-
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
-
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-
-  8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
-
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
-			    NO WARRANTY
-
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
-		     END OF TERMS AND CONDITIONS
-
-	    How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) year name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.
-
----------------------------------
-The file server/iso8601.py is licensed under the following terms.
-
-
-Copyright (c) 2007 Michael Twomey
-
-Permission is hereby granted, free of charge, to any person obtaining a
-copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be included
-in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

ChangeLog

@@ -1,549 +0,0 @@
-                         __      _ _ ___ _               
-                        / _|__ _(_) |_  ) |__  __ _ _ _  
-                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
-                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
-
-================================================================================
-Fail2Ban (version 0.8.7)                                              2012/07/31
-================================================================================
-
-ver. 0.8.7 (2012/07/31) - stable
-----------
-
-- Fixes:
-  Tom Hendrikx & Jeremy Olexa
-   * [0eaa4c2,444e4ac] Fix Gentoo init script: $opts variable is deprecated.
-     See http://forums.gentoo.org/viewtopic-t-899018.html
-  Chris Reffett
-   * [a018a26] Fixed addBannedIP to add enough failures to trigger a ban,
-     rather than just one failure.
-  Yaroslav Halchenko
-   * [4c76fb3] allow trailing white-spaces in lighttpd-auth.conf
-   * [25f1e8d] allow trailing whitespace in few missing it regexes for sshd.conf
-   * [ed16ecc] enforce "ip" field returned as str, not unicode so that log
-     message stays non-unicode. Close gh-32
-   * [b257be4] added %m-%d-%Y pattern + do not add %Y for Feb 29 fix if
-     already present in the pattern
-   * [47e956b] replace "|" with "_" in ipmasq-ZZZzzz|fail2ban.rul to be
-     friend to developers stuck with Windows (Closes gh-66)
-   * [80b191c] anchor grep regexp in actioncheck to not match partial names
-     of the jails (Closes: #672228) (Thanks Szépe Viktor for the report)
-- New features:
-  François Boulogne
-   * [a7cb20e..] add lighttpd-auth filter/jail
-  Lee Clemens & Yaroslav Halchenko
-   * [e442503] pyinotify backend (default if backend='auto' and pyinotify
-     is available)
-   * [d73a71f,3989d24] usedns parameter for the jails to allow disabling
-     use of DNS
-  Tom Hendrikx
-   * [f94a121..] 'recidive' filter/jail to monitor fail2ban.conf to ban
-     repeated offenders. Close gh-19
-  Xavier Devlamynck
-   * [7d465f9..] Add asterisk support
-  Zbigniew Jędrzejewski-Szmek
-   * [de502cf..] allow running fail2ban as non-root user (disabled by
-     default) via xt_recent. See doc/run-rootless.txt
-- Enhancements
-  Lee Clemens
-   * [47c03a2] files/nagios - spelling/grammar fixes
-   * [b083038] updated Free Software Foundation's address
-   * [9092a63] changed TLDs to invalid domains, in accordance with RFC 2606
-   * [642d9af,3282f86] reformated printing of jail's name to be consistent
-     with init's info messages
-   * [3282f86] uniform use of capitalized Jail in the messages
-  Leonardo Chiquitto
-   * [4502adf] Fix comments in dshield.conf and mynetwatchman.conf
-     to reflect code
-   * [a7d47e8] Update Free Software Foundation's address
-  Petr Voralek
-   * [4007751] catch failed ssh logins due to being listed in DenyUsers.
-     Close gh-47 (Closes: #669063)
-  Yaroslav Halchenko
-   * [MANY]    extended and robustified unittests: test different backends
-   * [d9248a6] refactored Filter's to avoid duplicate functionality
-   * [7821174] direct users to issues on github
-   * [d2ffee0..] re-factored fail2ban-regex -- more condensed output by
-     default with -v to control verbosity
-   * [b4099da] adjusted header for config/*.conf to mention .local and way
-     to comment (Thanks Stefano Forli for the note)
-   * [6ad55f6] added failregex for wu-ftpd to match against syslog instead
-     of DoS-prone auth.log's rhost (Closes: #514239)
-   * [2082fee] match possibly present "pam_unix(sshd:auth):" portion for
-     sshd filter (Closes: #648020)
-  Yehuda Katz & Yaroslav Halchenko
-   * [322f53e,bd40cc7] ./DEVELOP -- documentation for developers
-
-ver. 0.8.6 (2011/11/28) - stable
-----------
-- Fixes:
-  Markos Chandras & Yaroslav Halchenko
-   * [492d8e5,bd658fc] Use hashlib (instead of deprecated md5) where available
-  Robert Trace & Michael Lorant
-   * [c48c2b1] gentoo-initd cleanup and fixes: assure /var/run + remove stale
-     sock file
-  Michael Saavedra
-   * [3a58d0e] Lock server's executeCmd to prevent racing among iptables calls:
-     see http://bugs.debian.org/554162
-  Yaroslav Halchenko
-   * [3eb5e3b] Allow for trailing spaces in sasl logs
-   * [1632244] Stop server-side communication before stopping the
-     jails (prevents lockup if actions use fail2ban-client upon
-     unban): see https://github.com/fail2ban/fail2ban/issues/7
-   * [5a2d518] Various changes to reincarnate unittests
-  Yehuda Katz
-   * Wiki was cleaned from SPAM
-- Enhancements:
-  Adam Spiers
-   * [3152afb] Recognise time-stamped kernel messages
-  Guido Bozzetto
-   * [713fea6] Added ipmasq rule file to restart fail2ban when iptables are
-     wiped out: see http://bugs.debian.org/461417
-  Łukasz
-   * [5f23542] Matching of month names in Polish (thanks michaelberg79
-     for QA)
-  Tom Hendrikx
-   * [9fa54cf] Added Date: header for sendmail*.conf actions
-  Yaroslav Halchenko & Tom Hendrikx
-   * [b52d420..22b7007] <matches> in action files now can be used
-     to provide matched loglines which triggered action
-  Yaroslav Halchenko
-   * [ed0bf3a] Removed duplicate entry for DataCha0s/2\.0 in badbots:
-     see http://bugs.debian.org/519557
-   * [dad91f7] sshd.conf: allow user names to have spaces and
-     trailing spaces in the line
-   * [a9be451] removed expansions for few Date and Revision SVN keywords
-   * [a33135c] set/getFile for ticket.py -- found in source distribution
-     of 0.8.4
-   * [fbce415] additional logging while stopping the jails
-
-ver. 0.8.5 (2011/07/28) - stable
-----------
-- Fix: use addfailregex instead of failregex while processing per-jail
-  "failregex" parameter (Fixed Debian bug #635830, LP: #635036). Thanks to
-  Marat Khayrullin for the patch and Daniel T Chen for forwarding to
-  Debian.
-- Fix: use os.path.join to generate full path - fixes includes in configs
-  given local filename (5 weeks ago) [yarikoptic]
-- Fix: allowed for trailing spaces in proftpd logs
-- Fix: escaped () in pure-ftpd filter. Thanks to Teodor
-- Fix: allowed space in the trailing of failregex for sasl.conf:
-  see http://bugs.debian.org/573314
-- Fix: use /var/run/fail2ban instead of /tmp for temp files in actions:
-  see http://bugs.debian.org/544232
-- Fix: Tai64N stores time in GMT, needed to convert to local time before
-  returning
-- Fix: disabled named-refused-udp jail entirely with a big fat warning
-- Fix: added time module. Bug reported in buanzo's blog:
-  see http://blogs.buanzo.com.ar/2009/04/fail2ban-patch-ban-ip-address-manually.html
-- Fix: Patch to make log file descriptors cloexec to stop leaking file
-  descriptors on fork/exec. Thanks to Jonathan Underwood:
-  see https://bugzilla.redhat.com/show_bug.cgi?id=230191#c24
-- Enhancement: added author for dovecot filter and pruned unneeded space
-  in the regexp
-- Enhancement: proftpd filter -- if login failed -- count regardless of the
-  reason for failure
-- Enhancement: added <chain> to action.d/iptables*. Thanks to Matthijs Kooijman:
-  see http://bugs.debian.org/515599
-- Enhancement: added filter.d/dovecot.conf from Martin Waschbuesch
-- Enhancement: made filter.d/apache-overflows.conf catch more:
-  see http://bugs.debian.org/574182
-- Enhancement: added dropbear filter from Francis Russell and Zak B. Elep:
-  see http://bugs.debian.org/546913
-- Enhancement: changed default ignoreip to ignore entire loopback zone (/8):
-  see http://bugs.debian.org/598200
-- Minor: spell-checked jail.conf. Thanks to Christoph Anton Mitterer
-- Few minor cosmetic changes
-
-ver. 0.8.4 (2009/09/07) - stable
-----------
-- Check the inode number for rotation in addition to checking the first line of
-  the file. Thanks to Jonathan Kamens. Red Hat #503852. Tracker #2800279.
-- Moved the shutdown of the logging subsystem out of Server.quit() to
-  the end of Server.start(). Fixes the 'cannot release un-acquired lock'
-  error.
-- Added "Ban IP" command. Thanks to Arturo 'Buanzo' Busleiman.
-- Added two new filters: lighttpd-fastcgi and php-url-fopen.
-- Fixed the 'unexpected communication error' problem by means of
-  use_poll=False in Python >= 2.6.
-- Merged patches from Debian package. Thanks to Yaroslav Halchenko.
-- Use current day and month instead of Jan 1st if both are not available in the
-  log. Thanks to Andreas Itzchak Rehberg.
-- Try to match the regex even if the line does not contain a valid date/time.
-  Described in Debian #491253. Thanks to Yaroslav Halchenko.
-- Added/improved filters and date formats.
-- Added actions to report abuse to ISP, DShield and myNetWatchman. Thanks to
-  Russell Odom.
-- Suse init script. Remove socket file on startup is fail2ban crashed. Thanks to
-  Detlef Reichelt.
-- Removed begin-line anchor for "standard" timestamp. Fixed Debian bug #500824.
-- Added nagios script. Thanks to Sebastian Mueller.
-- Added CPanel date format. Thanks to David Collins. Tracker #1967610.
-- Improved SASL filter. Thanks to Loic Pefferkorn. Tracker #2310410.
-- Added NetBSD ipfilter (ipf command) action. Thanks to Ed Ravin. Tracker
-  #2484115.
-- Added cyrus-imap and sieve filters. Thanks to Jan Wagner. Debian bug #513953.
-- Changed <HOST> template to be more restrictive. Debian bug #514163.
-- Use timetuple instead of utctimetuple for ISO 8601. Maybe not a 100% correct
-  fix but seems to work. Tracker #2500276.
-- Made the named-refused regex a bit less restrictive in order to match logs
-  with "view". Thanks to Stephen Gildea.
-- Fixed maxretry/findtime rate. Many thanks to Christos Psonis. Tracker
-  #2019714.
-
-ver. 0.8.3 (2008/07/17) - stable
-----------
-- Process failtickets as long as failmanager is not empty.
-- Added "pam-generic" filter and more configuration fixes. Thanks to Yaroslav
-  Halchenko.
-- Fixed socket path in redhat and suse init script. Thanks to Jim Wight.
-- Fixed PID file while started in daemon mode. Thanks to Christian Jobic who
-  submitted a similar patch.
-- Fixed "fail2ban-client get <jail> logpath". Bug #1916986.
-- Added gssftpd filter. Thanks to Kevin Zembower.
-- Added "Day/Month/Year Hour:Minute:Second" date template. Thanks to Dennis
-  Winter.
-- Fixed ignoreregex processing in fail2ban-client. Thanks to René Berber.
-- Added ISO 8601 date/time format.
-- Added and changed some logging level and messages.
-- Added missing ignoreregex to filters. Thanks to Klaus Lehmann.
-- Use poll instead of select in asyncore.loop. This should solve the "Unknown
-  error 514". Thanks to Michael Geiger and Klaus Lehmann.
-
-ver. 0.8.2 (2008/03/06) - stable
-----------
-- Fixed named filter. Thanks to Yaroslav Halchenko
-- Fixed wrong path for apache-auth in jail.conf. Thanks to Vincent Deffontaines
-- Fixed timezone bug with epoch date template. Thanks to Michael Hanselmann
-- Added "full line failregex" patch. Thanks to Yaroslav Halchenko. It will be
-  possible to create stronger failregex against log injection
-- Fixed ipfw action script. Thanks to Nick Munger
-- Removed date from logging message when using SYSLOG. Thanks to Iain Lea
-- Fixed "ignore IPs". Only the first value was taken into account. Thanks to
-  Adrien Clerc
-- Moved socket to /var/run/fail2ban.
-- Rewrote the communication server.
-- Refactoring. Reduced number of files.
-- Removed Python 2.4. Minimum required version is now Python 2.3.
-- New log rotation detection algorithm.
-- Print monitored files in status.
-- Create a PID file in /var/run/fail2ban/. Thanks to Julien Perez.
-- Fixed "Feb 29" bug. Thanks to James Andrewartha who pointed this out. Thanks
-  to Yaroslav Halchenko for the fix.
-- "reload <jail>" reloads a single jail and the parameters in fail2ban.conf.
-- Added Mac OS/X startup script. Thanks to Bill Heaton.
-- Absorbed some Debian patches. Thanks to Yaroslav Halchenko.
-- Replaced "echo" with "printf" in actions. Fix #1839673
-- Replaced "reject" with "drop" in shorwall action. Fix #1854875
-- Fixed Debian bug #456567, #468477, #462060, #461426
-- readline is now optional in fail2ban-client (not needed in fail2ban-server).
-
-ver. 0.8.1 (2007/08/14) - stable
-----------
-- Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
-- Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko
-- Improved regular expressions. Thanks to Yaroslav Halchenko and others
-- Added sendmail actions. The action started with "mail" are now deprecated.
-  Thanks to Raphaël Marichez
-- Added "ignoreregex" support to fail2ban-regex
-- Updated suse-initd and added it to MANIFEST. Thanks to Christian Rauch
-- Tightening up the pid check in redhat-initd. Thanks to David Nutter
-- Added webmin authentication filter. Thanks to Guillaume Delvit
-- Removed textToDns() which is not required anymore. Thanks to Yaroslav
-  Halchenko
-- Added new action iptables-allports. Thanks to Yaroslav Halchenko
-- Added "named" date format to date detector. Thanks to Yaroslav Halchenko
-- Added filter file for named (bind9). Thanks to Yaroslav Halchenko
-- Fixed vsftpd filter. Thanks to Yaroslav Halchenko
-
-ver. 0.8.0 (2007/05/03) - stable
-----------
-- Fixed RedHat init script. Thanks to Jonathan Underwood
-- Added Solaris 10 files. Thanks to Hanno 'Rince' Wagner
-
-ver. 0.7.9 (2007/04/19) - release candidate
-----------
-- Close opened handlers. Thanks to Yaroslav Halchenko
-- Fixed "reload" bug. Many many thanks to Yaroslav Halchenko
-- Added date format for asctime without year
-- Modified filters config. Thanks to Michael C. Haller
-- Fixed a small bug in mail-buffered.conf
-
-ver. 0.7.8 (2007/03/21) - release candidate
-----------
-- Fixed asctime pattern in datedetector.py
-- Added new filters/actions. Thanks to Yaroslav Halchenko
-- Added Suse init script and modified gentoo-initd. Thanks to Christian Rauch
-- Moved every locking statements in a try..finally block
-
-ver. 0.7.7 (2007/02/08) - release candidate
-----------
-- Added signal handling in fail2ban-client
-- Added a wonderful visual effect when waiting on the server
-- fail2ban-client returns an error code if configuration is not valid
-- Added new filters/actions. Thanks to Yaroslav Halchenko
-- Call Python interpreter directly (instead of using "env")
-- Added file support to fail2ban-regex. Benchmark feature has been removed
-- Added cacti script and template.
-- Added IP list in "status <JAIL>". Thanks to Eric Gerbier
-
-ver. 0.7.6 (2007/01/04) - beta
-----------
-- Added a "sleep 1" in redhat-initd. Thanks to Jim Wight
-- Use /dev/log for SYSLOG output. Thanks to Joerg Sommrey
-- Use numeric output for iptables in "actioncheck"
-- Fixed removal of host in hosts.deny. Thanks to René Berber
-- Added new date format (2006-12-21 06:43:20) and Exim4 filter. Thanks to mEDI
-- Several "failregex" and "ignoreregex" are now accepted. Creation of rules
-  should be easier now.
-- Added license in COPYING. Thanks to Axel Thimm
-- Allow comma in action options. The value of the option must be escaped with "
-  or '. Thanks to Yaroslav Halchenko
-- Now Fail2ban goes in /usr/share/fail2ban instead of /usr/lib/fail2ban. This is
-  more compliant with FHS. Thanks to Axel Thimm and Yaroslav Halchenko
-
-ver. 0.7.5 (2006/12/07) - beta
-----------
-- Do not ban a host that is currently banned. Thanks to Yaroslav Halchenko
-- The supported tags in "action(un)ban" are <ip>, <failures> and <time>
-- Fixed refactoring bug (getLastcommand -> getLastAction)
-- Added option "ignoreregex" in filter scripts and jail.conf. Feature Request
-  #1283304
-- Fixed a bug in user defined time regex/pattern
-- Improved documentation
-- Moved version.py and protocol.py to common/
-- Merged "maxtime" option with "findtime"
-- Added "<HOST>" tag support in failregex which matches default IP
-  address/hostname. "(?P<host>\S)" is still valid and supported
-- Fixed exception when calling fail2ban-server with unknown option
-- Fixed Debian bug 400162. The "socket" option is now handled correctly by
-  fail2ban-client
-- Fixed RedHat init script. Thanks to Justin Shore
-- Changed timeout to 30 secondes before assuming the server cannot be started.
-  Thanks to Joël Bertrand
-
-ver. 0.7.4 (2006/11/01) - beta
-----------
-- Improved configuration files. Thanks to Yaroslav Halchenko
-- Added man page for "fail2ban-regex"
-- Moved ban/unban messages from "info" level to "warn"
-- Added "-s" option to specify the socket path and "socket" option in
-  "fail2ban.conf"
-- Added "backend" option in "jail.conf"
-- Added more filters/actions and jail samples. Thanks to Nick Munger, Christoph
-  Haas
-- Improved testing framework
-- Fixed a bug in the return code handling of the executed commands. Thanks to
-  Yaroslav Halchenko
-- Signal handling. There is a bug with join() and signal in Python
-- Better debugging output for "fail2ban-regex"
-- Added support for more date format
-- cPickle does not work with Python 2.5. Use pickle instead (performance is not
-  a problem in our case)
-
-ver. 0.7.3 (2006/09/28) - beta
-----------
-- Added man pages. Thanks to Yaroslav Halchenko
-- Added wildcard support for "logpath"
-- Added Gamin (file and directory monitoring system) support
-- (Re)added "ignoreip" option
-- Added more concurrency protection
-- First attempt at solving bug #1457620 (locale issue)
-- Performance improvements
-- (Re)added permanent banning with banTime < 0
-- Added DNS support to "ignoreip". Feature Request #1285859
-
-ver. 0.7.2 (2006/09/10) - beta
-----------
-- Refactoring and code cleanup
-- Improved client output
-- Added more get/set commands
-- Added more configuration templates
-- Removed "logpath" and "maxretry" from filter templates. They must be defined
-  in jail.conf now
-- Added interactive mode. Use "-i"
-- Added a date detector. "timeregex" and "timepattern" are no more needed
-- Added "fail2ban-regex". This is a tool to help finding "failregex"
-- Improved server communication. Start a new thread for each incoming request.
-  Fail2ban is not really thread-safe yet
-
-ver. 0.7.1 (2006/08/23) - alpha
-----------
-- Fixed daemon mode bug
-- Added Gentoo init.d script
-- Fixed path bug when trying to start "fail2ban-server"
-- Fixed reload command
-
-ver. 0.7.0 (2006/08/23) - alpha
-----------
-- Almost a complete rewrite :) Fail2ban design is really better (IMHO). There is
-  a lot of new features
-- Client/Server architecture
-- Multithreading. Each jail has its own threads: one for the log reading and
-  another for the actions
-- Execute several actions
-- Split configuration files. They are more readable and easy to use
-- failregex uses group (<host>) now. This feature was already present in the
-  Debian package
-- lots of things...
-
-ver. 0.6.1 (2006/03/16) - stable
-----------
-- Added permanent banning. Set banTime to a negative value to enable this
-  feature (-1 is perfect). Thanks to Mannone
-- Fixed locale bug. Thanks to Fernando José
-- Fixed crash when time format does not match data
-- Propagated patch from Debian to fix fail2ban search path addition to the path
-  search list: now it is added first. Thanks to Nick Craig-Wood
-- Added SMTP authentification for mail notification. Thanks to Markus Hoffmann
-- Removed debug mode as it is confusing for people
-- Added parsing of timestamp in TAI64N format (#1275325). Thanks to Mark
-  Edgington
-- Added patch #1382936 (Default formatted syslog logging). Thanks to Patrick
-  Börjesson
-- Removed 192.168.0.0/16 from ignoreip. Attacks could also come from the local
-  network.
-- Robust startup: if iptables module does not get fully initialized after
-  startup of fail2ban, fail2ban will do "maxreinit" attempts to initialize its
-  own firewall. It will sleep between attempts for "polltime" number of seconds
-  (closes Debian: #334272). Thanks to Yaroslav Halchenko
-- Added "interpolations" in fail2ban.conf. This is provided by the ConfigParser
-  module. Old configuration files still work. Thanks to Yaroslav Halchenko
-- Added initial support for hosts.deny and shorewall. Need more testing. Please
-  test. Thanks to kojiro from Gentoo forum for hosts.deny support
-- Added support for vsftpd. Thanks to zugeschmiert
-
-ver. 0.6.0 (2005/11/20) - stable
-----------
-- Propagated patches introduced by Debian maintainer (Yaroslav Halchenko):
-  * Added an option to report local time (including timezone) or GMT in mail
-    notification.
-
-ver. 0.5.5 (2005/10/26) - beta
-----------
-- Propagated patches introduced by Debian maintainer (Yaroslav Halchenko):
-  * Introduced fwcheck option to verify consistency of the chains. Implemented
-    automatic restart of fail2ban main function in case check of fwban or
-    fwunban command failed (closes: #329163, #331695). (Introduced patch was
-    further adjusted by upstream author).
-  * Added -f command line parameter for [findtime].
-  * Added a cleanup of firewall rules on emergency shutdown when unknown
-    exception is catched.
-  * Fail2ban should not crash now if a wrong file name is specified in config.
-  * reordered code a bit so that log targets are setup right after background
-    and then only loglevel (verbose, debug) is processed, so the warning could
-    be seen in the logs
-  * Added a keyword <section> in parsing of the subject and the body of an email
-    sent out by fail2ban (closes: #330311)
-
-ver. 0.5.4 (2005/09/13) - beta
-----------
-- Fixed bug #1286222.
-- Propagated patches introduced by Debian maintainer (Yaroslav Halchenko):
-  * Fixed handling of SYSLOG logging target. Now it can log to any SYSLOG target
-    and facility as directed by the config
-  * Format of SYSLOG entries fixed to look closer to standard
-  * Fixed errata in config/gentoo-confd
-  * Introduced findtime configuration variable to control the lifetime of caught
-    "failed" log entries
-	
-ver. 0.5.3 (2005/09/08) - beta
-----------
-- Fixed a bug when overriding "maxfailures" or "bantime". Thanks to Yaroslav
-  Halchenko
-- Added more debug output if an error occurs when sending mail. Thanks to
-  Stephen Gildea
-- Renamed "maxretry" to "maxfailures" and changed default value to 5. Thanks to
-  Stephen Gildea
-- Hopefully fixed bug #1256075
-- Fixed bug #1262345
-- Fixed exception handling in PIDLock
-- Removed warning when using "-V" or "-h" with no config file. Thanks to
-  Yaroslav Halchenko
-- Removed "-i eth0" from config file. Thanks to Yaroslav Halchenko
-
-ver. 0.5.2 (2005/08/06) - beta
-----------
-- Better PID lock file handling. Should close #1239562
-- Added man pages
-- Removed log4py dependency. Use logging module instead
-- "maxretry" and "bantime" can be overridden in each section
-- Fixed bug #1246278 (excessive memory usage)
-- Fixed crash on wrong option value in configuration file
-- Changed custom chains to lowercase
-
-ver. 0.5.1 (2005/07/23) - beta
-----------
-- Fixed bugs #1241756, #1239557
-- Added log targets in configuration file. Removed -l option
-- Changed iptables rules in order to create a separated chain for each section
-- Fixed static banList in firewall.py
-- Added an initd script for Debian. Thanks to Yaroslav Halchenko
-- Check for obsolete files after install
-
-ver. 0.5.0 (2005/07/12) - beta
-----------
-- Added support for CIDR mask in ignoreip
-- Added mail notification support
-- Fixed bug #1234699
-- Added tags replacement in rules definition. Should allow a clean solution for
-  Feature Request #1229479
-- Removed "interface" and "firewall" options
-- Added start and end commands in the configuration file. Thanks to Yaroslav
-  Halchenko
-- Added firewall rules definition in the configuration file
-- Cleaned fail2ban.py
-- Added an initd script for RedHat/Fedora. Thanks to Andrey G. Grozin
-
-ver. 0.4.1 (2005/06/30) - stable
-----------
-- Fixed textToDNS method which generated wrong matches for "rhost=12-xyz...".
-  Thanks to Tom Pike
-- fail2ban.conf modified for readability. Thanks to Iain Lea
-- Added an initd script for Gentoo
-- Changed default PID lock file location from /tmp to /var/run
-
-ver. 0.4.0 (2005/04/24) - stable
-----------
-- Fixed textToDNS which did not recognize strings like
-  "12-345-67-890.abcd.mnopqr.xyz"
-
-ver. 0.3.1 (2005/03/31) - beta
-----------
-- Corrected level of messages
-- Added DNS lookup support
-- Improved parsing speed. Only parse the new log messages
-- Added a second verbose level (-vv)
-
-ver. 0.3.0 (2005/02/24) - beta
-----------
-- Re-writting of parts of the code in order to handle several log files with
-  different rules
-- Removed sshd.py because it is no more needed
-- Fixed a bug when exiting with IP in the ban list
-- Added PID lock file
-- Improved some parts of the code
-- Added ipfw-start-rule option (thanks to Robert Edeker)
-- Added -k option which kills a currently running Fail2Ban
-
-ver. 0.1.2 (2004/11/21) - beta
-----------
-- Add ipfw and ipfwadm support. The rules are taken from BlockIt. Thanks to
-  Robert Edeker
-- Add -e option which allows to set the interface. Thanks to Robert Edeker who
-  reminded me this
-- Small code cleaning
-
-ver. 0.1.1 (2004/10/23) - beta
-----------
-- Add SIGTERM handler in order to exit nicely when in daemon mode
-- Add -r option which allows to set the maximum number of login failures
-- Remove the Metalog class as the log file are not so syslog daemon specific
-- Rewrite log reader to be service centered. Sshd support added. Match "Failed
-  password" and "Illegal user"
-- Add /etc/fail2ban.conf configuration support
-- Code documentation
-
-ver. 0.1.0 (2004/10/12) - alpha
-----------
-- Initial release

DEVELOP

@@ -1,156 +0,0 @@
-                         __      _ _ ___ _               
-                        / _|__ _(_) |_  ) |__  __ _ _ _  
-                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
-                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
-
-================================================================================
-How to develop for Fail2Ban
-================================================================================
-
-Fail2Ban uses GIT (http://git-scm.com/) distributed source control. This gives 
-each developer their own complete copy of the entire repository. Developers can 
-add and switch branches and commit changes when ever they want and then ask a 
-maintainer to merge their changes.
-
-Fail2Ban uses GitHub (https://github.com/fail2ban/fail2ban) to manage access to 
-the Git repository. GitHub provides free hosting for open-source projects as 
-well as a web-based Git repository browser and an issue tracker.
-
-If you are familiar with Python and you have a bug fix or a feature that you 
-would like to add to Fail2Ban, the best way to do so it to use the GitHub Pull 
-Request feature. You can find more details on the Fail2Ban wiki 
-(http://www.fail2ban.org/wiki/index.php/Get_Involved)
-
-Testing
-=======
-
-Existing tests can be run by executing `fail2ban-testcases`.
-
-Documentation about creating tests (when tests are required and some guidelines 
-for creating good tests) will be added soon.
-
-Coding Standards
-================
-Coming Soon.
-
-
-Design
-======
-
-Fail2Ban was initially developed with Python 2.3 (IIRC). It should
-still be compatible with Python 2.4 and such compatibility assurance
-makes code ... old-fashioned in many places (RF-Note).  In 0.7 the
-design went through major refactoring into client/server,
-a-thread-per-jail design which made it a bit difficult to follow.
-Below you can find a sketchy description of the main components of the
-system to orient yourself better.
-
-server/
-------
-
-Core classes hierarchy (feel welcome to draw a better/more complete
-one)::
-
- ->   inheritance
- +    delegation
- *    storage of multiple instances
-
- RF-Note   just a note which might be useful to address while doing RF
-
- JailThread -> Filter -> FileFilter -> {FilterPoll, FilterPyinotify, ...}
-         |     |         * FileContainer
-         |     + FailManager
-		 |     + DateDetector
-         \- -> Actions
-               * Actions
-               + BanManager
-
- Server
-   + Jails
-      * Jail
-        + Filter
-        * tickets (in __queue)
-
-failmanager.py
-~~~~~~~~~~~~~~
-
-FailManager
-
-  Keeps track of failures, recorded as 'tickets'.  All operations are
-  done via acquiring a lock
-
-FailManagerEmpty(Exception)
-
-  raised by FailManager.toBan after reaching the list of tickets
-  (RF-Note: asks to become a generator ;) )
-
-
-filter.py
-~~~~~~~~~~
-
-Filter(JailThread)
-
-  Wraps (non-threaded) FailManager (and proxies to it quite a bit),
-  and provides all primary logic for processing new lines, what IPs to
-  ignore, etc
-
-  .failManager  [FailManager]
-  .dateDetector [DateDetector]
-  .__failRegex  [list]
-  .__ignoreRegex [list]
-    Contains regular expressions for failures and ignores
-  .__findTime   [numeric]
-    Used in `processLineAndAdd` to skip old lines
-
-FileFilter(Filter):
-
-  Files-aware Filter
-
-  .__logPath [list]
-    keeps the tracked files (added 1-by-1 using addLogPath)
-    stored as FileContainer's
-  .getFailures
-    actually just returns
-    True
-      if managed to open and get lines (until empty)
-    False
-      if failed to open or absent container matching the filename
-
-FileContainer
-
-  Adapter for a file to deal with log rotation.
-
-  .open,.close,.readline
-     RF-Note: readline returns "" with handler absent... shouldn't it be None?
-  .__pos
-    Keeps the position pointer
-
-DNSUtils
-
-  Utility class for DNS and IP handling
-
-  RF-Note: convert to functions within a separate submodule
-
-
-filter*.py
-~~~~~~~~~~
-
-Implementations of FileFilter's for specific backends.  Derived
-classes should provide an implementation of `run` and usually
-override `addLogPath`, `delLogPath` methods.  In run() method they all
-one way or another provide
-
-		try:
-			while True:
-				ticket = self.failManager.toBan()
-				self.jail.putFailTicket(ticket)
-		except FailManagerEmpty:
-			self.failManager.cleanup(MyTime.time())
-
-thus channeling "ban tickets" from their failManager to a
-corresponding jail.
-
-action.py
-~~~~~~~~~
-
-Takes care about executing start/check/ban/unban/stop commands

MANIFEST

@@ -1,128 +0,0 @@
-README
-ChangeLog
-TODO
-THANKS
-COPYING
-fail2ban-client
-fail2ban-server
-fail2ban-testcases
-fail2ban-regex
-client/configreader.py
-client/configparserinc.py
-client/jailreader.py
-client/fail2banreader.py
-client/jailsreader.py
-client/beautifier.py
-client/filterreader.py
-client/actionreader.py
-client/__init__.py
-client/configurator.py
-client/csocket.py
-server/asyncserver.py
-server/filter.py
-server/filterpyinotify.py
-server/filtergamin.py
-server/filterpoll.py
-server/iso8601.py
-server/server.py
-server/actions.py
-server/faildata.py
-server/failmanager.py
-server/datedetector.py
-server/jailthread.py
-server/transmitter.py
-server/action.py
-server/ticket.py
-server/jail.py
-server/jails.py
-server/__init__.py
-server/banmanager.py
-server/datetemplate.py
-server/mytime.py
-server/failregex.py
-testcases/banmanagertestcase.py
-testcases/failmanagertestcase.py
-testcases/clientreadertestcase.py
-testcases/filtertestcase.py
-testcases/__init__.py
-testcases/datedetectortestcase.py
-testcases/actiontestcase.py
-testcases/servertestcase.py
-testcases/files/testcase01.log
-testcases/files/testcase02.log
-testcases/files/testcase03.log
-testcases/files/testcase04.log
-setup.py
-setup.cfg
-common/__init__.py
-common/helpers.py
-common/version.py
-common/protocol.py
-config/jail.conf
-config/filter.d/common.conf
-config/filter.d/apache-auth.conf
-config/filter.d/apache-badbots.conf
-config/filter.d/apache-nohome.conf
-config/filter.d/apache-noscript.conf
-config/filter.d/apache-overflows.conf
-config/filter.d/courierlogin.conf
-config/filter.d/couriersmtp.conf
-config/filter.d/cyrus-imap.conf
-config/filter.d/exim.conf
-config/filter.d/gssftpd.conf
-config/filter.d/lighttpd-fastcgi.conf
-config/filter.d/named-refused.conf
-config/filter.d/postfix.conf
-config/filter.d/proftpd.conf
-config/filter.d/pure-ftpd.conf
-config/filter.d/qmail.conf
-config/filter.d/pam-generic.conf
-config/filter.d/php-url-fopen.conf
-config/filter.d/sasl.conf
-config/filter.d/sieve.conf
-config/filter.d/sshd.conf
-config/filter.d/sshd-ddos.conf
-config/filter.d/vsftpd.conf
-config/filter.d/webmin-auth.conf
-config/filter.d/wuftpd.conf
-config/filter.d/xinetd-fail.conf
-config/action.d/complain.conf
-config/action.d/dshield.conf
-config/action.d/hostsdeny.conf
-config/action.d/ipfw.conf
-config/action.d/ipfilter.conf
-config/action.d/iptables.conf
-config/action.d/iptables-allports.conf
-config/action.d/iptables-multiport.conf
-config/action.d/iptables-multiport-log.conf
-config/action.d/iptables-new.conf
-config/action.d/mail.conf
-config/action.d/mail-buffered.conf
-config/action.d/mail-whois.conf
-config/action.d/mail-whois-lines.conf
-config/action.d/mynetwatchman.conf
-config/action.d/sendmail.conf
-config/action.d/sendmail-buffered.conf
-config/action.d/sendmail-whois.conf
-config/action.d/sendmail-whois-lines.conf
-config/action.d/shorewall.conf
-config/fail2ban.conf
-man/fail2ban-client.1
-man/fail2ban-client.h2m
-man/fail2ban-server.1
-man/fail2ban-server.h2m
-man/fail2ban-regex.1
-man/fail2ban-regex.h2m
-man/generate-man
-files/gentoo-initd
-files/gentoo-confd
-files/redhat-initd
-files/macosx-initd
-files/solaris-fail2ban.xml
-files/solaris-svc-fail2ban
-files/suse-initd
-files/cacti/fail2ban_stats.sh
-files/cacti/cacti_host_template_fail2ban.xml
-files/cacti/README
-files/nagios/check_fail2ban
-files/nagios/f2ban.txt

README

@@ -1,95 +0,0 @@
-                         __      _ _ ___ _               
-                        / _|__ _(_) |_  ) |__  __ _ _ _  
-                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
-                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
-
-================================================================================
-Fail2Ban (version 0.8.7)                                              2012/07/31
-================================================================================
-
-Fail2Ban scans log files like /var/log/pwdfail and bans IP that makes too many
-password failures. It updates firewall rules to reject the IP address. These
-rules can be defined by the user. Fail2Ban can read multiple log files such as
-sshd or Apache web server ones.
-
-This README is a quick introduction to Fail2ban. More documentation, FAQ, HOWTOs
-are available on the project website: http://www.fail2ban.org
-
-Installation:
--------------
-
-Required:
-   >=python-2.3 (http://www.python.org)
-
-Optional:
-   pyinotify:
-      >=linux-2.6.13
-      >=python-2.4
-      >=pyinotify-0.8.3 (https://github.com/seb-m/pyinotify)
-   Gamin:
-      >=gamin-0.0.21 (http://www.gnome.org/~veillard/gamin)
-
-To install, just do:
-
-> tar xvfj fail2ban-0.8.7.tar.bz2
-> cd fail2ban-0.8.7
-> python setup.py install
-
-This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
-placed into /usr/bin.
-
-It is possible that Fail2ban is already packaged for your distribution. In this
-case, you should use it.
-
-Fail2Ban should be correctly installed now. Just type:
-
-> fail2ban-client -h
-
-to see if everything is alright. You should always use fail2ban-client and never
-call fail2ban-server directly.
-
-Configuration:
---------------
-
-You can configure Fail2ban using the files in /etc/fail2ban. It is possible to
-configure the server using commands sent to it by fail2ban-client. The available
-commands are described in the man page of fail2ban-client. Please refer to it or
-to the website: http://www.fail2ban.org
-
-Contact:
---------
-
-Website: http://www.fail2ban.org
-
-You need some new features, you found bugs: visit
-https://github.com/fail2ban/fail2ban/issues
-and if your issue is not yet known -- file a bug report.
-
-If you would like to troubleshoot or discuss: join the mailing list
-https://lists.sourceforge.net/lists/listinfo/fail2ban-users
-
-If you just appreciate this program: send kudos to the original author
-(Cyril Jaquier: <cyril.jaquier@fail2ban.org>) or the mailing list
-https://lists.sourceforge.net/lists/listinfo/fail2ban-users
-
-
-Thanks:
--------
-
-See THANKS file.
-
-License:
---------
-
-Fail2Ban is free software; you can redistribute it and/or modify it under the
-terms of the GNU General Public License as published by the Free Software
-Foundation; either version 2 of the License, or (at your option) any later
-version.
-
-Fail2Ban is distributed in the hope that it will be useful, but WITHOUT ANY
-WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
-PARTICULAR PURPOSE. See the GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License along with
-Fail2Ban; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
-Suite 330, Boston, MA  02111-1307  USA

THANKS

@@ -1,47 +0,0 @@
-Fail2Ban is an open source project with many contributions from its
-users community. Below is an alphabetically sorted partial list of the
-contributors to the project.  If you have been left off, please let us
-know (preferably send a pull request on github with the "fix") and you
-will be added
-
-Adrien Clerc
-Andrey G. Grozin
-Arturo 'Buanzo' Busleiman
-Axel Thimm
-Bill Heaton
-Christian Rauch
-Christoph Haas
-Christos Psonis
-Daniel B. Cid
-David Nutter
-Eric Gerbier
-Guillaume Delvit
-Hanno 'Rince' Wagner
-Iain Lea
-Jonathan Kamens
-Jonathan Underwood
-Joël Bertrand
-Justin Shore
-Kévin Drapel
-kojiro
-Mark Edgington
-Markus Hoffmann
-Marvin Rouge
-mEDI
-Michael C. Haller
-Michael Hanselmann
-NickMunger
-Patrick Börjesson
-Raphaël Marichez
-René Berber
-Robert Edeker
-Russell Odom
-Sireyessire
-Stephen Gildea
-Tom Pike
-Tyler
-Vaclav Misek
-Vincent Deffontaines
-Yaroslav Halchenko
-Yehuda Katz
-zugeschmiert

TODO

@@ -1,54 +0,0 @@
-                         __      _ _ ___ _               
-                        / _|__ _(_) |_  ) |__  __ _ _ _  
-                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
-                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
-
-================================================================================
-ToDo
-================================================================================
-
-Legend:
-- not yet done
-? maybe
-# partially done
-* done
-
-- Removed relative imports
-
-- Cleanup fail2ban-client and fail2ban-server. Move code to server/ and client/
-
-- Add timeout to external commands (signal alarm, watchdog thread, etc)
-
-- Uniformize filters and actions name. Use the software name (openssh, postfix,
-  proftp) and possible qualifier (e.g. auth) after a '-'
-
-- Added <USER> tag for failregex. Add features using this information. Maybe add
-  more tags
-
-- Look at the memory consumption. Decrease memory usage
-
-- More detailed statistics
-
-- Auto-enable function (search for log files), check modification date to see if
-  service is still in use
-
-- Improve parsing of the action parameters in jailreader.py
-
-- Better handling of the protocol in transmitter.py
-
-- Add gettext support (I18N)
-
-- Multiline log reading
-
-- Improve execution of action. Why does subprocess.call deadlock with
-  multi-jails?
-
-# see Feature Request Tracking System at SourceForge.net
-
-# improve documentation and website for user
-
-# better return values in function
-
-# refactoring in server.py, actions.py, filter.py
-
-* New backend: pyinotify

client/__init__.py

@@ -1,28 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"

client/actionreader.py

@@ -1,93 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import logging
-from configreader import ConfigReader
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.client.config")
-
-class ActionReader(ConfigReader):
-	
-	def __init__(self, action, name):
-		ConfigReader.__init__(self)
-		self.__file = action[0]
-		self.__cInfo = action[1]
-		self.__name = name
-	
-	def setFile(self, fileName):
-		self.__file = fileName
-	
-	def getFile(self):
-		return self.__file
-	
-	def setName(self, name):
-		self.__name = name
-	
-	def getName(self):
-		return self.__name
-	
-	def read(self):
-		return ConfigReader.read(self, "action.d/" + self.__file)
-	
-	def getOptions(self, pOpts):
-		opts = [["string", "actionstart", ""],
-				["string", "actionstop", ""],
-				["string", "actioncheck", ""],
-				["string", "actionban", ""],
-				["string", "actionunban", ""]]
-		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
-		
-		if self.has_section("Init"):
-			for opt in self.options("Init"):
-				if not self.__cInfo.has_key(opt):
-					self.__cInfo[opt] = self.get("Init", opt)
-	
-	def convert(self):
-		head = ["set", self.__name]
-		stream = list()
-		stream.append(head + ["addaction", self.__file])
-		for opt in self.__opts:
-			if opt == "actionstart":
-				stream.append(head + ["actionstart", self.__file, self.__opts[opt]])
-			elif opt == "actionstop":
-				stream.append(head + ["actionstop", self.__file, self.__opts[opt]])
-			elif opt == "actioncheck":
-				stream.append(head + ["actioncheck", self.__file, self.__opts[opt]])
-			elif opt == "actionban":
-				stream.append(head + ["actionban", self.__file, self.__opts[opt]])
-			elif opt == "actionunban":
-				stream.append(head + ["actionunban", self.__file, self.__opts[opt]])
-		# cInfo
-		if self.__cInfo:
-			for p in self.__cInfo:
-				stream.append(head + ["setcinfo", self.__file, p, self.__cInfo[p]])
-
-		return stream
-		

client/beautifier.py

@@ -1,154 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-from server.jails import UnknownJailException
-from server.jails import DuplicateJailException
-import logging
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.client.config")
-
-##
-# Beautify the output of the client.
-#
-# Fail2ban server only return unformatted return codes which need to be
-# converted into user readable messages.
-
-class Beautifier:
-	
-	def __init__(self, cmd = None):
-		self.__inputCmd = cmd
-
-	def setInputCmd(self, cmd):
-		self.__inputCmd = cmd
-		
-	def getInputCmd(self):
-		return self.__inputCmd
-		
-	def beautify(self, response):
-		logSys.debug("Beautify " + `response` + " with " + `self.__inputCmd`)
-		inC = self.__inputCmd
-		msg = response
-		try:
-			if inC[0] == "ping":
-				msg = "Server replied: " + response
-			elif inC[0] == "start":
-				msg = "Jail started"
-			elif inC[0] == "stop":
-				if len(inC) == 1:
-					if response == None:
-						msg = "Shutdown successful"
-				else:
-					if response == None:
-						msg = "Jail stopped"
-			elif inC[0] == "add":
-				msg = "Added jail " + response
-			elif inC[0:1] == ['status']:
-				if len(inC) > 1:
-					# Create IP list
-					ipList = ""
-					for ip in response[1][1][2][1]:
-						ipList += ip + " "
-					# Creates file list.
-					fileList = ""
-					for f in response[0][1][2][1]:
-						fileList += f + " "
-					# Display information
-					msg = "Status for the jail: " + inC[1] + "\n"
-					msg = msg + "|- " + response[0][0] + "\n"
-					msg = msg + "|  |- " + response[0][1][2][0] + ":\t" + fileList + "\n"
-					msg = msg + "|  |- " + response[0][1][0][0] + ":\t" + `response[0][1][0][1]` + "\n"
-					msg = msg + "|  `- " + response[0][1][1][0] + ":\t" + `response[0][1][1][1]` + "\n"
-					msg = msg + "`- " + response[1][0] + "\n"
-					msg = msg + "   |- " + response[1][1][0][0] + ":\t" + `response[1][1][0][1]` + "\n"
-					msg = msg + "   |  `- " + response[1][1][2][0] + ":\t" + ipList + "\n"
-					msg = msg + "   `- " + response[1][1][1][0] + ":\t" + `response[1][1][1][1]`
-				else:
-					msg = "Status\n"
-					msg = msg + "|- " + response[0][0] + ":\t" + `response[0][1]` + "\n"
-					msg = msg + "`- " + response[1][0] + ":\t\t" + response[1][1]
-			elif inC[1] == "logtarget":
-				msg = "Current logging target is:\n"
-				msg = msg + "`- " + response
-			elif inC[1:2] == ['loglevel']:
-				msg = "Current logging level is "
-				if response == 1:
-					msg = msg + "ERROR"
-				elif response == 2:
-					msg = msg + "WARN"
-				elif response == 3:
-					msg = msg + "INFO"
-				elif response == 4:
-					msg = msg + "DEBUG"
-				else:
-					msg = msg + `response`
-			elif inC[2] in ("logpath", "addlogpath", "dellogpath"):
-				if len(response) == 0:
-					msg = "No file is currently monitored"
-				else:
-					msg = "Current monitored log file(s):\n"
-					for path in response[:-1]:
-						msg = msg + "|- " + path + "\n"
-					msg = msg + "`- " + response[len(response)-1]
-			elif inC[2] in ("ignoreip", "addignoreip", "delignoreip"):
-				if len(response) == 0:
-					msg = "No IP address/network is ignored"
-				else:
-					msg = "These IP addresses/networks are ignored:\n"
-					for ip in response[:-1]:
-						msg = msg + "|- " + ip + "\n"
-					msg = msg + "`- " + response[len(response)-1]
-			elif inC[2] in ("failregex", "addfailregex", "delfailregex",
-							"ignoreregex", "addignoreregex", "delignoreregex"):
-				if len(response) == 0:
-					msg = "No regular expression is defined"
-				else:
-					msg = "The following regular expression are defined:\n"
-					c = 0
-					for ip in response[:-1]:
-						msg = msg + "|- [" + str(c) + "]: " + ip + "\n"
-						c += 1
-					msg = msg + "`- [" + str(c) + "]: " + response[len(response)-1]
-		except Exception:
-			logSys.warn("Beautifier error. Please report the error")
-			logSys.error("Beautify " + `response` + " with " + `self.__inputCmd` +
-						 " failed")
-			msg = msg + `response`
-		return msg
-
-	def beautifyError(self, response):
-		logSys.debug("Beautify (error) " + `response` + " with " + `self.__inputCmd`)
-		msg = response
-		if isinstance(response, UnknownJailException):
-			msg = "Sorry but the jail '" + response[0] + "' does not exist"
-		elif isinstance(response, IndexError):
-			msg = "Sorry but the command is invalid"
-		elif isinstance(response, DuplicateJailException):
-			msg = "The jail '" + response[0] + "' already exists"
-		return msg

client/configparserinc.py

@@ -1,111 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Yaroslav Halchenko
-# Modified: Cyril Jaquier
-# $Revision$
-
-__author__ = 'Yaroslav Halhenko'
-__revision__ = '$Revision$'
-__date__ = '$Date$'
-__copyright__ = 'Copyright (c) 2007 Yaroslav Halchenko'
-__license__ = 'GPL'
-
-import logging, os
-from ConfigParser import SafeConfigParser
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.client.config")
-
-class SafeConfigParserWithIncludes(SafeConfigParser):
-	"""
-	Class adds functionality to SafeConfigParser to handle included
-	other configuration files (or may be urls, whatever in the future)
-
-	File should have section [includes] and only 2 options implemented
-	are 'files_before' and 'files_after' where files are listed 1 per
-	line.
-
-	Example:
-
-[INCLUDES]
-before = 1.conf
-         3.conf
-
-after = 1.conf
-
-	It is a simple implementation, so just basic care is taken about
-	recursion. Includes preserve right order, ie new files are
-	inserted to the list of read configs before original, and their
-	includes correspondingly so the list should follow the leaves of
-	the tree.
-
-	I wasn't sure what would be the right way to implement generic (aka c++
-	template) so we could base at any *configparser class... so I will
-	leave it for the future
-
-	"""
-
-	SECTION_NAME = "INCLUDES"
-
-	#@staticmethod
-	def getIncludes(resource, seen = []):
-		"""
-		Given 1 config resource returns list of included files
-		(recursively) with the original one as well
-		Simple loops are taken care about
-		"""
-		
-		# Use a short class name ;)
-		SCPWI = SafeConfigParserWithIncludes
-		
-		parser = SafeConfigParser()
-		parser.read(resource)
-		
-		resourceDir = os.path.dirname(resource)
-
-		newFiles = [ ('before', []), ('after', []) ]
-		if SCPWI.SECTION_NAME in parser.sections():
-			for option_name, option_list in newFiles:
-				if option_name in parser.options(SCPWI.SECTION_NAME):
-					newResources = parser.get(SCPWI.SECTION_NAME, option_name)
-					for newResource in newResources.split('\n'):
-						if os.path.isabs(newResource):
-							r = newResource
-						else:
-							r = os.path.join(resourceDir, newResource)
-						if r in seen:
-							continue
-						s = seen + [resource]
-						option_list += SCPWI.getIncludes(r, s)
-		# combine lists
-		return newFiles[0][1] + [resource] + newFiles[1][1]
-		#print "Includes list for " + resource + " is " + `resources`
-	getIncludes = staticmethod(getIncludes)
-
-
-	def read(self, filenames):
-		fileNamesFull = []
-		if not isinstance(filenames, list):
-			filenames = [ filenames ]
-		for filename in filenames:
-			fileNamesFull += SafeConfigParserWithIncludes.getIncludes(filename)
-		logSys.debug("Reading files: %s" % fileNamesFull)
-		return SafeConfigParser.read(self, fileNamesFull)
-

client/configreader.py

@@ -1,104 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# Modified by: Yaroslav Halchenko (SafeConfigParserWithIncludes)
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import logging, os
-from configparserinc import SafeConfigParserWithIncludes
-from ConfigParser import NoOptionError, NoSectionError
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.client.config")
-
-class ConfigReader(SafeConfigParserWithIncludes):
-	
-	BASE_DIRECTORY = "/etc/fail2ban/"
-	
-	def __init__(self):
-		SafeConfigParserWithIncludes.__init__(self)
-		self.__opts = None
-	
-	#@staticmethod
-	def setBaseDir(folderName):
-		path = folderName.rstrip('/')
-		ConfigReader.BASE_DIRECTORY = path + '/'
-	setBaseDir = staticmethod(setBaseDir)
-		
-	#@staticmethod
-	def getBaseDir():
-		return ConfigReader.BASE_DIRECTORY
-	getBaseDir = staticmethod(getBaseDir)
-	
-	def read(self, filename):
-		basename = ConfigReader.BASE_DIRECTORY + filename
-		logSys.debug("Reading " + basename)
-		bConf = basename + ".conf"
-		bLocal = basename + ".local"
-		if os.path.exists(bConf) or os.path.exists(bLocal):
-			SafeConfigParserWithIncludes.read(self, [bConf, bLocal])
-			return True
-		else:
-			logSys.error(bConf + " and " + bLocal + " do not exist")
-			return False
-	
-	##
-	# Read the options.
-	#
-	# Read the given option in the configuration file. Default values
-	# are used...
-	# Each optionValues entry is composed of an array with:
-	# 0 -> the type of the option
-	# 1 -> the name of the option
-	# 2 -> the default value for the option
-	
-	def getOptions(self, sec, options, pOptions = None):
-		values = dict()
-		for option in options:
-			try:
-				if option[0] == "bool":
-					v = self.getboolean(sec, option[1])
-				elif option[0] == "int":
-					v = self.getint(sec, option[1])
-				else:
-					v = self.get(sec, option[1])
-				if not pOptions == None and option[1] in pOptions:
-					continue
-				values[option[1]] = v
-			except NoSectionError, e:
-				# No "Definition" section or wrong basedir
-				logSys.error(e)
-				values[option[1]] = option[2]
-			except NoOptionError:
-				if not option[2] == None:
-					logSys.warn("'%s' not defined in '%s'. Using default value"
-								% (option[1], sec))
-					values[option[1]] = option[2]
-			except ValueError:
-				logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +
-							"'. Using default one: '" + `option[2]` + "'")
-				values[option[1]] = option[2]
-		return values

client/configurator.py

@@ -1,81 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import logging
-from configreader import ConfigReader
-from fail2banreader import Fail2banReader
-from jailsreader import JailsReader
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.client.config")
-
-class Configurator:
-	
-	def __init__(self):
-		self.__settings = dict()
-		self.__streams = dict()
-		self.__fail2ban = Fail2banReader()
-		self.__jails = JailsReader()
-	
-	#@staticmethod
-	def setBaseDir(folderName):
-		ConfigReader.setBaseDir(folderName)
-	setBaseDir = staticmethod(setBaseDir)
-	
-	#@staticmethod
-	def getBaseDir():
-		return ConfigReader.getBaseDir()
-	getBaseDir = staticmethod(getBaseDir)
-	
-	def readEarly(self):
-		self.__fail2ban.read()
-	
-	def readAll(self):
-		self.readEarly()
-		self.__jails.read()
-	
-	def getEarlyOptions(self):
-		return self.__fail2ban.getEarlyOptions()
-
-	def getOptions(self, jail = None):
-		self.__fail2ban.getOptions()
-		return self.__jails.getOptions(jail)
-		
-	def convertToProtocol(self):
-		self.__streams["general"] = self.__fail2ban.convert()
-		self.__streams["jails"] = self.__jails.convert()
-	
-	def getConfigStream(self):
-		cmds = list()
-		for opt in self.__streams["general"]:
-			cmds.append(opt)
-		for opt in self.__streams["jails"]:
-			cmds.append(opt)
-		return cmds
-	

client/csocket.py

@@ -1,62 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-#from cPickle import dumps, loads, HIGHEST_PROTOCOL
-from pickle import dumps, loads, HIGHEST_PROTOCOL
-import socket
-
-class CSocket:
-	
-	END_STRING = "<F2B_END_COMMAND>"
-	
-	def __init__(self, sock = "/var/run/fail2ban/fail2ban.sock"):
-		# Create an INET, STREAMing socket
-		#self.csock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-		self.__csock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-		#self.csock.connect(("localhost", 2222))
-		self.__csock.connect(sock)
-	
-	def send(self, msg):
-		# Convert every list member to string
-		obj = dumps([str(m) for m in msg], HIGHEST_PROTOCOL)
-		self.__csock.send(obj + CSocket.END_STRING)
-		ret = self.receive(self.__csock)
-		self.__csock.close()
-		return ret
-	
-	#@staticmethod
-	def receive(sock):
-		msg = ''
-		while msg.rfind(CSocket.END_STRING) == -1:
-			chunk = sock.recv(6)
-			if chunk == '':
-				raise RuntimeError, "socket connection broken"
-			msg = msg + chunk
-		return loads(msg)
-	receive = staticmethod(receive)

client/fail2banreader.py

@@ -1,61 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import logging
-from configreader import ConfigReader
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.client.config")
-
-class Fail2banReader(ConfigReader):
-	
-	def __init__(self):
-		ConfigReader.__init__(self)
-	
-	def read(self):
-		ConfigReader.read(self, "fail2ban")
-	
-	def getEarlyOptions(self):
-		opts = [["string", "socket", "/tmp/fail2ban.sock"]]
-		return ConfigReader.getOptions(self, "Definition", opts)
-	
-	def getOptions(self):
-		opts = [["int", "loglevel", 1],
-				["string", "logtarget", "STDERR"]]
-		self.__opts = ConfigReader.getOptions(self, "Definition", opts)
-	
-	def convert(self):
-		stream = list()
-		for opt in self.__opts:
-			if opt == "loglevel":
-				stream.append(["set", "loglevel", self.__opts[opt]])
-			elif opt == "logtarget":
-				stream.append(["set", "logtarget", self.__opts[opt]])
-		return stream
-	

client/filterreader.py

@@ -1,77 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import logging
-from configreader import ConfigReader
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.client.config")
-
-class FilterReader(ConfigReader):
-	
-	def __init__(self, fileName, name):
-		ConfigReader.__init__(self)
-		self.__file = fileName
-		self.__name = name
-	
-	def setFile(self, fileName):
-		self.__file = fileName
-	
-	def getFile(self):
-		return self.__file
-	
-	def setName(self, name):
-		self.__name = name
-	
-	def getName(self):
-		return self.__name
-	
-	def read(self):
-		return ConfigReader.read(self, "filter.d/" + self.__file)
-	
-	def getOptions(self, pOpts):
-		opts = [["string", "ignoreregex", ""],
-				["string", "failregex", ""]]
-		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
-	
-	def convert(self):
-		stream = list()
-		for opt in self.__opts:
-			if opt == "failregex":
-				for regex in self.__opts[opt].split('\n'):
-					# Do not send a command if the rule is empty.
-					if regex != '':
-						stream.append(["set", self.__name, "addfailregex", regex])
-			elif opt == "ignoreregex":
-				for regex in self.__opts[opt].split('\n'):
-					# Do not send a command if the rule is empty.
-					if regex != '':
-						stream.append(["set", self.__name, "addignoreregex", regex])		
-		return stream
-		

client/jailreader.py

@@ -1,177 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import logging, re, glob
-
-from configreader import ConfigReader
-from filterreader import FilterReader
-from actionreader import ActionReader
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.client.config")
-
-class JailReader(ConfigReader):
-	
-	actionCRE = re.compile("^((?:\w|-|_|\.)+)(?:\[(.*)\])?$")
-	
-	def __init__(self, name):
-		ConfigReader.__init__(self)
-		self.__name = name
-		self.__filter = None
-		self.__actions = list()
-	
-	def setName(self, value):
-		self.__name = value
-	
-	def getName(self):
-		return self.__name
-	
-	def read(self):
-		ConfigReader.read(self, "jail")
-	
-	def isEnabled(self):
-		return self.__opts["enabled"]
-	
-	def getOptions(self):
-		opts = [["bool", "enabled", "false"],
-				["string", "logpath", "/var/log/messages"],
-				["string", "backend", "auto"],
-				["int", "maxretry", 3],
-				["int", "findtime", 600],
-				["int", "bantime", 600],
-				["string", "usedns", "warn"],
-				["string", "failregex", None],
-				["string", "ignoreregex", None],
-				["string", "ignoreip", None],
-				["string", "filter", ""],
-				["string", "action", ""]]
-		self.__opts = ConfigReader.getOptions(self, self.__name, opts)
-		
-		if self.isEnabled():
-			# Read filter
-			self.__filter = FilterReader(self.__opts["filter"], self.__name)
-			ret = self.__filter.read()
-			if ret:
-				self.__filter.getOptions(self.__opts)
-			else:
-				logSys.error("Unable to read the filter")
-				return False
-			
-			# Read action
-			for act in self.__opts["action"].split('\n'):
-				try:
-					splitAct = JailReader.splitAction(act)
-					action = ActionReader(splitAct, self.__name)
-					ret = action.read()
-					if ret:
-						action.getOptions(self.__opts)
-						self.__actions.append(action)
-					else:
-						raise AttributeError("Unable to read action")
-				except Exception, e:
-					logSys.error("Error in action definition " + act)
-					logSys.debug(e)
-					return False
-		return True
-	
-	def convert(self):
-		stream = []
-		for opt in self.__opts:
-			if opt == "logpath":
-				for path in self.__opts[opt].split("\n"):
-					pathList = glob.glob(path)
-					if len(pathList) == 0:
-						logSys.error("No file found for " + path)
-					for p in pathList:
-						stream.append(["set", self.__name, "addlogpath", p])
-			elif opt == "backend":
-				backend = self.__opts[opt]
-			elif opt == "maxretry":
-				stream.append(["set", self.__name, "maxretry", self.__opts[opt]])
-			elif opt == "ignoreip":
-				for ip in self.__opts[opt].split():
-					# Do not send a command if the rule is empty.
-					if ip != '':
-						stream.append(["set", self.__name, "addignoreip", ip])
-			elif opt == "findtime":
-				stream.append(["set", self.__name, "findtime", self.__opts[opt]])
-			elif opt == "bantime":
-				stream.append(["set", self.__name, "bantime", self.__opts[opt]])
-			elif opt == "usedns":
-				stream.append(["set", self.__name, "usedns", self.__opts[opt]])
-			elif opt == "failregex":
-				stream.append(["set", self.__name, "addfailregex", self.__opts[opt]])
-			elif opt == "ignoreregex":
-				for regex in self.__opts[opt].split('\n'):
-					# Do not send a command if the rule is empty.
-					if regex != '':
-						stream.append(["set", self.__name, "addignoreregex", regex])
-		stream.extend(self.__filter.convert())
-		for action in self.__actions:
-			stream.extend(action.convert())
-		stream.insert(0, ["add", self.__name, backend])
-		return stream
-	
-	#@staticmethod
-	def splitAction(action):
-		m = JailReader.actionCRE.match(action)
-		d = dict()
-		if not m.group(2) == None:
-			# Huge bad hack :( This method really sucks. TODO Reimplement it.
-			actions = ""
-			escapeChar = None
-			allowComma = False
-			for c in m.group(2):
-				if c in ('"', "'") and not allowComma:
-					# Start
-					escapeChar = c
-					allowComma = True
-				elif c == escapeChar:
-					# End
-					escapeChar = None
-					allowComma = False
-				else:
-					if c == ',' and allowComma:
-						actions += "<COMMA>"
-					else:
-						actions += c
-			
-			# Split using ,
-			actionsSplit = actions.split(',')
-			# Replace the tag <COMMA> with ,
-			actionsSplit = [n.replace("<COMMA>", ',') for n in actionsSplit]
-			
-			for param in actionsSplit:
-				p = param.split('=')
-				try:
-					d[p[0].strip()] = p[1].strip()
-				except IndexError:
-					logSys.error("Invalid argument %s in '%s'" % (p, m.group(2)))
-		return [m.group(1), d]
-	splitAction = staticmethod(splitAction)

client/jailsreader.py

@@ -1,90 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import logging
-from configreader import ConfigReader
-from jailreader import JailReader
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.client.config")
-
-class JailsReader(ConfigReader):
-	
-	def __init__(self):
-		ConfigReader.__init__(self)
-		self.__jails = list()
-	
-	def read(self):
-		ConfigReader.read(self, "jail")
-	
-	def getOptions(self, section = None):
-		opts = []
-		self.__opts = ConfigReader.getOptions(self, "Definition", opts)
-
-		if section:
-			# Get the options of a specific jail.
-			jail = JailReader(section)
-			jail.read()
-			ret = jail.getOptions()
-			if ret:
-				if jail.isEnabled():
-					# We only add enabled jails
-					self.__jails.append(jail)
-			else:
-				logSys.error("Errors in jail '%s'. Skipping..." % section)
-				return False
-		else:
-			# Get the options of all jails.
-			for sec in self.sections():
-				jail = JailReader(sec)
-				jail.read()
-				ret = jail.getOptions()
-				if ret:
-					if jail.isEnabled():
-						# We only add enabled jails
-						self.__jails.append(jail)
-				else:
-					logSys.error("Errors in jail '" + sec + "'. Skipping...")
-					return False
-		return True
-	
-	def convert(self):
-		stream = list()
-		for opt in self.__opts:
-			if opt == "":
-				stream.append([])
-		# Convert jails
-		for jail in self.__jails:
-			stream.extend(jail.convert())
-		# Start jails
-		for jail in self.__jails:
-			stream.append(["start", jail.getName()])
-		
-		return stream
-		

common/__init__.py

@@ -1,28 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"

common/helpers.py

@@ -1,41 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# Author: Arturo 'Buanzo' Busleiman
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2009 Cyril Jaquier"
-__license__ = "GPL"
-
-
-def formatExceptionInfo():
-	""" Author: Arturo 'Buanzo' Busleiman """
-	import sys
-	cla, exc = sys.exc_info()[:2]
-	excName = cla.__name__
-	try:
-		excArgs = exc.__dict__["args"]
-	except KeyError:
-		excArgs = str(exc)
-	return (excName, excArgs)

common/protocol.py

@@ -1,139 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import textwrap
-
-##
-# Describes the protocol used to communicate with the server.
-
-protocol = [
-['', "BASIC", ""],
-["start", "starts the server and the jails"], 
-["reload", "reloads the configuration"], 
-["reload <JAIL>", "reloads the jail <JAIL>"], 
-["stop", "stops all jails and terminate the server"], 
-["status", "gets the current status of the server"], 
-["ping", "tests if the server is alive"], 
-['', "LOGGING", ""],
-["set loglevel <LEVEL>", "sets logging level to <LEVEL>. 0 is minimal, 4 is debug"], 
-["get loglevel", "gets the logging level"], 
-["set logtarget <TARGET>", "sets logging target to <TARGET>. Can be STDOUT, STDERR, SYSLOG or a file"], 
-["get logtarget", "gets logging target"], 
-['', "JAIL CONTROL", ""],
-["add <JAIL> <BACKEND>", "creates <JAIL> using <BACKEND>"], 
-["start <JAIL>", "starts the jail <JAIL>"], 
-["stop <JAIL>", "stops the jail <JAIL>. The jail is removed"], 
-["status <JAIL>", "gets the current status of <JAIL>"],
-['', "JAIL CONFIGURATION", ""],
-["set <JAIL> idle on|off", "sets the idle state of <JAIL>"], 
-["set <JAIL> addignoreip <IP>", "adds <IP> to the ignore list of <JAIL>"], 
-["set <JAIL> delignoreip <IP>", "removes <IP> from the ignore list of <JAIL>"], 
-["set <JAIL> addlogpath <FILE>", "adds <FILE> to the monitoring list of <JAIL>"], 
-["set <JAIL> dellogpath <FILE>", "removes <FILE> from the monitoring list of <JAIL>"],
-["set <JAIL> addfailregex <REGEX>", "adds the regular expression <REGEX> which must match failures for <JAIL>"], 
-["set <JAIL> delfailregex <INDEX>", "removes the regular expression at <INDEX> for failregex"], 
-["set <JAIL> addignoreregex <REGEX>", "adds the regular expression <REGEX> which should match pattern to exclude for <JAIL>"],
-["set <JAIL> delignoreregex <INDEX>", "removes the regular expression at <INDEX> for ignoreregex"], 
-["set <JAIL> findtime <TIME>", "sets the number of seconds <TIME> for which the filter will look back for <JAIL>"], 
-["set <JAIL> bantime <TIME>", "sets the number of seconds <TIME> a host will be banned for <JAIL>"], 
-["set <JAIL> usedns <VALUE>", "sets the usedns mode for <JAIL>"],
-["set <JAIL> banip <IP>", "manually Ban <IP> for <JAIL>"], 
-["set <JAIL> maxretry <RETRY>", "sets the number of failures <RETRY> before banning the host for <JAIL>"], 
-["set <JAIL> addaction <ACT>", "adds a new action named <NAME> for <JAIL>"], 
-["set <JAIL> delaction <ACT>", "removes the action <NAME> from <JAIL>"], 
-["set <JAIL> setcinfo <ACT> <KEY> <VALUE>", "sets <VALUE> for <KEY> of the action <NAME> for <JAIL>"], 
-["set <JAIL> delcinfo <ACT> <KEY>", "removes <KEY> for the action <NAME> for <JAIL>"], 
-["set <JAIL> actionstart <ACT> <CMD>", "sets the start command <CMD> of the action <ACT> for <JAIL>"], 
-["set <JAIL> actionstop <ACT> <CMD>", "sets the stop command <CMD> of the action <ACT> for <JAIL>"], 
-["set <JAIL> actioncheck <ACT> <CMD>", "sets the check command <CMD> of the action <ACT> for <JAIL>"], 
-["set <JAIL> actionban <ACT> <CMD>", "sets the ban command <CMD> of the action <ACT> for <JAIL>"],
-["set <JAIL> actionunban <ACT> <CMD>", "sets the unban command <CMD> of the action <ACT> for <JAIL>"], 
-['', "JAIL INFORMATION", ""],
-["get <JAIL> logpath", "gets the list of the monitored files for <JAIL>"],
-["get <JAIL> ignoreip", "gets the list of ignored IP addresses for <JAIL>"],
-["get <JAIL> failregex", "gets the list of regular expressions which matches the failures for <JAIL>"],
-["get <JAIL> ignoreregex", "gets the list of regular expressions which matches patterns to ignore for <JAIL>"],
-["get <JAIL> findtime", "gets the time for which the filter will look back for failures for <JAIL>"],
-["get <JAIL> bantime", "gets the time a host is banned for <JAIL>"],
-["get <JAIL> usedns", "gets the usedns setting for <JAIL>"],
-["get <JAIL> maxretry", "gets the number of failures allowed for <JAIL>"],
-["get <JAIL> addaction", "gets the last action which has been added for <JAIL>"],
-["get <JAIL> actionstart <ACT>", "gets the start command for the action <ACT> for <JAIL>"],
-["get <JAIL> actionstop <ACT>", "gets the stop command for the action <ACT> for <JAIL>"],
-["get <JAIL> actioncheck <ACT>", "gets the check command for the action <ACT> for <JAIL>"],
-["get <JAIL> actionban <ACT>", "gets the ban command for the action <ACT> for <JAIL>"],
-["get <JAIL> actionunban <ACT>", "gets the unban command for the action <ACT> for <JAIL>"],
-]
-
-##
-# Prints the protocol in a "man" format. This is used for the
-# "-h" output of fail2ban-client.
-
-def printFormatted():
-	INDENT=4
-	MARGIN=41
-	WIDTH=34
-	firstHeading = False
-	for m in protocol:
-		if m[0] == '' and firstHeading:
-			print
-		firstHeading = True
-		first = True
-		for n in textwrap.wrap(m[1], WIDTH):
-			if first:
-				line = ' ' * INDENT + m[0] + ' ' * (MARGIN - len(m[0])) + n
-				first = False
-			else:
-				line = ' ' * (INDENT + MARGIN) + n
-			print line
-
-##
-# Prints the protocol in a "mediawiki" format.
-
-def printWiki():
-	firstHeading = False
-	for m in protocol:
-		if m[0] == '':
-			if firstHeading:
-				print "|}"
-			__printWikiHeader(m[1], m[2])
-			firstHeading = True
-		else:
-			print "|-"
-			print "| <span style=\"white-space:nowrap;\"><tt>" + m[0] + "</tt></span> || || " + m[1]
-	print "|}"
-
-def __printWikiHeader(section, desc):
-	print
-	print "=== " + section + " ==="
-	print
-	print desc
-	print
-	print "{|"
-	print "| '''Command''' || || '''Description'''"

common/version.py

@@ -1,28 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav Halchenko"
-__license__ = "GPL"
-
-version = "0.8.7"

config/action.d/complain.conf

@@ -1,86 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Russell Odom <russ@gloomytrousers.co.uk>
-# Sends a complaint e-mail to addresses listed in the whois record for an
-# offending IP address.
-#
-# You should provide the <logpath> in the jail config - lines from the log
-# matching the given IP address will be provided in the complaint as evidence.
-#
-# Note that we will try to use e-mail addresses that are most likely to be abuse
-# addresses (based on various keywords). If they aren't found we fall back on
-# any other addresses found in the whois record, with a few exceptions.
-# If no addresses are found, no e-mail is sent.
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = ADDRESSES=`whois <ip> | perl -e 'while (<STDIN>) { next if /^changed|@(ripe|apnic)\.net/io; $m += (/abuse|trouble:|report|spam|security/io?3:0); if (/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)/io) { while (s/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)//io) { if ($m) { $a{lc($1)}=$m } else { $b{lc($1)}=$m } } $m=0 } else { $m && --$m } } if (%%a) {print join(",",keys(%%a))} else {print join(",",keys(%%b))}'`
-	    IP=<ip>
-            if [ ! -z "$ADDRESSES" ]; then
-                (printf %%b "<message>\n"; date '+Note: Local timezone is %%z (%%Z)'; grep '<ip>' <logpath>) | <mailcmd> "Abuse from <ip>" $ADDRESSES <mailargs>
-            fi
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
-# Values:  CMD
-#
-actionunban =
-
-[Init]
-message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to a whois lookup is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process. This mail was generated by Fail2Ban.)\n
-
-# Path to the log files which contain relevant lines for the abuser IP
-#
-logpath = /dev/null
-
-# Option:  mailcmd
-# Notes.:  Your system mail command. Is passed 2 args: subject and recipient
-# Values:  CMD  Default: mail -s
-#
-mailcmd = mail -s
-
-# Option:  mailargs
-# Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
-#          CC reports to another address:
-#              -c me@example.com
-#          Appear to come from a different address - the '--' indicates
-#          arguments to be passed to Sendmail:
-#              -- -f me@example.com
-# Values:  [ STRING ]  Default: (empty)
-#
-mailargs =
-

config/action.d/dshield.conf

@@ -1,210 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Russell Odom <russ@gloomytrousers.co.uk>
-# Submits attack reports to DShield (http://www.dshield.org/)
-#
-# You MUST configure at least:
-# <port> (the port that's being attacked - use number not name).
-#
-# You SHOULD also provide:
-# <myip> (your public IP address, if it's not the address of eth0)
-# <userid> (your DShield userID, if you have one - recommended, but reports will
-# be used anonymously if not)
-# <protocol> (the protocol in use - defaults to tcp)
-#
-# Best practice is to provide <port> and <protocol> in jail.conf like this:
-# action = dshield[port=1234,protocol=tcp]
-#
-# ...and create "dshield.local" with contents something like this:
-# [Init]
-# myip = 10.0.0.1
-# userid = 12345
-#
-# Other useful configuration values are <mailargs> (you can use for specifying
-# a different sender address for the report e-mails, which should match what is
-# configured at DShield), and <lines>/<minreportinterval>/<maxbufferage> (to
-# configure how often the buffer is flushed).
-#
-# $Revision$
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = if [ -f <tmpfile>.buffer ]; then
-                 cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" <dest> <mailargs>
-                 date +%%s > <tmpfile>.lastsent
-             fi
-             rm -f <tmpfile>.buffer <tmpfile>.first
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-# See http://www.dshield.org/specs.html for more on report format/notes
-#
-# Note: We are currently using <time> for the timestamp because no tag is
-# available to indicate the timestamp of the log message(s) which triggered the
-# ban. Therefore the timestamps we are using in the report, whilst often only a
-# few seconds out, are incorrect. See
-# http://sourceforge.net/tracker/index.php?func=detail&aid=2017795&group_id=121032&atid=689047
-#
-actionban = TZONE=`date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'`
-            DATETIME="`perl -e '@t=localtime(<time>);printf "%%4d-%%02d-%%02d %%02d:%%02d:%%02d",1900+$t[5],$t[4]+1,$t[3],$t[2],$t[1],$t[0]'` $TZONE"
-	    PROTOCOL=`awk '{IGNORECASE=1;if($1=="<protocol>"){print $2;exit}}' /etc/protocols`
-	    if [ -z "$PROTOCOL" ]; then PROTOCOL=<protocol>; fi
-            printf %%b "$DATETIME\t<userid>\t<failures>\t<ip>\t<srcport>\t<myip>\t<port>\t$PROTOCOL\t<tcpflags>\n" >> <tmpfile>.buffer
-            NOW=`date +%%s`
-            if [ ! -f <tmpfile>.first ]; then
-                echo <time> | cut -d. -f1 > <tmpfile>.first
-            fi
-            if [ ! -f <tmpfile>.lastsent ]; then
-                echo 0 > <tmpfile>.lastsent
-            fi
-            LOGAGE=$(($NOW - `cat <tmpfile>.first`))
-            LASTREPORT=$(($NOW - `cat <tmpfile>.lastsent`))
-            LINES=$( wc -l <tmpfile>.buffer | awk '{ print $1 }' )
-            if [ $LINES -ge <lines> && $LASTREPORT -gt <minreportinterval> ] || [ $LOGAGE -gt <maxbufferage> ]; then
-                cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ $TZONE Fail2Ban" <dest> <mailargs>
-                rm -f <tmpfile>.buffer <tmpfile>.first
-                echo $NOW > <tmpfile>.lastsent
-            fi
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = if [ -f <tmpfile>.first ]; then
-                  NOW=`date +%%s`
-                  LOGAGE=$(($NOW - `cat <tmpfile>.first`))
-                  if [ $LOGAGE -gt <maxbufferage> ]; then
-                      cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" <dest> <mailargs>
-                      rm -f <tmpfile>.buffer <tmpfile>.first
-                      echo $NOW > <tmpfile>.lastsent
-                  fi
-              fi
-
-
-[Init]
-# Option:  port
-# Notes.:  The target port for the attack (numerical). MUST be provided in the
-#          jail config, as it cannot be detected here.
-# Values:  [ NUM ]  Default: ???
-#
-port = ???
-
-# Option:  userid
-# Notes.:  Your DSheild user ID. Should be provided either in the jail config or
-#          in a .local file.
-#          Register at https://secure.dshield.org/register.html
-# Values:  [ NUM ]  Default: 0
-#
-userid = 0
-
-# Option:  myip
-# Notes.:  TThe target IP for the attack (your public IP). Should be provided
-#          either in the jail config or in a .local file unless your PUBLIC IP
-#          is the first IP assigned to eth0
-# Values:  [ an IP address ]  Default: Tries to find the IP address of eth0,
-#          which in most cases will be a private IP, and therefore incorrect
-#
-myip = `ip -4 addr show dev eth0 | grep inet | head -1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`
-
-# Option:  protocol
-# Notes.:  The protocol over which the attack is happening
-# Values:  [ tcp | udp | icmp | (any other protocol name from /etc/protocols) | NUM ] Default: tcp
-#
-protocol = tcp
-
-# Option:  lines
-# Notes.:  How many lines to buffer before making a report. Regardless of this,
-#          reports are sent a minimum of <minreportinterval> apart, or if the
-#          buffer contains an event over <maxbufferage> old, or on shutdown
-# Values:  [ NUM ]  Default: 50
-#
-lines = 50
-
-# Option:  minreportinterval
-# Notes.:  Minimum period (in seconds) that must elapse before we submit another
-#          batch of reports. DShield request a minimum of 1 hour (3600 secs)
-#          between reports.
-# Values:  [ NUM ]  Default: 3600
-#
-minreportinterval = 3600
-
-# Option:  maxbufferage
-# Notes.:  Maximum age (in seconds) of the oldest report in the buffer before we
-#          submit the batch, even if we haven't reached <lines> yet. Note that
-#          this is only checked on each ban/unban, and that we always send
-#          anything in the buffer on shutdown. Must be greater than
-#          <minreportinterval>.
-# Values:  [ NUM ]  Default: 21600 (6 hours)
-#
-maxbufferage = 21600
-
-# Option:  srcport
-# Notes.:  The source port of the attack. You're unlikely to have this info, so
-#          you can leave the default
-# Values:  [ NUM ]  Default: ???
-#
-srcport = ???
-
-# Option:  tcpflags
-# Notes.:  TCP flags on attack. You're unlikely to have this info, so you can
-#          leave empty
-# Values:  [ STRING ]  Default: (empty)
-#
-tcpflags =
-
-# Option:  mailcmd
-# Notes.:  Your system mail command. Is passed 2 args: subject and recipient
-# Values:  CMD  Default: mail -s
-#
-mailcmd = mail -s
-
-# Option:  mailargs
-# Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
-#          CC reports to another address:
-#              -c me@example.com
-#          Appear to come from a different address (the From address must match
-#          the one configured at DShield - the '--' indicates arguments to be
-#          passed to Sendmail):
-#              -- -f me@example.com
-# Values:  [ STRING ]  Default: (empty)
-#
-mailargs =
-
-# Option:  dest
-# Notes.:  Destination e-mail address for reports
-# Values:  [ STRING ]  Default: reports@dshield.org
-#
-dest = reports@dshield.org
-
-# Option:  tmpfile
-# Notes.:  Base name of temporary files used for buffering
-# Values:  [ STRING ]  Default: /var/run/fail2ban/tmp-dshield
-#
-tmpfile = /var/run/fail2ban/tmp-dshield
-

config/action.d/dummy.conf

@@ -1,52 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = touch /tmp/fail2ban.dummy
-              printf %%b "<init>\n" >> /tmp/fail2ban.dummy
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = rm -f /tmp/fail2ban.dummy
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = printf %%b "+<ip>\n" >> /tmp/fail2ban.dummy
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = printf %%b "-<ip>\n" >> /tmp/fail2ban.dummy
-
-[Init]
-
-init = 123
-

config/action.d/hostsdeny.conf

@@ -1,55 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = 
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = 
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = IP=<ip> &&
-            printf %%b "ALL: $IP\n" >> <file>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = IP=<ip> && sed -i.old /ALL:\ $IP/d <file>
-
-[Init]
-
-# Option:  file
-# Notes.:  hosts.deny file path.
-# Values:  STR  Default:  /etc/hosts.deny
-#
-file = /etc/hosts.deny

config/action.d/ipfilter.conf

@@ -1,57 +0,0 @@
-# Fail2Ban configuration file
-#
-# NetBSD ipfilter (ipf command) ban/unban
-#
-# Author: Ed Ravin <eravin@panix.com>
-#
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-# enable IPF if not already enabled
-actionstart = /sbin/ipf -E
-
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-# don't disable IPF with "/sbin/ipf -D", there may be other filters in use
-actionstop = 
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = echo block in quick from <ip>/32 | /sbin/ipf -f -
-
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-# note -r option used to remove matching rule
-actionunban = echo block in quick from <ip>/32 | /sbin/ipf -r -f -
-
-[Init]
-

config/action.d/ipfw.conf

@@ -1,65 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Nick Munger
-# Modified by: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = 
-
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = 
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = ipfw add deny tcp from <ip> to <localhost> <port>
-
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
-
-[Init]
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]
-#
-port = ssh
-
-# Option:  localhost
-# Notes.:  the local IP address of the network interface
-# Values:  IP
-#
-localhost = 127.0.0.1

config/action.d/iptables-allports.conf

@@ -1,70 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> -p <protocol> -j fail2ban-<name>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = iptables -D <chain> -p <protocol> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -X fail2ban-<name>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
-
-[Init]
-
-# Defaut name of the chain
-#
-name = default
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
-#          added
-# Values:  STRING  Default: INPUT
-chain = INPUT

config/action.d/iptables-multiport-log.conf

@@ -1,84 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Guido Bozzetto
-# Modified: Cyril Jaquier
-#
-# make "fail2ban-<name>" chain to match drop IP
-# make "fail2ban-<name>-log" chain to log and drop
-# insert a jump to fail2ban-<name> from -I <chain> if proto/port match
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> 1 -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
-              iptables -N fail2ban-<name>-log
-              iptables -I fail2ban-<name>-log -j LOG --log-prefix "$(expr fail2ban-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
-              iptables -A fail2ban-<name>-log -j DROP
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -F fail2ban-<name>-log
-             iptables -X fail2ban-<name>
-             iptables -X fail2ban-<name>-log
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = iptables -n -L fail2ban-<name>-log >/dev/null
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = iptables -D fail2ban-<name> -s <ip> -j fail2ban-<name>-log
-
-[Init]
-
-# Defaut name of the chain
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
-#          added
-# Values:  STRING  Default: INPUT
-chain = INPUT

config/action.d/iptables-multiport.conf

@@ -1,74 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified by Yaroslav Halchenko for multiport banning
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -X fail2ban-<name>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
-
-[Init]
-
-# Defaut name of the chain
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
-#          added
-# Values:  STRING  Default: INPUT
-chain = INPUT

config/action.d/iptables-new.conf

@@ -1,76 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Copied from iptables.conf and modified by Yaroslav Halchenko 
-#  to fullfill the needs of bugreporter dbts#350746.
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = iptables -D <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -X fail2ban-<name>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
-
-[Init]
-
-# Defaut name of the chain
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
-#          added
-# Values:  STRING  Default: INPUT
-chain = INPUT

config/action.d/iptables-xt_recent-echo.conf

@@ -1,76 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
-#
-# $Revision: 1 $
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-# Changing iptables rules requires root priviledges. If fail2ban is
-# configured to run as root, firewall setup can be performed by
-# fail2ban automatically. However, if fail2ban is configured to run as
-# a normal user, the configuration must be done by some other means
-# (e.g. using static firewall configuration with the
-# iptables-persistent package).
-# 
-# Explanation of the rule below:
-#    Check if any packets coming from an IP on the fail2ban-<name>
-#    list have been seen in the last 3600 seconds. If yes, update the
-#    timestamp for this IP and drop the packet. If not, let the packet
-#    through.
-#
-#    Fail2ban inserts blacklisted hosts into the fail2ban-<name> list
-#    and removes them from the list after some time, according to its
-#    own rules. The 3600 second timeout is independent and acts as a
-#    safeguard in case the fail2ban process dies unexpectedly. The
-#    shorter of the two timeouts actually matters.
-actionstart = iptables -I INPUT -m recent --update --seconds 3600 --name fail2ban-<name> -j DROP
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = echo / > /proc/net/xt_recent/fail2ban-<name>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = test -e /proc/net/xt_recent/fail2ban-<name>
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = echo +<ip> > /proc/net/xt_recent/fail2ban-<name>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = echo -<ip> > /proc/net/xt_recent/fail2ban-<name>
-
-[Init]
-
-# Defaut name of the chain
-#
-name = default
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp

config/action.d/iptables.conf

@@ -1,74 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> -p <protocol> --dport <port> -j fail2ban-<name>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = iptables -D <chain> -p <protocol> --dport <port> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -X fail2ban-<name>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
-
-[Init]
-
-# Defaut name of the chain
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
-#          added
-# Values:  STRING  Default: INPUT
-chain = INPUT

config/action.d/mail-buffered.conf

@@ -1,88 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "Hi,\n
-              The jail <name> has been started successfully.\n
-              Output will be buffered until <lines> lines are available.\n
-              Regards,\n
-              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = if [ -f <tmpfile> ]; then
-                 printf %%b "Hi,\n
-                 These hosts have been banned by Fail2Ban.\n
-                 `cat <tmpfile>`
-                 Regards,\n
-                 Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest>
-                 rm <tmpfile>
-             fi
-             printf %%b "Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
-            LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
-            if [ $LINE -ge <lines> ]; then
-                printf %%b "Hi,\n
-                These hosts have been banned by Fail2Ban.\n
-                `cat <tmpfile>`
-                \nRegards,\n
-                Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest>
-                rm <tmpfile>
-            fi
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = 
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-
-# Default number of lines that are buffered
-#
-lines = 5
-
-# Default temporary file
-#
-tmpfile = /var/run/fail2ban/tmp-mail.txt
-
-# Destination/Addressee of the mail
-#
-dest = root

config/action.d/mail-whois-lines.conf

@@ -1,75 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified-By: Yaroslav Halchenko to include grepping on IP over log files
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = printf %%b "Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here are more information about <ip>:\n
-            `whois <ip>`\n\n
-            Lines containing IP:<ip> in <logpath>\n
-            `grep '\<<ip>\>' <logpath>`\n\n
-            Regards,\n
-            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
-# Values:  CMD
-#
-actionunban = 
-
-[Init]
-
-# Defaut name of the chain
-#
-name = default
-
-# Destinataire of the mail
-#
-dest = root
-
-# Path to the log files which contain relevant lines for the abuser IP
-#
-logpath = /dev/null

config/action.d/mail-whois.conf

@@ -1,69 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = printf %%b "Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here are more information about <ip>:\n
-            `whois <ip>`\n
-            Regards,\n
-            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = 
-
-[Init]
-
-# Defaut name of the chain
-#
-name = default
-
-# Destination/Addressee of the mail
-#
-dest = root
-

config/action.d/mail.conf

@@ -1,67 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = printf %%b "Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n
-            Regards,\n
-            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = 
-
-[Init]
-
-# Defaut name of the chain
-#
-name = default
-
-# Destination/Addressee of the mail
-#
-dest = root
-

config/action.d/mynetwatchman.conf

@@ -1,144 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Russell Odom <russ@gloomytrousers.co.uk>
-# Submits attack reports to myNetWatchman (http://www.mynetwatchman.com/)
-#
-# You MUST configure at least:
-# <port> (the port that's being attacked - use number not name).
-# <mnwlogin> (your mNW login).
-# <mnwpass> (your mNW password).
-#
-# You SHOULD also provide:
-# <myip> (your public IP address, if it's not the address of eth0)
-# <protocol> (the protocol in use - defaults to tcp)
-#
-# Best practice is to provide <port> and <protocol> in jail.conf like this:
-# action = mynetwatchman[port=1234,protocol=udp]
-#
-# ...and create "mynetwatchman.local" with contents something like this:
-# [Init]
-# mnwlogin = me@example.com
-# mnwpass = SECRET
-# myip = 10.0.0.1
-#
-# Another useful configuration value is <getcmd>, if you don't have wget
-# installed (an example config for curl is given below)
-#
-# $Revision$
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-#
-# Note: We are currently using <time> for the timestamp because no tag is
-# available to indicate the timestamp of the log message(s) which triggered the
-# ban. Therefore the timestamps we are using in the report, whilst often only a
-# few seconds out, are incorrect. See
-# http://sourceforge.net/tracker/index.php?func=detail&aid=2017795&group_id=121032&atid=689047
-#
-actionban = MNWLOGIN=`perl -e '$s=shift;$s=~s/([\W])/"%%".uc(sprintf("%%2.2x",ord($1)))/eg;print $s' '<mnwlogin>'`
-            MNWPASS=`perl -e '$s=shift;$s=~s/([\W])/"%%".uc(sprintf("%%2.2x",ord($1)))/eg;print $s' '<mnwpass>'`
-	    PROTOCOL=`awk '{IGNORECASE=1;if($1=="<protocol>"){print $2;exit}}' /etc/protocols`
-	    if [ -z "$PROTOCOL" ]; then PROTOCOL=<protocol>; fi
-	    DATETIME=`perl -e '@t=gmtime(<time>);printf "%%4d-%%02d-%%02d+%%02d:%%02d:%%02d",1900+$t[5],$t[4]+1,$t[3],$t[2],$t[1],$t[0]'`
-            <getcmd> "<mnwurl>?AT=2&AV=0&AgentEmail=$MNWLOGIN&AgentPassword=$MNWPASS&AttackerIP=<ip>&SrcPort=<srcport>&ProtocolID=$PROTOCOL&DestPort=<port>&AttackCount=<failures>&VictimIP=<myip>&AttackDateTime=$DATETIME" 2>&1 >> <tmpfile>.out && grep -q 'Attack Report Insert Successful' <tmpfile>.out && rm -f <tmpfile>.out
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban =
-
-[Init]
-# Option:  port
-# Notes.:  The target port for the attack (numerical). MUST be provided in
-#          the jail config, as it cannot be detected here.
-# Values:  [ NUM ]  Default: ???
-#
-port = 0
-
-# Option:  mnwlogin
-# Notes.:  Your mNW login e-mail address. MUST be provided either in the jail
-#          config or in a .local file.
-#          Register at http://www.mynetwatchman.com/reg.asp
-# Values:  [ STRING ]  Default: (empty)
-#
-mnwlogin =
-
-# Option:  mnwpass
-# Notes.:  The password corresponding to your mNW login e-mail address. MUST be
-#          provided either in the jail config or in a .local file.
-# Values:  [ STRING ]  Default: (empty)
-#
-mnwpass =
-
-# Option:  myip
-# Notes.:  TThe target IP for the attack (your public IP). Should be overridden
-#          either in the jail config or in a .local file unless your PUBLIC IP
-#          is the first IP assigned to eth0
-# Values:  [ an IP address ]  Default: Tries to find the IP address of eth0,
-#          which in most cases will be a private IP, and therefore incorrect
-#
-myip = `ip -4 addr show dev eth0 | grep inet | head -1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`
-
-# Option:  protocol
-# Notes.:  The protocol over which the attack is happening
-# Values:  [ tcp | udp | icmp | (any other protocol name from /etc/protocols) | NUM ] Default: tcp
-#
-protocol = tcp
-
-# Option:  getcmd
-# Notes.:  A command to fetch a URL. Should output page to STDOUT
-# Values:  CMD  Default: wget
-#
-getcmd = wget --no-verbose --tries=3 --waitretry=10 --connect-timeout=10 --read-timeout=60 --retry-connrefused --output-document=- --user-agent=Fail2Ban
-# Alternative value:
-# getcmd = curl --silent --show-error --retry 3 --connect-timeout 10 --max-time 60 --user-agent Fail2Ban
-
-# Option:  srcport
-# Notes.:  The source port of the attack. You're unlikely to have this info, so
-#          you can leave the default
-# Values:  [ NUM ]  Default: 0
-#
-srcport = 0
-
-# Option:  mnwurl
-# Notes.:  The report service URL on the mNW site
-# Values:  STRING  Default: http://mynetwatchman.com/insertwebreport.asp
-#
-mnwurl = http://mynetwatchman.com/insertwebreport.asp
-
-# Option:  tmpfile
-# Notes.:  Base name of temporary files
-# Values:  [ STRING ]  Default: /var/run/fail2ban/tmp-mynetwatchman
-#
-tmpfile = /var/run/fail2ban/tmp-mynetwatchman

config/action.d/sendmail-buffered.conf

@@ -1,105 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
-              From: Fail2Ban <<sender>>
-              To: <dest>\n
-              Hi,\n
-              The jail <name> has been started successfully.\n
-              Output will be buffered until <lines> lines are available.\n
-              Regards,\n
-              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = if [ -f <tmpfile> ]; then
-                 printf %%b "Subject: [Fail2Ban] <name>: summary
-                 From: Fail2Ban <<sender>>
-                 To: <dest>\n
-                 Hi,\n
-                 These hosts have been banned by Fail2Ban.\n
-                 `cat <tmpfile>`
-                 Regards,\n
-                 Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-                 rm <tmpfile>
-             fi
-             printf %%b "Subject: [Fail2Ban] <name>: stopped
-             From: Fail2Ban <<sender>>
-             To: <dest>\n
-             Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
-            LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
-            if [ $LINE -ge <lines> ]; then
-                printf %%b "Subject: [Fail2Ban] <name>: summary
-                From: Fail2Ban <<sender>>
-                To: <dest>\n
-                Hi,\n
-                These hosts have been banned by Fail2Ban.\n
-                `cat <tmpfile>`
-                Regards,\n
-                Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-                rm <tmpfile>
-            fi
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = 
-
-[Init]
-
-# Defaut name of the chain
-#
-name = default
-
-# Destination/Addressee of the mail
-#
-dest = root
-
-# Sender of the mail
-#
-sender = fail2ban
-
-# Default number of lines that are buffered
-#
-lines = 5
-
-# Default temporary file
-#
-tmpfile = /var/run/fail2ban/tmp-mail.txt
-

config/action.d/sendmail-whois-lines.conf

@@ -1,91 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
-              Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
-              From: Fail2Ban <<sender>>
-              To: <dest>\n
-              Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
-             Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
-             From: Fail2Ban <<sender>>
-             To: <dest>\n
-             Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
-            Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
-            From: Fail2Ban <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here are more information about <ip>:\n
-            `/usr/bin/whois <ip>`\n\n
-            Lines containing IP:<ip> in <logpath>\n
-            `/bin/grep '\<<ip>\>' <logpath>`\n\n
-            Regards,\n
-            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = 
-
-[Init]
-
-# Defaut name of the chain
-#
-name = default
-
-# Destination/Addressee of the mail
-#
-dest = root
-
-# Sender of the mail
-#
-sender = fail2ban
-
-# Path to the log files which contain relevant lines for the abuser IP
-#
-logpath = /dev/null
-

config/action.d/sendmail-whois.conf

@@ -1,85 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
-              Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
-              From: Fail2Ban <<sender>>
-              To: <dest>\n
-              Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
-             Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
-             From: Fail2Ban <<sender>>
-             To: <dest>\n
-             Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
-            Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
-            From: Fail2Ban <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here are more information about <ip>:\n
-            `/usr/bin/whois <ip>`\n
-            Regards,\n
-            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = 
-
-[Init]
-
-# Defaut name of the chain
-#
-name = default
-
-# Destination/Addressee of the mail
-#
-dest = root
-
-# Sender of the mail
-#
-sender = fail2ban
-

config/action.d/sendmail.conf

@@ -1,83 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
-              Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
-              From: Fail2Ban <<sender>>
-              To: <dest>\n
-              Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
-             Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
-             From: Fail2Ban <<sender>>
-             To: <dest>\n
-             Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
-            Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
-            From: Fail2Ban <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n
-            Regards,\n
-            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = 
-
-[Init]
-
-# Defaut name of the chain
-#
-name = default
-
-# Destination/Addressee of the mail
-#
-dest = root
-
-# Sender of the mail
-#
-sender = fail2ban
-

config/action.d/shorewall.conf

@@ -1,54 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-# The default Shorewall configuration is with "BLACKLISTNEWONLY=Yes" (see
-# file /etc/shorewall/shorewall.conf). This means that when Fail2ban adds a
-# new shorewall rule to ban an IP address, that rule will affect only new
-# connections. So if the attempter goes on trying using the same connection
-# he could even log in. In order to get the same behavior of the iptable
-# action (so that the ban is immediate) the /etc/shorewall/shorewall.conf
-# file should me modified with "BLACKLISTNEWONLY=No".
-# 
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = 
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = 
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = shorewall drop <ip>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = shorewall allow <ip>

config/fail2ban.conf

@@ -1,38 +0,0 @@
-# Fail2Ban main configuration file
-#
-# Comments: use '#' for comment lines and ';' for inline comments
-#
-# Changes:  in most of the cases you should not modify this
-#           file, but provide customizations in fail2ban.local file, e.g.:
-#
-# [Definition]
-# loglevel = 4
-#
-
-[Definition]
-
-# Option:  loglevel
-# Notes.:  Set the log level output.
-#          1 = ERROR
-#          2 = WARN
-#          3 = INFO
-#          4 = DEBUG
-# Values:  NUM  Default:  3
-#
-loglevel = 3
-
-# Option:  logtarget
-# Notes.:  Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
-#          Only one log target can be specified.
-# Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
-#
-logtarget = /var/log/fail2ban.log
-
-# Option: socket
-# Notes.: Set the socket file. This is used to communicate with the daemon. Do
-#         not remove this file when Fail2ban runs. It will not be possible to
-#         communicate with the server afterwards.
-# Values: FILE  Default:  /var/run/fail2ban/fail2ban.sock
-#
-socket = /var/run/fail2ban/fail2ban.sock
-

config/filter.d/apache-auth.conf

@@ -1,25 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match the password failure messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = [[]client <HOST>[]] user .* authentication failure
-            [[]client <HOST>[]] user .* not found
-            [[]client <HOST>[]] user .* password mismatch
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/apache-badbots.conf

@@ -1,28 +0,0 @@
-# Fail2Ban configuration file
-#
-# List of bad bots fetched from http://www.user-agents.org
-# Generated on Sun Feb 11 01:09:15 EST 2007 by ./badbots.sh
-#
-# Author: Yaroslav Halchenko
-#
-# $Revision$
-#
-
-[Definition]
-
-badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider
-badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|MVAClient|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|sogou spider|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|WebVulnCrawl\.blogspot\.com/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
-
-# Option:  failregex
-# Notes.:  Regexp to catch known spambots and software alike. Please verify
-#          that it is your intent to block IPs which were driven by
-#          abovementioned bots.
-# Values:  TEXT
-#
-failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex =

config/filter.d/apache-nohome.conf

@@ -1,23 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Yaroslav O. Halchenko <debian@onerussian.com>
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match failures to find a home directory on a server, which
-#          became popular last days. Most often attacker just uses IP instead of
-#          domain name -- so expect to see them in generic error.log if you have
-#          per-domain log files.
-# Values:  TEXT
-#
-failregex = [[]client <HOST>[]] File does not exist: .*/~.*
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/apache-noscript.conf

@@ -1,24 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match the password failure messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = [[]client <HOST>[]] (File does not exist|script not found or unable to stat): /\S*(\.php|\.asp|\.exe|\.pl)
-            [[]client <HOST>[]] script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat *$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/apache-overflows.conf

@@ -1,20 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Tim Connors
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  Regexp to catch Apache overflow attempts.
-# Values:  TEXT
-#
-failregex = [[]client <HOST>[]] (Invalid (method|URI) in request|request failed: URI too long|erroneous characters after protocol string)
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex =

config/filter.d/asterisk.conf

@@ -1,39 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Xavier Devlamynck
-#
-# $Revision$
-#
-
-
-[INCLUDES]
-
-# Read common prefixes. If any customizations available -- read them from
-# common.local
-before = common.conf
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
-# Values:  TEXT
-#
-failregex = NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - Wrong password$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - No matching peer found$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - Peer is not supposed to register$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - ACL error (permit/deny)$
-            NOTICE%(__pid_re)s <HOST> failed to authenticate as '.*'$
-            NOTICE%(__pid_re)s .*: No registration for peer '.*' \(from <HOST>\)$
-            NOTICE%(__pid_re)s .*: Host <HOST> failed MD5 authentication for '.*' (.*)$
-            NOTICE%(__pid_re)s .*: Failed to authenticate user .*@<HOST>.*$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex =

config/filter.d/common.conf

@@ -1,47 +0,0 @@
-# Generic configuration items (to be used as interpolations) in other
-# filters  or actions configurations
-#
-# Author: Yaroslav Halchenko
-#
-# $Revision$
-#
-
-[INCLUDES]
-
-# Load customizations if any available
-after = common.local
-
-
-[DEFAULT]
-
-# Daemon definition is to be specialized (if needed) in .conf file
-_daemon = \S*
-
-#
-# Shortcuts for easier comprehension of the failregex
-#
-# PID.
-# EXAMPLES: [123]
-__pid_re = (?:\[\d+\])
-
-# Daemon name (with optional source_file:line or whatever)
-# EXAMPLES: pam_rhosts_auth, [sshd], pop(pam_unix)
-__daemon_re = [\[\(]?%(_daemon)s(?:\(\S+\))?[\]\)]?:?
-
-# Combinations of daemon name and PID
-# EXAMPLES: sshd[31607], pop(pam_unix)[4920]
-__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
-
-# Some messages have a kernel prefix with a timestamp
-# EXAMPLES: kernel: [769570.846956]
-__kernel_prefix = kernel: \[\d+\.\d+\]
-
-__hostname = \S+
-
-#
-# Common line prefixes (beginnings) which could be used in filters
-#
-#       [hostname] [vserver tag] daemon_id spaces
-# this can be optional (for instance if we match named native log files)
-__prefix_line = \s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*
-

config/filter.d/courierlogin.conf

@@ -1,24 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Christoph Haas
-# Modified by: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = LOGIN FAILED, .*, ip=\[<HOST>\]$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/couriersmtp.conf

@@ -1,23 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = error,relay=<HOST>,.*550 User unknown
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/cyrus-imap.conf

@@ -1,26 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Jan Wagner <waja@cyconet.org>
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = : badlogin: .*\[<HOST>\] plaintext .*SASL\(-13\): authentication failure: checkpass failed$
-	    : badlogin: .*\[<HOST>\] LOGIN \[SASL\(-13\): authentication failure: checkpass failed\]$
-	    : badlogin: .*\[<HOST>\] (?:CRAM-MD5|NTLM) \[SASL\(-13\): authentication failure: incorrect (?:digest|NTLM) response\]$
-	    : badlogin: .*\[<HOST>\] DIGEST-MD5 \[SASL\(-13\): authentication failure: client response doesn't match what we generated\]$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/dovecot.conf

@@ -1,23 +0,0 @@
-# Fail2Ban configuration file for dovcot
-#
-# Author: Martin Waschbuesch
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = .*(?:pop3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/dropbear.conf

@@ -1,52 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Francis Russell
-#         Zak B. Elep
-#
-# $Revision$
-#
-# More information: http://bugs.debian.org/546913
-
-[INCLUDES]
-
-# Read common prefixes. If any customizations available -- read them from
-# common.local
-before = common.conf
-
-
-[Definition]
-
-_daemon = dropbear
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
-# Values:  TEXT
-
-# These match the unmodified dropbear messages. It isn't possible to
-# match the source of the 'exit before auth' messages from dropbear.
-#
-failregex = ^%(__prefix_line)slogin attempt for nonexistent user ('.*' )?from <HOST>:.*\s*$
-            ^%(__prefix_line)sbad password attempt for .+ from <HOST>:.*\s*$
-
-# The only line we need to match with the modified dropbear.
-
-# NOTE: The failregex below is ONLY intended to work with a patched
-# version of Dropbear as described here:
-# http://www.unchartedbackwaters.co.uk/pyblosxom/static/patches
-#
-# The standard Dropbear output doesn't provide enough information to
-# ban all types of attack.  The Dropbear patch adds IP address
-# information to the 'exit before auth' message which is always
-# produced for any form of non-successful login. It is that message
-# which this file matches.
-
-# failregex = ^%(__prefix_line)sexit before auth from <HOST>.*\s*$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/exim.conf

@@ -1,23 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = \[<HOST>\] .*(?:rejected by local_scan|Unrouteable address)
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/gssftpd.conf

@@ -1,20 +0,0 @@
-# Fail2Ban configuration file for wuftpd
-#
-# Author: Kevin Zembower (copied from wsftpd.conf)
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
-# Values: TEXT
-#
-failregex = ftpd(?:\[\d+\])?:\s+repeated login failures from <HOST> \(\S+\)$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/lighttpd-auth.conf

@@ -1,19 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Francois Boulogne <fboulogne@april.org>
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match wrong passwords as notified by lighttpd's auth Module
-# Values:  TEXT
-#
-failregex = .*http_auth.*password doesn\'t match.*IP: <HOST>\s*$
-
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/lighttpd-fastcgi.conf

@@ -1,18 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Arturo 'Buanzo' Busleiman <buanzo@buanzo.com.ar>
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match ALERTS as notified by lighttpd's FastCGI Module
-# Values:  TEXT
-#
-failregex = .*ALERT\ -\ .*attacker\ \'<HOST>\'
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/named-refused.conf

@@ -1,35 +0,0 @@
-# Fail2Ban configuration file for named (bind9). Trying to generalize the
-#          structure which is general to capture general patterns in log
-#          lines to cover different configurations/distributions
-#
-# Author: Yaroslav Halchenko
-#
-# $Revision$
-#
-
-[Definition]
-
-# 
-# Daemon name
-_daemon=named
-
-#
-# Shortcuts for easier comprehension of the failregex
-__pid_re=(?:\[\d+\])
-__daemon_re=\(?%(_daemon)s(?:\(\S+\))?\)?:?
-__daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
-#       hostname       daemon_id         spaces
-# this can be optional (for instance if we match named native log files)
-__line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
-
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
-# Values: TEXT
-#
-failregex = %(__line_prefix)sclient <HOST>#.+: query(?: \(cache\))? '.*' denied\s*$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/pam-generic.conf

@@ -1,31 +0,0 @@
-# Fail2Ban configuration file for generic PAM authentication errors
-#
-# Author: Yaroslav Halchenko
-#
-# $Revision$
-#
-
-[Definition]
-
-# if you want to catch only login erros from specific daemons, use smth like
-#_ttys_re=(?:ssh|pure-ftpd|ftp)
-# To catch all failed logins
-_ttys_re=\S*
-
-#
-# Shortcuts for easier comprehension of the failregex
-__pid_re=(?:\[\d+\])
-__pam_re=\(?pam_unix(?:\(\S+\))?\)?:?
-__pam_combs_re=(?:%(__pid_re)s?:\s+%(__pam_re)s|%(__pam_re)s%(__pid_re)s?:)
-
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
-# Values: TEXT
-#
-failregex = \s\S+ \S+%(__pam_combs_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=%(_ttys_re)s ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/php-url-fopen.conf

@@ -1,23 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Arturo 'Buanzo' Busleiman <buanzo@buanzo.com.ar>
-# Version 2
-# fixes the failregex so REFERERS that contain =http:// don't get blocked
-# (mentioned by "fasuto" (no real email provided... blog comment) in this entry:
-# http://blogs.buanzo.com.ar/2009/04/fail2ban-filter-for-php-injection-attacks.html#comment-1489
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match this kind of request:
-#
-# 66.185.212.172 - - [26/Mar/2009:08:44:20 -0500] "GET /index.php?n=http://eatmyfood.hostinginfive.com/pizza.htm? HTTP/1.1" 200 114 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
-#
-failregex = ^<HOST> -.*"(GET|POST).*\?.*\=http\:\/\/.* HTTP\/.*$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/postfix.conf

@@ -1,23 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = reject: RCPT from (.*)\[<HOST>\]: 554
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/proftpd.conf

@@ -1,26 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Yaroslav Halchenko
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values: TEXT
-#
-failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+ *$
-            \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): .*$
-            \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\. *$
-            \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/pure-ftpd.conf

@@ -1,29 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified: Yaroslav Halchenko for pure-ftpd
-#
-# $Revision$
-#
-
-[Definition]
-
-# Error message specified in multiple languages
-__errmsg = (?:Authentication failed for user|Erreur d'authentification pour l'utilisateur)
-
-#
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile. The
-#         host must be matched by a group named "host". The tag "<HOST>" can
-#         be used for standard IP/hostname matching and is only an alias for
-#         (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values: TEXT
-#
-failregex = pure-ftpd(?:\[\d+\])?: \(.+?@<HOST>\) \[WARNING\] %(__errmsg)s \[.+\]\s*$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 
-

config/filter.d/qmail.conf

@@ -1,23 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip )<HOST>
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/recidive.conf

@@ -1,38 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Tom Hendrikx, modifications by Amir Caspi 
-# 
-# This filter monitors the fail2ban log file, and enables you to add long 
-# time bans for ip addresses that get banned by fail2ban multiple times.
-# Reasons to use this: block very persistent attackers for a longer time, 
-# stop receiving email notifications about the same attacker over and 
-# over again.
-#
-# This jail is only useful if you set the 'findtime' and 'bantime' parameters 
-# in jail.conf to a higher value than the other jails. Also, this jail has its
-# drawbacks, namely in that it works only with iptables, or if you use a 
-# different blocking mechanism for this jail versus others (e.g. hostsdeny 
-# for most jails, and shorewall for this one).
-#
-
-[Definition]
-
-# The name of the jail that this filter is used for. In jail.conf, name the 
-# jail using this filter 'recidive', or change this line!
-_jailname = recidive
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
-# Values:  TEXT
-#
-failregex = fail2ban.actions:\s+WARNING\s+\[(?:.*)\]\s+Ban\s+<HOST>
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-# Ignore our own bans, to keep our counts exact.
-ignoreregex = fail2ban.actions:\s+WARNING\s+\[%(_jailname)s\]\s+Ban\s+<HOST>

config/filter.d/sasl.conf

@@ -1,23 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Yaroslav Halchenko
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values: TEXT
-#
-failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/sieve.conf

@@ -1,22 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Jan Wagner <waja@cyconet.org>
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching.
-# Values: TEXT
-#
-failregex = : badlogin: .*\[<HOST>\] (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failure$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/sshd-ddos.conf

@@ -1,23 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Yaroslav Halchenko
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = sshd(?:\[\d+\])?: Did not receive identification string from <HOST>$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/sshd.conf

@@ -1,42 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[INCLUDES]
-
-# Read common prefixes. If any customizations available -- read them from
-# common.local
-before = common.conf
-
-
-[Definition]
-
-_daemon = sshd
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
-            ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
-            ^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?\s*$
-            ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
-            ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
-            ^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$
-            ^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$
-            ^%(__prefix_line)s(?:pam_unix\(sshd:auth\):\s)?authentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
-            ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
-            ^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\s*$
-            ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/vsftpd.conf

@@ -1,24 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values: TEXT
-#
-failregex = vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=<HOST>(?:\s+user=\S*)?\s*$
-            \[.+\] FAIL LOGIN: Client "<HOST>"\s*$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/webmin-auth.conf

@@ -1,28 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Rule by : Delvit Guillaume
-#
-# $Revision$
-#
-
-[Definition]
-
-# patern :      webmin[15673]: Non-existent login as toto from 86.0.6.217
-#               webmin[29544]: Invalid login as root from 86.0.6.217
-#
-# Option:  failregex
-# Notes.:  regex to match the password failure messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = webmin.* Non-existent login as .+ from <HOST>$
-            webmin.* Invalid login as .+ from <HOST>$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/wuftpd.conf

@@ -1,21 +0,0 @@
-# Fail2Ban configuration file for wuftpd
-#
-# Author: Yaroslav Halchenko
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
-# Values: TEXT
-#
-failregex = wu-ftpd(?:\[\d+\])?:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>$
-            wu-ftpd(?:\[\d+\])?: *failed login from .*\[<HOST>\] *$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/filter.d/xinetd-fail.conf

@@ -1,30 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Guido Bozzetto
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-# Cfr.: /var/log/(daemon\.|sys)log
-# libwrap => tcp wrappers: hosts.(allow|deny)
-# address => xinetd: deny_from|only_from
-# load => xinetd: max_load (temporary problem)
-#
-
-failregex = xinetd(?:\[\d{1,5}\])?: FAIL: \S+ address from=<HOST>$
-            xinetd(?:\[\d{1,5}\])?: FAIL: \S+ libwrap from=<HOST>$
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex = 

config/jail.conf

@@ -1,308 +0,0 @@
-# Fail2Ban jail specifications file
-#
-# Comments: use '#' for comment lines and ';' for inline comments
-#
-# Changes:  in most of the cases you should not modify this
-#           file, but provide customizations in jail.local file, e.g.:
-#
-# [DEFAULT]
-# bantime = 3600
-#
-# [ssh-iptables]
-# enabled = true
-#
-
-# The DEFAULT allows a global definition of the options. They can be overridden
-# in each jail afterwards.
-
-[DEFAULT]
-
-# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
-# ban a host which matches an address in this list. Several addresses can be
-# defined using space separator.
-ignoreip = 127.0.0.1/8
-
-# "bantime" is the number of seconds that a host is banned.
-bantime  = 600
-
-# A host is banned if it has generated "maxretry" during the last "findtime"
-# seconds.
-findtime  = 600
-
-# "maxretry" is the number of failures before a host get banned.
-maxretry = 3
-
-# "backend" specifies the backend used to get files modification.
-# Available options are "pyinotify", "gamin", "polling" and "auto".
-# This option can be overridden in each jail as well.
-#
-# pyinotify: requires pyinotify (a file alteration monitor) to be installed.
-#              If pyinotify is not installed, Fail2ban will use auto.
-# gamin:     requires Gamin (a file alteration monitor) to be installed.
-#              If Gamin is not installed, Fail2ban will use auto.
-# polling:   uses a polling algorithm which does not require external libraries.
-# auto:      will try to use the following backends, in order:
-#              pyinotify, gamin, polling.
-backend = auto
-
-# "usedns" specifies if jails should trust hostnames in logs,
-#   warn when reverse DNS lookups are performed, or ignore all hostnames in logs
-#
-# yes:   if a hostname is encountered, a reverse DNS lookup will be performed.
-# warn:  if a hostname is encountered, a reverse DNS lookup will be performed, 
-#        but it will be logged as a warning.
-# no:    if a hostname is encountered, will not be used for banning,
-#        but it will be logged as info.
-usedns = warn
-
-
-# This jail corresponds to the standard configuration in Fail2ban 0.6.
-# The mail-whois action send a notification e-mail with a whois request
-# in the body.
-
-[ssh-iptables]
-
-enabled  = false
-filter   = sshd
-action   = iptables[name=SSH, port=ssh, protocol=tcp]
-           sendmail-whois[name=SSH, dest=you@example.com, sender=fail2ban@example.com]
-logpath  = /var/log/sshd.log
-maxretry = 5
-
-[proftpd-iptables]
-
-enabled  = false
-filter   = proftpd
-action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
-           sendmail-whois[name=ProFTPD, dest=you@example.com]
-logpath  = /var/log/proftpd/proftpd.log
-maxretry = 6
-
-# This jail forces the backend to "polling".
-
-[sasl-iptables]
-
-enabled  = false
-filter   = sasl
-backend  = polling
-action   = iptables[name=sasl, port=smtp, protocol=tcp]
-           sendmail-whois[name=sasl, dest=you@example.com]
-logpath  = /var/log/mail.log
-
-# Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
-# used to avoid banning the user "myuser".
-
-[ssh-tcpwrapper]
-
-enabled     = false
-filter      = sshd
-action      = hostsdeny
-              sendmail-whois[name=SSH, dest=you@example.com]
-ignoreregex = for myuser from
-logpath     = /var/log/sshd.log
-
-# This jail demonstrates the use of wildcards in "logpath".
-# Moreover, it is possible to give other files on a new line.
-
-[apache-tcpwrapper]
-
-enabled  = false
-filter	 = apache-auth
-action   = hostsdeny
-logpath  = /var/log/apache*/*error.log
-           /home/www/myhomepage/error.log
-maxretry = 6
-
-# The hosts.deny path can be defined with the "file" argument if it is
-# not in /etc.
-
-[postfix-tcpwrapper]
-
-enabled  = false
-filter   = postfix
-action   = hostsdeny[file=/not/a/standard/path/hosts.deny]
-           sendmail[name=Postfix, dest=you@example.com]
-logpath  = /var/log/postfix.log
-bantime  = 300
-
-# Do not ban anybody. Just report information about the remote host.
-# A notification is sent at most every 600 seconds (bantime).
-
-[vsftpd-notification]
-
-enabled  = false
-filter   = vsftpd
-action   = sendmail-whois[name=VSFTPD, dest=you@example.com]
-logpath  = /var/log/vsftpd.log
-maxretry = 5
-bantime  = 1800
-
-# Same as above but with banning the IP address.
-
-[vsftpd-iptables]
-
-enabled  = false
-filter   = vsftpd
-action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
-           sendmail-whois[name=VSFTPD, dest=you@example.com]
-logpath  = /var/log/vsftpd.log
-maxretry = 5
-bantime  = 1800
-
-# Ban hosts which agent identifies spammer robots crawling the web
-# for email addresses. The mail outputs are buffered.
-
-[apache-badbots]
-
-enabled  = false
-filter   = apache-badbots
-action   = iptables-multiport[name=BadBots, port="http,https"]
-           sendmail-buffered[name=BadBots, lines=5, dest=you@example.com]
-logpath  = /var/www/*/logs/access_log
-bantime  = 172800
-maxretry = 1
-
-# Use shorewall instead of iptables.
-
-[apache-shorewall]
-
-enabled  = false
-filter   = apache-noscript
-action   = shorewall
-           sendmail[name=Postfix, dest=you@example.com]
-logpath  = /var/log/apache2/error_log
-
-# Ban attackers that try to use PHP's URL-fopen() functionality
-# through GET/POST variables. - Experimental, with more than a year
-# of usage in production environments.
-
-[php-url-fopen]
-
-enabled = false
-port    = http,https
-filter  = php-url-fopen
-logpath = /var/www/*/logs/access_log
-maxretry = 1
-
-# A simple PHP-fastcgi jail which works with lighttpd.
-# If you run a lighttpd server, then you probably will
-# find these kinds of messages in your error_log:
-# ALERT – tried to register forbidden variable ‘GLOBALS’
-# through GET variables (attacker '1.2.3.4', file '/var/www/default/htdocs/index.php')
-# This jail would block the IP 1.2.3.4.
-
-[lighttpd-fastcgi]
-
-enabled = false
-port    = http,https
-filter  = lighttpd-fastcgi
-# adapt the following two items as needed
-logpath = /var/log/lighttpd/error.log
-maxretry = 2
-
-# Same as above for mod_auth
-# It catches wrong authentifications
-
-[lighttpd-auth]
-
-enabled = false
-port    = http,https
-filter  = lighttpd-auth
-# adapt the following two items as needed
-logpath = /var/log/lighttpd/error.log
-maxretry = 2
-
-# This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
-# option is overridden in this jail. Moreover, the action "mail-whois" defines
-# the variable "name" which contains a comma using "". The characters '' are
-# valid too.
-
-[ssh-ipfw]
-
-enabled  = false
-filter   = sshd
-action   = ipfw[localhost=192.168.0.1]
-           sendmail-whois[name="SSH,IPFW", dest=you@example.com]
-logpath  = /var/log/auth.log
-ignoreip = 168.192.0.1
-
-# These jails block attacks against named (bind9). By default, logging is off
-# with bind9 installation. You will need something like this:
-#
-# logging {
-#     channel security_file {
-#         file "/var/log/named/security.log" versions 3 size 30m;
-#         severity dynamic;
-#         print-time yes;
-#     };
-#     category security {
-#         security_file;
-#     };
-# };
-#
-# in your named.conf to provide proper logging.
-# This jail blocks UDP traffic for DNS requests.
-
-# !!! WARNING !!!
-#   Since UDP is connection-less protocol, spoofing of IP and imitation
-#   of illegal actions is way too simple.  Thus enabling of this filter
-#   might provide an easy way for implementing a DoS against a chosen
-#   victim. See
-#    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
-#   Please DO NOT USE this jail unless you know what you are doing.
-#
-# [named-refused-udp]
-#
-# enabled  = false
-# filter   = named-refused
-# action   = iptables-multiport[name=Named, port="domain,953", protocol=udp]
-#            sendmail-whois[name=Named, dest=you@example.com]
-# logpath  = /var/log/named/security.log
-# ignoreip = 168.192.0.1
-
-# This jail blocks TCP traffic for DNS requests.
-
-[named-refused-tcp]
-
-enabled  = false
-filter   = named-refused
-action   = iptables-multiport[name=Named, port="domain,953", protocol=tcp]
-           sendmail-whois[name=Named, dest=you@example.com]
-logpath  = /var/log/named/security.log
-ignoreip = 168.192.0.1
-
-# Multiple jails, 1 per protocol, are necessary ATM:
-# see https://github.com/fail2ban/fail2ban/issues/37
-[asterisk-tcp]
-
-enabled  = false
-filter   = asterisk
-action   = iptables-multiport[name=asterisk-tcp, port="5060,5061", protocol=tcp]
-           sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com]
-logpath  = /var/log/asterisk/messages
-maxretry = 10
-
-[asterisk-udp]
-
-enabled  = false
-filter	 = asterisk
-action   = iptables-multiport[name=asterisk-udp, port="5060,5061", protocol=udp]
-           sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com]
-logpath  = /var/log/asterisk/messages
-maxretry = 10
-
-# Jail for more extended banning of persistent abusers
-# !!! WARNING !!!
-#   Make sure that your loglevel specified in fail2ban.conf/.local
-#   is not at DEBUG level -- which might then cause fail2ban to fall into
-#   an infinite loop constantly feeding itself with non-informative lines
-[recidive]
-
-enabled  = false
-filter   = recidive
-logpath  = /var/log/fail2ban.log
-action   = iptables-allports[name=recidive]
-           sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log]
-bantime  = 604800  ; 1 week
-findtime = 86400   ; 1 day
-maxretry = 5

doc/run-rootless.txt

@@ -1,92 +0,0 @@
-Fail2ban normally requires root priviledges to insert iptables rules
-through calls to /sbin/iptables and also to read the logfiles.
-Fail2ban can run as an unpriviledged user provided that those two
-capabilites are preserved. The idea is to run fail2ban as a normal
-user (e.g. fail2ban) who belongs to a group which is allowed to read
-logfiles. The user should also be allowed to write to
-/proc/net/xt_recent/fail2ban-<name> (name is specified in the iptables
-rule).
-
-/proc/net/xt_recent/* is created by the xt_recent kernel module when
-an iptables rule with '-m limit' is inserted. This file contains a
-dynamic list of IP addresses which can than be used in iptables rules.
-Addresses can be matched against this list, with an optional timeout.
-One way to use xt_recent is to insert IPs into this list from an
-iptables rule, e.g. after connecting to the SSH port three times in a
-minute. This is the standard usage described in iptables(3).
-
-Another way to use xt_recent is by inserting the rules by writing to
-/proc/net/xt_recent/fail2ban-<name>. This can be performed by a fail2ban
-action. Files in /proc/net/xt_recent/ are protected by normal
-filesystem rules, so can be chown'ed and chmod'ed to be writable by a
-certain user. After the necessary iptables rules are inserted (which
-requires root priviledges), blacklisting can be perfomed by an
-unpriviledged user.
-
-Using fail2ban with xt_recent allows smarter filtering than normal
-iptables rules with the xt_recent module can provide.
-
-The disadvantage is that fail2ban cannot perform the setup by itself,
-which would require the priviledge to call /sbin/iptables, and it must
-be done through other means.
-
-The primary advantage is obvious: it's generally better to run
-services not as root. This setup is more robust, because xt_recent has
-it's own memory management and should behave smartly in case a very
-large amount of IPs is blocked. Also in case the fail2ban process dies
-the rules expire automatically. In case of a large amount of blocked
-IPs, traversing rules linearly for each SYN packet as fail2ban
-normally inserts them will be slow, but xt_recent with the same number
-of IPs would be much faster. (Didn't test this, so this is pure
-handwaving, but it should really be this way ;)) From the
-administrators point of view, a setup with xt_recent might also be
-easier, because it's very simple to modify the permissions on
-/proc/net/xt_recent/fail2ban-<name> to be readable or writable by
-some user and thus allow delisting IPs by helper administrators
-without the ability to mess up other iptables rules.
-
-The xt_recent-echo jail can be used under the root user without
-further configuration. To run not as root, futher setup is necessary:
-
-- Create user:
-
-  - set FAIL2BAN_USER in /etc/default/fail2ban.
-
-    This probably should be fail2ban.
-
-  - add user fail2ban who can read /var/log/auth.log and other
-    necessary log files. Log files are owned by group 'adm', so
-    it is enough if this user belongs to this group.
-
-    The user can be created e.g. with
-
-     useradd --system --no-create-home --home-dir / --groups adm fail2ban
-
-- Statically initialize chains firewall:
-
-  - put a rule to check the xt_recent list in the static firewall initialization
-    script, with names like fail2ban-ssh (action uses separate chains per each
-    jail, so define here the ones you need 1-per-jail)
-
-    Sample invocation might be
-
-     iptables -I INPUT -m recent --update --seconds 3600 --name fail2ban-<name> -j DROP
-
-    with <name> suitably replaced.
-
-  - suppress actionstart for iptables-xt_recent-echo action by creating an override file
-    iptables-xt_recent-echo.local to accompany iptables-xt_recent-echo.conf with
-
-     [Definition]
-     actionstart =
-
-- Permissions:
-
-  make sure that configuration files under /etc/fail2ban are readable by
-  fail2ban user. Make sure that logfiles of fail2ban itself are writable
-  by the fail2ban user. /etc/init.d/fail2ban will change the ownership at
-  startup, but it is also necessary to modify /etc/logrotate.d/fail2ban.
-
-  The simplest way is to replace '# create ...' with the following
-    # create 640 fail2ban adm
-

fail2ban-client

@@ -1,407 +0,0 @@
-#!/usr/bin/python
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import sys, string, os, pickle, re, logging, signal
-import getopt, time, shlex, socket
-
-# Inserts our own modules path first in the list
-# fix for bug #343821
-sys.path.insert(1, "/usr/share/fail2ban")
-
-# Now we can import our modules
-from common.version import version
-from common.protocol import printFormatted
-from client.csocket import CSocket
-from client.configurator import Configurator
-from client.beautifier import Beautifier
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.client")
-
-##
-#
-# @todo This class needs cleanup.
-
-class Fail2banClient:
-
-	SERVER = "fail2ban-server"
-	PROMPT = "fail2ban> "
-
-	def __init__(self):
-		self.__argv = None
-		self.__stream = None
-		self.__configurator = Configurator()
-		self.__conf = dict()
-		self.__conf["conf"] = "/etc/fail2ban"
-		self.__conf["dump"] = False
-		self.__conf["force"] = False
-		self.__conf["verbose"] = 1
-		self.__conf["interactive"] = False
-		self.__conf["socket"] = None
-		
-	def dispVersion(self):
-		print "Fail2Ban v" + version
-		print
-		print "Copyright (c) 2004-2008 Cyril Jaquier"
-		print "Copyright of modifications held by their respective authors."
-		print "Licensed under the GNU General Public License v2 (GPL)."
-		print
-		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
-		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
-	
-	def dispUsage(self):
-		""" Prints Fail2Ban command line options and exits
-		"""
-		print "Usage: "+self.__argv[0]+" [OPTIONS] <COMMAND>"
-		print
-		print "Fail2Ban v" + version + " reads log file that contains password failure report"
-		print "and bans the corresponding IP addresses using firewall rules."
-		print
-		print "Options:"
-		print "    -c <DIR>                configuration directory"
-		print "    -s <FILE>               socket path"
-		print "    -d                      dump configuration. For debugging"
-		print "    -i                      interactive mode"
-		print "    -v                      increase verbosity"
-		print "    -q                      decrease verbosity"
-		print "    -x                      force execution of the server (remove socket file)"
-		print "    -h, --help              display this help message"
-		print "    -V, --version           print the version"
-		print
-		print "Command:"
-		
-		# Prints the protocol
-		printFormatted()
-		
-		print
-		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
-	
-	def dispInteractive(self):
-		print "Fail2Ban v" + version + " reads log file that contains password failure report"
-		print "and bans the corresponding IP addresses using firewall rules."
-		print 
-
-	def __sigTERMhandler(self, signum, frame):
-		# Print a new line because we probably come from wait
-		print
-		logSys.warn("Caught signal %d. Exiting" % signum)
-		sys.exit(-1)
-
-	def __getCmdLineOptions(self, optList):
-		""" Gets the command line options
-		"""
-		for opt in optList:
-			if opt[0] == "-c":
-				self.__conf["conf"] = opt[1]
-			elif opt[0] == "-s":
-				self.__conf["socket"] = opt[1]
-			elif opt[0] == "-d":
-				self.__conf["dump"] = True
-			elif opt[0] == "-v":
-				self.__conf["verbose"] = self.__conf["verbose"] + 1
-			elif opt[0] == "-q":
-				self.__conf["verbose"] = self.__conf["verbose"] - 1
-			elif opt[0] == "-x":
-				self.__conf["force"] = True
-			elif opt[0] == "-i":
-				self.__conf["interactive"] = True
-			elif opt[0] in ["-h", "--help"]:
-	 			self.dispUsage()
-	 			sys.exit(0)
-	 		elif opt[0] in ["-V", "--version"]:
-	 			self.dispVersion()
-	 			sys.exit(0)
-	
-	def __ping(self):
-		return self.__processCmd([["ping"]], False)
-	
-	def __processCmd(self, cmd, showRet = True):
-		beautifier = Beautifier()
-		for c in cmd:
-			beautifier.setInputCmd(c)
-			try:
-				client = CSocket(self.__conf["socket"])
-				ret = client.send(c)
-				if ret[0] == 0:
-					logSys.debug("OK : " + `ret[1]`)
-					if showRet:
-						print beautifier.beautify(ret[1])
-				else:
-					logSys.debug("NOK: " + `ret[1].args`)
-					print beautifier.beautifyError(ret[1])
-					return False
-			except socket.error:
-				if showRet:
-					logSys.error("Unable to contact server. Is it running?")
-				return False
-			except Exception, e:
-				if showRet:
-					logSys.error(e)
-				return False
-		return True
-		
-	##
-	# Process a command line.
-	#
-	# Process one command line and exit.
-	# @param cmd the command line
-
-	def __processCommand(self, cmd):
-		if len(cmd) == 1 and cmd[0] == "start":
-			if self.__ping():
-				logSys.error("Server already running")
-				return False
-			else:
-				# Read the config
-				ret = self.__readConfig()
-				# Do not continue if configuration is not 100% valid
-				if not ret:
-					return False
-				# Start the server
-				self.__startServerAsync(self.__conf["socket"],
-										self.__conf["force"])
-				try:
-					# Wait for the server to start
-					self.__waitOnServer()
-					# Configure the server
-					self.__processCmd(self.__stream, False)
-					return True
-				except ServerExecutionException:
-					logSys.error("Could not start server. Maybe an old " +
-								 "socket file is still present. Try to " +
-								 "remove " + self.__conf["socket"] + ". If " +
-								 "you used fail2ban-client to start the " +
-								 "server, adding the -x option will do it")
-					return False
-		elif len(cmd) == 1 and cmd[0] == "reload":
-			if self.__ping():
-				ret = self.__readConfig()
-				# Do not continue if configuration is not 100% valid
-				if not ret:
-					return False
-				self.__processCmd([['stop', 'all']], False)
-				# Configure the server
-				return self.__processCmd(self.__stream, False)
-			else:
-				logSys.error("Could not find server")
-				return False
-		elif len(cmd) == 2 and cmd[0] == "reload":
-			if self.__ping():
-				jail = cmd[1]
-				ret = self.__readJailConfig(jail)
-				# Do not continue if configuration is not 100% valid
-				if not ret:
-					return False
-				self.__processCmd([['stop', jail]], False)
-				# Configure the server
-				return self.__processCmd(self.__stream, False)
-			else:
-				logSys.error("Could not find server")
-				return False
-		else:
-			return self.__processCmd([cmd])
-	
-	
-	##
-	# Start Fail2Ban server.
-	#
-	# Start the Fail2ban server in daemon mode.
-	
-	def __startServerAsync(self, socket, force = False):
-		# Forks the current process.
-		pid = os.fork()
-		if pid == 0:
-			args = list()
-			args.append(self.SERVER)
-			# Start in background mode.
-			args.append("-b")
-			# Set the socket path.
-			args.append("-s")
-			args.append(socket)
-			# Force the execution if needed.
-			if force:
-				args.append("-x")
-			try:
-				# Use the current directory.
-				exe = os.path.abspath(os.path.join(sys.path[0], self.SERVER))
-				os.execv(exe, args)
-			except OSError:
-				try:
-					# Use the PATH env.
-					os.execvp(self.SERVER, args)
-				except OSError:
-					print "Could not find %s" % self.SERVER
-					os.exit(-1)
-						
-			
-	def __waitOnServer(self):
-		# Wait for the server to start
-		cnt = 0
-		if self.__conf["verbose"] > 1:
-			pos = 0
-			delta = 1
-			mask = "[          ]"
-		while not self.__ping():
-			# Wonderful visual :)
-			if self.__conf["verbose"] > 1:
-				pos += delta
-				sys.stdout.write("\rINFO   " + mask[:pos] + '#' + mask[pos+1:] +
-								 " Waiting on the server...")
-				sys.stdout.flush()
-				if pos > len(mask)-3:
-					delta = -1
-				elif pos < 2:
-					delta = 1
-			# The server has 30 secondes to start.
-			if cnt >= 300:
-				if self.__conf["verbose"] > 1:
-					sys.stdout.write('\n')
-				raise ServerExecutionException("Failed to start server")
-			time.sleep(0.1)
-			cnt += 1
-		if self.__conf["verbose"] > 1:
-			sys.stdout.write('\n')
-			
-	
-	def start(self, argv):
-		# Command line options
-		self.__argv = argv
-		
-		# Install signal handlers
-		signal.signal(signal.SIGTERM, self.__sigTERMhandler)
-		signal.signal(signal.SIGINT, self.__sigTERMhandler)
-		
-		# Reads the command line options.
-		try:
-			cmdOpts = 'hc:s:xdviqV'
-			cmdLongOpts = ['help', 'version']
-			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
-		except getopt.GetoptError:
-			self.dispUsage()
-			return False
-			
-		self.__getCmdLineOptions(optList)
-		
-		verbose = self.__conf["verbose"]
-		if verbose <= 0:
-			logSys.setLevel(logging.ERROR)
-		elif verbose == 1:
-			logSys.setLevel(logging.WARN)
-		elif verbose == 2:
-			logSys.setLevel(logging.INFO)
-		else:
-			logSys.setLevel(logging.DEBUG)
-		# Add the default logging handler
-		stdout = logging.StreamHandler(sys.stdout)
-		# set a format which is simpler for console use
-		formatter = logging.Formatter('%(levelname)-6s %(message)s')
-		# tell the handler to use this format
-		stdout.setFormatter(formatter)
-		logSys.addHandler(stdout)
-
-		# Set the configuration path
-		self.__configurator.setBaseDir(self.__conf["conf"])
-		
-		# Set socket path
-		self.__configurator.readEarly()
-		socket = self.__configurator.getEarlyOptions()
-		if self.__conf["socket"] == None:
-			self.__conf["socket"] = socket["socket"]
-		logSys.info("Using socket file " + self.__conf["socket"])
-
-		if self.__conf["dump"]:
-			ret = self.__readConfig()
-			self.dumpConfig(self.__stream)
-			return ret
-		
-		# Interactive mode
-		if self.__conf["interactive"]:
-			try:
-				import readline
-			except ImportError:
-				logSys.error("Readline not available")
-				return False
-			try:
-				ret = True
-				if len(args) > 0:
-					ret = self.__processCommand(args)
-				if ret:
-					readline.parse_and_bind("tab: complete")
-					self.dispInteractive()
-					while True:
-						cmd = raw_input(self.PROMPT)
-						if cmd == "exit" or cmd == "quit":
-							# Exit
-							return True
-						if not cmd == "":
-							self.__processCommand(shlex.split(cmd))
-			except (EOFError, KeyboardInterrupt):
-				print
-				return True
-		# Single command mode
-		else:
-			if len(args) < 1:
-				self.dispUsage()
-				return False
-			return self.__processCommand(args)
-
-	def __readConfig(self):
-		# Read the configuration
-		self.__configurator.readAll()
-		ret = self.__configurator.getOptions()
-		self.__configurator.convertToProtocol()
-		self.__stream = self.__configurator.getConfigStream()
-		return ret
-	
-	def __readJailConfig(self, jail):
-		self.__configurator.readAll()
-		ret = self.__configurator.getOptions(jail)
-		self.__configurator.convertToProtocol()
-		self.__stream = self.__configurator.getConfigStream()
-		return ret
-	
-	#@staticmethod
-	def dumpConfig(cmd):
-		for c in cmd:
-			print c
-		return True
-	dumpConfig = staticmethod(dumpConfig)
-
-
-class ServerExecutionException(Exception):
-	pass
-
-if __name__ == "__main__":
-	client = Fail2banClient()
-	# Exit with correct return value
-	if client.start(sys.argv):
-		sys.exit(0)
-	else:
-		sys.exit(-1)

fail2ban-regex

@@ -1,365 +0,0 @@
-#!/usr/bin/python
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import getopt, sys, time, logging, os
-
-# Inserts our own modules path first in the list
-# fix for bug #343821
-#sys.path.insert(1, "/usr/share/fail2ban")
-
-from client.configparserinc import SafeConfigParserWithIncludes
-from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
-from common.version import version
-from server.filter import Filter
-from server.failregex import RegexException
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.regex")
-
-class RegexStat:
-
-	def __init__(self, failregex):
-		self.__stats = 0
-		self.__failregex = failregex
-		self.__ipList = list()
-	
-	def inc(self):
-		self.__stats += 1
-	
-	def getStats(self):
-		return self.__stats
-
-	def getFailRegex(self):
-		return self.__failregex
-	
-	def appendIP(self, value):
-		self.__ipList.extend(value)
-	
-	def getIPList(self):
-		return self.__ipList
-
-class Fail2banRegex:
-	
-	test = None
-
-	CONFIG_DEFAULTS = {'configpath' : "/etc/fail2ban/"}
-
-	def __init__(self):
-		self.__filter = Filter(None)
-		self.__ignoreregex = list()
-		self.__failregex = list()
-		self.__verbose = False
-		# Setup logging
-		logging.getLogger("fail2ban").handlers = []
-		self.__hdlr = logging.StreamHandler(Fail2banRegex.test)
-		# set a format which is simpler for console use
-		formatter = logging.Formatter("%(message)s")
-		# tell the handler to use this format
-		self.__hdlr.setFormatter(formatter)
-		self.__logging_level = self.__verbose and logging.DEBUG or logging.WARN
-		logging.getLogger("fail2ban").addHandler(self.__hdlr)
-		logging.getLogger("fail2ban").setLevel(logging.ERROR)
-	
-	#@staticmethod
-	def dispVersion():
-		print "Fail2Ban v" + version
-		print
-		print "Copyright (c) 2004-2008 Cyril Jaquier"
-		print "Copyright of modifications held by their respective authors."
-		print "Licensed under the GNU General Public License v2 (GPL)."
-		print
-		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
-		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
-	dispVersion = staticmethod(dispVersion)
-	
-	#@staticmethod
-	def dispUsage():
-		print "Usage: "+sys.argv[0]+" [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]"
-		print
-		print "Fail2Ban v" + version + " reads log file that contains password failure report"
-		print "and bans the corresponding IP addresses using firewall rules."
-		print
-		print "This tools can test regular expressions for \"fail2ban\"."
-		print
-		print "Options:"
-		print "    -h, --help              display this help message"
-		print "    -V, --version           print the version"
-		print "    -v, --verbose           verbose output"
-		print
-		print "Log:"
-		print "    string                  a string representing a log line"
-		print "    filename                path to a log file (/var/log/auth.log)"
-		print
-		print "Regex:"
-		print "    string                  a string representing a 'failregex'"
-		print "    filename                path to a filter file (filter.d/sshd.conf)"
-		print
-		print "IgnoreRegex:"
-		print "    string                  a string representing an 'ignoreregex'"
-		print "    filename                path to a filter file (filter.d/sshd.conf)"
-		print
-		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
-	dispUsage = staticmethod(dispUsage)
-	
-	def getCmdLineOptions(self, optList):
-		""" Gets the command line options
-		"""
-		for opt in optList:
-			if opt[0] in ["-h", "--help"]:
-				self.dispUsage()
-				sys.exit(0)
-			elif opt[0] in ["-V", "--version"]:
-				self.dispVersion()
-				sys.exit(0)
-			elif opt[0] in ["-v", "--verbose"]:
-				self.__verbose = True
-
-	#@staticmethod
-	def logIsFile(value):
-		return os.path.isfile(value)
-	logIsFile = staticmethod(logIsFile)
-
-	def readIgnoreRegex(self, value):
-		if os.path.isfile(value):
-			reader = SafeConfigParserWithIncludes(defaults=self.CONFIG_DEFAULTS)
-			try:
-				reader.read(value)
-				print "Use ignoreregex file : " + value
-				self.__ignoreregex = [RegexStat(m)
-									for m in reader.get("Definition", "ignoreregex").split('\n')]
-			except NoSectionError:
-				print "No [Definition] section in " + value
-				print
-				return False
-			except NoOptionError:
-				print "No failregex option in " + value
-				print
-				return False
-			except MissingSectionHeaderError:
-				print "No section headers in " + value
-				print
-				return False
-		else:
-			if len(value) > 53:
-				stripReg = value[0:50] + "..."
-			else:
-				stripReg = value
-			print "Use ignoreregex line : " + stripReg
-			self.__ignoreregex = [RegexStat(value)]
-		return True
-
-	def readRegex(self, value):
-		if os.path.isfile(value):
-			reader = SafeConfigParserWithIncludes(defaults=self.CONFIG_DEFAULTS)
-			try:
-				reader.read(value)
-				print "Use regex file : " + value
-				self.__failregex = [RegexStat(m)
-									for m in reader.get("Definition", "failregex").split('\n')]
-			except NoSectionError:
-				print "No [Definition] section in " + value
-				print
-				return False
-			except NoOptionError:
-				print "No failregex option in " + value
-				print
-				return False
-			except MissingSectionHeaderError:
-				print "No section headers in " + value
-				print
-				return False
-		else:
-			if len(value) > 53:
-				stripReg = value[0:50] + "..."
-			else:
-				stripReg = value
-			print "Use regex line : " + stripReg
-			self.__failregex = [RegexStat(value)]
-		return True
-	
-	def testIgnoreRegex(self, line):
-		found = False
-		for regex in self.__ignoreregex:
-			logging.getLogger("fail2ban").setLevel(self.__logging_level)
-			try:
-				self.__filter.addIgnoreRegex(regex.getFailRegex())
-				try:
-					ret = self.__filter.ignoreLine(line)
-					if ret:
-						regex.inc()
-				except RegexException, e:
-					print e
-					return False
-			finally:
-				self.__filter.delIgnoreRegex(0)
-				logging.getLogger("fail2ban").setLevel(self.__logging_level)
-	
-	def testRegex(self, line):
-		found = False
-		for regex in self.__ignoreregex:
-			self.__filter.addIgnoreRegex(regex.getFailRegex())
-		for regex in self.__failregex:
-			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
-			try:
-				self.__filter.addFailRegex(regex.getFailRegex())
-				try:
-					ret = self.__filter.processLine(line)
-					if not len(ret) == 0:
-						if found == True:
-							ret[0].append(True)
-						else:
-							found = True
-							ret[0].append(False)
-						regex.inc()
-						regex.appendIP(ret)
-				except RegexException, e:
-					print e
-					return False
-				except IndexError:
-					print "Sorry, but no <host> found in regex"
-					return False
-			finally:
-				self.__filter.delFailRegex(0)
-				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
-		for regex in self.__ignoreregex:
-					self.__filter.delIgnoreRegex(0)
-	
-	def printStats(self):
-		print
-		print "Results"
-		print "======="
-		print
-
-		def print_failregexes(title, failregexes):
-			# Print title
-			total, out = 0, []
-			for cnt, failregex in enumerate(failregexes):
-				match = failregex.getStats()
-				total += match
-				if (match or self.__verbose):
-					out.append("|  %d) [%d] %s" % (cnt+1, match, failregex.getFailRegex()))
-			print "%s: %d total" % (title, total)
-			if len(out):
-				print "|- #) [# of hits] regular expression"
-				print '\n'.join(out)
-				print '`-'
-			print
-			return total
-
-		# Print title
-		total = print_failregexes("Failregex", self.__failregex)
-		_ = print_failregexes("Ignoreregex", self.__ignoreregex)
-
-		print "Summary"
-		print "======="
-		print
-
-		if total == 0:
-			print "Sorry, no match"
-			print
-			print "Look at the above section 'Running tests' which could contain important"
-			print "information."
-			return False
-		else:
-			# Print stats
-			print "Addresses found:"
-			for cnt, failregex in enumerate(self.__failregex):
-				if self.__verbose or len(failregex.getIPList()):
-					print "[%d]" % (cnt+1)
-					for ip in failregex.getIPList():
-						timeTuple = time.localtime(ip[1])
-						timeString = time.strftime("%a %b %d %H:%M:%S %Y", timeTuple)
-						print "    %s (%s)%s" % (
-							ip[0], timeString, ip[2] and " (already matched)" or "")
-			print
-			
-			print "Date template hits:"
-			for template in self.__filter.dateDetector.getTemplates():
-				if self.__verbose or template.getHits():
-					print `template.getHits()` + " hit(s): " + template.getName()
-			print
-			
-			print "Success, the total number of match is " + str(total)
-			print
-			print "However, look at the above section 'Running tests' which could contain important"
-			print "information."
-			return True
-
-			
-if __name__ == "__main__":
-	fail2banRegex = Fail2banRegex()
-	# Reads the command line options.
-	try:
-		cmdOpts = 'hVcv'
-		cmdLongOpts = ['help', 'version', 'verbose']
-		optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
-	except getopt.GetoptError:
-		fail2banRegex.dispUsage()
-		sys.exit(-1)
-	# Process command line
-	fail2banRegex.getCmdLineOptions(optList)
-
-	# We need 2 or 3 parameters
-	if not len(args) in (2, 3):
-		fail2banRegex.dispUsage()
-		sys.exit(-1)
-	else:
-		print
-		print "Running tests"
-		print "============="
-		print
-
-		cmd_log, cmd_regex = args[:2]
-
-		if len(args) == 3:
-			fail2banRegex.readIgnoreRegex(args[2]) or sys.exit(-1)
-
-		fail2banRegex.readRegex(cmd_regex) or sys.exit(-1)
-
-		if fail2banRegex.logIsFile(cmd_log):
-			try:
-				hdlr = open(cmd_log)
-				print "Use log file   : " + cmd_log
-				print
-				for line in hdlr:
-					fail2banRegex.testIgnoreRegex(line)
-					fail2banRegex.testRegex(line)
-			except IOError, e:
-				print e
-				print
-				sys.exit(-1)
-		else:
-			if len(sys.argv[1]) > 53:
-				stripLog = cmd_log[0:50] + "..."
-			else:
-				stripLog = cmd_log
-			print "Use single line: " + stripLog
-			print
-			fail2banRegex.testIgnoreRegex(cmd_log)
-			fail2banRegex.testRegex(cmd_log)
-
-		fail2banRegex.printStats() or sys.exit(-1)

fail2ban-server

@@ -1,141 +0,0 @@
-#!/usr/bin/python
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import getopt, sys, logging
-
-# Inserts our own modules path first in the list
-# fix for bug #343821
-sys.path.insert(1, "/usr/share/fail2ban")
-
-from common.version import version
-from server.server import Server
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban")
-
-##
-# \mainpage Fail2Ban
-#
-# \section Introduction
-#
-# Fail2ban is designed to protect your server against brute force attacks.
-# Its first goal was to protect a SSH server.
-
-class Fail2banServer:
-	
-	def __init__(self):
-		self.__server = None
-		self.__argv = None
-		self.__conf = dict()
-		self.__conf["background"] = True
-		self.__conf["force"] = False
-		self.__conf["socket"] = "/var/run/fail2ban/fail2ban.sock"
-	
-	def dispVersion(self):
-		print "Fail2Ban v" + version
-		print
-		print "Copyright (c) 2004-2008 Cyril Jaquier"
-		print "Copyright of modifications held by their respective authors."
-		print "Licensed under the GNU General Public License v2 (GPL)."
-		print
-		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
-		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
-	
-	def dispUsage(self):
-		""" Prints Fail2Ban command line options and exits
-		"""
-		print "Usage: "+self.__argv[0]+" [OPTIONS]"
-		print
-		print "Fail2Ban v" + version + " reads log file that contains password failure report"
-		print "and bans the corresponding IP addresses using firewall rules."
-		print
-		print "Only use this command for debugging purpose. Start the server with"
-		print "fail2ban-client instead. The default behaviour is to start the server"
-		print "in background."
-		print
-		print "Options:"
-		print "    -b                   start in background"
-		print "    -f                   start in foreground"
-		print "    -s <FILE>            socket path"
-		print "    -x                   force execution of the server (remove socket file)"
-		print "    -h, --help           display this help message"
-		print "    -V, --version        print the version"
-		print
-		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
-	
-	def __getCmdLineOptions(self, optList):
-		""" Gets the command line options
-		"""
-		for opt in optList:
-			if opt[0] == "-b":
-				self.__conf["background"] = True
-			if opt[0] == "-f":
-				self.__conf["background"] = False
-			if opt[0] == "-s":
-				self.__conf["socket"] = opt[1]
-			if opt[0] == "-x":
-				self.__conf["force"] = True
-			if opt[0] in ["-h", "--help"]:
-	 			self.dispUsage()
-				sys.exit(0)
-			if opt[0] in ["-V", "--version"]:
-	 			self.dispVersion()
-				sys.exit(0)
-		
-	def start(self, argv):
-		# Command line options
-		self.__argv = argv
-		
-		# Reads the command line options.
-		try:
-			cmdOpts = 'bfs:xhV'
-			cmdLongOpts = ['help', 'version']
-			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
-		except getopt.GetoptError:
-			self.dispUsage()
-			sys.exit(-1)
-			
-		self.__getCmdLineOptions(optList)
-		
-		try:
-			self.__server = Server(self.__conf["background"])
-			self.__server.start(self.__conf["socket"], self.__conf["force"])
-			return True
-		except Exception, e:
-			logSys.exception(e)
-			self.__server.quit()
-			return False
-		
-if __name__ == "__main__":
-	server = Fail2banServer()
-	if server.start(sys.argv):
-		sys.exit(0)
-	else:
-		sys.exit(-1)

fail2ban-testcases

@@ -1,184 +0,0 @@
-#!/usr/bin/python
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-"""Script to run Fail2Ban tests battery
-"""
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-
-import unittest, logging, sys, time, os
-
-from common.version import version
-from testcases import banmanagertestcase
-from testcases import clientreadertestcase
-from testcases import failmanagertestcase
-from testcases import filtertestcase
-from testcases import servertestcase
-from testcases import datedetectortestcase
-from testcases import actiontestcase
-from server.mytime import MyTime
-
-from optparse import OptionParser, Option
-
-def get_opt_parser():
-	# use module docstring for help output
-	p = OptionParser(
-				usage="%s [OPTIONS]\n" % sys.argv[0] + __doc__,
-				version="%prog " + version)
-
-	p.add_options([
-		Option('-l', "--log-level", type="choice",
-			   dest="log_level",
-			   choices=('debug', 'info', 'warn', 'error', 'fatal'),
-			   default=None,
-			   help="Log level for the logger to use during running tests"),
-		])
-
-	return p
-
-parser = get_opt_parser()
-(opts, files) = parser.parse_args()
-assert(not len(files))
-
-#
-# Logging
-#
-logSys = logging.getLogger("fail2ban")
-
-# Numerical level of verbosity corresponding to a log "level"
-verbosity = {'debug': 3,
-			 'info': 2,
-			 'warn': 1,
-			 'error': 1,
-			 'fatal': 0,
-			 None: 1}[opts.log_level]
-
-if opts.log_level is not None:
-	# so we had explicit settings
-	logSys.setLevel(getattr(logging, opts.log_level.upper()))
-else:
-	# suppress the logging but it would leave unittests' progress dots
-	# ticking, unless like with '-l fatal' which would be silent
-	# unless error occurs
-	logSys.setLevel(getattr(logging, 'FATAL'))
-
-# Add the default logging handler
-stdout = logging.StreamHandler(sys.stdout)
-# Custom log format for the verbose tests runs
-if verbosity > 1:
-	stdout.setFormatter(logging.Formatter(' %(asctime)-15s %(thread)s %(message)s'))
-else:
-	# just prefix with the space
-	stdout.setFormatter(logging.Formatter(' %(message)s'))
-logSys.addHandler(stdout)
-
-
-#
-# Let know the version
-#
-if not opts.log_level or opts.log_level != 'fatal':
-	print "Fail2ban " + version + " test suite. Please wait..."
-
-
-#
-# Gather the tests
-#
-tests = unittest.TestSuite()
-
-# Server
-#tests.addTest(unittest.makeSuite(servertestcase.StartStop))
-#tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
-tests.addTest(unittest.makeSuite(actiontestcase.ExecuteAction))
-# FailManager
-tests.addTest(unittest.makeSuite(failmanagertestcase.AddFailure))
-# BanManager
-tests.addTest(unittest.makeSuite(banmanagertestcase.AddFailure))
-# ClientReader
-tests.addTest(unittest.makeSuite(clientreadertestcase.JailReaderTest))
-
-# Filter
-tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
-tests.addTest(unittest.makeSuite(filtertestcase.LogFile))
-tests.addTest(unittest.makeSuite(filtertestcase.LogFileMonitor))
-tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
-tests.addTest(unittest.makeSuite(filtertestcase.DNSUtilsTests))
-
-# DateDetector
-tests.addTest(unittest.makeSuite(datedetectortestcase.DateDetectorTest))
-
-#
-# Extensive use-tests of different available filters backends
-#
-
-from server.filterpoll import FilterPoll
-filters = [FilterPoll]					  # always available
-
-# Additional filters available only if external modules are available
-# yoh: Since I do not know better way for parametric tests
-#      with good old unittest
-try:
-	from server.filtergamin import FilterGamin
-	filters.append(FilterGamin)
-except:
-	pass
-
-try:
-	from server.filterpyinotify import FilterPyinotify
-	filters.append(FilterPyinotify)
-except:
-	pass
-
-for Filter_ in filters:
-	tests.addTest(unittest.makeSuite(
-		filtertestcase.get_monitor_failures_testcase(Filter_)))
-
-
-#
-# Run the tests
-#
-testRunner = unittest.TextTestRunner(verbosity=verbosity)
-
-try:
-	# Set the time to a fixed, known value
-	# Sun Aug 14 12:00:00 CEST 2005
-	# yoh: we need to adjust TZ to match the one used by Cyril so all the timestamps match
-	old_TZ = os.environ.get('TZ', None)
-	os.environ['TZ'] = 'Europe/Zurich'
-	time.tzset()
-	MyTime.setTime(1124013600)
-
-	tests_results = testRunner.run(tests)
-
-finally:
-	# Just for the sake of it reset the TZ
-	# yoh: move all this into setup/teardown methods within tests
-	os.environ.pop('TZ')
-	if old_TZ:
-		os.environ['TZ'] = old_TZ
-	time.tzset()
-
-if not tests_results.wasSuccessful():
-	sys.exit(1)

fail2ban_0.5.2.orig.tar.gz.id

@@ -0,0 +1 @@
+432096e69a64df45cd8aa49b66e5f473cb8de972

fail2ban_0.5.3.orig.tar.gz.id

@@ -0,0 +1 @@
+9018dec2acaf9038b973d2874ef4848fdcfcfc2e

fail2ban_0.5.4.orig.tar.gz.id

@@ -0,0 +1 @@
+881b05f931fee22ff04637209b4a6d774149fb56

fail2ban_0.6.0.orig.tar.gz.id

@@ -0,0 +1 @@
+7bd8c4dda6b2978e8eaaaad8f428727ac3a36d49

fail2ban_0.6.1.orig.tar.gz.id

@@ -0,0 +1 @@
+151df27656b75c6f83a42857c28b99c9793998f0

fail2ban_0.7.4.orig.tar.gz.id

@@ -0,0 +1 @@
+6e5843a7cebd7b3d92274eb3da391e3e6c166284