Merge commit 'remotes/upstream-repo/tags/FAIL2BAN-0_8_5^' into upstream

* commit 'remotes/upstream-repo/tags/FAIL2BAN-0_8_5^': for 0.8.5 release -- changelog + version BF: use addfailregex instead of failregex while processing per-jail "failregex" parameter (Closes: #635830) (LP: #635036) BF: use os.path.join to generate full path - fixes includes in configs given local filename very minor -- uniform indentation in example BF: use standard/reserved example.com instead of mail.com ENH: Adding author for dovecot filter and prunning unneeded space in the regexp Conflicts: common/version.py -- my added copyright
for 0.8.5 release -- changelog + version
2011-07-28 23:07:09 -04:00 · 2011-07-29 02:31:01 +00:00 · 2011-07-29 02:08:31 +00:00 · 2011-06-27 03:40:16 +00:00 · 2011-06-27 03:40:08 +00:00 · 2011-05-07 03:16:40 +00:00
129 changed files with 3875 additions and 3088 deletions
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<projectDescription>
-	<name>fail2ban-unstable</name>
-	<comment></comment>
-	<projects>
-	</projects>
-	<buildSpec>
-		<buildCommand>
-			<name>org.python.pydev.PyDevBuilder</name>
-			<arguments>
-			</arguments>
-		</buildCommand>
-	</buildSpec>
-	<natures>
-		<nature>org.python.pydev.pythonNature</nature>
-	</natures>
-</projectDescription>
@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<?eclipse-pydev version="1.0"?>
-
-<pydev_project>
-<pydev_property name="org.python.pydev.PYTHON_PROJECT_VERSION">python 2.4</pydev_property>
-<pydev_pathproperty name="org.python.pydev.PROJECT_SOURCE_PATH">
-<path>/fail2ban-unstable/client</path>
-<path>/fail2ban-unstable/server</path>
-<path>/fail2ban-unstable/testcases</path>
-<path>/fail2ban-unstable</path>
-</pydev_pathproperty>
-</pydev_project>
@@ -1,3 +0,0 @@
-#Wed Sep 20 22:14:25 GMT 2006
-eclipse.preferences.version=1
-encoding//server/datestrptime.py=UTF-8
@@ -1,335 +0,0 @@
-               __      _ _ ___ _               
-              / _|__ _(_) |_  ) |__  __ _ _ _  
-             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
-             |_| \__,_|_|_/___|_.__/\__,_|_||_|
-
-=============================================================
-Fail2Ban (version 0.8.0)                           2007/05/03
-=============================================================
-
-ver. 0.8.0 (2007/05/03) - stable
----------
- Fixed RedHat init script. Thanks to Jonathan Underwood
- Added Solaris 10 files. Thanks to Hanno 'Rince' Wagner
-
-ver. 0.7.9 (2007/04/19) - release candidate
----------
- Close opened handlers. Thanks to Yaroslav Halchenko
- Fixed "reload" bug. Many many thanks to Yaroslav Halchenko
- Added date format for asctime without year
- Modified filters config. Thanks to Michael C. Haller
- Fixed a small bug in mail-buffered.conf
-
-ver. 0.7.8 (2007/03/21) - release candidate
----------
- Fixed asctime pattern in datedetector.py
- Added new filters/actions. Thanks to Yaroslav Halchenko
- Added Suse init script and modified gentoo-initd. Thanks to
-  Christian Rauch
- Moved every locking statements in a try..finally block
-
-ver. 0.7.7 (2007/02/08) - release candidate
----------
- Added signal handling in fail2ban-client
- Added a wonderful visual effect when waiting on the server
- fail2ban-client returns an error code if configuration is
-  not valid
- Added new filters/actions. Thanks to Yaroslav Halchenko
- Call Python interpreter directly (instead of using "env")
- Added file support to fail2ban-regex. Benchmark feature has
-  been removed
- Added cacti script and template.
- Added IP list in "status <JAIL>". Thanks to Eric Gerbier
-
-ver. 0.7.6 (2007/01/04) - beta
----------
- Added a "sleep 1" in redhat-initd. Thanks to Jim Wight
- Use /dev/log for SYSLOG output. Thanks to Joerg Sommrey
- Use numeric output for iptables in "actioncheck"
- Fixed removal of host in hosts.deny. Thanks to René Berber
- Added new date format (2006-12-21 06:43:20) and Exim4
-  filter. Thanks to mEDI
- Several "failregex" and "ignoreregex" are now accepted.
-  Creation of rules should be easier now.
- Added license in COPYING. Thanks to Axel Thimm
- Allow comma in action options. The value of the option must
-  be escaped with " or '. Thanks to Yaroslav Halchenko
- Now Fail2ban goes in /usr/share/fail2ban instead of
-  /usr/lib/fail2ban. This is more compliant with FHS. Thanks
-  to Axel Thimm and Yaroslav Halchenko
-
-ver. 0.7.5 (2006/12/07) - beta
----------
- Do not ban a host that is currently banned. Thanks to
-  Yaroslav Halchenko
- The supported tags in "action(un)ban" are <ip>, <failures>
-  and <time>
- Fixed refactoring bug (getLastcommand -> getLastAction)
- Added option "ignoreregex" in filter scripts and jail.conf.
-  Feature Request #1283304
- Fixed a bug in user defined time regex/pattern
- Improved documentation
- Moved version.py and protocol.py to common/
- Merged "maxtime" option with "findtime"
- Added "<HOST>" tag support in failregex which matches
-  default IP address/hostname. "(?P<host>\S)" is still valid
-  and supported
- Fixed exception when calling fail2ban-server with unknown
-  option
- Fixed Debian bug 400162. The "socket" option is now handled
-  correctly by fail2ban-client
- Fixed RedHat init script. Thanks to Justin Shore
- Changed timeout to 30 secondes before assuming the server
-  cannot be started. Thanks to Joël Bertrand
-
-ver. 0.7.4 (2006/11/01) - beta
----------
- Improved configuration files. Thanks to Yaroslav Halchenko
- Added man page for "fail2ban-regex"
- Moved ban/unban messages from "info" level to "warn"
- Added "-s" option to specify the socket path and "socket"
-  option in "fail2ban.conf"
- Added "backend" option in "jail.conf"
- Added more filters/actions and jail samples. Thanks to Nick
-  Munger, Christoph Haas
- Improved testing framework
- Fixed a bug in the return code handling of the executed
-  commands. Thanks to Yaroslav Halchenko
- Signal handling. There is a bug with join() and signal in
-  Python
- Better debugging output for "fail2ban-regex"
- Added support for more date format
- cPickle does not work with Python 2.5. Use pickle instead
-  (performance is not a problem in our case)
-
-ver. 0.7.3 (2006/09/28) - beta
----------
- Added man pages. Thanks to Yaroslav Halchenko
- Added wildcard support for "logpath"
- Added Gamin (file and directory monitoring system) support
- (Re)added "ignoreip" option
- Added more concurrency protection
- First attempt at solving bug #1457620 (locale issue)
- Performance improvements
- (Re)added permanent banning with banTime < 0
- Added DNS support to "ignoreip". Feature Request #1285859
-
-ver. 0.7.2 (2006/09/10) - beta
----------
- Refactoring and code cleanup
- Improved client output
- Added more get/set commands
- Added more configuration templates
- Removed "logpath" and "maxretry" from filter templates.
-  They must be defined in jail.conf now
- Added interactive mode. Use "-i"
- Added a date detector. "timeregex" and "timepattern" are no
-  more needed
- Added "fail2ban-regex". This is a tool to help finding
-  "failregex"
- Improved server communication. Start a new thread for each
-  incoming request. Fail2ban is not really thread-safe yet
-
-ver. 0.7.1 (2006/08/23) - alpha
----------
- Fixed daemon mode bug
- Added Gentoo init.d script
- Fixed path bug when trying to start "fail2ban-server"
- Fixed reload command
-
-ver. 0.7.0 (2006/08/23) - alpha
----------
- Almost a complete rewrite :) Fail2ban design is really
-  better (IMHO). There is a lot of new features
- Client/Server architecture
- Multithreading. Each jail has its own threads: one for the
-  log reading and another for the actions
- Execute several actions
- Split configuration files. They are more readable and easy
-  to use
- failregex uses group (<host>) now. This feature was already
-  present in the Debian package
- lots of things...
-
-ver. 0.6.1 (2006/03/16) - stable
----------
- Added permanent banning. Set banTime to a negative value to
-  enable this feature (-1 is perfect). Thanks to Mannone
- Fixed locale bug. Thanks to Fernando José
- Fixed crash when time format does not match data
- Propagated patch from Debian to fix fail2ban search path 
-  addition to the path search list: now it is added first. 
-  Thanks to Nick Craig-Wood
- Added SMTP authentification for mail notification. Thanks
-  to Markus Hoffmann
- Removed debug mode as it is confusing for people
- Added parsing of timestamp in TAI64N format (#1275325).
-  Thanks to Mark Edgington
- Added patch #1382936 (Default formatted syslog logging).
-  Thanks to Patrick B�rjesson
- Removed 192.168.0.0/16 from ignoreip. Attacks could also
-  come from the local network.
- Robust startup: if iptables module does not get fully
-  initialized after startup of fail2ban, fail2ban will do
-  "maxreinit" attempts to initialize its own firewall. It
-  will sleep between attempts for "polltime" number of
-  seconds (closes Debian: #334272). Thanks to Yaroslav
-  Halchenko
- Added "interpolations" in fail2ban.conf. This is provided
-  by the ConfigParser module. Old configuration files still
-  work. Thanks to Yaroslav Halchenko
- Added initial support for hosts.deny and shorewall. Need
-  more testing. Please test. Thanks to kojiro from Gentoo
-  forum for hosts.deny support
- Added support for vsftpd. Thanks to zugeschmiert
-
-ver. 0.6.0 (2005/11/20) - stable
----------
- Propagated patches introduced by Debian maintainer 
-  (Yaroslav Halchenko):
-  * Added an option to report local time (including timezone)
-    or GMT in mail notification.
-
-ver. 0.5.5 (2005/10/26) - beta
----------
- Propagated patches introduced by Debian maintainer 
-  (Yaroslav Halchenko):
-  * Introduced fwcheck option to verify consistency of the
-    chains. Implemented automatic restart of fail2ban main
-    function in case check of fwban or fwunban command failed
-    (closes: #329163, #331695). (Introduced patch was further
-    adjusted by upstream author).
-  * Added -f command line parameter for [findtime].
-  * Added a cleanup of firewall rules on emergency shutdown
-    when unknown exception is catched.
-  * Fail2ban should not crash now if a wrong file name is
-    specified in config.
-  * reordered code a bit so that log targets are setup right
-    after background and then only loglevel (verbose, debug)
-    is processed, so the warning could be seen in the logs
-  * Added a keyword <section> in parsing of the subject and
-    the body of an email sent out by fail2ban (closes:
-    #330311)
-
-ver. 0.5.4 (2005/09/13) - beta
----------
- Fixed bug #1286222.
- Propagated patches introduced by Debian maintainer 
-  (Yaroslav Halchenko):
-  * Fixed handling of SYSLOG logging target. Now it can log
-    to any SYSLOG target and facility as directed by the 
-    config
-  * Format of SYSLOG entries fixed to look closer to standard
-  * Fixed errata in config/gentoo-confd
-  * Introduced findtime configuration variable to control the
-    lifetime of caught "failed" log entries
-	
-ver. 0.5.3 (2005/09/08) - beta
----------
- Fixed a bug when overriding "maxfailures" or "bantime".
-  Thanks to Yaroslav Halchenko
- Added more debug output if an error occurs when sending
-  mail. Thanks to Stephen Gildea
- Renamed "maxretry" to "maxfailures" and changed default
-  value to 5. Thanks to Stephen Gildea
- Hopefully fixed bug #1256075
- Fixed bug #1262345
- Fixed exception handling in PIDLock
- Removed warning when using "-V" or "-h" with no config
-  file. Thanks to Yaroslav Halchenko
- Removed "-i eth0" from config file. Thanks to Yaroslav
-  Halchenko
-
-ver. 0.5.2 (2005/08/06) - beta
----------
- Better PID lock file handling. Should close #1239562
- Added man pages
- Removed log4py dependency. Use logging module instead
- "maxretry" and "bantime" can be overridden in each section
- Fixed bug #1246278 (excessive memory usage)
- Fixed crash on wrong option value in configuration file
- Changed custom chains to lowercase
-
-ver. 0.5.1 (2005/07/23) - beta
----------
- Fixed bugs #1241756, #1239557
- Added log targets in configuration file. Removed -l option
- Changed iptables rules in order to create a separated chain
-  for each section
- Fixed static banList in firewall.py
- Added an initd script for Debian. Thanks to Yaroslav
-  Halchenko
- Check for obsolete files after install
-
-ver. 0.5.0 (2005/07/12) - beta
----------
- Added support for CIDR mask in ignoreip
- Added mail notification support
- Fixed bug #1234699
- Added tags replacement in rules definition. Should allow a
-  clean solution for Feature Request #1229479
- Removed "interface" and "firewall" options
- Added start and end commands in the configuration file.
-  Thanks to Yaroslav Halchenko
- Added firewall rules definition in the configuration file
- Cleaned fail2ban.py
- Added an initd script for RedHat/Fedora. Thanks to Andrey
-  G. Grozin
-
-ver. 0.4.1 (2005/06/30) - stable
----------
- Fixed textToDNS method which generated wrong matches for
-  "rhost=12-xyz...". Thanks to Tom Pike
- fail2ban.conf modified for readability. Thanks to Iain Lea
- Added an initd script for Gentoo
- Changed default PID lock file location from /tmp to
-  /var/run
-
-ver. 0.4.0 (2005/04/24) - stable
----------
- Fixed textToDNS which did not recognize strings like
-  "12-345-67-890.abcd.mnopqr.xyz"
-
-ver. 0.3.1 (2005/03/31) - beta
----------
- Corrected level of messages
- Added DNS lookup support
- Improved parsing speed. Only parse the new log messages
- Added a second verbose level (-vv)
-
-ver. 0.3.0 (2005/02/24) - beta
----------
- Re-writting of parts of the code in order to handle several
-  log files with different rules
- Removed sshd.py because it is no more needed
- Fixed a bug when exiting with IP in the ban list
- Added PID lock file
- Improved some parts of the code
- Added ipfw-start-rule option (thanks to Robert Edeker)
- Added -k option which kills a currently running Fail2Ban
-
-ver. 0.1.2 (2004/11/21) - beta
----------
- Add ipfw and ipfwadm support. The rules are taken from
-  BlockIt. Thanks to Robert Edeker
- Add -e option which allows to set the interface. Thanks to
-  Robert Edeker who reminded me this
- Small code cleaning
-
-ver. 0.1.1 (2004/10/23) - beta
----------
- Add SIGTERM handler in order to exit nicely when in daemon
-  mode
- Add -r option which allows to set the maximum number of
-  login failures
- Remove the Metalog class as the log file are not so syslog
-  daemon specific
- Rewrite log reader to be service centered. Sshd support
-  added. Match "Failed password" and "Illegal user"
- Add /etc/fail2ban.conf configuration support
- Code documentation
-
-
-ver. 0.1.0 (2004/10/12) - alpha
----------
- Initial release
@@ -1,3 +1,7 @@
+The following copyright applies to all files present in the Fail2ban package,
+except if a different copyright is explicitly defined in this file.
+
+
 		    GNU GENERAL PUBLIC LICENSE
 		       Version 2, June 1991

@@ -337,3 +341,28 @@ proprietary programs.  If your program is a subroutine library, you may
 consider it more useful to permit linking proprietary applications with the
 library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.
+
+---------------------------------
+The file server/iso8601.py is licensed under the following terms.
+
+
+Copyright (c) 2007 Michael Twomey
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be included
+in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
@@ -0,0 +1,439 @@
+                         __      _ _ ___ _               
+                        / _|__ _(_) |_  ) |__  __ _ _ _  
+                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+================================================================================
+Fail2Ban (version 0.8.5)                                              2011/07/28
+================================================================================
+
+ver. 0.8.5 (2011/07/28) - stable
+----------
+- Fix: use addfailregex instead of failregex while processing per-jail
+  "failregex" parameter (Fixed Debian bug #635830, LP: #635036). Thanks to
+  Marat Khayrullin for the patch and Daniel T Chen for forwarding to
+  Debian.
+- Fix: use os.path.join to generate full path - fixes includes in configs
+  given local filename (5 weeks ago) [yarikoptic]
+- Fix: allowed for trailing spaces in proftpd logs
+- Fix: escaped () in pure-ftpd filter. Thanks to Teodor
+- Fix: allowed space in the trailing of failregex for sasl.conf:
+  see http://bugs.debian.org/573314
+- Fix: use /var/run/fail2ban instead of /tmp for temp files in actions:
+  see http://bugs.debian.org/544232
+- Fix: Tai64N stores time in GMT, needed to convert to local time before
+  returning
+- Fix: disabled named-refused-udp jail entirely with a big fat warning
+- Fix: added time module. Bug reported in buanzo's blog:
+  see http://blogs.buanzo.com.ar/2009/04/fail2ban-patch-ban-ip-address-manually.html
+- Fix: Patch to make log file descriptors cloexec to stop leaking file
+  descriptors on fork/exec. Thanks to Jonathan Underwood:
+  see https://bugzilla.redhat.com/show_bug.cgi?id=230191#c24
+- Enhancement: added author for dovecot filter and pruned unneeded space
+  in the regexp
+- Enhancement: proftpd filter -- if login failed -- count regardless of the
+  reason for failure
+- Enhancement: added <chain> to action.d/iptables*. Thanks to Matthijs Kooijman:
+  see http://bugs.debian.org/515599
+- Enhancement: added filter.d/dovecot.conf from Martin Waschbuesch
+- Enhancement: made filter.d/apache-overflows.conf catch more:
+  see http://bugs.debian.org/574182
+- Enhancement: added dropbear filter from Francis Russell and Zak B. Elep:
+  see http://bugs.debian.org/546913
+- Enhancement: changed default ignoreip to ignore entire loopback zone (/8):
+  see http://bugs.debian.org/598200
+- Minor: spell-checked jail.conf. Thanks to Christoph Anton Mitterer
+- Few minor cosmetic changes
+
+ver. 0.8.4 (2009/09/07) - stable
+----------
+- Check the inode number for rotation in addition to checking the first line of
+  the file. Thanks to Jonathan Kamens. Red Hat #503852. Tracker #2800279.
+- Moved the shutdown of the logging subsystem out of Server.quit() to
+  the end of Server.start(). Fixes the 'cannot release un-acquired lock'
+  error.
+- Added "Ban IP" command. Thanks to Arturo 'Buanzo' Busleiman.
+- Added two new filters: lighttpd-fastcgi and php-url-fopen.
+- Fixed the 'unexpected communication error' problem by means of
+  use_poll=False in Python >= 2.6.
+- Merged patches from Debian package. Thanks to Yaroslav Halchenko.
+- Use current day and month instead of Jan 1st if both are not available in the
+  log. Thanks to Andreas Itzchak Rehberg.
+- Try to match the regex even if the line does not contain a valid date/time.
+  Described in Debian #491253. Thanks to Yaroslav Halchenko.
+- Added/improved filters and date formats.
+- Added actions to report abuse to ISP, DShield and myNetWatchman. Thanks to
+  Russell Odom.
+- Suse init script. Remove socket file on startup is fail2ban crashed. Thanks to
+  Detlef Reichelt.
+- Removed begin-line anchor for "standard" timestamp. Fixed Debian bug #500824.
+- Added nagios script. Thanks to Sebastian Mueller.
+- Added CPanel date format. Thanks to David Collins. Tracker #1967610.
+- Improved SASL filter. Thanks to Loic Pefferkorn. Tracker #2310410.
+- Added NetBSD ipfilter (ipf command) action. Thanks to Ed Ravin. Tracker
+  #2484115.
+- Added cyrus-imap and sieve filters. Thanks to Jan Wagner. Debian bug #513953.
+- Changed <HOST> template to be more restrictive. Debian bug #514163.
+- Use timetuple instead of utctimetuple for ISO 8601. Maybe not a 100% correct
+  fix but seems to work. Tracker #2500276.
+- Made the named-refused regex a bit less restrictive in order to match logs
+  with "view". Thanks to Stephen Gildea.
+- Fixed maxretry/findtime rate. Many thanks to Christos Psonis. Tracker
+  #2019714.
+
+ver. 0.8.3 (2008/07/17) - stable
+----------
+- Process failtickets as long as failmanager is not empty.
+- Added "pam-generic" filter and more configuration fixes. Thanks to Yaroslav
+  Halchenko.
+- Fixed socket path in redhat and suse init script. Thanks to Jim Wight.
+- Fixed PID file while started in daemon mode. Thanks to Christian Jobic who
+  submitted a similar patch.
+- Fixed "fail2ban-client get <jail> logpath". Bug #1916986.
+- Added gssftpd filter. Thanks to Kevin Zembower.
+- Added "Day/Month/Year Hour:Minute:Second" date template. Thanks to Dennis
+  Winter.
+- Fixed ignoreregex processing in fail2ban-client. Thanks to René Berber.
+- Added ISO 8601 date/time format.
+- Added and changed some logging level and messages.
+- Added missing ignoreregex to filters. Thanks to Klaus Lehmann.
+- Use poll instead of select in asyncore.loop. This should solve the "Unknown
+  error 514". Thanks to Michael Geiger and Klaus Lehmann.
+
+ver. 0.8.2 (2008/03/06) - stable
+----------
+- Fixed named filter. Thanks to Yaroslav Halchenko
+- Fixed wrong path for apache-auth in jail.conf. Thanks to Vincent Deffontaines
+- Fixed timezone bug with epoch date template. Thanks to Michael Hanselmann
+- Added "full line failregex" patch. Thanks to Yaroslav Halchenko. It will be
+  possible to create stronger failregex against log injection
+- Fixed ipfw action script. Thanks to Nick Munger
+- Removed date from logging message when using SYSLOG. Thanks to Iain Lea
+- Fixed "ignore IPs". Only the first value was taken into account. Thanks to
+  Adrien Clerc
+- Moved socket to /var/run/fail2ban.
+- Rewrote the communication server.
+- Refactoring. Reduced number of files.
+- Removed Python 2.4. Minimum required version is now Python 2.3.
+- New log rotation detection algorithm.
+- Print monitored files in status.
+- Create a PID file in /var/run/fail2ban/. Thanks to Julien Perez.
+- Fixed "Feb 29" bug. Thanks to James Andrewartha who pointed this out. Thanks
+  to Yaroslav Halchenko for the fix.
+- "reload <jail>" reloads a single jail and the parameters in fail2ban.conf.
+- Added Mac OS/X startup script. Thanks to Bill Heaton.
+- Absorbed some Debian patches. Thanks to Yaroslav Halchenko.
+- Replaced "echo" with "printf" in actions. Fix #1839673
+- Replaced "reject" with "drop" in shorwall action. Fix #1854875
+- Fixed Debian bug #456567, #468477, #462060, #461426
+- readline is now optional in fail2ban-client (not needed in fail2ban-server).
+
+ver. 0.8.1 (2007/08/14) - stable
+----------
+- Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
+- Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko
+- Improved regular expressions. Thanks to Yaroslav Halchenko and others
+- Added sendmail actions. The action started with "mail" are now deprecated.
+  Thanks to Raphaël Marichez
+- Added "ignoreregex" support to fail2ban-regex
+- Updated suse-initd and added it to MANIFEST. Thanks to Christian Rauch
+- Tightening up the pid check in redhat-initd. Thanks to David Nutter
+- Added webmin authentication filter. Thanks to Guillaume Delvit
+- Removed textToDns() which is not required anymore. Thanks to Yaroslav
+  Halchenko
+- Added new action iptables-allports. Thanks to Yaroslav Halchenko
+- Added "named" date format to date detector. Thanks to Yaroslav Halchenko
+- Added filter file for named (bind9). Thanks to Yaroslav Halchenko
+- Fixed vsftpd filter. Thanks to Yaroslav Halchenko
+
+ver. 0.8.0 (2007/05/03) - stable
+----------
+- Fixed RedHat init script. Thanks to Jonathan Underwood
+- Added Solaris 10 files. Thanks to Hanno 'Rince' Wagner
+
+ver. 0.7.9 (2007/04/19) - release candidate
+----------
+- Close opened handlers. Thanks to Yaroslav Halchenko
+- Fixed "reload" bug. Many many thanks to Yaroslav Halchenko
+- Added date format for asctime without year
+- Modified filters config. Thanks to Michael C. Haller
+- Fixed a small bug in mail-buffered.conf
+
+ver. 0.7.8 (2007/03/21) - release candidate
+----------
+- Fixed asctime pattern in datedetector.py
+- Added new filters/actions. Thanks to Yaroslav Halchenko
+- Added Suse init script and modified gentoo-initd. Thanks to Christian Rauch
+- Moved every locking statements in a try..finally block
+
+ver. 0.7.7 (2007/02/08) - release candidate
+----------
+- Added signal handling in fail2ban-client
+- Added a wonderful visual effect when waiting on the server
+- fail2ban-client returns an error code if configuration is not valid
+- Added new filters/actions. Thanks to Yaroslav Halchenko
+- Call Python interpreter directly (instead of using "env")
+- Added file support to fail2ban-regex. Benchmark feature has been removed
+- Added cacti script and template.
+- Added IP list in "status <JAIL>". Thanks to Eric Gerbier
+
+ver. 0.7.6 (2007/01/04) - beta
+----------
+- Added a "sleep 1" in redhat-initd. Thanks to Jim Wight
+- Use /dev/log for SYSLOG output. Thanks to Joerg Sommrey
+- Use numeric output for iptables in "actioncheck"
+- Fixed removal of host in hosts.deny. Thanks to René Berber
+- Added new date format (2006-12-21 06:43:20) and Exim4 filter. Thanks to mEDI
+- Several "failregex" and "ignoreregex" are now accepted. Creation of rules
+  should be easier now.
+- Added license in COPYING. Thanks to Axel Thimm
+- Allow comma in action options. The value of the option must be escaped with "
+  or '. Thanks to Yaroslav Halchenko
+- Now Fail2ban goes in /usr/share/fail2ban instead of /usr/lib/fail2ban. This is
+  more compliant with FHS. Thanks to Axel Thimm and Yaroslav Halchenko
+
+ver. 0.7.5 (2006/12/07) - beta
+----------
+- Do not ban a host that is currently banned. Thanks to Yaroslav Halchenko
+- The supported tags in "action(un)ban" are <ip>, <failures> and <time>
+- Fixed refactoring bug (getLastcommand -> getLastAction)
+- Added option "ignoreregex" in filter scripts and jail.conf. Feature Request
+  #1283304
+- Fixed a bug in user defined time regex/pattern
+- Improved documentation
+- Moved version.py and protocol.py to common/
+- Merged "maxtime" option with "findtime"
+- Added "<HOST>" tag support in failregex which matches default IP
+  address/hostname. "(?P<host>\S)" is still valid and supported
+- Fixed exception when calling fail2ban-server with unknown option
+- Fixed Debian bug 400162. The "socket" option is now handled correctly by
+  fail2ban-client
+- Fixed RedHat init script. Thanks to Justin Shore
+- Changed timeout to 30 secondes before assuming the server cannot be started.
+  Thanks to Joël Bertrand
+
+ver. 0.7.4 (2006/11/01) - beta
+----------
+- Improved configuration files. Thanks to Yaroslav Halchenko
+- Added man page for "fail2ban-regex"
+- Moved ban/unban messages from "info" level to "warn"
+- Added "-s" option to specify the socket path and "socket" option in
+  "fail2ban.conf"
+- Added "backend" option in "jail.conf"
+- Added more filters/actions and jail samples. Thanks to Nick Munger, Christoph
+  Haas
+- Improved testing framework
+- Fixed a bug in the return code handling of the executed commands. Thanks to
+  Yaroslav Halchenko
+- Signal handling. There is a bug with join() and signal in Python
+- Better debugging output for "fail2ban-regex"
+- Added support for more date format
+- cPickle does not work with Python 2.5. Use pickle instead (performance is not
+  a problem in our case)
+
+ver. 0.7.3 (2006/09/28) - beta
+----------
+- Added man pages. Thanks to Yaroslav Halchenko
+- Added wildcard support for "logpath"
+- Added Gamin (file and directory monitoring system) support
+- (Re)added "ignoreip" option
+- Added more concurrency protection
+- First attempt at solving bug #1457620 (locale issue)
+- Performance improvements
+- (Re)added permanent banning with banTime < 0
+- Added DNS support to "ignoreip". Feature Request #1285859
+
+ver. 0.7.2 (2006/09/10) - beta
+----------
+- Refactoring and code cleanup
+- Improved client output
+- Added more get/set commands
+- Added more configuration templates
+- Removed "logpath" and "maxretry" from filter templates. They must be defined
+  in jail.conf now
+- Added interactive mode. Use "-i"
+- Added a date detector. "timeregex" and "timepattern" are no more needed
+- Added "fail2ban-regex". This is a tool to help finding "failregex"
+- Improved server communication. Start a new thread for each incoming request.
+  Fail2ban is not really thread-safe yet
+
+ver. 0.7.1 (2006/08/23) - alpha
+----------
+- Fixed daemon mode bug
+- Added Gentoo init.d script
+- Fixed path bug when trying to start "fail2ban-server"
+- Fixed reload command
+
+ver. 0.7.0 (2006/08/23) - alpha
+----------
+- Almost a complete rewrite :) Fail2ban design is really better (IMHO). There is
+  a lot of new features
+- Client/Server architecture
+- Multithreading. Each jail has its own threads: one for the log reading and
+  another for the actions
+- Execute several actions
+- Split configuration files. They are more readable and easy to use
+- failregex uses group (<host>) now. This feature was already present in the
+  Debian package
+- lots of things...
+
+ver. 0.6.1 (2006/03/16) - stable
+----------
+- Added permanent banning. Set banTime to a negative value to enable this
+  feature (-1 is perfect). Thanks to Mannone
+- Fixed locale bug. Thanks to Fernando José
+- Fixed crash when time format does not match data
+- Propagated patch from Debian to fix fail2ban search path addition to the path
+  search list: now it is added first. Thanks to Nick Craig-Wood
+- Added SMTP authentification for mail notification. Thanks to Markus Hoffmann
+- Removed debug mode as it is confusing for people
+- Added parsing of timestamp in TAI64N format (#1275325). Thanks to Mark
+  Edgington
+- Added patch #1382936 (Default formatted syslog logging). Thanks to Patrick
+  B�rjesson
+- Removed 192.168.0.0/16 from ignoreip. Attacks could also come from the local
+  network.
+- Robust startup: if iptables module does not get fully initialized after
+  startup of fail2ban, fail2ban will do "maxreinit" attempts to initialize its
+  own firewall. It will sleep between attempts for "polltime" number of seconds
+  (closes Debian: #334272). Thanks to Yaroslav Halchenko
+- Added "interpolations" in fail2ban.conf. This is provided by the ConfigParser
+  module. Old configuration files still work. Thanks to Yaroslav Halchenko
+- Added initial support for hosts.deny and shorewall. Need more testing. Please
+  test. Thanks to kojiro from Gentoo forum for hosts.deny support
+- Added support for vsftpd. Thanks to zugeschmiert
+
+ver. 0.6.0 (2005/11/20) - stable
+----------
+- Propagated patches introduced by Debian maintainer (Yaroslav Halchenko):
+  * Added an option to report local time (including timezone) or GMT in mail
+    notification.
+
+ver. 0.5.5 (2005/10/26) - beta
+----------
+- Propagated patches introduced by Debian maintainer (Yaroslav Halchenko):
+  * Introduced fwcheck option to verify consistency of the chains. Implemented
+    automatic restart of fail2ban main function in case check of fwban or
+    fwunban command failed (closes: #329163, #331695). (Introduced patch was
+    further adjusted by upstream author).
+  * Added -f command line parameter for [findtime].
+  * Added a cleanup of firewall rules on emergency shutdown when unknown
+    exception is catched.
+  * Fail2ban should not crash now if a wrong file name is specified in config.
+  * reordered code a bit so that log targets are setup right after background
+    and then only loglevel (verbose, debug) is processed, so the warning could
+    be seen in the logs
+  * Added a keyword <section> in parsing of the subject and the body of an email
+    sent out by fail2ban (closes: #330311)
+
+ver. 0.5.4 (2005/09/13) - beta
+----------
+- Fixed bug #1286222.
+- Propagated patches introduced by Debian maintainer (Yaroslav Halchenko):
+  * Fixed handling of SYSLOG logging target. Now it can log to any SYSLOG target
+    and facility as directed by the config
+  * Format of SYSLOG entries fixed to look closer to standard
+  * Fixed errata in config/gentoo-confd
+  * Introduced findtime configuration variable to control the lifetime of caught
+    "failed" log entries
+	
+ver. 0.5.3 (2005/09/08) - beta
+----------
+- Fixed a bug when overriding "maxfailures" or "bantime". Thanks to Yaroslav
+  Halchenko
+- Added more debug output if an error occurs when sending mail. Thanks to
+  Stephen Gildea
+- Renamed "maxretry" to "maxfailures" and changed default value to 5. Thanks to
+  Stephen Gildea
+- Hopefully fixed bug #1256075
+- Fixed bug #1262345
+- Fixed exception handling in PIDLock
+- Removed warning when using "-V" or "-h" with no config file. Thanks to
+  Yaroslav Halchenko
+- Removed "-i eth0" from config file. Thanks to Yaroslav Halchenko
+
+ver. 0.5.2 (2005/08/06) - beta
+----------
+- Better PID lock file handling. Should close #1239562
+- Added man pages
+- Removed log4py dependency. Use logging module instead
+- "maxretry" and "bantime" can be overridden in each section
+- Fixed bug #1246278 (excessive memory usage)
+- Fixed crash on wrong option value in configuration file
+- Changed custom chains to lowercase
+
+ver. 0.5.1 (2005/07/23) - beta
+----------
+- Fixed bugs #1241756, #1239557
+- Added log targets in configuration file. Removed -l option
+- Changed iptables rules in order to create a separated chain for each section
+- Fixed static banList in firewall.py
+- Added an initd script for Debian. Thanks to Yaroslav Halchenko
+- Check for obsolete files after install
+
+ver. 0.5.0 (2005/07/12) - beta
+----------
+- Added support for CIDR mask in ignoreip
+- Added mail notification support
+- Fixed bug #1234699
+- Added tags replacement in rules definition. Should allow a clean solution for
+  Feature Request #1229479
+- Removed "interface" and "firewall" options
+- Added start and end commands in the configuration file. Thanks to Yaroslav
+  Halchenko
+- Added firewall rules definition in the configuration file
+- Cleaned fail2ban.py
+- Added an initd script for RedHat/Fedora. Thanks to Andrey G. Grozin
+
+ver. 0.4.1 (2005/06/30) - stable
+----------
+- Fixed textToDNS method which generated wrong matches for "rhost=12-xyz...".
+  Thanks to Tom Pike
+- fail2ban.conf modified for readability. Thanks to Iain Lea
+- Added an initd script for Gentoo
+- Changed default PID lock file location from /tmp to /var/run
+
+ver. 0.4.0 (2005/04/24) - stable
+----------
+- Fixed textToDNS which did not recognize strings like
+  "12-345-67-890.abcd.mnopqr.xyz"
+
+ver. 0.3.1 (2005/03/31) - beta
+----------
+- Corrected level of messages
+- Added DNS lookup support
+- Improved parsing speed. Only parse the new log messages
+- Added a second verbose level (-vv)
+
+ver. 0.3.0 (2005/02/24) - beta
+----------
+- Re-writting of parts of the code in order to handle several log files with
+  different rules
+- Removed sshd.py because it is no more needed
+- Fixed a bug when exiting with IP in the ban list
+- Added PID lock file
+- Improved some parts of the code
+- Added ipfw-start-rule option (thanks to Robert Edeker)
+- Added -k option which kills a currently running Fail2Ban
+
+ver. 0.1.2 (2004/11/21) - beta
+----------
+- Add ipfw and ipfwadm support. The rules are taken from BlockIt. Thanks to
+  Robert Edeker
+- Add -e option which allows to set the interface. Thanks to Robert Edeker who
+  reminded me this
+- Small code cleaning
+
+ver. 0.1.1 (2004/10/23) - beta
+----------
+- Add SIGTERM handler in order to exit nicely when in daemon mode
+- Add -r option which allows to set the maximum number of login failures
+- Remove the Metalog class as the log file are not so syslog daemon specific
+- Rewrite log reader to be service centered. Sshd support added. Match "Failed
+  password" and "Illegal user"
+- Add /etc/fail2ban.conf configuration support
+- Code documentation
+
+ver. 0.1.0 (2004/10/12) - alpha
+----------
+- Initial release
@@ -1,103 +0,0 @@
-README
-CHANGELOG
-TODO
-COPYING
-fail2ban-client
-fail2ban-server
-fail2ban-testcases
-fail2ban-regex
-client/configreader.py
-client/jailreader.py
-client/fail2banreader.py
-client/jailsreader.py
-client/beautifier.py
-client/filterreader.py
-client/actionreader.py
-client/__init__.py
-client/configurator.py
-client/csocket.py
-server/ssocket.py
-server/banticket.py
-server/filter.py
-server/filtergamin.py
-server/filterpoll.py
-server/server.py
-server/datestrptime.py
-server/failticket.py
-server/actions.py
-server/datetai64n.py
-server/faildata.py
-server/failmanager.py
-server/datedetector.py
-server/jailthread.py
-server/transmitter.py
-server/action.py
-server/ticket.py
-server/jail.py
-server/jails.py
-server/__init__.py
-server/dateepoch.py
-server/banmanager.py
-server/datetemplate.py
-server/mytime.py
-server/regex.py
-server/failregex.py
-testcases/banmanagertestcase.py
-testcases/failmanagertestcase.py
-testcases/clientreadertestcase.py
-testcases/filtertestcase.py
-testcases/__init__.py
-testcases/datedetectortestcase.py
-testcases/actiontestcase.py
-testcases/servertestcase.py
-testcases/files/testcase01.log
-testcases/files/testcase02.log
-testcases/files/testcase03.log
-testcases/files/testcase04.log
-setup.py
-setup.cfg
-common/__init__.py
-common/version.py
-common/protocol.py
-config/jail.conf
-config/filter.d/apache-auth.conf
-config/filter.d/apache-badbots.conf
-config/filter.d/apache-noscript.conf
-config/filter.d/courierlogin.conf
-config/filter.d/couriersmtp.conf
-config/filter.d/exim.conf
-config/filter.d/postfix.conf
-config/filter.d/proftpd.conf
-config/filter.d/pure-ftpd.conf
-config/filter.d/qmail.conf
-config/filter.d/sasl.conf
-config/filter.d/sshd.conf
-config/filter.d/sshd-ddos.conf
-config/filter.d/vsftpd.conf
-config/filter.d/wuftpd.conf
-config/action.d/hostsdeny.conf
-config/action.d/ipfw.conf
-config/action.d/iptables.conf
-config/action.d/iptables-multiport.conf
-config/action.d/iptables-new.conf
-config/action.d/mail.conf
-config/action.d/mail-buffered.conf
-config/action.d/mail-whois.conf
-config/action.d/mail-whois-lines.conf
-config/action.d/shorewall.conf
-config/fail2ban.conf
-man/fail2ban-client.1
-man/fail2ban-client.h2m
-man/fail2ban-server.1
-man/fail2ban-server.h2m
-man/fail2ban-regex.1
-man/fail2ban-regex.h2m
-man/generate-man
-files/gentoo-initd
-files/gentoo-confd
-files/redhat-initd
-files/solaris-fail2ban.xml
-files/solaris-svc-fail2ban
-files/cacti/fail2ban_stats.sh
-files/cacti/cacti_host_template_fail2ban.xml
-files/cacti/README
@@ -0,0 +1,15 @@
+Metadata-Version: 1.0
+Name: fail2ban
+Version: 0.8.4
+Summary: Ban IPs that make too many password failure
+Home-page: http://www.fail2ban.org
+Author: Cyril Jaquier
+Author-email: cyril.jaquier@fail2ban.org
+License: GPL
+Description: 
+        Fail2Ban scans log files like /var/log/pwdfail or
+        /var/log/apache/error_log and bans IP that makes
+        too many password failures. It updates firewall rules
+        to reject the IP address or executes user defined
+        commands.
+Platform: Posix
@@ -1,96 +1,91 @@
-               __      _ _ ___ _               
-              / _|__ _(_) |_  ) |__  __ _ _ _  
-             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
-             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+                         __      _ _ ___ _               
+                        / _|__ _(_) |_  ) |__  __ _ _ _  
+                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+                       |_| \__,_|_|_/___|_.__/\__,_|_||_|

-=============================================================
-Fail2Ban (version 0.8.0)                           2007/05/03
-=============================================================
+================================================================================
+Fail2Ban (version 0.8.5)                                              2011/07/26
+================================================================================

-Fail2Ban scans log files like /var/log/pwdfail and bans IP
-that makes too many password failures. It updates firewall
-rules to reject the IP address. These rules can be defined by
-the user. Fail2Ban can read multiple log files such as sshd
-or Apache web server ones.
+Fail2Ban scans log files like /var/log/pwdfail and bans IP that makes too many
+password failures. It updates firewall rules to reject the IP address. These
+rules can be defined by the user. Fail2Ban can read multiple log files such as
+sshd or Apache web server ones.

-This README is a quick introduction to Fail2ban. More
-documentation, FAQ, HOWTOs are available on the project
-website: http://www.fail2ban.org
+This README is a quick introduction to Fail2ban. More documentation, FAQ, HOWTOs
+are available on the project website: http://www.fail2ban.org

 Installation:
 -------------

 Required:
-   >=python-2.4 (http://www.python.org)
+   >=python-2.3 (http://www.python.org)

 Optional:
   >=gamin-0.0.21 (http://www.gnome.org/~veillard/gamin)

 To install, just do:

-> tar xvfj fail2ban-0.8.0.tar.bz2
-> cd fail2ban-0.8.0
+> tar xvfj fail2ban-0.8.4.tar.bz2
+> cd fail2ban-0.8.4
 > python setup.py install

-This will install Fail2Ban into /usr/share/fail2ban. The
-executable scripts are placed into /usr/bin.
+This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
+placed into /usr/bin.

-It is possible that Fail2ban is already packaged for your
-distribution. In this case, you should use it.
+It is possible that Fail2ban is already packaged for your distribution. In this
+case, you should use it.

 Fail2Ban should be correctly installed now. Just type:

 > fail2ban-client -h

-to see if everything is alright. You should always use
-fail2ban-client and never call fail2ban-server directly.
+to see if everything is alright. You should always use fail2ban-client and never
+call fail2ban-server directly.

 Configuration:
 --------------

-You can configure Fail2ban using the files in /etc/fail2ban.
-It is possible to configure the server using commands sent to
-it by fail2ban-client. The available commands are described
-in the man page of fail2ban-client. Please refer to it or to
-the website: http://www.fail2ban.org
+You can configure Fail2ban using the files in /etc/fail2ban. It is possible to
+configure the server using commands sent to it by fail2ban-client. The available
+commands are described in the man page of fail2ban-client. Please refer to it or
+to the website: http://www.fail2ban.org

 Contact:
 --------

-You need some new features, you found bugs or you just
-appreciate this program, you can contact me at:
+You need some new features, you found bugs or you just appreciate this program,
+you can contact me at:

 Website: http://www.fail2ban.org

-Cyril Jaquier: <lostcontrol@users.sourceforge.net>
+Cyril Jaquier: <cyril.jaquier@fail2ban.org>

 Thanks:
 -------

-Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
-Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
-Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
-Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
-Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
-René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch,
-Michael C. Haller, Jonathan Underwood, Hanno 'Rince' Wagner
+Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker, Tom Pike, Iain Lea,
+Andrey G. Grozin, Yaroslav Halchenko, Jonathan Kamens, Stephen Gildea, Markus
+Hoffmann, Mark Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler, Nick
+Munger, Christoph Haas, Justin Shore, Joël Bertrand, René Berber, mEDI, Axel
+Thimm, Eric Gerbier, Christian Rauch, Michael C. Haller, Jonathan Underwood,
+Hanno 'Rince' Wagner, Daniel B. Cid, David Nutter, Raphaël Marichez, Guillaume
+Delvit, Vaclav Misek, Adrien Clerc, Michael Hanselmann, Vincent Deffontaines,
+Bill Heaton, Russell Odom, Christos Psonis, Arturo 'Buanzo' Busleiman and many
+others.

 License:
 --------

-Fail2Ban is free software; you can redistribute it
-and/or modify it under the terms of the GNU General Public
-License as published by the Free Software Foundation; either
-version 2 of the License, or (at your option) any later
+Fail2Ban is free software; you can redistribute it and/or modify it under the
+terms of the GNU General Public License as published by the Free Software
+Foundation; either version 2 of the License, or (at your option) any later
 version.

-Fail2Ban is distributed in the hope that it will be
-useful, but WITHOUT ANY WARRANTY; without even the implied
-warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-PURPOSE.  See the GNU General Public License for more
-details.
+Fail2Ban is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+PARTICULAR PURPOSE. See the GNU General Public License for more details.

-You should have received a copy of the GNU General Public
-License along with Fail2Ban; if not, write to the Free
-Software Foundation, Inc., 59 Temple Place, Suite 330,
-Boston, MA  02111-1307  USA
+You should have received a copy of the GNU General Public License along with
+Fail2Ban; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
+Suite 330, Boston, MA  02111-1307  USA
@@ -1,11 +1,11 @@
-               __      _ _ ___ _               
-              / _|__ _(_) |_  ) |__  __ _ _ _  
-             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
-             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+                         __      _ _ ___ _               
+                        / _|__ _(_) |_  ) |__  __ _ _ _  
+                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+                       |_| \__,_|_|_/___|_.__/\__,_|_||_|

-=============================================================
-ToDo                                         $Revision$
-=============================================================
+================================================================================
+ToDo                                                            $Revision: 732 $
+================================================================================

 Legend:
 - not yet done
@@ -15,29 +15,24 @@ Legend:

 - Removed relative imports

- Discuss where Fail2ban should be installed (/usr/share,
-  /usr/lib/python/site-packages/, etc)
+- Cleanup fail2ban-client and fail2ban-server. Move code to server/ and client/

- Cleanup fail2ban-client and fail2ban-server. Move code to
-  server/ and client/
-
- Add timeout to external commands (signal alarm, watchdog
-  thread, etc)
+- Add timeout to external commands (signal alarm, watchdog thread, etc)

 - New backend: pyinotify

- Uniformize filters and actions name. Use the software name
-  (openssh, postfix, proftp)
+- Uniformize filters and actions name. Use the software name (openssh, postfix,
+  proftp)

- Added <USER> tag for failregex. Add features using this
-  information. Maybe add more tags
+- Added <USER> tag for failregex. Add features using this information. Maybe add
+  more tags

 - Look at the memory consumption. Decrease memory usage

 - More detailed statistics

- Auto-enable function (search for log files), check
-  modification date to see if service is still in use
+- Auto-enable function (search for log files), check modification date to see if
+  service is still in use

 - Improve parsing of the action parameters in jailreader.py

@@ -45,14 +40,10 @@ Legend:

 - Add gettext support (I18N)

- Fix the cPickle issue with Python 2.5
-
 - Multiline log reading

- Improve communication. (asyncore, asynchat??)
-
- Improve execution of action. Why does subprocess.call
-  deadlock with multi-jails?
+- Improve execution of action. Why does subprocess.call deadlock with
+  multi-jails?

 # see Feature Request Tracking System at SourceForge.net

@@ -16,10 +16,10 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 433 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 433 $"
+__date__ = "$Date: 2006-10-24 21:40:51 +0200 (Tue, 24 Oct 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
@@ -16,11 +16,11 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 433 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 433 $"
+__date__ = "$Date: 2006-10-24 21:40:51 +0200 (Tue, 24 Oct 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -16,11 +16,11 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 644 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 644 $"
+__date__ = "$Date: 2008-01-15 00:12:21 +0100 (Tue, 15 Jan 2008) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -72,9 +72,14 @@ class Beautifier:
 					ipList = ""
 					for ip in response[1][1][2][1]:
 						ipList += ip + " "
+					# Creates file list.
+					fileList = ""
+					for f in response[0][1][2][1]:
+						fileList += f + " "
 					# Display information
 					msg = "Status for the jail: " + inC[1] + "\n"
 					msg = msg + "|- " + response[0][0] + "\n"
+					msg = msg + "|  |- " + response[0][1][2][0] + ":\t" + fileList + "\n"
 					msg = msg + "|  |- " + response[0][1][0][0] + ":\t" + `response[0][1][0][1]` + "\n"
 					msg = msg + "|  `- " + response[0][1][1][0] + ":\t" + `response[0][1][1][1]` + "\n"
 					msg = msg + "`- " + response[1][0] + "\n"
@@ -0,0 +1,108 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Yaroslav Halchenko
+# Modified: Cyril Jaquier
+# $Revision: 656 $
+
+__author__ = 'Yaroslav Halhenko'
+__revision__ = '$Revision: $'
+__date__ = '$Date:  $'
+__copyright__ = 'Copyright (c) 2007 Yaroslav Halchenko'
+__license__ = 'GPL'
+
+import logging, os
+from ConfigParser import SafeConfigParser
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class SafeConfigParserWithIncludes(SafeConfigParser):
+	"""
+	Class adds functionality to SafeConfigParser to handle included
+	other configuration files (or may be urls, whatever in the future)
+
+	File should have section [includes] and only 2 options implemented
+	are 'files_before' and 'files_after' where files are listed 1 per
+	line.
+
+	Example:
+
+[INCLUDES]
+before = 1.conf
+         3.conf
+
+after = 1.conf
+
+	It is a simple implementation, so just basic care is taken about
+	recursion. Includes preserve right order, ie new files are
+	inserted to the list of read configs before original, and their
+	includes correspondingly so the list should follow the leaves of
+	the tree.
+
+	I wasn't sure what would be the right way to implement generic (aka c++
+	template) so we could base at any *configparser class... so I will
+	leave it for the future
+
+	"""
+
+	SECTION_NAME = "INCLUDES"
+
+	#@staticmethod
+	def getIncludes(resource, seen = []):
+		"""
+		Given 1 config resource returns list of included files
+		(recursively) with the original one as well
+		Simple loops are taken care about
+		"""
+		
+		# Use a short class name ;)
+		SCPWI = SafeConfigParserWithIncludes
+		
+		parser = SafeConfigParser()
+		parser.read(resource)
+		
+		resourceDir = os.path.dirname(resource)
+
+		newFiles = [ ('before', []), ('after', []) ]
+		if SCPWI.SECTION_NAME in parser.sections():
+			for option_name, option_list in newFiles:
+				if option_name in parser.options(SCPWI.SECTION_NAME):
+					newResources = parser.get(SCPWI.SECTION_NAME, option_name)
+					for newResource in newResources.split('\n'):
+						if os.path.isabs(newResource):
+							r = newResource
+						else:
+							r = os.path.join(resourceDir, newResource)
+						if r in seen:
+							continue
+						s = seen + [resource]
+						option_list += SCPWI.getIncludes(r, s)
+		# combine lists
+		return newFiles[0][1] + [resource] + newFiles[1][1]
+		#print "Includes list for " + resource + " is " + `resources`
+	getIncludes = staticmethod(getIncludes)
+
+
+	def read(self, filenames):
+		fileNamesFull = []
+		if not isinstance(filenames, list):
+			filenames = [ filenames ]
+		for filename in filenames:
+			fileNamesFull += SafeConfigParserWithIncludes.getIncludes(filename)
+		logSys.debug("Reading files: %s" % fileNamesFull)
+		return SafeConfigParser.read(self, fileNamesFull)
+
@@ -15,38 +15,40 @@
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 # Author: Cyril Jaquier
-# 
-# $Revision$
+# Modified by: Yaroslav Halchenko (SafeConfigParserWithIncludes)
+# $Revision: 656 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 656 $"
+__date__ = "$Date: 2008-03-04 01:17:56 +0100 (Tue, 04 Mar 2008) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

 import logging, os
-from ConfigParser import SafeConfigParser
+from configparserinc import SafeConfigParserWithIncludes
 from ConfigParser import NoOptionError, NoSectionError

 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.client.config")

-class ConfigReader(SafeConfigParser):
+class ConfigReader(SafeConfigParserWithIncludes):
 	
 	BASE_DIRECTORY = "/etc/fail2ban/"
 	
 	def __init__(self):
-		SafeConfigParser.__init__(self)
+		SafeConfigParserWithIncludes.__init__(self)
 		self.__opts = None
 	
-	@staticmethod
+	#@staticmethod
 	def setBaseDir(folderName):
 		path = folderName.rstrip('/')
 		ConfigReader.BASE_DIRECTORY = path + '/'
+	setBaseDir = staticmethod(setBaseDir)
 		
-	@staticmethod
+	#@staticmethod
 	def getBaseDir():
 		return ConfigReader.BASE_DIRECTORY
+	getBaseDir = staticmethod(getBaseDir)
 	
 	def read(self, filename):
 		basename = ConfigReader.BASE_DIRECTORY + filename
@@ -54,7 +56,7 @@ class ConfigReader(SafeConfigParser):
 		bConf = basename + ".conf"
 		bLocal = basename + ".local"
 		if os.path.exists(bConf) or os.path.exists(bLocal):
-			SafeConfigParser.read(self, [bConf, bLocal])
+			SafeConfigParserWithIncludes.read(self, [bConf, bLocal])
 			return True
 		else:
 			logSys.error(bConf + " and " + bLocal + " do not exist")
@@ -16,11 +16,11 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 655 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 655 $"
+__date__ = "$Date: 2008-03-04 01:13:39 +0100 (Tue, 04 Mar 2008) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -40,13 +40,15 @@ class Configurator:
 		self.__fail2ban = Fail2banReader()
 		self.__jails = JailsReader()
 	
-	@staticmethod
+	#@staticmethod
 	def setBaseDir(folderName):
 		ConfigReader.setBaseDir(folderName)
+	setBaseDir = staticmethod(setBaseDir)
 	
-	@staticmethod
+	#@staticmethod
 	def getBaseDir():
 		return ConfigReader.getBaseDir()
+	getBaseDir = staticmethod(getBaseDir)
 	
 	def readEarly(self):
 		self.__fail2ban.read()
@@ -54,13 +56,13 @@ class Configurator:
 	def readAll(self):
 		self.readEarly()
 		self.__jails.read()
-		
+	
 	def getEarlyOptions(self):
 		return self.__fail2ban.getEarlyOptions()
-	
-	def getAllOptions(self):
+
+	def getOptions(self, jail = None):
 		self.__fail2ban.getOptions()
-		return self.__jails.getOptions()
+		return self.__jails.getOptions(jail)
 		
 	def convertToProtocol(self):
 		self.__streams["general"] = self.__fail2ban.convert()
@@ -16,11 +16,11 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 635 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 635 $"
+__date__ = "$Date: 2007-12-16 22:38:04 +0100 (Sun, 16 Dec 2007) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -32,7 +32,7 @@ class CSocket:
 	
 	END_STRING = "<F2B_END_COMMAND>"
 	
-	def __init__(self, sock = "/tmp/fail2ban.sock"):
+	def __init__(self, sock = "/var/run/fail2ban/fail2ban.sock"):
 		# Create an INET, STREAMing socket
 		#self.csock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 		self.__csock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
@@ -47,7 +47,7 @@ class CSocket:
 		self.__csock.close()
 		return ret
 	
-	@staticmethod
+	#@staticmethod
 	def receive(sock):
 		msg = ''
 		while msg.rfind(CSocket.END_STRING) == -1:
@@ -56,3 +56,4 @@ class CSocket:
 				raise RuntimeError, "socket connection broken"
 			msg = msg + chunk
 		return loads(msg)
+	receive = staticmethod(receive)
@@ -16,11 +16,11 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 407 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 407 $"
+__date__ = "$Date: 2006-10-09 20:05:13 +0200 (Mon, 09 Oct 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -16,11 +16,11 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 711 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 711 $"
+__date__ = "$Date: 2008-08-13 00:05:13 +0200 (Wed, 13 Aug 2008) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -53,20 +53,14 @@ class FilterReader(ConfigReader):
 		return ConfigReader.read(self, "filter.d/" + self.__file)
 	
 	def getOptions(self, pOpts):
-		opts = [["string", "timeregex", None],
-				["string", "timepattern", None],
-				["string", "ignoreregex", ""],
+		opts = [["string", "ignoreregex", ""],
 				["string", "failregex", ""]]
 		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
 	
 	def convert(self):
 		stream = list()
 		for opt in self.__opts:
-			if opt == "timeregex":
-				stream.append(["set", self.__name, "timeregex", self.__opts[opt]])
-			elif opt == "timepattern":
-				stream.append(["set", self.__name, "timepattern", self.__opts[opt]])
-			elif opt == "failregex":
+			if opt == "failregex":
 				for regex in self.__opts[opt].split('\n'):
 					# Do not send a command if the rule is empty.
 					if regex != '':
@@ -16,11 +16,11 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 690 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 690 $"
+__date__ = "$Date: 2008-05-12 10:34:42 +0200 (Mon, 12 May 2008) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -90,7 +90,7 @@ class JailReader(ConfigReader):
 						self.__actions.append(action)
 					else:
 						raise AttributeError("Unable to read action")
-				except AttributeError, e:
+				except Exception, e:
 					logSys.error("Error in action definition " + act)
 					logSys.debug(e)
 					return False
@@ -120,16 +120,19 @@ class JailReader(ConfigReader):
 			elif opt == "bantime":
 				stream.append(["set", self.__name, "bantime", self.__opts[opt]])
 			elif opt == "failregex":
-				stream.append(["set", self.__name, "failregex", self.__opts[opt]])
+				stream.append(["set", self.__name, "addfailregex", self.__opts[opt]])
 			elif opt == "ignoreregex":
-				stream.append(["set", self.__name, "ignoreregex", self.__opts[opt]])
+				for regex in self.__opts[opt].split('\n'):
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addignoreregex", regex])
 		stream.extend(self.__filter.convert())
 		for action in self.__actions:
 			stream.extend(action.convert())
 		stream.insert(0, ["add", self.__name, backend])
 		return stream
 	
-	@staticmethod
+	#@staticmethod
 	def splitAction(action):
 		m = JailReader.actionCRE.match(action)
 		d = dict()
@@ -165,3 +168,4 @@ class JailReader(ConfigReader):
 				except IndexError:
 					logSys.error("Invalid argument %s in '%s'" % (p, m.group(2)))
 		return [m.group(1), d]
+	splitAction = staticmethod(splitAction)
@@ -16,11 +16,11 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 655 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 655 $"
+__date__ = "$Date: 2008-03-04 01:13:39 +0100 (Tue, 04 Mar 2008) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -40,12 +40,13 @@ class JailsReader(ConfigReader):
 	def read(self):
 		ConfigReader.read(self, "jail")
 	
-	def getOptions(self):
+	def getOptions(self, section = None):
 		opts = []
 		self.__opts = ConfigReader.getOptions(self, "Definition", opts)

-		for sec in self.sections():
-			jail = JailReader(sec)
+		if section:
+			# Get the options of a specific jail.
+			jail = JailReader(section)
 			jail.read()
 			ret = jail.getOptions()
 			if ret:
@@ -53,8 +54,21 @@ class JailsReader(ConfigReader):
 					# We only add enabled jails
 					self.__jails.append(jail)
 			else:
-				logSys.error("Errors in jail '" + sec + "'. Skipping...")
+				logSys.error("Errors in jail '%s'. Skipping..." % section)
 				return False
+		else:
+			# Get the options of all jails.
+			for sec in self.sections():
+				jail = JailReader(sec)
+				jail.read()
+				ret = jail.getOptions()
+				if ret:
+					if jail.isEnabled():
+						# We only add enabled jails
+						self.__jails.append(jail)
+				else:
+					logSys.error("Errors in jail '" + sec + "'. Skipping...")
+					return False
 		return True
 	
 	def convert(self):
@@ -16,10 +16,10 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 504 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 504 $"
+__date__ = "$Date: 2006-12-23 17:37:17 +0100 (Sat, 23 Dec 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
@@ -15,23 +15,24 @@
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 # Author: Cyril Jaquier
+# Author: Arturo 'Buanzo' Busleiman
 # 
-# $Revision$
+# $Revision: 741 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__version__ = "$Revision: 741 $"
+__date__ = "$Date: 2009-08-30 16:13:04 +0200 (Sun, 30 Aug 2009) $"
+__copyright__ = "Copyright (c) 2009 Cyril Jaquier"
 __license__ = "GPL"

-import logging
-from ticket import Ticket

-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban")
-
-class FailTicket(Ticket):
-	
-	def __init__(self, ip, time):
-		Ticket.__init__(self, ip, time)
-	
+def formatExceptionInfo():
+    """ Author: Arturo 'Buanzo' Busleiman """
+    import sys
+    cla, exc = sys.exc_info()[:2]
+    excName = cla.__name__
+    try:
+        excArgs = exc.__dict__["args"]
+    except KeyError:
+        excArgs = str(exc)
+    return (excName, excArgs)
@@ -16,11 +16,11 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 751 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 751 $"
+__date__ = "$Date: 2009-09-01 22:25:32 +0200 (Tue, 01 Sep 2009) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -33,6 +33,7 @@ protocol = [
 ['', "BASIC", ""],
 ["start", "starts the server and the jails"], 
 ["reload", "reloads the configuration"], 
+["reload <JAIL>", "reloads the jail <JAIL>"], 
 ["stop", "stops all jails and terminate the server"], 
 ["status", "gets the current status of the server"], 
 ["ping", "tests if the server is alive"], 
@@ -51,15 +52,14 @@ protocol = [
 ["set <JAIL> addignoreip <IP>", "adds <IP> to the ignore list of <JAIL>"], 
 ["set <JAIL> delignoreip <IP>", "removes <IP> from the ignore list of <JAIL>"], 
 ["set <JAIL> addlogpath <FILE>", "adds <FILE> to the monitoring list of <JAIL>"], 
-["set <JAIL> dellogpath <FILE>", "removes <FILE> to the monitoring list of <JAIL>"], 
-["set <JAIL> timeregex <REGEX>", "sets the regular expression <REGEX> to match the date format for <JAIL>. This will disable the autodetection feature."], 
-["set <JAIL> timepattern <PATTERN>", "sets the pattern <PATTERN> to match the date format for <JAIL>. This will disable the autodetection feature."], 
+["set <JAIL> dellogpath <FILE>", "removes <FILE> from the monitoring list of <JAIL>"],
 ["set <JAIL> addfailregex <REGEX>", "adds the regular expression <REGEX> which must match failures for <JAIL>"], 
 ["set <JAIL> delfailregex <INDEX>", "removes the regular expression at <INDEX> for failregex"], 
 ["set <JAIL> addignoreregex <REGEX>", "adds the regular expression <REGEX> which should match pattern to exclude for <JAIL>"],
 ["set <JAIL> delignoreregex <INDEX>", "removes the regular expression at <INDEX> for ignoreregex"], 
 ["set <JAIL> findtime <TIME>", "sets the number of seconds <TIME> for which the filter will look back for <JAIL>"], 
 ["set <JAIL> bantime <TIME>", "sets the number of seconds <TIME> a host will be banned for <JAIL>"], 
+["set <JAIL> banip <IP>", "manually Ban <IP> for <JAIL>"], 
 ["set <JAIL> maxretry <RETRY>", "sets the number of failures <RETRY> before banning the host for <JAIL>"], 
 ["set <JAIL> addaction <ACT>", "adds a new action named <NAME> for <JAIL>"], 
 ["set <JAIL> delaction <ACT>", "removes the action <NAME> from <JAIL>"], 
@@ -73,8 +73,6 @@ protocol = [
 ['', "JAIL INFORMATION", ""],
 ["get <JAIL> logpath", "gets the list of the monitored files for <JAIL>"],
 ["get <JAIL> ignoreip", "gets the list of ignored IP addresses for <JAIL>"],
-["get <JAIL> timeregex", "gets the regular expression used for the time detection for <JAIL>"],
-["get <JAIL> timepattern", "gets the pattern used for the time detection for <JAIL>"],
 ["get <JAIL> failregex", "gets the list of regular expressions which matches the failures for <JAIL>"],
 ["get <JAIL> ignoreregex", "gets the list of regular expressions which matches patterns to ignore for <JAIL>"],
 ["get <JAIL> findtime", "gets the time for which the filter will look back for failures for <JAIL>"],
@@ -16,12 +16,12 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 754 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__version__ = "$Revision: 754 $"
+__date__ = "$Date: 2009-09-07 21:13:45 +0200 (Mon, 07 Sep 2009) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011 Yaroslav Halchenko"
 __license__ = "GPL"

-version = "0.8.0"
+version = "0.8.5"
@@ -0,0 +1,86 @@
+# Fail2Ban configuration file
+#
+# Author: Russell Odom <russ@gloomytrousers.co.uk>
+# Sends a complaint e-mail to addresses listed in the whois record for an
+# offending IP address.
+#
+# You should provide the <logpath> in the jail config - lines from the log
+# matching the given IP address will be provided in the complaint as evidence.
+#
+# Note that we will try to use e-mail addresses that are most likely to be abuse
+# addresses (based on various keywords). If they aren't found we fall back on
+# any other addresses found in the whois record, with a few exceptions.
+# If no addresses are found, no e-mail is sent.
+#
+# $Revision: 717 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart =
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop =
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck =
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = ADDRESSES=`whois <ip> | perl -e 'while (<STDIN>) { next if /^changed|@(ripe|apnic)\.net/io; $m += (/abuse|trouble:|report|spam|security/io?3:0); if (/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)/io) { while (s/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)//io) { if ($m) { $a{lc($1)}=$m } else { $b{lc($1)}=$m } } $m=0 } else { $m && --$m } } if (%%a) {print join(",",keys(%%a))} else {print join(",",keys(%%b))}'`
+	    IP=<ip>
+            if [ ! -z "$ADDRESSES" ]; then
+                (printf %%b "<message>\n"; date '+Note: Local timezone is %%z (%%Z)'; grep '<ip>' <logpath>) | <mailcmd> "Abuse from <ip>" $ADDRESSES <mailargs>
+            fi
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+#
+actionunban =
+
+[Init]
+message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to a whois lookup is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process. This mail was generated by Fail2Ban.)\n
+
+# Path to the log files which contain relevant lines for the abuser IP
+#
+logpath = /dev/null
+
+# Option:  mailcmd
+# Notes.:  Your system mail command. Is passed 2 args: subject and recipient
+# Values:  CMD  Default: mail -s
+#
+mailcmd = mail -s
+
+# Option:  mailargs
+# Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
+#          CC reports to another address:
+#              -c me@example.com
+#          Appear to come from a different address - the '--' indicates
+#          arguments to be passed to Sendmail:
+#              -- -f me@example.com
+# Values:  [ STRING ]  Default: (empty)
+#
+mailargs =
+
@@ -0,0 +1,210 @@
+# Fail2Ban configuration file
+#
+# Author: Russell Odom <russ@gloomytrousers.co.uk>
+# Submits attack reports to DShield (http://www.dshield.org/)
+#
+# You MUST configure at least:
+# <port> (the port that's being attacked - use number not name).
+#
+# You SHOULD also provide:
+# <myip> (your public IP address, if it's not the address of eth0)
+# <userid> (your DShield userID, if you have one - recommended, but reports will
+# be used anonymously if not)
+# <protocol> (the protocol in use - defaults to tcp)
+#
+# Best practice is to provide <port> and <protocol> in jail.conf like this:
+# action = dshield[port=1234,protocol=tcp]
+#
+# ...and create "dshield.local" with contents something like this:
+# [Init]
+# myip = 10.0.0.1
+# userid = 12345
+#
+# Other useful configuration values are <mailargs> (you can use for specifying
+# a different sender address for the report e-mails, which should match what is
+# configured at DShield), and <lines>/<minreportinterval>/<maxbufferage> (to
+# configure how often the buffer is flushed).
+#
+# $Revision$
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart =
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = if [ -f <tmpfile>.buffer ]; then
+                 cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" <dest> <mailargs>
+                 date +%%s > <tmpfile>.lastsent
+             fi
+             rm -f <tmpfile>.buffer <tmpfile>.first
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck =
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+# See http://www.dshield.org/specs.html for more on report format/notes
+#
+# Note: We are currently using <time> for the timestamp because no tag is
+# available to indicate the timestamp of the log message(s) which triggered the
+# ban. Therefore the timestamps we are using in the report, whilst often only a
+# few seconds out, are incorrect. See
+# http://sourceforge.net/tracker/index.php?func=detail&aid=2017795&group_id=121032&atid=689047
+#
+actionban = TZONE=`date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'`
+            DATETIME="`perl -e '@t=localtime(<time>);printf "%%4d-%%02d-%%02d %%02d:%%02d:%%02d",1900+$t[5],$t[4]+1,$t[3],$t[2],$t[1],$t[0]'` $TZONE"
+	    PROTOCOL=`awk '{IGNORECASE=1;if($1=="<protocol>"){print $2;exit}}' /etc/protocols`
+	    if [ -z "$PROTOCOL" ]; then PROTOCOL=<protocol>; fi
+            printf %%b "$DATETIME\t<userid>\t<failures>\t<ip>\t<srcport>\t<myip>\t<port>\t$PROTOCOL\t<tcpflags>\n" >> <tmpfile>.buffer
+            NOW=`date +%%s`
+            if [ ! -f <tmpfile>.first ]; then
+                echo <time> | cut -d. -f1 > <tmpfile>.first
+            fi
+            if [ ! -f <tmpfile>.lastsent ]; then
+                echo 0 > <tmpfile>.lastsent
+            fi
+            LOGAGE=$(($NOW - `cat <tmpfile>.first`))
+            LASTREPORT=$(($NOW - `cat <tmpfile>.lastsent`))
+            LINES=$( wc -l <tmpfile>.buffer | awk '{ print $1 }' )
+            if [ $LINES -ge <lines> && $LASTREPORT -gt <minreportinterval> ] || [ $LOGAGE -gt <maxbufferage> ]; then
+                cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ $TZONE Fail2Ban" <dest> <mailargs>
+                rm -f <tmpfile>.buffer <tmpfile>.first
+                echo $NOW > <tmpfile>.lastsent
+            fi
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = if [ -f <tmpfile>.first ]; then
+                  NOW=`date +%%s`
+                  LOGAGE=$(($NOW - `cat <tmpfile>.first`))
+                  if [ $LOGAGE -gt <maxbufferage> ]; then
+                      cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" <dest> <mailargs>
+                      rm -f <tmpfile>.buffer <tmpfile>.first
+                      echo $NOW > <tmpfile>.lastsent
+                  fi
+              fi
+
+
+[Init]
+# Option:  port
+# Notes.:  The target port for the attack (numerical). MUST be provided in the
+#          jail config, as it cannot be detected here.
+# Values:  [ NUM ]  Default: ???
+#
+port = ???
+
+# Option:  userid
+# Notes.:  Your DSheild user ID. Should be provided either in the jail config or
+#          in a .local file.
+#          Register at https://secure.dshield.org/register.html
+# Values:  [ NUM ]  Default: 0
+#
+userid = 0
+
+# Option:  myip
+# Notes.:  TThe target IP for the attack (your public IP). Should be provided
+#          either in the jail config or in a .local file unless your PUBLIC IP
+#          is the first IP assigned to eth0
+# Values:  [ an IP address ]  Default: Tries to find the IP address of eth0,
+#          which in most cases will be a private IP, and therefore incorrect
+#
+myip = `ip -4 addr show dev eth0 | grep inet | head -1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`
+
+# Option:  protocol
+# Notes.:  The protocol over which the attack is happening
+# Values:  [ tcp | udp | icmp | (any other protocol name from /etc/protocols) | NUM ] Default: tcp
+#
+protocol = tcp
+
+# Option:  lines
+# Notes.:  How many lines to buffer before making a report. Regardless of this,
+#          reports are sent a minimum of <minreportinterval> apart, or if the
+#          buffer contains an event over <maxbufferage> old, or on shutdown
+# Values:  [ NUM ]  Default: 50
+#
+lines = 50
+
+# Option:  minreportinterval
+# Notes.:  Minimum period (in seconds) that must elapse before we submit another
+#          batch of reports. DShield request a minimum of 1 hour (3600 secs)
+#          between reports.
+# Values:  [ NUM ]  Default: 3600
+#
+minreportinterval = 3600
+
+# Option:  maxbufferage
+# Notes.:  Maximum age (in seconds) of the oldest report in the buffer before we
+#          submit the batch, even if we haven't reached <lines> yet. Note that
+#          this is only checked on each ban/unban, and that we always send
+#          anything in the buffer on shutdown. Must be greater than
+#          <minreportinterval>.
+# Values:  [ NUM ]  Default: 21600 (6 hours)
+#
+maxbufferage = 21600
+
+# Option:  srcport
+# Notes.:  The source port of the attack. You're unlikely to have this info, so
+#          you can leave the default
+# Values:  [ NUM ]  Default: ???
+#
+srcport = ???
+
+# Option:  tcpflags
+# Notes.:  TCP flags on attack. You're unlikely to have this info, so you can
+#          leave empty
+# Values:  [ STRING ]  Default: (empty)
+#
+tcpflags =
+
+# Option:  mailcmd
+# Notes.:  Your system mail command. Is passed 2 args: subject and recipient
+# Values:  CMD  Default: mail -s
+#
+mailcmd = mail -s
+
+# Option:  mailargs
+# Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
+#          CC reports to another address:
+#              -c me@example.com
+#          Appear to come from a different address (the From address must match
+#          the one configured at DShield - the '--' indicates arguments to be
+#          passed to Sendmail):
+#              -- -f me@example.com
+# Values:  [ STRING ]  Default: (empty)
+#
+mailargs =
+
+# Option:  dest
+# Notes.:  Destination e-mail address for reports
+# Values:  [ STRING ]  Default: reports@dshield.org
+#
+dest = reports@dshield.org
+
+# Option:  tmpfile
+# Notes.:  Base name of temporary files used for buffering
+# Values:  [ STRING ]  Default: /tmp/fail2ban-dshield
+#
+tmpfile = /var/run/fail2ban/tmp-dshield
+
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 660 $
 #

 [Definition]
@@ -13,7 +13,7 @@
 #
 actionstart = 

-# Option:  actionend
+# Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
@@ -34,7 +34,7 @@ actioncheck =
 # Values:  CMD
 #
 actionban = IP=<ip> &&
-            echo "ALL: $IP" >> <file>
+            printf %%b "ALL: $IP\n" >> <file>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -1,8 +1,9 @@
 # Fail2Ban configuration file
 #
-# Author: Cyril Jaquier
+# NetBSD ipfilter (ipf command) ban/unban
+#
+# Author: Ed Ravin <eravin@panix.com>
 #
-# $Revision$
 #

 [Definition]
@@ -11,14 +12,17 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = touch /tmp/fail2ban.dummy
-              echo "<init>" >> /tmp/fail2ban.dummy
+# enable IPF if not already enabled
+actionstart = /sbin/ipf -E

-# Option:  actionend
+
+# Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = rm -f /tmp/fail2ban.dummy
+# don't disable IPF with "/sbin/ipf -D", there may be other filters in use
+actionstop = 
+

 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -26,6 +30,7 @@ actionstop = rm -f /tmp/fail2ban.dummy
 #
 actioncheck = 

+
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -34,7 +39,8 @@ actioncheck =
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = echo "+<ip>" >> /tmp/fail2ban.dummy
+actionban = echo block in quick from <ip>/32 | /sbin/ipf -f -
+

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -44,9 +50,8 @@ actionban = echo "+<ip>" >> /tmp/fail2ban.dummy
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionunban = echo "-<ip>" >> /tmp/fail2ban.dummy
+# note -r option used to remove matching rule
+actionunban = echo block in quick from <ip>/32 | /sbin/ipf -r -f -

 [Init]

-init = 123
-
@@ -3,7 +3,7 @@
 # Author: Nick Munger
 # Modified by: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 658 $
 #

 [Definition]
@@ -15,7 +15,7 @@
 actionstart = 


-# Option:  actionend
+# Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
@@ -37,7 +37,7 @@ actioncheck =
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = ipaction add deny tcp from <ip> to <localhost> <port>
+actionban = ipfw add deny tcp from <ip> to <localhost> <port>


 # Option:  actionunban
@@ -48,7 +48,7 @@ actionban = ipaction add deny tcp from <ip> to <localhost> <port>
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionunban = ipaction delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
+actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`

 [Init]

@@ -0,0 +1,70 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
+# 			made active on all ports from original iptables.conf
+#
+# $Revision: 658 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> -p <protocol> -j fail2ban-<name>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D <chain> -p <protocol> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT
@@ -0,0 +1,84 @@
+# Fail2Ban configuration file
+#
+# Author: Guido Bozzetto
+# Modified: Cyril Jaquier
+#
+# make "fail2ban-<name>" chain to match drop IP
+# make "fail2ban-<name>-log" chain to log and drop
+# insert a jump to fail2ban-<name> from -I <chain> if proto/port match
+#
+# $Revision: 668 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> 1 -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+              iptables -N fail2ban-<name>-log
+              iptables -I fail2ban-<name>-log -j LOG --log-prefix "$(expr fail2ban-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
+              iptables -A fail2ban-<name>-log -j DROP
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -F fail2ban-<name>-log
+             iptables -X fail2ban-<name>
+             iptables -X fail2ban-<name>-log
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L fail2ban-<name>-log >/dev/null
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j fail2ban-<name>-log
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 # Modified by Yaroslav Halchenko for multiport banning
-# $Revision$
+# $Revision: 658 $
 #

 [Definition]
@@ -13,13 +13,13 @@
 #
 actionstart = iptables -N fail2ban-<name>
              iptables -A fail2ban-<name> -j RETURN
-              iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+              iptables -I <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>

-# Option:  actionend
+# Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
             iptables -F fail2ban-<name>
             iptables -X fail2ban-<name>

@@ -27,7 +27,7 @@ actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fai
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
+actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -67,3 +67,8 @@ port = ssh
 #
 protocol = tcp

+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT
@@ -4,7 +4,7 @@
 # Copied from iptables.conf and modified by Yaroslav Halchenko 
 #  to fullfill the needs of bugreporter dbts#350746.
 #
-# $Revision$
+# $Revision: 658 $
 #

 [Definition]
@@ -15,13 +15,13 @@
 #
 actionstart = iptables -N fail2ban-<name>
              iptables -A fail2ban-<name> -j RETURN
-              iptables -I INPUT -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+              iptables -I <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>

-# Option:  actionend
+# Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D INPUT -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+actionstop = iptables -D <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
             iptables -F fail2ban-<name>
             iptables -X fail2ban-<name>

@@ -29,7 +29,7 @@ actionstop = iptables -D INPUT -m state --state NEW -p <protocol> --dport <port>
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
+actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -69,3 +69,8 @@ port = ssh
 #
 protocol = tcp

+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 658 $
 #

 [Definition]
@@ -13,13 +13,13 @@
 #
 actionstart = iptables -N fail2ban-<name>
              iptables -A fail2ban-<name> -j RETURN
-              iptables -I INPUT -p <protocol> --dport <port> -j fail2ban-<name>
+              iptables -I <chain> -p <protocol> --dport <port> -j fail2ban-<name>

-# Option:  actionend
+# Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D INPUT -p <protocol> --dport <port> -j fail2ban-<name>
+actionstop = iptables -D <chain> -p <protocol> --dport <port> -j fail2ban-<name>
             iptables -F fail2ban-<name>
             iptables -X fail2ban-<name>

@@ -27,7 +27,7 @@ actionstop = iptables -D INPUT -p <protocol> --dport <port> -j fail2ban-<name>
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
+actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -67,3 +67,8 @@ port = ssh
 #
 protocol = tcp

+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision: 510 $
+# $Revision: 701 $
 #

 [Definition]
@@ -11,25 +11,25 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = echo -en "Hi,\n
-              The jail <name> has been started successfuly.\n
+actionstart = printf %%b "Hi,\n
+              The jail <name> has been started successfully.\n
              Output will be buffered until <lines> lines are available.\n
              Regards,\n
              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>

-# Option:  actionend
+# Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile> ]; then
-                 echo -en "Hi,\n
+                 printf %%b "Hi,\n
                 These hosts have been banned by Fail2Ban.\n
                 `cat <tmpfile>`
                 Regards,\n
                 Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest>
                 rm <tmpfile>
             fi
-             echo -en "Hi,\n
+             printf %%b "Hi,\n
             The jail <name> has been stopped.\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
@@ -48,10 +48,10 @@ actioncheck =
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = echo `date`": <ip> (<failures> failures)" >> <tmpfile>
+actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
            LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
-            if [ $LINE -eq <lines> ]; then
-                echo -en "Hi,\n
+            if [ $LINE -ge <lines> ]; then
+                printf %%b "Hi,\n
                These hosts have been banned by Fail2Ban.\n
                `cat <tmpfile>`
                \nRegards,\n
@@ -81,7 +81,7 @@ lines = 5

 # Default temporary file
 #
-tmpfile = /tmp/fail2ban-mail.txt
+tmpfile = /var/run/fail2ban/tmp-mail.txt

 # Destination/Addressee of the mail
 #
@@ -2,36 +2,36 @@
 #
 # Author: Cyril Jaquier
 # Modified-By: Yaroslav Halchenko to include grepping on IP over log files
-# $Revision$
+# $Revision: 660 $
 #

 [Definition]

-# Option:  fwstart
+# Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = echo -en "Hi,\n
-              The jail <name> has been started successfuly.\n
+actionstart = printf %%b "Hi,\n
+              The jail <name> has been started successfully.\n
              Regards,\n
              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>

-# Option:  fwend
+# Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = echo -en "Hi,\n
+actionstop = printf %%b "Hi,\n
             The jail <name> has been stopped.\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>

-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = 

-# Option:  fwban
+# Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
@@ -40,7 +40,7 @@ actioncheck =
 #          <bantime>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = echo -en "Hi,\n
+actionban = printf %%b "Hi,\n
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n\n
            Here are more information about <ip>:\n
@@ -50,7 +50,7 @@ actionban = echo -en "Hi,\n
            Regards,\n
            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>

-# Option:  fwunban
+# Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 660 $
 #

 [Definition]
@@ -11,16 +11,16 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = echo -en "Hi,\n
-              The jail <name> has been started successfuly.\n
+actionstart = printf %%b "Hi,\n
+              The jail <name> has been started successfully.\n
              Regards,\n
              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>

-# Option:  actionend
+# Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = echo -en "Hi,\n
+actionstop = printf %%b "Hi,\n
             The jail <name> has been stopped.\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
@@ -39,7 +39,7 @@ actioncheck =
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = echo -en "Hi,\n
+actionban = printf %%b "Hi,\n
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n\n
            Here are more information about <ip>:\n
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 660 $
 #

 [Definition]
@@ -11,16 +11,16 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = echo -en "Hi,\n
-              The jail <name> has been started successfuly.\n
+actionstart = printf %%b "Hi,\n
+              The jail <name> has been started successfully.\n
              Regards,\n
              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>

-# Option:  actionend
+# Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = echo -en "Hi,\n
+actionstop = printf %%b "Hi,\n
             The jail <name> has been stopped.\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
@@ -39,7 +39,7 @@ actioncheck =
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = echo -en "Hi,\n
+actionban = printf %%b "Hi,\n
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n
            Regards,\n
@@ -0,0 +1,144 @@
+# Fail2Ban configuration file
+#
+# Author: Russell Odom <russ@gloomytrousers.co.uk>
+# Submits attack reports to myNetWatchman (http://www.mynetwatchman.com/)
+#
+# You MUST configure at least:
+# <port> (the port that's being attacked - use number not name).
+# <mnwlogin> (your mNW login).
+# <mnwpass> (your mNW password).
+#
+# You SHOULD also provide:
+# <myip> (your public IP address, if it's not the address of eth0)
+# <protocol> (the protocol in use - defaults to tcp)
+#
+# Best practice is to provide <port> and <protocol> in jail.conf like this:
+# action = mynetwatchman[port=1234,protocol=udp]
+#
+# ...and create "mynetwatchman.local" with contents something like this:
+# [Init]
+# mnwlogin = me@example.com
+# mnwpass = SECRET
+# myip = 10.0.0.1
+#
+# Another useful configuration value is <getcmd>, if you don't have wget
+# installed (an example config for curl is given below)
+#
+# $Revision$
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart =
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop =
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck =
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+#
+# Note: We are currently using <time> for the timestamp because no tag is
+# available to indicate the timestamp of the log message(s) which triggered the
+# ban. Therefore the timestamps we are using in the report, whilst often only a
+# few seconds out, are incorrect. See
+# http://sourceforge.net/tracker/index.php?func=detail&aid=2017795&group_id=121032&atid=689047
+#
+actionban = MNWLOGIN=`perl -e '$s=shift;$s=~s/([\W])/"%%".uc(sprintf("%%2.2x",ord($1)))/eg;print $s' '<mnwlogin>'`
+            MNWPASS=`perl -e '$s=shift;$s=~s/([\W])/"%%".uc(sprintf("%%2.2x",ord($1)))/eg;print $s' '<mnwpass>'`
+	    PROTOCOL=`awk '{IGNORECASE=1;if($1=="<protocol>"){print $2;exit}}' /etc/protocols`
+	    if [ -z "$PROTOCOL" ]; then PROTOCOL=<protocol>; fi
+	    DATETIME=`perl -e '@t=gmtime(<time>);printf "%%4d-%%02d-%%02d+%%02d:%%02d:%%02d",1900+$t[5],$t[4]+1,$t[3],$t[2],$t[1],$t[0]'`
+            <getcmd> "<mnwurl>?AT=2&AV=0&AgentEmail=$MNWLOGIN&AgentPassword=$MNWPASS&AttackerIP=<ip>&SrcPort=<srcport>&ProtocolID=$PROTOCOL&DestPort=<port>&AttackCount=<failures>&VictimIP=<myip>&AttackDateTime=$DATETIME" 2>&1 >> <tmpfile>.out && grep -q 'Attack Report Insert Successful' <tmpfile>.out && rm -f <tmpfile>.out
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban =
+
+[Init]
+# Option:  port
+# Notes.:  The target port for the attack (numerical). MUST be provided in
+#          the jail config, as it cannot be detected here.
+# Values:  [ NUM ]  Default: ???
+#
+port = 0
+
+# Option:  mnwlogin
+# Notes.:  Your mNW login e-mail address. MUST be provided either in the jail
+#          config or in a .local file.
+#          Register at http://www.mynetwatchman.com/reg.asp
+# Values:  [ STRING ]  Default: (empty)
+#
+mnwlogin =
+
+# Option:  mnwpass
+# Notes.:  The password corresponding to your mNW login e-mail address. MUST be
+#          provided either in the jail config or in a .local file.
+# Values:  [ STRING ]  Default: (empty)
+#
+mnwpass =
+
+# Option:  myip
+# Notes.:  TThe target IP for the attack (your public IP). Should be overridden
+#          either in the jail config or in a .local file unless your PUBLIC IP
+#          is the first IP assigned to eth0
+# Values:  [ an IP address ]  Default: Tries to find the IP address of eth0,
+#          which in most cases will be a private IP, and therefore incorrect
+#
+myip = `ip -4 addr show dev eth0 | grep inet | head -1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`
+
+# Option:  protocol
+# Notes.:  The protocol over which the attack is happening
+# Values:  [ tcp | udp | icmp | (any other protocol name from /etc/protocols) | NUM ] Default: tcp
+#
+protocol = tcp
+
+# Option:  getcmd
+# Notes.:  A command to fetch a URL. Should output page to STDOUT
+# Values:  CMD  Default: wget
+#
+getcmd = wget --no-verbose --tries=3 --waitretry=10 --connect-timeout=10 --read-timeout=60 --retry-connrefused --output-document=- --user-agent=Fail2Ban
+# Alternative value:
+# getcmd = curl --silent --show-error --retry 3 --connect-timeout 10 --max-time 60 --user-agent Fail2Ban
+
+# Option:  srcport
+# Notes.:  The source port of the attack. You're unlikely to have this info, so
+#          you can leave the default
+# Values:  [ NUM ]  Default: 0
+#
+srcport = 0
+
+# Option:  mnwurl
+# Notes.:  The report service URL on the mNW site
+# Values:  STRING  Default: http://mynetwatchman.com/insertwebreport.asp
+#
+mnwurl = http://mynetwatchman.com/insertwebreport.asp
+
+# Option:  tmpfile
+# Notes.:  Base name of temporary files
+# Values:  [ STRING ]  Default: /tmp/fail2ban-mynetwatchman
+#
+tmpfile = /var/run/fail2ban/tmp-mynetwatchman
@@ -0,0 +1,105 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 701 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Output will be buffered until <lines> lines are available.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = if [ -f <tmpfile> ]; then
+                 printf %%b "Subject: [Fail2Ban] <name>: summary
+                 From: Fail2Ban <<sender>>
+                 To: <dest>\n
+                 Hi,\n
+                 These hosts have been banned by Fail2Ban.\n
+                 `cat <tmpfile>`
+                 Regards,\n
+                 Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+                 rm <tmpfile>
+             fi
+             printf %%b "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
+            LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
+            if [ $LINE -ge <lines> ]; then
+                printf %%b "Subject: [Fail2Ban] <name>: summary
+                From: Fail2Ban <<sender>>
+                To: <dest>\n
+                Hi,\n
+                These hosts have been banned by Fail2Ban.\n
+                `cat <tmpfile>`
+                Regards,\n
+                Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+                rm <tmpfile>
+            fi
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
+# Default number of lines that are buffered
+#
+lines = 5
+
+# Default temporary file
+#
+tmpfile = /var/run/fail2ban/tmp-mail.txt
+
@@ -0,0 +1,88 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 660 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+            From: Fail2Ban <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n
+            `/usr/bin/whois <ip>`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `/bin/grep '\<<ip>\>' <logpath>`\n\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
+# Path to the log files which contain relevant lines for the abuser IP
+#
+logpath = /dev/null
+
@@ -0,0 +1,82 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 660 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+            From: Fail2Ban <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n
+            `/usr/bin/whois <ip>`\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
@@ -0,0 +1,80 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 660 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+            From: Fail2Ban <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
@@ -2,8 +2,16 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 661 $
 #
+# The default Shorewall configuration is with "BLACKLISTNEWONLY=Yes" (see
+# file /etc/shorewall/shorewall.conf). This means that when Fail2ban adds a
+# new shorewall rule to ban an IP address, that rule will affect only new
+# connections. So if the attempter goes on trying using the same connection
+# he could even log in. In order to get the same behavior of the iptable
+# action (so that the ban is immediate) the /etc/shorewall/shorewall.conf
+# file should me modified with "BLACKLISTNEWONLY=No".
+# 

 [Definition]

@@ -13,7 +21,7 @@
 #
 actionstart = 

-# Option:  actionend
+# Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
@@ -33,7 +41,7 @@ actioncheck =
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = shorewall reject <ip>
+actionban = shorewall drop <ip>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 629 $
 #

 [Definition]
@@ -28,7 +28,7 @@ logtarget = /var/log/fail2ban.log
 # Notes.: Set the socket file. This is used to communicate with the daemon. Do
 #         not remove this file when Fail2ban runs. It will not be possible to
 #         communicate with the server afterwards.
-# Values: FILE  Default:  /tmp/fail2ban.sock
+# Values: FILE  Default:  /var/run/fail2ban/fail2ban.sock
 #
-socket = /tmp/fail2ban.sock
+socket = /var/run/fail2ban/fail2ban.sock

@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 728 $
 #

 [Definition]
@@ -11,7 +11,7 @@
 # Notes.:  regex to match the password failure messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
 failregex = [[]client <HOST>[]] user .* authentication failure
@@ -5,10 +5,12 @@
 #
 # Author: Yaroslav Halchenko
 #
+# $Revision: 668 $
+#

 [Definition]

-badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02
+badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider
 badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|DataCha0s/2\.0|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|MVAClient|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|sogou spider|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|WebVulnCrawl\.blogspot\.com/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00

 # Option:  failregex
@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Yaroslav O. Halchenko <debian@onerussian.com>
+#
+# $Revision: 716 $
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match failures to find a home directory on a server, which
+#          became popular last days. Most often attacker just uses IP instead of
+#          domain name -- so expect to see them in generic error.log if you have
+#          per-domain log files.
+# Values:  TEXT
+#
+failregex = [[]client <HOST>[]] File does not exist: .*/~.*
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 728 $
 #

 [Definition]
@@ -11,10 +11,11 @@
 # Notes.:  regex to match the password failure messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = [[]client <HOST>[]] File does not exist: .*(\.php|\.asp)
+failregex = [[]client <HOST>[]] (File does not exist|script not found or unable to stat): /\S*(\.php|\.asp|\.exe|\.pl)
+            [[]client <HOST>[]] script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat *$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -0,0 +1,20 @@
+# Fail2Ban configuration file
+#
+# Author: Tim Connors
+#
+# $Revision: 668 $
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  Regexp to catch Apache overflow attempts.
+# Values:  TEXT
+#
+failregex = [[]client <HOST>[]] (Invalid (method|URI) in request|request failed: URI too long|erroneous characters after protocol string)
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex =
@@ -0,0 +1,41 @@
+# Generic configuration items (to be used as interpolations) in other
+# filters  or actions configurations
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision: 728 $
+#
+
+[INCLUDES]
+
+# Load customizations if any available
+after = common.local
+
+
+[DEFAULT]
+
+# Daemon definition is to be specialized (if needed) in .conf file
+_daemon = \S*
+
+#
+# Shortcuts for easier comprehension of the failregex
+#
+# PID.
+# EXAMPLES: [123]
+__pid_re = (?:\[\d+\])
+
+# Daemon name (with optional source_file:line or whatever)
+# EXAMPLES: pam_rhosts_auth, [sshd], pop(pam_unix)
+__daemon_re = [\[\(]?%(_daemon)s(?:\(\S+\))?[\]\)]?:?
+
+# Combinations of daemon name and PID
+# EXAMPLES: sshd[31607], pop(pam_unix)[4920]
+__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
+
+#
+# Common line prefixes (beginnings) which could be used in filters
+#
+#       [hostname] [vserver tag] daemon_id spaces
+# this can be optional (for instance if we match named native log files)
+__prefix_line = \s*(?:\S+ )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*
+
@@ -3,7 +3,7 @@
 # Author: Christoph Haas
 # Modified by: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 728 $
 #

 [Definition]
@@ -12,7 +12,7 @@
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
 failregex = LOGIN FAILED, .*, ip=\[<HOST>\]$
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 728 $
 #

 [Definition]
@@ -11,7 +11,7 @@
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
 failregex = error,relay=<HOST>,.*550 User unknown
@@ -0,0 +1,26 @@
+# Fail2Ban configuration file
+#
+# Author: Jan Wagner <waja@cyconet.org>
+#
+# $Revision: 728 $
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values:  TEXT
+#
+failregex = : badlogin: .*\[<HOST>\] plaintext .*SASL\(-13\): authentication failure: checkpass failed$
+	    : badlogin: .*\[<HOST>\] LOGIN \[SASL\(-13\): authentication failure: checkpass failed\]$
+	    : badlogin: .*\[<HOST>\] (?:CRAM-MD5|NTLM) \[SASL\(-13\): authentication failure: incorrect (?:digest|NTLM) response\]$
+	    : badlogin: .*\[<HOST>\] DIGEST-MD5 \[SASL\(-13\): authentication failure: client response doesn't match what we generated\]$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -0,0 +1,23 @@
+# Fail2Ban configuration file for dovcot
+#
+# Author: Martin Waschbuesch
+#
+# $Revision: $
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values:  TEXT
+#
+failregex = .*(?:pop3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -0,0 +1,52 @@
+# Fail2Ban configuration file
+#
+# Author: Francis Russell
+#         Zak B. Elep
+#
+# $Revision$
+#
+# More information: http://bugs.debian.org/546913
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+
+[Definition]
+
+_daemon = dropbear
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+
+# These match the unmodified dropbear messages. It isn't possible to
+# match the source of the 'exit before auth' messages from dropbear.
+#
+failregex = ^%(__prefix_line)slogin attempt for nonexistent user ('.*' )?from <HOST>:.*\s*$
+            ^%(__prefix_line)sbad password attempt for .+ from <HOST>:.*\s*$
+
+# The only line we need to match with the modified dropbear.
+
+# NOTE: The failregex below is ONLY intended to work with a patched
+# version of Dropbear as described here:
+# http://www.unchartedbackwaters.co.uk/pyblosxom/static/patches
+#
+# The standard Dropbear output doesn't provide enough information to
+# ban all types of attack.  The Dropbear patch adds IP address
+# information to the 'exit before auth' message which is always
+# produced for any form of non-successful login. It is that message
+# which this file matches.
+
+# failregex = ^%(__prefix_line)sexit before auth from <HOST>.*\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 728 $
 #

 [Definition]
@@ -11,7 +11,7 @@
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
 failregex = \[<HOST>\] .*(?:rejected by local_scan|Unrouteable address)
@@ -0,0 +1,20 @@
+# Fail2Ban configuration file for wuftpd
+#
+# Author: Kevin Zembower (copied from wsftpd.conf)
+#
+# $Revision: 699 $
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = ftpd(?:\[\d+\])?:\s+repeated login failures from <HOST> \(\S+\)$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -0,0 +1,18 @@
+# Fail2Ban configuration file
+#
+# Author: Arturo 'Buanzo' Busleiman <buanzo@buanzo.com.ar>
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match ALERTS as notified by lighttpd's FastCGI Module
+# Values:  TEXT
+#
+failregex = .*ALERT\ -\ .*attacker\ \'<HOST>\'
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -0,0 +1,35 @@
+# Fail2Ban configuration file for named (bind9). Trying to generalize the
+#          structure which is general to capture general patterns in log
+#          lines to cover different configurations/distributions
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision: 730 $
+#
+
+[Definition]
+
+# 
+# Daemon name
+_daemon=named
+
+#
+# Shortcuts for easier comprehension of the failregex
+__pid_re=(?:\[\d+\])
+__daemon_re=\(?%(_daemon)s(?:\(\S+\))?\)?:?
+__daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
+#       hostname       daemon_id         spaces
+# this can be optional (for instance if we match named native log files)
+__line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = %(__line_prefix)sclient <HOST>#.+: query(?: \(cache\))? '.*' denied\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -0,0 +1,31 @@
+# Fail2Ban configuration file for generic PAM authentication errors
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision:  $
+#
+
+[Definition]
+
+# if you want to catch only login erros from specific daemons, use smth like
+#_ttys_re=(?:ssh|pure-ftpd|ftp)
+# To catch all failed logins
+_ttys_re=\S*
+
+#
+# Shortcuts for easier comprehension of the failregex
+__pid_re=(?:\[\d+\])
+__pam_re=\(?pam_unix(?:\(\S+\))?\)?:?
+__pam_combs_re=(?:%(__pid_re)s?:\s+%(__pam_re)s|%(__pam_re)s%(__pid_re)s?:)
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = \s\S+ \S+%(__pam_combs_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=%(_ttys_re)s ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Arturo 'Buanzo' Busleiman <buanzo@buanzo.com.ar>
+# Version 2
+# fixes the failregex so REFERERS that contain =http:// don't get blocked
+# (mentioned by "fasuto" (no real email provided... blog comment) in this entry:
+# http://blogs.buanzo.com.ar/2009/04/fail2ban-filter-for-php-injection-attacks.html#comment-1489
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match this kind of request:
+#
+# 66.185.212.172 - - [26/Mar/2009:08:44:20 -0500] "GET /index.php?n=http://eatmyfood.hostinginfive.com/pizza.htm? HTTP/1.1" 200 114 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
+#
+failregex = ^<HOST> -.*"(GET|POST).*\?.*\=http\:\/\/.* HTTP\/.*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 728 $
 #

 [Definition]
@@ -11,7 +11,7 @@
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
 failregex = reject: RCPT from (.*)\[<HOST>\]: 554
@@ -2,7 +2,7 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
+# $Revision: 728 $
 #

 [Definition]
@@ -11,10 +11,13 @@
 # Notes.: regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values: TEXT
 #
-failregex = USER \S+: no such user found from \S* ?\[<HOST>\] to \S+\s*$
+failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+ *$
+            \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): .*$
+            \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\. *$
+            \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -16,10 +16,10 @@ __errmsg = (?:Authentication failed for user|Erreur d'authentification pour l'ut
 # Notes.: regex to match the password failures messages in the logfile. The
 #         host must be matched by a group named "host". The tag "<HOST>" can
 #         be used for standard IP/hostname matching and is only an alias for
-#         (?:::f{4,6}:)?(?P<host>\S+)
+#         (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values: TEXT
 #
-failregex = pure-ftpd: (.+?@<HOST>) \[WARNING\] %(__errmsg)s \[.+\]$
+failregex = pure-ftpd(?:\[\d+\])?: \(.+?@<HOST>\) \[WARNING\] %(__errmsg)s \[.+\]\s*$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 728 $
 #

 [Definition]
@@ -11,7 +11,7 @@
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
 failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip )<HOST>
@@ -2,7 +2,7 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
+# $Revision: 728 $
 #

 [Definition]
@@ -11,10 +11,10 @@
 # Notes.: regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values: TEXT
 #
-failregex = : warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
+failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -0,0 +1,22 @@
+# Fail2Ban configuration file
+#
+# Author: Jan Wagner <waja@cyconet.org>
+#
+# $Revision: 727 $
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching.
+# Values: TEXT
+#
+failregex = : badlogin: .*\[<HOST>\] (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failure$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -2,7 +2,7 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
+# $Revision: 728 $
 #

 [Definition]
@@ -11,10 +11,10 @@
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = sshd\[\S*\]: Did not receive identification string from <HOST>
+failregex = sshd(?:\[\d+\])?: Did not receive identification string from <HOST>$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -2,22 +2,37 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 728 $
 #

+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+
 [Definition]

+_daemon = sshd
+
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = Authentication failure for .* from <HOST>
-            Failed [-/\w]+ for .* from <HOST>
-            ROOT LOGIN REFUSED .* FROM <HOST>
-            [iI](?:llegal|nvalid) user .* from <HOST>
+failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
+            ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
+            ^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
+            ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
+            ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
+            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$
+            ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
+            ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
+            ^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\s*$
+            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 728 $
 #

 [Definition]
@@ -11,11 +11,11 @@
 # Notes.: regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values: TEXT
 #
-failregex = vsftpd: .* authentication failure; .* rhost=<HOST>$
-            \[.+\] FAIL LOGIN: Client "<HOST>"$
+failregex = vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=<HOST>(?:\s+user=\S*)?\s*$
+            \[.+\] FAIL LOGIN: Client "<HOST>"\s*$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -0,0 +1,28 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Rule by : Delvit Guillaume
+#
+# $Revision: 728 $
+#
+
+[Definition]
+
+# patern :      webmin[15673]: Non-existent login as toto from 86.0.6.217
+#               webmin[29544]: Invalid login as root from 86.0.6.217
+#
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values:  TEXT
+#
+failregex = webmin.* Non-existent login as .+ from <HOST>$
+            webmin.* Invalid login as .+ from <HOST>$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -2,7 +2,7 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision:  $
+# $Revision: 699 $
 #

 [Definition]
@@ -11,4 +11,10 @@
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT
 #
-failregex = wu-ftpd\[\d+\]:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>
+failregex = wu-ftpd(?:\[\d+\])?:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -0,0 +1,30 @@
+# Fail2Ban configuration file
+#
+# Author: Guido Bozzetto
+#
+# $Revision: 728 $
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values:  TEXT
+#
+# Cfr.: /var/log/(daemon\.|sys)log
+# libwrap => tcp wrappers: hosts.(allow|deny)
+# address => xinetd: deny_from|only_from
+# load => xinetd: max_load (temporary problem)
+#
+
+failregex = xinetd(?:\[\d{1,5}\])?: FAIL: \S+ address from=<HOST>$
+            xinetd(?:\[\d{1,5}\])?: FAIL: \S+ libwrap from=<HOST>$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -2,10 +2,10 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
+# $Revision: 747 $
 #

-# The DEFAULT allows a global definition of the options. They can be override
+# The DEFAULT allows a global definition of the options. They can be overridden
 # in each jail afterwards.

 [DEFAULT]
@@ -13,7 +13,7 @@
 # "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
 # ban a host which matches an address in this list. Several addresses can be
 # defined using space separator.
-ignoreip = 127.0.0.1
+ignoreip = 127.0.0.1/8

 # "bantime" is the number of seconds that a host is banned.
 bantime  = 600
@@ -45,7 +45,7 @@ backend = auto
 enabled  = false
 filter   = sshd
 action   = iptables[name=SSH, port=ssh, protocol=tcp]
-           mail-whois[name=SSH, dest=yourmail@mail.com]
+           sendmail-whois[name=SSH, dest=you@example.com, sender=fail2ban@example.com]
 logpath  = /var/log/sshd.log
 maxretry = 5

@@ -54,7 +54,7 @@ maxretry = 5
 enabled  = false
 filter   = proftpd
 action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
-           mail-whois[name=ProFTPD, dest=yourmail@mail.com]
+           sendmail-whois[name=ProFTPD, dest=you@example.com]
 logpath  = /var/log/proftpd/proftpd.log
 maxretry = 6

@@ -66,7 +66,7 @@ enabled  = false
 filter   = sasl
 backend  = polling
 action   = iptables[name=sasl, port=smtp, protocol=tcp]
-           mail-whois[name=sasl, dest=yourmail@mail.com]
+           sendmail-whois[name=sasl, dest=you@example.com]
 logpath  = /var/log/mail.log

 # Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
@@ -77,7 +77,7 @@ logpath  = /var/log/mail.log
 enabled     = false
 filter      = sshd
 action      = hostsdeny
-              mail-whois[name=SSH, dest=yourmail@mail.com]
+              sendmail-whois[name=SSH, dest=you@example.com]
 ignoreregex = for myuser from
 logpath     = /var/log/sshd.log

@@ -89,8 +89,8 @@ logpath     = /var/log/sshd.log
 enabled  = false
 filter	 = apache-auth
 action   = hostsdeny
-logpath  = /var/log/apache*/*access.log
-           /home/www/myhomepage/access.log
+logpath  = /var/log/apache*/*error.log
+           /home/www/myhomepage/error.log
 maxretry = 6

 # The hosts.deny path can be defined with the "file" argument if it is
@@ -101,7 +101,7 @@ maxretry = 6
 enabled  = false
 filter   = postfix
 action   = hostsdeny[file=/not/a/standard/path/hosts.deny]
-           mail[name=Postfix, dest=yourmail@mail.com]
+           sendmail[name=Postfix, dest=you@example.com]
 logpath  = /var/log/postfix.log
 bantime  = 300

@@ -112,7 +112,7 @@ bantime  = 300

 enabled  = false
 filter   = vsftpd
-action   = mail-whois[name=VSFTPD, dest=yourmail@mail.com]
+action   = sendmail-whois[name=VSFTPD, dest=you@example.com]
 logpath  = /var/log/vsftpd.log
 maxretry = 5
 bantime  = 1800
@@ -124,7 +124,7 @@ bantime  = 1800
 enabled  = false
 filter   = vsftpd
 action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
-           mail-whois[name=VSFTPD, dest=yourmail@mail.com]
+           sendmail-whois[name=VSFTPD, dest=you@example.com]
 logpath  = /var/log/vsftpd.log
 maxretry = 5
 bantime  = 1800
@@ -137,7 +137,7 @@ bantime  = 1800
 enabled  = false
 filter   = apache-badbots
 action   = iptables-multiport[name=BadBots, port="http,https"]
-           mail-buffered[name=BadBots, lines=5, dest=yourmail@mail.com]
+           sendmail-buffered[name=BadBots, lines=5, dest=you@example.com]
 logpath  = /var/www/*/logs/access_log
 bantime  = 172800
 maxretry = 1
@@ -149,9 +149,37 @@ maxretry = 1
 enabled  = false
 filter   = apache-noscript
 action   = shorewall
-           mail[name=Postfix, dest=yourmail@mail.com]
+           sendmail[name=Postfix, dest=you@example.com]
 logpath  = /var/log/apache2/error_log

+# Ban attackers that try to use PHP's URL-fopen() functionality
+# through GET/POST variables. - Experimental, with more than a year
+# of usage in production environments.
+
+[php-url-fopen]
+
+enabled = false
+port    = http,https
+filter  = php-url-fopen
+logpath = /var/www/*/logs/access_log
+maxretry = 1
+
+# A simple PHP-fastcgi jail which works with lighttpd.
+# If you run a lighttpd server, then you probably will
+# find these kinds of messages in your error_log:
+# ALERT – tried to register forbidden variable ‘GLOBALS’
+# through GET variables (attacker '1.2.3.4', file '/var/www/default/htdocs/index.php')
+# This jail would block the IP 1.2.3.4.
+
+[lighttpd-fastcgi]
+
+enabled = false
+port    = http,https
+filter  = lighttpd-fastcgi
+# adapt the following two items as needed
+logpath = /var/log/lighttpd/error.log
+maxretry = 2
+
 # This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
 # option is overridden in this jail. Moreover, the action "mail-whois" defines
 # the variable "name" which contains a comma using "". The characters '' are
@@ -162,6 +190,52 @@ logpath  = /var/log/apache2/error_log
 enabled  = false
 filter   = sshd
 action   = ipfw[localhost=192.168.0.1]
-           mail-whois[name="SSH,IPFW", dest=yourmail@mail.com]
+           sendmail-whois[name="SSH,IPFW", dest=you@example.com]
 logpath  = /var/log/auth.log
 ignoreip = 168.192.0.1
+
+# These jails block attacks against named (bind9). By default, logging is off
+# with bind9 installation. You will need something like this:
+#
+# logging {
+#     channel security_file {
+#         file "/var/log/named/security.log" versions 3 size 30m;
+#         severity dynamic;
+#         print-time yes;
+#     };
+#     category security {
+#         security_file;
+#     };
+# };
+#
+# in your named.conf to provide proper logging.
+# This jail blocks UDP traffic for DNS requests.
+
+# !!! WARNING !!!
+#   Since UDP is connection-less protocol, spoofing of IP and imitation
+#   of illegal actions is way too simple.  Thus enabling of this filter
+#   might provide an easy way for implementing a DoS against a chosen
+#   victim. See
+#    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
+#   Please DO NOT USE this jail unless you know what you are doing.
+#
+# [named-refused-udp]
+#
+# enabled  = false
+# filter   = named-refused
+# action   = iptables-multiport[name=Named, port="domain,953", protocol=udp]
+#            sendmail-whois[name=Named, dest=you@example.com]
+# logpath  = /var/log/named/security.log
+# ignoreip = 168.192.0.1
+
+# This jail blocks TCP traffic for DNS requests.
+
+[named-refused-tcp]
+
+enabled  = false
+filter   = named-refused
+action   = iptables-multiport[name=Named, port="domain,953", protocol=tcp]
+           sendmail-whois[name=Named, dest=you@example.com]
+logpath  = /var/log/named/security.log
+ignoreip = 168.192.0.1
+
@@ -17,16 +17,16 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 672 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 672 $"
+__date__ = "$Date: 2008-03-06 00:18:06 +0100 (Thu, 06 Mar 2008) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

 import sys, string, os, pickle, re, logging, signal
-import getopt, time, readline, shlex, socket
+import getopt, time, shlex, socket

 # Inserts our own modules path first in the list
 # fix for bug #343821
@@ -48,7 +48,8 @@ logSys = logging.getLogger("fail2ban.client")

 class Fail2banClient:

-	prompt = "fail2ban> "
+	SERVER = "fail2ban-server"
+	PROMPT = "fail2ban> "

 	def __init__(self):
 		self.__argv = None
@@ -65,11 +66,11 @@ class Fail2banClient:
 	def dispVersion(self):
 		print "Fail2Ban v" + version
 		print
-		print "Copyright (c) 2004-2006 Cyril Jaquier"
+		print "Copyright (c) 2004-2008 Cyril Jaquier"
 		print "Copyright of modifications held by their respective authors."
 		print "Licensed under the GNU General Public License v2 (GPL)."
 		print
-		print "Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>."
+		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
 		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
 	
 	def dispUsage(self):
@@ -97,7 +98,7 @@ class Fail2banClient:
 		printFormatted()
 		
 		print
-		print "Report bugs to <lostcontrol@users.sourceforge.net>"
+		print "Report bugs to <cyril.jaquier@fail2ban.org>"
 	
 	def dispInteractive(self):
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
@@ -208,6 +209,19 @@ class Fail2banClient:
 			else:
 				logSys.error("Could not find server")
 				return False
+		elif len(cmd) == 2 and cmd[0] == "reload":
+			if self.__ping():
+				jail = cmd[1]
+				ret = self.__readJailConfig(jail)
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
+				self.__processCmd([['stop', jail]], False)
+				# Configure the server
+				return self.__processCmd(self.__stream, False)
+			else:
+				logSys.error("Could not find server")
+				return False
 		else:
 			return self.__processCmd([cmd])
 	
@@ -222,7 +236,7 @@ class Fail2banClient:
 		pid = os.fork()
 		if pid == 0:
 			args = list()
-			args.append("fail2ban-server")
+			args.append(self.SERVER)
 			# Start in background mode.
 			args.append("-b")
 			# Set the socket path.
@@ -232,14 +246,15 @@ class Fail2banClient:
 			if force:
 				args.append("-x")
 			try:
-				# Use the PATH env
-				os.execvp("fail2ban-server", args)
+				# Use the current directory.
+				exe = os.path.abspath(os.path.join(sys.path[0], self.SERVER))
+				os.execv(exe, args)
 			except OSError:
 				try:
-					# Use the current directory
-					os.execv("fail2ban-server", args)
+					# Use the PATH env.
+					os.execvp(self.SERVER, args)
 				except OSError:
-					print "Could not find fail2ban-server"
+					print "Could not find %s" % self.SERVER
 					os.exit(-1)
 						
 			
@@ -325,6 +340,11 @@ class Fail2banClient:
 		
 		# Interactive mode
 		if self.__conf["interactive"]:
+			try:
+				import readline
+			except ImportError:
+				logSys.error("Readline not available")
+				return False
 			try:
 				ret = True
 				if len(args) > 0:
@@ -333,7 +353,7 @@ class Fail2banClient:
 					readline.parse_and_bind("tab: complete")
 					self.dispInteractive()
 					while True:
-						cmd = raw_input(self.prompt)
+						cmd = raw_input(self.PROMPT)
 						if cmd == "exit" or cmd == "quit":
 							# Exit
 							return True
@@ -352,16 +372,24 @@ class Fail2banClient:
 	def __readConfig(self):
 		# Read the configuration
 		self.__configurator.readAll()
-		ret = self.__configurator.getAllOptions()
+		ret = self.__configurator.getOptions()
 		self.__configurator.convertToProtocol()
 		self.__stream = self.__configurator.getConfigStream()
 		return ret
 	
-	@staticmethod
+	def __readJailConfig(self, jail):
+		self.__configurator.readAll()
+		ret = self.__configurator.getOptions(jail)
+		self.__configurator.convertToProtocol()
+		self.__stream = self.__configurator.getConfigStream()
+		return ret
+	
+	#@staticmethod
 	def dumpConfig(cmd):
 		for c in cmd:
 			print c
 		return True
+	dumpConfig = staticmethod(dumpConfig)


 class ServerExecutionException(Exception):
@@ -17,11 +17,11 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 672 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 672 $"
+__date__ = "$Date: 2008-03-06 00:18:06 +0100 (Thu, 06 Mar 2008) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -31,11 +31,11 @@ import getopt, sys, time, logging, os
 # fix for bug #343821
 sys.path.insert(1, "/usr/share/fail2ban")

-from ConfigParser import SafeConfigParser
+from client.configparserinc import SafeConfigParserWithIncludes
 from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
 from common.version import version
 from server.filter import Filter
-from server.regex import RegexException
+from server.failregex import RegexException

 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.regex")
@@ -65,9 +65,12 @@ class RegexStat:
 class Fail2banRegex:
 	
 	test = None
-	
+
+	CONFIG_DEFAULTS = {'configpath' : "/etc/fail2ban/"}
+
 	def __init__(self):
 		self.__filter = Filter(None)
+		self.__ignoreregex = list()
 		self.__failregex = list()
 		# Setup logging
 		logging.getLogger("fail2ban").handlers = []
@@ -79,20 +82,21 @@ class Fail2banRegex:
 		logging.getLogger("fail2ban").addHandler(self.__hdlr)
 		logging.getLogger("fail2ban").setLevel(logging.ERROR)
 	
-	@staticmethod
+	#@staticmethod
 	def dispVersion():
 		print "Fail2Ban v" + version
 		print
-		print "Copyright (c) 2004-2006 Cyril Jaquier"
+		print "Copyright (c) 2004-2008 Cyril Jaquier"
 		print "Copyright of modifications held by their respective authors."
 		print "Licensed under the GNU General Public License v2 (GPL)."
 		print
-		print "Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>."
+		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
 		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+	dispVersion = staticmethod(dispVersion)
 	
-	@staticmethod
+	#@staticmethod
 	def dispUsage():
-		print "Usage: "+sys.argv[0]+" [OPTIONS] <LOG> <REGEX>"
+		print "Usage: "+sys.argv[0]+" [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]"
 		print
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
@@ -111,7 +115,12 @@ class Fail2banRegex:
 		print "    string                  a string representing a 'failregex'"
 		print "    filename                path to a filter file (filter.d/sshd.conf)"
 		print
-		print "Report bugs to <lostcontrol@users.sourceforge.net>"
+		print "IgnoreRegex:"
+		print "    string                  a string representing an 'ignoreregex'"
+		print "    filename                path to a filter file (filter.d/sshd.conf)"
+		print
+		print "Report bugs to <cyril.jaquier@fail2ban.org>"
+	dispUsage = staticmethod(dispUsage)
 	
 	def getCmdLineOptions(self, optList):
 		""" Gets the command line options
@@ -124,13 +133,43 @@ class Fail2banRegex:
 				self.dispVersion()
 				sys.exit(0)

-	@staticmethod
+	#@staticmethod
 	def logIsFile(value):
 		return os.path.isfile(value)
+	logIsFile = staticmethod(logIsFile)
+
+	def readIgnoreRegex(self, value):
+		if os.path.isfile(value):
+			reader = SafeConfigParserWithIncludes(defaults=self.CONFIG_DEFAULTS)
+			try:
+				reader.read(value)
+				print "Use ignoreregex file : " + value
+				self.__ignoreregex = [RegexStat(m)
+									for m in reader.get("Definition", "ignoreregex").split('\n')]
+			except NoSectionError:
+				print "No [Definition] section in " + value
+				print
+				return False
+			except NoOptionError:
+				print "No failregex option in " + value
+				print
+				return False
+			except MissingSectionHeaderError:
+				print "No section headers in " + value
+				print
+				return False
+		else:
+			if len(value) > 53:
+				stripReg = value[0:50] + "..."
+			else:
+				stripReg = value
+			print "Use ignoreregex line : " + stripReg
+			self.__ignoreregex = [RegexStat(value)]
+		return True

 	def readRegex(self, value):
 		if os.path.isfile(value):
-			reader = SafeConfigParser()
+			reader = SafeConfigParserWithIncludes(defaults=self.CONFIG_DEFAULTS)
 			try:
 				reader.read(value)
 				print "Use regex file : " + value
@@ -157,14 +196,33 @@ class Fail2banRegex:
 			self.__failregex = [RegexStat(value)]
 		return True
 	
+	def testIgnoreRegex(self, line):
+		found = False
+		for regex in self.__ignoreregex:
+			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
+			try:
+				self.__filter.addIgnoreRegex(regex.getFailRegex())
+				try:
+					ret = self.__filter.ignoreLine(line)
+					if ret:
+						regex.inc()
+				except RegexException, e:
+					print e
+					return False
+			finally:
+				self.__filter.delIgnoreRegex(0)
+				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
+	
 	def testRegex(self, line):
 		found = False
+		for regex in self.__ignoreregex:
+			self.__filter.addIgnoreRegex(regex.getFailRegex())
 		for regex in self.__failregex:
 			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
 			try:
 				self.__filter.addFailRegex(regex.getFailRegex())
 				try:
-					ret = self.__filter.findFailure(line)
+					ret = self.__filter.processLine(line)
 					if not len(ret) == 0:
 						if found == True:
 							ret[0].append(True)
@@ -182,6 +240,8 @@ class Fail2banRegex:
 			finally:
 				self.__filter.delFailRegex(0)
 				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
+		for regex in self.__ignoreregex:
+					self.__filter.delIgnoreRegex(0)
 	
 	def printStats(self):
 		print
@@ -191,25 +251,51 @@ class Fail2banRegex:
 		
 		# Print title
 		cnt = 1
-		print "Failregex:"
+		print "Failregex"
+		print "|- Regular expressions:"
 		for failregex in self.__failregex:
-			print "[" + str(cnt) + "] " + failregex.getFailRegex()
+			print "|  [" + str(cnt) + "] " + failregex.getFailRegex()
 			cnt += 1
+		cnt = 1
 		
-		print
+		print "|"
 		
 		# Print stats
 		cnt = 1
 		total = 0
-		print "Number of matches:"
+		print "`- Number of matches:"
 		for failregex in self.__failregex:
 			match = failregex.getStats()
 			total += match
-			print "[" + str(cnt) + "] " + str(match) + " match(es)"
+			print "   [" + str(cnt) + "] " + str(match) + " match(es)"
 			cnt += 1
 		
 		print
 		
+		# Print title
+		cnt = 1
+		print "Ignoreregex"
+		print "|- Regular expressions:"
+		for failregex in self.__ignoreregex:
+			print "|  [" + str(cnt) + "] " + failregex.getFailRegex()
+			cnt += 1
+		cnt = 1
+		
+		print "|"
+		
+		# Print stats
+		cnt = 1
+		print "`- Number of matches:"
+		for failregex in self.__ignoreregex:
+			match = failregex.getStats()
+			print "   [" + str(cnt) + "] " + str(match) + " match(es)"
+			cnt += 1
+		
+		print
+		print "Summary"
+		print "======="
+		print
+		
 		if total == 0:
 			print "Sorry, no match"
 			print
@@ -236,7 +322,7 @@ class Fail2banRegex:
 			
 			print "Date template hits:"
 			for template in self.__filter.dateDetector.getTemplates():
-				print `template.getHits()` + " hit: " + template.getName()
+				print `template.getHits()` + " hit(s): " + template.getName()
 			
 			print
 			
@@ -260,7 +346,7 @@ if __name__ == "__main__":
 	# Process command line
 	fail2banRegex.getCmdLineOptions(optList)
 	# We need exactly 3 parameters
-	if not len(sys.argv) == 3:
+	if not len(sys.argv) in (3, 4):
 		fail2banRegex.dispUsage()
 		sys.exit(-1)
 	else:
@@ -269,6 +355,10 @@ if __name__ == "__main__":
 		print "============="
 		print

+		if len(sys.argv) == 4:
+			if fail2banRegex.readIgnoreRegex(sys.argv[3]) == False:
+				sys.exit(-1)
+
 		if fail2banRegex.readRegex(sys.argv[2]) == False:
 			sys.exit(-1)

@@ -278,6 +368,7 @@ if __name__ == "__main__":
 				print "Use log file   : " + sys.argv[1]
 				print
 				for line in hdlr:
+					fail2banRegex.testIgnoreRegex(line)
 					fail2banRegex.testRegex(line)
 			except IOError, e:
 				print e
@@ -290,6 +381,7 @@ if __name__ == "__main__":
 				stripLog = sys.argv[1]
 			print "Use single line: " + stripLog
 			print
+			fail2banRegex.testIgnoreRegex(sys.argv[1])
 			fail2banRegex.testRegex(sys.argv[1])
 		
 		if fail2banRegex.printStats():
@@ -17,15 +17,15 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 672 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 672 $"
+__date__ = "$Date: 2008-03-06 00:18:06 +0100 (Thu, 06 Mar 2008) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

-import getopt, sys
+import getopt, sys, logging

 # Inserts our own modules path first in the list
 # fix for bug #343821
@@ -34,6 +34,9 @@ sys.path.insert(1, "/usr/share/fail2ban")
 from common.version import version
 from server.server import Server

+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
 ##
 # \mainpage Fail2Ban
 #
@@ -50,16 +53,16 @@ class Fail2banServer:
 		self.__conf = dict()
 		self.__conf["background"] = True
 		self.__conf["force"] = False
-		self.__conf["socket"] = "/tmp/fail2ban.sock"
+		self.__conf["socket"] = "/var/run/fail2ban/fail2ban.sock"
 	
 	def dispVersion(self):
 		print "Fail2Ban v" + version
 		print
-		print "Copyright (c) 2004-2006 Cyril Jaquier"
+		print "Copyright (c) 2004-2008 Cyril Jaquier"
 		print "Copyright of modifications held by their respective authors."
 		print "Licensed under the GNU General Public License v2 (GPL)."
 		print
-		print "Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>."
+		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
 		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
 	
 	def dispUsage(self):
@@ -82,7 +85,7 @@ class Fail2banServer:
 		print "    -h, --help           display this help message"
 		print "    -V, --version        print the version"
 		print
-		print "Report bugs to <lostcontrol@users.sourceforge.net>"
+		print "Report bugs to <cyril.jaquier@fail2ban.org>"
 	
 	def __getCmdLineOptions(self, optList):
 		""" Gets the command line options
@@ -123,7 +126,7 @@ class Fail2banServer:
 			self.__server.start(self.__conf["socket"], self.__conf["force"])
 			return True
 		except Exception, e:
-			print e
+			logSys.exception(e)
 			self.__server.quit()
 			return False
 		
@@ -17,11 +17,11 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 522 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 522 $"
+__date__ = "$Date: 2007-01-21 23:19:57 +0100 (Sun, 21 Jan 2007) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -4,7 +4,7 @@
             |_| \__,_|_|_/___|_.__/\__,_|_||_|

 =============================================================
-Fail2Ban (version 0.7.7)                           2007/??/??
+Fail2Ban (version 0.8.2)                           2008/03/06
 =============================================================

 Cacti is a graphing solution using RRDTool. It is possible to
@@ -13,7 +13,7 @@ use Cacti to display statistics about Fail2ban.
 Installation:
 -------------

-1/ Install Fail2ban version 0.7 or higher and ensure that it
+1/ Install Fail2ban version 0.8 or higher and ensure that it
   works properly.
 2/ The user running poller.php must have read and write
   access to the socket used by Fail2ban.
@@ -30,7 +30,7 @@ appreciate this program, you can contact me at:

 Website: http://www.fail2ban.org

-Cyril Jaquier: <lostcontrol@users.sourceforge.net>
+Cyril Jaquier: <cyril.jaquier@fail2ban.org>

 License:
 --------
@@ -25,7 +25,7 @@
 #
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 527 $

 FAIL2BAN="fail2ban-client"

@@ -17,7 +17,7 @@
 #
 # Author: Sireyessire, Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 559 $

 opts="start stop restart reload showlog"

@@ -0,0 +1,19 @@
+/Library/LaunchDaemonsm/org.fail2ban.plist
+===================================
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+        <key>Disabled</key>
+        <false/>
+        <key>Label</key>
+        <string>fail2ban</string>
+        <key>ProgramArguments</key>
+        <array>
+                <string>/usr/local/bin/fail2ban-client</string>
+                <string>start</string>
+        </array>
+        <key>RunAtLoad</key>
+        <true/>
+</dict>
+</plist>
@@ -0,0 +1,106 @@
+#!/bin/bash
+#
+# Usage: ./check_fail2ban
+###############################################################################################
+# Description: 
+#		This plugin will check the status of Fail2ban.  
+#
+# Created:      2008-10-25 (Sebastian Mueller)
+#
+# Changes:      2008-10-26 fixed some issues (Sebastian Mueller)
+# Changes:      2009-01-25 add the second check, when server is not replying and the
+#		process is hang-up (Sebastian Mueller)
+#
+# please visit my website http://www.elchtest.eu or my personal WIKI http://wiki.elchtest.eu
+#
+################################################################################################
+# if you have any questions, send a mail to linux@krabbe-offline.de 
+#
+# this script is for my personal use. read the script before running/using it!!!
+#
+#
+# YOU HAVE BEEN WARNED. THIS MAY DESTROY YOUR MACHINE. I ACCEPT NO RESPONSIBILITY.
+###############################################################################################
+
+
+SECOND_CHECK=0 
+STATE_OK=0
+STATE_CRITICAL=2
+
+######################################################################
+# Read the Status from fail2ban-client 
+######################################################################
+check_processes_fail2ban()
+{
+        
+  F2B=`sudo -u root fail2ban-client ping | awk -F " " '{print $3}'`
+  exit_fail2ban=0
+
+  if  [[ $F2B = "pong" ]]; then
+   exit_fail2ban=$STATE_OK
+ else
+ exit_fail2ban=$STATE_CRITICAL
+ fi
+
+}
+######################################################################
+# first check in the Background, PID will be killed when no response
+# after 10 seconds, might be possible, otherwise the scipt will be
+# pressent in your memory all the time
+#
+######################################################################
+
+check_processes_fail2ban &
+pid=$!
+
+typeset -i i=0
+while ps $pid >/dev/null
+do
+ sleep 1
+ i=$i+1
+if [ $i -ge 10 ]
+ then
+ kill $pid 
+   SECOND_CHECK=1
+   exit_fail2ban=$STATE_CRITICAL
+   break
+fi
+done
+
+######################################################################
+# when the Server response (doesent mean the FAIL2BAN is working)
+# in the first step, then it will run again and test the Service 
+# and provide the real status
+######################################################################
+
+
+if [ $SECOND_CHECK -eq 0  ]; then
+  check_processes_fail2ban
+ elif [ $SECOND_CHECK -eq 1 ]; then
+  exit_fail2ban=$STATE_CRITICAL
+fi
+
+
+
+######################################################################
+# Mainmenu
+######################################################################
+
+
+final_exit=$exit_fail2ban
+if [ $final_exit -eq 0  ]; then
+  echo "SYSTEM OK - Fail2ban is working normaly"
+  exitstatus=$STATE_OK
+elif [ $final_exit -ne "0" ]; then
+  echo "SYSTEM WARNING - Fail2Ban is not working"
+######################################################################
+# If don't have a Nagios Server for monitoring, remove the comment and
+# add your Mail Addres. You can check it with a Cron Job once a hour.
+# put a txt file on your server and describe how to fix the issue, this 
+# could be attached to the mail.
+######################################################################
+#  mutt -s "FAIL2BAN NOT WORKING" your@example.com < /home/f2ban.txt
+
+  exitstatus=$STATE_CRITICAL
+fi
+exit $exitstatus
@@ -0,0 +1,18 @@
+It seems that Fail2ban is currently not working, please login and check
+
+HELP:
+
+1.) stop the Service
+/etc/init.d/fail2ban stop
+
+2.) delete the socket if avalible
+rm /tmp/fail2ban.sock
+
+3.) start the Service 
+/etc/init.d/fail2ban start
+
+4.) check if fail2ban is working
+fail2ban-client ping
+Answer should be "pong"
+
+5.) if the answer is not "pong" run away or  CRY FOR HELP ;-) 
@@ -20,14 +20,14 @@ FAIL2BAN="/usr/bin/fail2ban-client"
 RETVAL=0

 getpid() {
-    pid=`ps -ef | grep fail2ban-|grep -v grep|awk '{print $2}'`
+    pid=`ps -eo pid,comm | grep fail2ban- | awk '{ print $1 }'`
 }

 start() {
    echo -n $"Starting fail2ban: "
    getpid
    if [ -z "$pid" ]; then
-	rm -rf /tmp/fail2ban.sock # in case of unclean shutdown
+	rm -rf /var/run/fail2ban/fail2ban.sock # in case of unclean shutdown
        $FAIL2BAN start > /dev/null
        RETVAL=$?
    fi
@@ -6,26 +6,26 @@
 #
 ### BEGIN INIT INFO
 # Provides:          fail2ban
-# Required-Start:    $syslog $remote_fs postfix
+# Required-Start:    $syslog $remote_fs sendmail
 # Required-Stop:     $syslog $remote_fs
 # Should-Stop: $time ypbind sendmail
 # Default-Start:     3 5
 # Default-Stop:      0 1 2 6
 # Description:       startup Fail2Ban
 ### END INIT INFO
-PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/sbin:/usr/bin:/bin
 FAIL2BAN_BIN=/usr/local/bin/fail2ban-client
 FAIL2BAN_SERVER=/usr/local/bin/fail2ban-server
-FAIL2BAN_SOCKET=/tmp/fail2ban.sock
-test -x $FAIL2BAN_BIN || { echo "$FAIL2BAN_BIN not installed"; 
-	if [ "$1" = "stop" ]; then exit 0;
-	else exit 5; fi; }
+FAIL2BAN_SOCKET=/var/run/fail2ban/fail2ban.sock
+test -x $FAIL2BAN_BIN || { echo "$FAIL2BAN_BIN not installed";
+        if [ "$1" = "stop" ]; then exit 0;
+        else exit 5; fi; }

 # Check for existence of needed config file and read it
 FAIL2BAN_CONFIG=/etc/fail2ban/fail2ban.conf
 test -r $FAIL2BAN_CONFIG || { echo "$FAIL2BAN_CONFIG not existing";
-	if [ "$1" = "stop" ]; then exit 0;
-	else exit 6; fi; }
+        if [ "$1" = "stop" ]; then exit 0;
+        else exit 6; fi; }

 . /etc/rc.status

@@ -34,54 +34,70 @@ rc_reset

 case "$1" in
    start)
-	echo -n "Starting Fail2Ban "
-	/sbin/startproc $FAIL2BAN_BIN -q start 2>1 > /dev/null
-	rc_status -v
-	;;
+        echo -n "Starting Fail2Ban "
+        # a cleanup workaround, since /etc/init.d/boot.local removes only. 
+        # regular files, and not sockets 
+        if test -e $FAIL2BAN_SOCKET; then
+            if ! lsof -n $FAIL2BAN_SOCKET &>/dev/null; then
+                rm $FAIL2BAN_SOCKET
+            fi
+        fi
+        /sbin/startproc $FAIL2BAN_BIN start &>/dev/null
+        rc_status -v
+        ;;
    stop)
-	echo -n "Shutting down Fail2ban "
-	/sbin/startproc $FAIL2BAN_BIN -q stop
-	rc_status -v
-	;;
+        echo -n "Shutting down Fail2ban "
+        /sbin/startproc $FAIL2BAN_BIN -q stop
+        rc_status -v
+        ;;
    try-restart|condrestart)
-	if test "$1" = "condrestart"; then
-		echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}"
-	fi
-	$0 status
-	if test $? = 0; then
-		$0 restart
-	else
-		rc_reset	# Not running is not a failure.
-	fi
-	rc_status
-	;;
+        if test "$1" = "condrestart"; then
+                echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}"
+        fi
+        $0 status
+        if test $? = 0; then
+                $0 restart
+        else
+                rc_reset        # Not running is not a failure.
+        fi
+        rc_status
+        ;;
    restart)
-	$0 stop
-	i=60
-	while [ -e $FAIL2BAN_SOCKET ] && [ $i -gt 60 ]
-		sleep 1
-		i=$[i-1]
-		echo -n "."
-	done
-	echo "."
-	$0 start
+        $0 stop
+        echo -n "-wait a minute "
+        i=60
+        while [ -e $FAIL2BAN_SOCKET ] && [ $i -gt 0 ]; do
+                sleep 1
+                i=$[$i-1]
+                echo -n "."
+        done
+        echo "."
+        $0 start

-	# Remember status and be quiet
-	rc_status
-	;;
+        # Remember status and be quiet
+        rc_status
+        ;;
    force-reload)
-	echo -n "Reload service Fail2ban "
-	/sbin/startproc $FAIL2BAN_BIN -q reload
-	rc_status -v
-	;;
+        echo -n "Reload service Fail2ban "
+        /sbin/startproc $FAIL2BAN_BIN -q reload
+        rc_status -v
+        ;;
    reload)
-	echo -n "Reload service Fail2ban "
-	/sbin/startproc $FAIL2BAN_BIN -q reload
-	rc_status -v
-	;;
+        echo -n "Reload service Fail2ban "
+        /sbin/startproc $FAIL2BAN_BIN -q reload
+        rc_status -v
+        ;;
    status)
-	echo -n "Checking for service Fail2ban "
-	/sbin/checkproc $FAIL2BAN_SERVER
-	rc_status -v
-	;;
+        echo -n "Checking for service Fail2ban "
+        /sbin/checkproc $FAIL2BAN_SERVER
+        rc_status -v
+        ;;
    probe)
+        test /etc/fail2ban/fail2ban.conf -nt /var/run/fail2ban.pid && echo reload
+        ;;
+    *)
+        echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}"
+        exit 1
+        ;;
+esac
+rc_exit
@@ -1,2 +0,0 @@
-#!/bin/bash
-kill `ps ax|grep fail2ban|grep -v grep|awk '{print $1}'`
@@ -1,11 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "May 2007" "fail2ban-client v0.8.0" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "March 2008" "fail2ban-client v0.8.2" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
+.SH SYNOPSIS
+.B fail2ban-client
+[\fIOPTIONS\fR] \fI<COMMAND>\fR
 .SH DESCRIPTION
-[?1034hUsage: ../fail2ban\-client [OPTIONS] <COMMAND>
-.PP
-Fail2Ban v0.8.0 reads log file that contains password failure report
+Fail2Ban v0.8.2 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
@@ -45,6 +46,9 @@ starts the server and the jails
 \fBreload\fR
 reloads the configuration
 .TP
+\fBreload <JAIL>\fR
+reloads the jail <JAIL>
+.TP
 \fBstop\fR
 stops all jails and terminate the
 server
@@ -109,18 +113,6 @@ of <JAIL>
 removes <FILE> to the monitoring
 list of <JAIL>
 .TP
-\fBset <JAIL> timeregex <REGEX>\fR
-sets the regular expression
-<REGEX> to match the date format
-for <JAIL>. This will disable the
-autodetection feature.
-.TP
-\fBset <JAIL> timepattern <PATTERN>\fR
-sets the pattern <PATTERN> to
-match the date format for <JAIL>.
-This will disable the
-autodetection feature.
-.TP
 \fBset <JAIL> addfailregex <REGEX>\fR
 adds the regular expression
 <REGEX> which must match failures
@@ -256,12 +248,12 @@ action <ACT> for <JAIL>
 .SH FILES
 \fI/etc/fail2ban/*\fR
 .SH AUTHOR
-Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
 Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
 .SH "REPORTING BUGS"
-Report bugs to <lostcontrol@users.sourceforge.net>
+Report bugs to <cyril.jaquier@fail2ban.org>
 .SH COPYRIGHT
-Copyright \(co 2004-2006 Cyril Jaquier
+Copyright \(co 2004-2008 Cyril Jaquier
 .br
 Copyright of modifications held by their respective authors.
 Licensed under the GNU General Public License v2 (GPL).
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-REGEX "1" "May 2007" "fail2ban-regex v0.8.0" "User Commands"
+.TH FAIL2BAN-REGEX "1" "March 2008" "fail2ban-regex v0.8.2" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
-[\fIOPTIONS\fR] \fI<LOG> <REGEX>\fR
+[\fIOPTIONS\fR] \fI<LOG> <REGEX> \fR[\fIIGNOREREGEX\fR]
 .SH DESCRIPTION
-Fail2Ban v0.8.0 reads log file that contains password failure report
+Fail2Ban v0.8.2 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 This tools can test regular expressions for "fail2ban".
@@ -31,13 +31,20 @@ a string representing a 'failregex'
 .TP
 \fBfilename\fR
 path to a filter file (filter.d/sshd.conf)
+.SS "IgnoreRegex:"
+.TP
+\fBstring\fR
+a string representing an 'ignoreregex'
+.TP
+\fBfilename\fR
+path to a filter file (filter.d/sshd.conf)
 .SH AUTHOR
-Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
 Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
 .SH "REPORTING BUGS"
-Report bugs to <lostcontrol@users.sourceforge.net>
+Report bugs to <cyril.jaquier@fail2ban.org>
 .SH COPYRIGHT
-Copyright \(co 2004-2006 Cyril Jaquier
+Copyright \(co 2004-2008 Cyril Jaquier
 .br
 Copyright of modifications held by their respective authors.
 Licensed under the GNU General Public License v2 (GPL).
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "May 2007" "fail2ban-server v0.8.0" "User Commands"
+.TH FAIL2BAN-SERVER "1" "March 2008" "fail2ban-server v0.8.2" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.8.0 reads log file that contains password failure report
+Fail2Ban v0.8.2 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with
@@ -32,12 +32,12 @@ display this help message
 \fB\-V\fR, \fB\-\-version\fR
 print the version
 .SH AUTHOR
-Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
 Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
 .SH "REPORTING BUGS"
-Report bugs to <lostcontrol@users.sourceforge.net>
+Report bugs to <cyril.jaquier@fail2ban.org>
 .SH COPYRIGHT
-Copyright \(co 2004-2006 Cyril Jaquier
+Copyright \(co 2004-2008 Cyril Jaquier
 .br
 Copyright of modifications held by their respective authors.
 Licensed under the GNU General Public License v2 (GPL).
@@ -16,10 +16,10 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 433 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 433 $"
+__date__ = "$Date: 2006-10-24 21:40:51 +0200 (Tue, 24 Oct 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
@@ -16,11 +16,11 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 682 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 682 $"
+__date__ = "$Date: 2008-04-08 00:25:16 +0200 (Tue, 08 Apr 2008) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -106,7 +106,7 @@ class Action:
 		
 	def setActionStart(self, value):
 		self.__actionStart = value
-		logSys.info("Set actionStart = %s" % value)
+		logSys.debug("Set actionStart = %s" % value)
 	
 	##
 	# Get the "start" command.
@@ -135,7 +135,7 @@ class Action:
 	
 	def setActionBan(self, value):
 		self.__actionBan = value
-		logSys.info("Set actionBan = %s" % value)
+		logSys.debug("Set actionBan = %s" % value)
 	
 	##
 	# Get the "ban" command.
@@ -160,7 +160,7 @@ class Action:
 	
 	def setActionUnban(self, value):
 		self.__actionUnban = value
-		logSys.info("Set actionUnban = %s" % value)
+		logSys.debug("Set actionUnban = %s" % value)
 	
 	##
 	# Get the "unban" command.
@@ -185,7 +185,7 @@ class Action:
 	
 	def setActionCheck(self, value):
 		self.__actionCheck = value
-		logSys.info("Set actionCheck = %s" % value)
+		logSys.debug("Set actionCheck = %s" % value)
 	
 	##
 	# Get the "check" command.
@@ -202,7 +202,7 @@ class Action:
 	
 	def setActionStop(self, value):
 		self.__actionStop = value
-		logSys.info("Set actionStop = %s" % value)
+		logSys.debug("Set actionStop = %s" % value)
 	
 	##
 	# Get the "stop" command.
@@ -231,7 +231,7 @@ class Action:
 	# @param aInfo the properties
 	# @return a string
 	
-	@staticmethod
+	#@staticmethod
 	def replaceTag(query, aInfo):
 		""" Replace tags in query
 		"""
@@ -241,6 +241,7 @@ class Action:
 		# New line
 		string = string.replace("<br>", '\n')
 		return string
+	replaceTag = staticmethod(replaceTag)
 	
 	##
 	# Executes a command with preliminary checks and substitutions.
@@ -297,7 +298,7 @@ class Action:
 	# @param realCmd the command to execute
 	# @return True if the command succeeded

-	@staticmethod
+	#@staticmethod
 	def executeCmd(realCmd):
 		logSys.debug(realCmd)
 		try:
@@ -312,3 +313,5 @@ class Action:
 		except OSError, e:
 			logSys.error("%s failed with %s" % (realCmd, e))
 		return False
+	executeCmd = staticmethod(executeCmd)
+	
@@ -16,11 +16,11 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 567 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 567 $"
+__date__ = "$Date: 2007-03-26 23:17:31 +0200 (Mon, 26 Mar 2007) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -0,0 +1,164 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 567 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 567 $"
+__date__ = "$Date: 2007-03-26 23:17:31 +0200 (Mon, 26 Mar 2007) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from pickle import dumps, loads, HIGHEST_PROTOCOL
+from common import helpers
+import asyncore, asynchat, socket, os, logging, sys, traceback
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.server")
+
+##
+# Request handler class.
+#
+# This class extends asynchat in order to provide a request handler for
+# incoming query.
+
+class RequestHandler(asynchat.async_chat):
+	
+	END_STRING = "<F2B_END_COMMAND>"
+
+	def __init__(self, conn, transmitter):
+		asynchat.async_chat.__init__(self, conn)
+		self.__transmitter = transmitter
+		self.__buffer = []
+		# Sets the terminator.
+		self.set_terminator(RequestHandler.END_STRING)
+
+	def collect_incoming_data(self, data):
+		#logSys.debug("Received raw data: " + str(data))
+		self.__buffer.append(data)
+
+	##
+	# Handles a new request.
+	#
+	# This method is called once we have a complete request.
+
+	def found_terminator(self):
+		# Joins the buffer items.
+		message = loads("".join(self.__buffer))
+		# Gives the message to the transmitter.
+		message = self.__transmitter.proceed(message)
+		# Serializes the response.
+		message = dumps(message, HIGHEST_PROTOCOL)
+		# Sends the response to the client.
+		self.send(message + RequestHandler.END_STRING)
+		# Closes the channel.
+		self.close_when_done()
+		
+	def handle_error(self):
+		e1,e2 = helpers.formatExceptionInfo()
+		logSys.error("Unexpected communication error: "+e2)
+		logSys.error(traceback.format_exc().splitlines())
+		self.close()
+		
+##
+# Asynchronous server class.
+#
+# This class extends asyncore and dispatches connection requests to
+# RequestHandler.
+
+class AsyncServer(asyncore.dispatcher):
+
+	def __init__(self, transmitter):
+		asyncore.dispatcher.__init__(self)
+		self.__transmitter = transmitter
+		self.__sock = "/var/run/fail2ban/fail2ban.sock"
+		self.__init = False
+
+	##
+	# Returns False as we only read the socket first.
+
+	def writable(self):
+		return False
+
+	def handle_accept(self):
+		try:
+			conn, addr = self.accept()
+		except socket.error:
+			logSys.warning("Socket error")
+			return
+		except TypeError:
+			logSys.warning("Type error")
+			return
+		# Creates an instance of the handler class to handle the
+		# request/response on the incoming connection.
+		RequestHandler(conn, self.__transmitter)
+	
+	##
+	# Starts the communication server.
+	#
+	# @param sock: socket file.
+	# @param force: remove the socket file if exists.
+	
+	def start(self, sock, force):
+		self.__sock = sock
+		# Remove socket
+		if os.path.exists(sock):
+			logSys.error("Fail2ban seems to be already running")
+			if force:
+				logSys.warn("Forcing execution of the server")
+				os.remove(sock)
+			else:
+				raise AsyncServerException("Server already running")
+		# Creates the socket.
+		self.create_socket(socket.AF_UNIX, socket.SOCK_STREAM)
+		self.set_reuse_addr()
+		try:
+			self.bind(sock)
+		except Exception:
+			raise AsyncServerException("Unable to bind socket %s" % self.__sock)
+		self.listen(1)
+		# Sets the init flag.
+		self.__init = True
+		# TODO Add try..catch
+		# There's a bug report for Python 2.6/3.0 that use_poll=True yields some 2.5 incompatibilities:
+		if sys.version_info >= (2, 6): # if python 2.6 or greater...
+			logSys.debug("Detected Python 2.6 or greater. asyncore.loop() not using poll")
+			asyncore.loop(use_poll = False) # fixes the "Unexpected communication problem" issue on Python 2.6 and 3.0
+		else:
+			logSys.debug("NOT Python 2.6/3.* - asyncore.loop() using poll")
+			asyncore.loop(use_poll = True)
+	
+	##
+	# Stops the communication server.
+	
+	def stop(self):
+		if self.__init:
+			# Only closes the socket if it was initialized first.
+			self.close()
+		# Remove socket
+		if os.path.exists(self.__sock):
+			logSys.debug("Removed socket file " + self.__sock)
+			os.remove(self.__sock)
+		logSys.debug("Socket shutdown")
+
+
+##
+# AsyncServerException is used to wrap communication exceptions.
+
+class AsyncServerException(Exception):
+	pass
@@ -16,15 +16,15 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 638 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 638 $"
+__date__ = "$Date: 2007-12-17 21:00:36 +0100 (Mon, 17 Dec 2007) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

-from banticket import BanTicket
+from ticket import BanTicket
 from threading import Lock
 from mytime import MyTime
 import logging
@@ -125,7 +125,7 @@ class BanManager:
 	# @param ticket the FailTicket
 	# @return a BanTicket
 	
-	@staticmethod
+	#@staticmethod
 	def createBanTicket(ticket):
 		ip = ticket.getIP()
 		#lastTime = ticket.getTime()
@@ -133,6 +133,7 @@ class BanManager:
 		banTicket = BanTicket(ip, lastTime)
 		banTicket.setAttempt(ticket.getAttempt())
 		return banTicket
+	createBanTicket = staticmethod(createBanTicket)
 	
 	##
 	# Add a ban ticket.
@@ -1,50 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import logging
-from ticket import Ticket
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban")
-
-##
-# Ban Ticket.
-#
-# This class extends the Ticket class. It is mainly used by the BanManager.
-
-class BanTicket(Ticket):
-	
-	##
-	# Constructor.
-	#
-	# Call the Ticket (parent) constructor and initialize default
-	# values.
-	# @param ip the IP address
-	# @param time the ban time
-	
-	def __init__(self, ip, time):
-		Ticket.__init__(self, ip, time)
-	
@@ -16,19 +16,17 @@

 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 722 $

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 722 $"
+__date__ = "$Date: 2009-01-28 00:21:55 +0100 (Wed, 28 Jan 2009) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

 import time, logging

-from datestrptime import DateStrptime
-from datetai64n	import DateTai64n
-from dateepoch import DateEpoch
+from datetemplate import DateStrptime, DateTai64n, DateEpoch, DateISO8601
 from threading import Lock

 # Gets the instance of the logger.
@@ -39,26 +37,25 @@ class DateDetector:
 	def __init__(self):
 		self.__lock = Lock()
 		self.__templates = list()
-		self.__defTemplate = DateStrptime()
 	
 	def addDefaultTemplate(self):
+		self.__lock.acquire()
 		try:
-			self.__lock.acquire()
 			# standard
 			template = DateStrptime()
-			template.setName("Month Day Hour:Minute:Second")
-			template.setRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+			template.setName("MONTH Day Hour:Minute:Second")
+			template.setRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%b %d %H:%M:%S")
 			self.__templates.append(template)
 			# asctime
 			template = DateStrptime()
-			template.setName("Weekday Month Day Hour:Minute:Second Year")
+			template.setName("WEEKDAY MONTH Day Hour:Minute:Second Year")
 			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}")
 			template.setPattern("%a %b %d %H:%M:%S %Y")
 			self.__templates.append(template)
 			# asctime without year
 			template = DateStrptime()
-			template.setName("Weekday Month Day Hour:Minute:Second")
+			template.setName("WEEKDAY MONTH Day Hour:Minute:Second")
 			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%a %b %d %H:%M:%S")
 			self.__templates.append(template)
@@ -68,18 +65,42 @@ class DateDetector:
 			template.setRegex("\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y/%m/%d %H:%M:%S")
 			self.__templates.append(template)
+			# simple date too (from x11vnc)
+			template = DateStrptime()
+			template.setName("Day/Month/Year Hour:Minute:Second")
+			template.setRegex("\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2}")
+			template.setPattern("%d/%m/%Y %H:%M:%S")
+			self.__templates.append(template)
 			# Apache format [31/Oct/2006:09:22:55 -0000]
 			template = DateStrptime()
-			template.setName("Day/Month/Year:Hour:Minute:Second")
+			template.setName("Day/MONTH/Year:Hour:Minute:Second")
 			template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}")
 			template.setPattern("%d/%b/%Y:%H:%M:%S")
 			self.__templates.append(template)
+			# CPanel 05/20/2008:01:57:39
+			template = DateStrptime()
+			template.setName("Month/Day/Year:Hour:Minute:Second")
+			template.setRegex("\d{2}/\d{2}/\d{4}:\d{2}:\d{2}:\d{2}")
+			template.setPattern("%m/%d/%Y:%H:%M:%S")
+			self.__templates.append(template)
 			# Exim 2006-12-21 06:43:20
 			template = DateStrptime()
 			template.setName("Year-Month-Day Hour:Minute:Second")
 			template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y-%m-%d %H:%M:%S")
 			self.__templates.append(template)
+			# named 26-Jul-2007 15:20:52.252 
+			template = DateStrptime()
+			template.setName("Day-MONTH-Year Hour:Minute:Second[.Millisecond]")
+			template.setRegex("\d{2}-\S{3}-\d{4} \d{2}:\d{2}:\d{2}")
+			template.setPattern("%d-%b-%Y %H:%M:%S")
+			self.__templates.append(template)
+			# 17-07-2008 17:23:25
+			template = DateStrptime()
+			template.setName("Day-Month-Year Hour:Minute:Second")
+			template.setRegex("\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}")
+			template.setPattern("%d-%m-%Y %H:%M:%S")
+			self.__templates.append(template)
 			# TAI64N
 			template = DateTai64n()
 			template.setName("TAI64N")
@@ -88,60 +109,53 @@ class DateDetector:
 			template = DateEpoch()
 			template.setName("Epoch")
 			self.__templates.append(template)
+			# ISO 8601
+			template = DateISO8601()
+			template.setName("ISO 8601")
+			self.__templates.append(template)
+			# Only time information in the log
+			template = DateStrptime()
+			template.setName("Hour:Minute:Second")
+			template.setRegex("^\d{2}:\d{2}:\d{2}")
+			template.setPattern("%H:%M:%S")
+			self.__templates.append(template)
+			# <09/16/08@05:03:30>
+			template = DateStrptime()
+			template.setName("<Month/Day/Year@Hour:Minute:Second>")
+			template.setRegex("^<\d{2}/\d{2}/\d{2}@\d{2}:\d{2}:\d{2}>")
+			template.setPattern("<%m/%d/%y@%H:%M:%S>")
+			self.__templates.append(template)
 		finally:
 			self.__lock.release()
 	
 	def getTemplates(self):
 		return self.__templates
 	
-	def setDefaultRegex(self, value):
-		self.__defTemplate.setRegex(value)
-	
-	def getDefaultRegex(self):
-		return self.__defTemplate.getRegex()
-	
-	def setDefaultPattern(self, value):
-		self.__defTemplate.setPattern(value)
-	
-	def getDefaultPattern(self):
-		return self.__defTemplate.getPattern()
-	
 	def matchTime(self, line):
-		if self.__defTemplate.isValid():
-			return self.__defTemplate.matchDate(line)
-		else:
-			try:
-				self.__lock.acquire()
-				for template in self.__templates:
-					match = template.matchDate(line)
-					if not match == None:
-						return match
-				return None
-			finally:
-				self.__lock.release()
+		self.__lock.acquire()
+		try:
+			for template in self.__templates:
+				match = template.matchDate(line)
+				if not match == None:
+					return match
+			return None
+		finally:
+			self.__lock.release()

 	def getTime(self, line):
-		if self.__defTemplate.isValid():
-			try:
-				date = self.__defTemplate.getDate(line)
-				return date
-			except ValueError:
-				return None
-		else:
-			try:
-				self.__lock.acquire()
-				for template in self.__templates:
-					try:
-						date = template.getDate(line)
-						if date == None:
-							continue
-						template.incHits()
-						return date
-					except ValueError:
-						pass
-				return None
-			finally:
-				self.__lock.release()
+		self.__lock.acquire()
+		try:
+			for template in self.__templates:
+				try:
+					date = template.getDate(line)
+					if date == None:
+						continue
+					return date
+				except ValueError:
+					pass
+			return None
+		finally:
+			self.__lock.release()

 	def getUnixTime(self, line):
 		date = self.getTime(line)
@@ -155,11 +169,10 @@ class DateDetector:
 	# in this object and thus should be called from time to time.
 	
 	def sortTemplate(self):
+		self.__lock.acquire()
 		try:
-			self.__lock.acquire()
 			logSys.debug("Sorting the template list")
-			self.__templates.sort(cmp = lambda x, y:
-								cmp(x.getHits(), y.getHits()), 
-								reverse = True)
+			self.__templates.sort(lambda x, y: cmp(x.getHits(), y.getHits()))
+			self.__templates.reverse()
 		finally:
 			self.__lock.release()
--- a/Show More
+++ b/Show More