- Updated for 0.7.7

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@543 a942ae1a-1317-0410-a47c-b1dcaea8d605

.project

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>fail2ban-unstable</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.python.pydev.PyDevBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.python.pydev.pythonNature</nature>
+	</natures>
+</projectDescription>

.pydevproject

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<?eclipse-pydev version="1.0"?>
+
+<pydev_project>
+<pydev_property name="org.python.pydev.PYTHON_PROJECT_VERSION">python 2.4</pydev_property>
+<pydev_pathproperty name="org.python.pydev.PROJECT_SOURCE_PATH">
+<path>/fail2ban-unstable/client</path>
+<path>/fail2ban-unstable/server</path>
+<path>/fail2ban-unstable/testcases</path>
+<path>/fail2ban-unstable</path>
+</pydev_pathproperty>
+</pydev_project>

.settings/org.eclipse.core.resources.prefs

@@ -0,0 +1,3 @@
+#Wed Sep 20 22:14:25 GMT 2006
+eclipse.preferences.version=1
+encoding//server/datestrptime.py=UTF-8

CHANGELOG

@@ -4,9 +4,118 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.0)                           2006/08/23
+Fail2Ban (version 0.7.7)                           2007/02/08
 =============================================================
 
+ver. 0.7.7 (2007/02/08) - release candidate
+----------
+- Added signal handling in fail2ban-client
+- Added a wonderful visual effect when waiting on the server
+- fail2ban-client returns an error code if configuration is
+  not valid
+- Added new filters/actions. Thanks to Yaroslav Halchenko
+- Call Python interpreter directly (instead of using "env")
+- Added file support to fail2ban-regex. Benchmark feature has
+  been removed
+- Added cacti script and template.
+- Added IP list in "status <JAIL>". Thanks to Eric Gerbier
+
+ver. 0.7.6 (2007/01/04) - beta
+----------
+- Added a "sleep 1" in redhat-initd. Thanks to Jim Wight
+- Use /dev/log for SYSLOG output. Thanks to Joerg Sommrey
+- Use numeric output for iptables in "actioncheck"
+- Fixed removal of host in hosts.deny. Thanks to René Berber
+- Added new date format (2006-12-21 06:43:20) and Exim4
+  filter. Thanks to mEDI
+- Several "failregex" and "ignoreregex" are now accepted.
+  Creation of rules should be easier now.
+- Added license in COPYING. Thanks to Axel Thimm
+- Allow comma in action options. The value of the option must
+  be escaped with " or '. Thanks to Yaroslav Halchenko
+- Now Fail2ban goes in /usr/share/fail2ban instead of
+  /usr/lib/fail2ban. This is more compliant with FHS. Thanks
+  to Axel Thimm and Yaroslav Halchenko
+
+ver. 0.7.5 (2006/12/07) - beta
+----------
+- Do not ban a host that is currently banned. Thanks to
+  Yaroslav Halchenko
+- The supported tags in "action(un)ban" are <ip>, <failures>
+  and <time>
+- Fixed refactoring bug (getLastcommand -> getLastAction)
+- Added option "ignoreregex" in filter scripts and jail.conf.
+  Feature Request #1283304
+- Fixed a bug in user defined time regex/pattern
+- Improved documentation
+- Moved version.py and protocol.py to common/
+- Merged "maxtime" option with "findtime"
+- Added "<HOST>" tag support in failregex which matches
+  default IP address/hostname. "(?P<host>\S)" is still valid
+  and supported
+- Fixed exception when calling fail2ban-server with unknown
+  option
+- Fixed Debian bug 400162. The "socket" option is now handled
+  correctly by fail2ban-client
+- Fixed RedHat init script. Thanks to Justin Shore
+- Changed timeout to 30 secondes before assuming the server
+  cannot be started. Thanks to Joël Bertrand
+
+ver. 0.7.4 (2006/11/01) - beta
+----------
+- Improved configuration files. Thanks to Yaroslav Halchenko
+- Added man page for "fail2ban-regex"
+- Moved ban/unban messages from "info" level to "warn"
+- Added "-s" option to specify the socket path and "socket"
+  option in "fail2ban.conf"
+- Added "backend" option in "jail.conf"
+- Added more filters/actions and jail samples. Thanks to Nick
+  Munger, Christoph Haas
+- Improved testing framework
+- Fixed a bug in the return code handling of the executed
+  commands. Thanks to Yaroslav Halchenko
+- Signal handling. There is a bug with join() and signal in
+  Python
+- Better debugging output for "fail2ban-regex"
+- Added support for more date format
+- cPickle does not work with Python 2.5. Use pickle instead
+  (performance is not a problem in our case)
+
+ver. 0.7.3 (2006/09/28) - beta
+----------
+- Added man pages. Thanks to Yaroslav Halchenko
+- Added wildcard support for "logpath"
+- Added Gamin (file and directory monitoring system) support
+- (Re)added "ignoreip" option
+- Added more concurrency protection
+- First attempt at solving bug #1457620 (locale issue)
+- Performance improvements
+- (Re)added permanent banning with banTime < 0
+- Added DNS support to "ignoreip". Feature Request #1285859
+
+ver. 0.7.2 (2006/09/10) - beta
+----------
+- Refactoring and code cleanup
+- Improved client output
+- Added more get/set commands
+- Added more configuration templates
+- Removed "logpath" and "maxretry" from filter templates.
+  They must be defined in jail.conf now
+- Added interactive mode. Use "-i"
+- Added a date detector. "timeregex" and "timepattern" are no
+  more needed
+- Added "fail2ban-regex". This is a tool to help finding
+  "failregex"
+- Improved server communication. Start a new thread for each
+  incoming request. Fail2ban is not really thread-safe yet
+
+ver. 0.7.1 (2006/08/23) - alpha
+----------
+- Fixed daemon mode bug
+- Added Gentoo init.d script
+- Fixed path bug when trying to start "fail2ban-server"
+- Fixed reload command
+
 ver. 0.7.0 (2006/08/23) - alpha
 ----------
 - Almost a complete rewrite :) Fail2ban design is really
@@ -36,7 +145,7 @@ ver. 0.6.1 (2006/03/16) - stable
 - Added parsing of timestamp in TAI64N format (#1275325).
   Thanks to Mark Edgington
 - Added patch #1382936 (Default formatted syslog logging).
-  Thanks to Patrick Börjesson
+  Thanks to Patrick B�rjesson
 - Removed 192.168.0.0/16 from ignoreip. Attacks could also
   come from the local network.
 - Robust startup: if iptables module does not get fully

COPYING

@@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.

MANIFEST

@@ -1,13 +1,16 @@
 README
 CHANGELOG
 TODO
+COPYING
 fail2ban-client
 fail2ban-server
 fail2ban-testcases
+fail2ban-regex
 client/configreader.py
 client/jailreader.py
 client/fail2banreader.py
 client/jailsreader.py
+client/beautifier.py
 client/filterreader.py
 client/actionreader.py
 client/__init__.py
@@ -16,35 +19,77 @@ client/csocket.py
 server/ssocket.py
 server/banticket.py
 server/filter.py
+server/filtergamin.py
+server/filterpoll.py
 server/server.py
+server/datestrptime.py
 server/failticket.py
 server/actions.py
+server/datetai64n.py
 server/faildata.py
 server/failmanager.py
+server/datedetector.py
 server/jailthread.py
 server/transmitter.py
 server/action.py
 server/ticket.py
 server/jail.py
+server/jails.py
 server/__init__.py
+server/dateepoch.py
 server/banmanager.py
-setup.py
+server/datetemplate.py
+server/mytime.py
+server/regex.py
+server/failregex.py
 testcases/banmanagertestcase.py
 testcases/failmanagertestcase.py
 testcases/clientreadertestcase.py
 testcases/filtertestcase.py
 testcases/__init__.py
+testcases/datedetectortestcase.py
+testcases/actiontestcase.py
 testcases/servertestcase.py
 testcases/files/testcase01.log
 testcases/files/testcase02.log
-version.py
+testcases/files/testcase03.log
+testcases/files/testcase04.log
+setup.py
+setup.cfg
+common/__init__.py
+common/version.py
+common/protocol.py
 config/jail.conf
+config/filter.d/postfix.conf
 config/filter.d/vsftpd.conf
 config/filter.d/apache-auth.conf
+config/filter.d/apache-noscript.conf
+config/filter.d/qmail.conf
+config/filter.d/couriersmtp.conf
+config/filter.d/courierlogin.conf
 config/filter.d/sshd.conf
+config/filter.d/proftpd.conf
+config/filter.d/sasl.conf
+config/filter.d/wuftpd.conf
 config/action.d/iptables.conf
+config/action.d/iptables-multiport.conf
+config/action.d/iptables-new.conf
+config/action.d/ipfw.conf
 config/action.d/mail-whois.conf
-config/action.d/dummy.conf
+config/action.d/mail-whois-lines.conf
 config/action.d/mail.conf
 config/action.d/hostsdeny.conf
+config/action.d/shorewall.conf
 config/fail2ban.conf
+man/fail2ban-client.1
+man/fail2ban-client.h2m
+man/fail2ban-server.1
+man/fail2ban-server.h2m
+man/fail2ban-regex.1
+man/fail2ban-regex.h2m
+man/generate-man
+files/gentoo-initd
+files/redhat-initd
+files/cacti/fail2ban_stats.sh
+files/cacti/cacti_host_template_fail2ban.xml
+files/cacti/README

README

@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.0)                           2006/08/23
+Fail2Ban (version 0.7.7)                           2007/02/08
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -13,122 +13,67 @@ rules to reject the IP address. These rules can be defined by
 the user. Fail2Ban can read multiple log files such as sshd
 or Apache web server ones.
 
-This is my first Python program. Moreover, English is not my
-mother tongue...
-
-
-More details:
--------------
-
-Fail2Ban is rather simple. I have a home server connected to
-the Internet which runs apache, samba, sshd, ... I see in my
-logs that people are trying to log into my box using "manual"
-brute force or scripts. They try 10, 20 and sometimes more
-user/password (without success anyway). In order to
-discourage these script kiddies, I wanted that sshd refuse
-login from a specific ip after 3 password failures. After
-some Google searches, I found that sshd was not able of that.
-So I search for a script or program that do it. I found
-nothing :-( So I decide to write mine and to learn Python :-)
-
-For each sections defined in the configuration file, Fail2Ban
-tries to find lines which match the failregex. Then it
-retrieves the message time using timeregex and timepattern.
-It finally gets the ip and if it has already done 3 or more
-password failures in the last banTime, the ip is banned for
-banTime using a firewall rule. This rule is set by the user
-in the configuration file. Thus, Fail2Ban can be adapted for
-lots of firewall. After banTime, the rule is deleted. Notice
-that if no "plain" ip is available, Fail2Ban try to do DNS
-lookup in order to found one or several ip's to ban.
-
-Sections can be freely added so it is possible to monitor
-several daemons at the same time.
-
-Runs on my server and does its job rather well :-) The idea
-is to make fail2ban usable with daemons and services that
-require a login (sshd, telnetd, ...) and with different
-firewalls.
-
+This README is a quick introduction to Fail2ban. More
+documentation, FAQ, HOWTOs are available on the project
+website: http://www.fail2ban.org
 
 Installation:
 -------------
 
-Require: python-2.4 (http://www.python.org)
+Required:
+   >=python-2.4 (http://www.python.org)
+
+Optional:
+   >=gamin-0.0.21 (http://www.gnome.org/~veillard/gamin)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.7.0.tar.bz2
-> cd fail2ban-0.7.0
+> tar xvfj fail2ban-0.7.7.tar.bz2
+> cd fail2ban-0.7.7
 > python setup.py install
 
-This will install Fail2Ban into /usr/lib/fail2ban. The
+This will install Fail2Ban into /usr/share/fail2ban. The
 executable scripts are placed into /usr/bin.
 
 Gentoo: ebuilds are available on the website.
 Debian: Fail2Ban is in Debian unstable.
 RedHat: packages are available on the website.
 
-Fail2Ban should now be correctly installed. Just type:
+Fail2Ban should be correctly installed now. Just type:
 
 > fail2ban-client -h
 
-to see if everything is alright.
+to see if everything is alright. You should always use
+fail2ban-client and never call fail2ban-server directly.
 
 Configuration:
 --------------
 
-You can configure fail2ban using the files in /etc/fail2ban
-or using command line. Here are the available command line
-options (not complete yet):
-
-  <COMMAND>
-
-    start                   start the server and the jails
-    reload                  reload the configuration
-    stop                    stop all jails and terminate the
-                            server
-    status                  get the current status
-
-    set loglevel <LEVEL>    set loglevel to <LEVEL>
-    get loglevel            get loglevel
-    set logtarget <TARGET>  set log target to <TARGET>
-    get logtarget           get log target
-
-    add <JAIL>              create <JAIL>
-    set <JAIL> <CMD>        set the <CMD> value for <JAIL>
-    get <JAIL> <CMD>        get the <CMD> value for <JAIL>
-    start <JAIL>            start <JAIL>
-    stop <JAIL>             stop <JAIL>. The jail is removed
-    status <JAIL>           get the current status of <JAIL>
-
-  [OPTIONS]
-
-    -c <DIR>                configuration directory
-    -d                      dump configuration. For debugging
-    -v                      increase verbosity
-    -q                      decrease verbosity
-    -x                      force execution of the server
-    -h                      display this help message
+You can configure Fail2ban using the files in /etc/fail2ban.
+It is possible to configure the server using commands sent to
+it by fail2ban-client. The available commands are described
+in the man page of fail2ban-client. Please refer to it or to
+the website: http://www.fail2ban.org
 
 Contact:
 --------
 
 You need some new features, you found bugs or you just
-appreciate this program, you can contact me at :
+appreciate this program, you can contact me at:
 
-Website: http://fail2ban.sourceforge.net
+Website: http://www.fail2ban.org
 
 Cyril Jaquier: <lostcontrol@users.sourceforge.net>
 
-
 Thanks:
 -------
 
-Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
+Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
 Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
-Edgington, Patrick Börjesson, kojiro, zugeschmiert
+Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
+Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
+René Berber, mEDI, Axel Thimm, Eric Gerbier
 
 License:
 --------

TODO

@@ -13,103 +13,43 @@ Legend:
 # partially done
 * done
 
-- correct handling of threads (join???)
+- Add timeout to external commands (signal alarm, watchdog
+  thread, etc)
 
-- signal handling (ctrl-c, etc)
+- New backend: pynotify
 
-- add a reload option to fail2ban-client
+- Uniformize filters and actions name. Use the software name
+  (openssh, postfix, proftp)
 
-- see Feature Request Tracking System at SourceForge.net
+- Added <USER> tag for failregex. Add features using this
+  information
 
-* findall in dns.py should be no more needed
+- Look at the memory consumption. Decrease memory usage
 
-* remove utils/ directory
+- More detailed statistics
 
-- improve installation process (better prefix support)
+- Auto-enable function (search for log files), check
+  modification date to see if service is still in use
+
+- Improve parsing of the action parameters in jailreader.py
+
+- Better handling of the protocol in transmitter.py
+
+- Add gettext support (I18N)
+
+- Fix the cPickle issue with Python 2.5
+
+- Multiline log reading
+
+- Improve communication. (asyncore, asynchat??)
+
+- Improve execution of action. Why does subprocess.call
+  deadlock with multi-jails?
+
+# see Feature Request Tracking System at SourceForge.net
 
 # improve documentation and website for user
 
-* use Doxygen
-
-- use PyLint to check the code
-
-* better configuration files
-
-- add a check to see if the time of the log messages is
-  correctly detected (valid regexp)
-
-? use Gentoo Portage style for scripts.
-  - banning engines script in /etc/fail2ban/scripts.d
-    Example: /etc/fail2ban/scripts.d/iptables
-    Will be mostly bash scripting which is more "user
-    friendly".
-  - split configuration files in /etc/fail2ban/services.d
-    for log files
-    Example: /etc/fail2ban/services.d/apache
-    Mainly regular expressions.
-  - template for common regex in /etc/fail2ban/templates.d
-    Example: /etc/fail2ban/templates.d/date
-    Mainly regular expressions.
-
-* remove debug mode (root check)
-
 # better return values in function
 
-? use more email.Utils in mail.py
-
-? add gettext support. Is this really needed for a server
-  utility?
-
-* send an email when fail2ban is running
-
-* add multithreading. Python threading is not really
-  efficient. However, fail2ban could benefit of it. We could
-  use threads like this:
-  - one thread which check for host to unban.
-  - one thread per file to watch. This will allow things like
-    different polling time for each file.
-  <srv> is read-only (we only read log files) thus no locks
-  are required. However, <meth> is read-write and must take
-  care of concurrency in case of multithreading.
-
-- add FAM/Gamin support. Should be quite efficient with
-  threading. Take care that handle_one_event() release the
-  Python lock.
-
-# add a test framework. We could use unittest which is in
-  Python since 2.1. It should be possible to run all tests
-  automatically.
-
-* add client/server using socket. Something similar to
-  gdesklets. DBUS seems to be designed for desktop use.
-  - fail2ban start -> start the daemon.
-  - fail2ban stop -> stop the daemon.
-  - fail2ban add <srv> <meth> -> add <srv> monitoring with
-    <meth> ban method (iptables, hosts.deny, etc).
-  - fail2ban del <srv> -> remove <srv> monitoring.
-  - fail2ban status <srv> -> query current fail2ban status.
-    Should return infos like a ban counter. Could be graph
-    with rrdtool.
-  - fail2ban pause <srv> -> suspend monitoring.
-  - fail2ban resume <srv> -> resume monitoring.
-  - fail2ban list -> list available services.
-  - fail2ban flush <srv> -> flush the <srv> ban list.
-  
-* remove PID file.
-
-* remove most of the command lines options if possible.
-
-- add the possibility to specify wildcard in log files.
-  Example: logfile = /var/log/apache2/access-*.log
-  Should we start one thread per file or just one thread per
-  serivce?
-
-- autodetect date format in log file. Match the most popular
-  format and sort them using the hit ratio. Should avoid
-  user problem with regex and not have a big impact on perfs.
-
-- restart automatically the daemon if an exception occurs.
-
-- do not close socket after a send
-
-- refactoring in server.py, actions.py, filter.py
+# refactoring in server.py, actions.py, filter.py

client/__init__.py

@@ -22,4 +22,4 @@ __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
 __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
+__license__ = "GPL"

client/actionreader.py

@@ -34,24 +34,24 @@ class ActionReader(ConfigReader):
 	
 	def __init__(self, action, name):
 		ConfigReader.__init__(self)
-		self.file = action[0]
-		self.cInfo = action[1]
-		self.name = name
+		self.__file = action[0]
+		self.__cInfo = action[1]
+		self.__name = name
 	
-	def setFile(self, file):
-		self.file = file
+	def setFile(self, fileName):
+		self.__file = fileName
 	
 	def getFile(self):
-		return self.file
+		return self.__file
 	
 	def setName(self, name):
-		self.name = name
+		self.__name = name
 	
 	def getName(self):
-		return self.name
+		return self.__name
 	
 	def read(self):
-		ConfigReader.read(self, "action.d/" + self.file)
+		return ConfigReader.read(self, "action.d/" + self.__file)
 	
 	def getOptions(self, pOpts):
 		opts = [["string", "actionstart", ""],
@@ -59,32 +59,32 @@ class ActionReader(ConfigReader):
 				["string", "actioncheck", ""],
 				["string", "actionban", ""],
 				["string", "actionunban", ""]]
-		self.opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
 		
 		if self.has_section("Init"):
 			for opt in self.options("Init"):
-				if not self.cInfo.has_key(opt):
-					self.cInfo[opt] = self.get("Init", opt)
+				if not self.__cInfo.has_key(opt):
+					self.__cInfo[opt] = self.get("Init", opt)
 	
 	def convert(self):
-		head = ["set", self.name]
+		head = ["set", self.__name]
 		stream = list()
-		stream.append(head + ["addaction", self.file])
-		for opt in self.opts:
+		stream.append(head + ["addaction", self.__file])
+		for opt in self.__opts:
 			if opt == "actionstart":
-				stream.append(head + ["actionstart", self.file, self.opts[opt]])
+				stream.append(head + ["actionstart", self.__file, self.__opts[opt]])
 			elif opt == "actionstop":
-				stream.append(head + ["actionstop", self.file, self.opts[opt]])
+				stream.append(head + ["actionstop", self.__file, self.__opts[opt]])
 			elif opt == "actioncheck":
-				stream.append(head + ["actioncheck", self.file, self.opts[opt]])
+				stream.append(head + ["actioncheck", self.__file, self.__opts[opt]])
 			elif opt == "actionban":
-				stream.append(head + ["actionban", self.file, self.opts[opt]])
+				stream.append(head + ["actionban", self.__file, self.__opts[opt]])
 			elif opt == "actionunban":
-				stream.append(head + ["actionunban", self.file, self.opts[opt]])
+				stream.append(head + ["actionunban", self.__file, self.__opts[opt]])
 		# cInfo
-		if self.cInfo:
-			for p in self.cInfo:
-				stream.append(head + ["setcinfo", self.file, p, self.cInfo[p]])
+		if self.__cInfo:
+			for p in self.__cInfo:
+				stream.append(head + ["setcinfo", self.__file, p, self.__cInfo[p]])
 
 		return stream
 		

client/beautifier.py

@@ -0,0 +1,141 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from server.jails import UnknownJailException
+from server.jails import DuplicateJailException
+import logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+##
+# Beautify the output of the client.
+#
+# Fail2ban server only return unformatted return codes which need to be
+# converted into user readable messages.
+
+class Beautifier:
+	
+	def __init__(self, cmd = None):
+		self.__inputCmd = cmd
+
+	def setInputCmd(self, cmd):
+		self.__inputCmd = cmd
+		
+	def getInputCmd(self):
+		return self.__inputCmd
+		
+	def beautify(self, response):
+		logSys.debug("Beautify " + `response` + " with " + `self.__inputCmd`)
+		inC = self.__inputCmd
+		msg = response
+		try:
+			if inC[0] == "ping":
+				msg = "Server replied: " + response
+			elif inC[0] == "start":
+				msg = "Jail started"
+			elif inC[0] == "stop":
+				if len(inC) == 1:
+					if response == None:
+						msg = "Shutdown successful"
+				else:
+					if response == None:
+						msg = "Jail stopped"
+			elif inC[0] == "add":
+				msg = "Added jail " + response
+			elif inC[0:1] == ['status']:
+				if len(inC) > 1:
+					msg = "Status for the jail: " + inC[1] + "\n"
+					msg = msg + "|- " + response[0][0] + "\n"
+					msg = msg + "|  |- " + response[0][1][0][0] + ":\t" + `response[0][1][0][1]` + "\n"
+					msg = msg + "|  `- " + response[0][1][1][0] + ":\t" + `response[0][1][1][1]` + "\n"
+					msg = msg + "`- " + response[1][0] + "\n"
+					msg = msg + "   |- " + response[1][1][0][0] + ":\t" + `response[1][1][0][1]` + "\n"
+					msg = msg + "   |  `- " + response[1][1][2][0] + ":\t" + `response[1][1][2][1]` + "\n"
+					msg = msg + "   `- " + response[1][1][1][0] + ":\t" + `response[1][1][1][1]`
+				else:
+					msg = "Status\n"
+					msg = msg + "|- " + response[0][0] + ":\t" + `response[0][1]` + "\n"
+					msg = msg + "`- " + response[1][0] + ":\t\t" + response[1][1]
+			elif inC[1] == "logtarget":
+				msg = "Current logging target is:\n"
+				msg = msg + "`- " + response
+			elif inC[1:2] == ['loglevel']:
+				msg = "Current logging level is "
+				if response == 1:
+					msg = msg + "ERROR"
+				elif response == 2:
+					msg = msg + "WARN"
+				elif response == 3:
+					msg = msg + "INFO"
+				elif response == 4:
+					msg = msg + "DEBUG"
+				else:
+					msg = msg + `response`
+			elif inC[2] in ("logpath", "addlogpath", "dellogpath"):
+				if len(response) == 0:
+					msg = "No file is currently monitored"
+				else:
+					msg = "Current monitored log file(s):\n"
+					for path in response[:-1]:
+						msg = msg + "|- " + path + "\n"
+					msg = msg + "`- " + response[len(response)-1]
+			elif inC[2] in ("ignoreip", "addignoreip", "delignoreip"):
+				if len(response) == 0:
+					msg = "No IP address/network is ignored"
+				else:
+					msg = "These IP addresses/networks are ignored:\n"
+					for ip in response[:-1]:
+						msg = msg + "|- " + ip + "\n"
+					msg = msg + "`- " + response[len(response)-1]
+			elif inC[2] in ("failregex", "addfailregex", "delfailregex",
+							"ignoreregex", "addignoreregex", "delignoreregex"):
+				if len(response) == 0:
+					msg = "No regular expression is defined"
+				else:
+					msg = "The following regular expression are defined:\n"
+					c = 0
+					for ip in response[:-1]:
+						msg = msg + "|- [" + str(c) + "]: " + ip + "\n"
+						c += 1
+					msg = msg + "`- [" + str(c) + "]: " + response[len(response)-1]
+		except Exception:
+			logSys.warn("Beautifier error. Please report the error")
+			logSys.error("Beautify " + `response` + " with " + `self.__inputCmd` +
+						 " failed")
+			msg = msg + `response`
+		return msg
+
+	def beautifyError(self, response):
+		logSys.debug("Beautify (error) " + `response` + " with " + `self.__inputCmd`)
+		msg = response
+		if isinstance(response, UnknownJailException):
+			msg = "Sorry but the jail '" + response[0] + "' does not exist"
+		elif isinstance(response, IndexError):
+			msg = "Sorry but the command is invalid"
+		elif isinstance(response, DuplicateJailException):
+			msg = "The jail '" + response[0] + "' already exists"
+		return msg

client/configreader.py

@@ -24,36 +24,41 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import logging
-from ConfigParser import *
+import logging, os
+from ConfigParser import SafeConfigParser
+from ConfigParser import NoOptionError, NoSectionError
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.client.config")
 
 class ConfigReader(SafeConfigParser):
 	
-	basedir = "/etc/fail2ban/"
+	BASE_DIRECTORY = "/etc/fail2ban/"
 	
 	def __init__(self):
 		SafeConfigParser.__init__(self)
-		self.opts = None
+		self.__opts = None
 	
 	@staticmethod
-	def setBaseDir(dir):
-		global basedir
-		path = dir.rstrip('/')
-		basedir = path + '/'
+	def setBaseDir(folderName):
+		path = folderName.rstrip('/')
+		ConfigReader.BASE_DIRECTORY = path + '/'
 		
 	@staticmethod
 	def getBaseDir():
-		global basedir
-		return basedir
+		return ConfigReader.BASE_DIRECTORY
 	
 	def read(self, filename):
-		global basedir
-		basename = basedir + filename
+		basename = ConfigReader.BASE_DIRECTORY + filename
 		logSys.debug("Reading " + basename)
-		SafeConfigParser.read(self, [basename + ".conf", basename + ".local"])
+		bConf = basename + ".conf"
+		bLocal = basename + ".local"
+		if os.path.exists(bConf) or os.path.exists(bLocal):
+			SafeConfigParser.read(self, [bConf, bLocal])
+			return True
+		else:
+			logSys.error(bConf + " and " + bLocal + " do not exist")
+			return False
 	
 	##
 	# Read the options.
@@ -64,6 +69,7 @@ class ConfigReader(SafeConfigParser):
 	# 0 -> the type of the option
 	# 1 -> the name of the option
 	# 2 -> the default value for the option
+	
 	def getOptions(self, sec, options, pOptions = None):
 		values = dict()
 		for option in options:
@@ -80,12 +86,14 @@ class ConfigReader(SafeConfigParser):
 			except NoSectionError, e:
 				# No "Definition" section or wrong basedir
 				logSys.error(e)
+				values[option[1]] = option[2]
 			except NoOptionError:
 				if not option[2] == None:
-					logSys.warn("No '" + option[1] + "' defined in '" + sec + "'")
+					logSys.warn("'%s' not defined in '%s'. Using default value"
+								% (option[1], sec))
 					values[option[1]] = option[2]
 			except ValueError:
 				logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +
 							"'. Using default one: '" + `option[2]` + "'")
 				values[option[1]] = option[2]
-		return values
+		return values

client/configurator.py

@@ -35,34 +35,42 @@ logSys = logging.getLogger("fail2ban.client.config")
 class Configurator:
 	
 	def __init__(self):
-		self.settings = dict()
-		self.streams = dict()
-		self.fail2ban = Fail2banReader()
-		self.jails = JailsReader()
+		self.__settings = dict()
+		self.__streams = dict()
+		self.__fail2ban = Fail2banReader()
+		self.__jails = JailsReader()
 	
-	def setBaseDir(self, dir):
-		ConfigReader.setBaseDir(dir)
+	@staticmethod
+	def setBaseDir(folderName):
+		ConfigReader.setBaseDir(folderName)
 	
-	def getBaseDir(self):
+	@staticmethod
+	def getBaseDir():
 		return ConfigReader.getBaseDir()
 	
+	def readEarly(self):
+		self.__fail2ban.read()
+	
 	def readAll(self):
-		self.fail2ban.read()
-		self.jails.read()
+		self.readEarly()
+		self.__jails.read()
+		
+	def getEarlyOptions(self):
+		return self.__fail2ban.getEarlyOptions()
 	
 	def getAllOptions(self):
-		self.settings["general"] = self.fail2ban.getOptions()
-		self.settings["jails"] = self.jails.getOptions()
+		self.__fail2ban.getOptions()
+		return self.__jails.getOptions()
 		
 	def convertToProtocol(self):
-		self.streams["general"] = self.fail2ban.convert()
-		self.streams["jails"] = self.jails.convert()
+		self.__streams["general"] = self.__fail2ban.convert()
+		self.__streams["jails"] = self.__jails.convert()
 	
 	def getConfigStream(self):
 		cmds = list()
-		for opt in self.streams["general"]:
+		for opt in self.__streams["general"]:
 			cmds.append(opt)
-		for opt in self.streams["jails"]:
+		for opt in self.__streams["jails"]:
 			cmds.append(opt)
 		return cmds
 	

client/csocket.py

@@ -24,31 +24,35 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import socket, pickle
+#from cPickle import dumps, loads, HIGHEST_PROTOCOL
+from pickle import dumps, loads, HIGHEST_PROTOCOL
+import socket
 
 class CSocket:
 	
-	def __init__(self):
-		self.socketFile = "/tmp/fail2ban.sock"
+	END_STRING = "<F2B_END_COMMAND>"
+	
+	def __init__(self, sock = "/tmp/fail2ban.sock"):
 		# Create an INET, STREAMing socket
 		#self.csock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-		self.csock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+		self.__csock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
 		#self.csock.connect(("localhost", 2222))
-		self.csock.connect(self.socketFile)
+		self.__csock.connect(sock)
 	
 	def send(self, msg):
 		# Convert every list member to string
-		obj = pickle.dumps(map(str, msg))
-		self.csock.send(obj + "<F2B_END_COMMAND>")
-		ret = self.receive(self.csock)
-		self.csock.close()
+		obj = dumps([str(m) for m in msg], HIGHEST_PROTOCOL)
+		self.__csock.send(obj + CSocket.END_STRING)
+		ret = self.receive(self.__csock)
+		self.__csock.close()
 		return ret
 	
-	def receive(self, socket):
+	@staticmethod
+	def receive(sock):
 		msg = ''
-		while msg.rfind("<F2B_END_COMMAND>") == -1:
-			chunk = socket.recv(6)
+		while msg.rfind(CSocket.END_STRING) == -1:
+			chunk = sock.recv(6)
 			if chunk == '':
 				raise RuntimeError, "socket connection broken"
 			msg = msg + chunk
-		return pickle.loads(msg)
+		return loads(msg)

client/fail2banreader.py

@@ -38,17 +38,21 @@ class Fail2banReader(ConfigReader):
 	def read(self):
 		ConfigReader.read(self, "fail2ban")
 	
+	def getEarlyOptions(self):
+		opts = [["string", "socket", "/tmp/fail2ban.sock"]]
+		return ConfigReader.getOptions(self, "Definition", opts)
+	
 	def getOptions(self):
 		opts = [["int", "loglevel", 1],
 				["string", "logtarget", "STDERR"]]
-		self.opts = ConfigReader.getOptions(self, "Definition", opts)
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts)
 	
 	def convert(self):
 		stream = list()
-		for opt in self.opts:
+		for opt in self.__opts:
 			if opt == "loglevel":
-				stream.append(["set", "loglevel", self.opts[opt]])
+				stream.append(["set", "loglevel", self.__opts[opt]])
 			elif opt == "logtarget":
-				stream.append(["set", "logtarget", self.opts[opt]])
+				stream.append(["set", "logtarget", self.__opts[opt]])
 		return stream
 	

client/filterreader.py

@@ -32,49 +32,49 @@ logSys = logging.getLogger("fail2ban.client.config")
 
 class FilterReader(ConfigReader):
 	
-	def __init__(self, file, name):
+	def __init__(self, fileName, name):
 		ConfigReader.__init__(self)
-		self.file = file
-		self.name = name
+		self.__file = fileName
+		self.__name = name
 	
-	def setFile(self, file):
-		self.file = file
+	def setFile(self, fileName):
+		self.__file = fileName
 	
 	def getFile(self):
-		return self.file
+		return self.__file
 	
 	def setName(self, name):
-		self.name = name
+		self.__name = name
 	
 	def getName(self):
-		return self.name
+		return self.__name
 	
 	def read(self):
-		ConfigReader.read(self, "filter.d/" + self.file)
+		return ConfigReader.read(self, "filter.d/" + self.__file)
 	
 	def getOptions(self, pOpts):
-		opts = [["string", "logpath", "/var/log/sshd.log"],
-				["string", "timeregex", ""],
-				["string", "timepattern", ""],
-				["string", "failregex", ""],
-				["int", "maxtime", 600],
-				["int", "maxretry", 3]]
-		self.opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
+		opts = [["string", "timeregex", None],
+				["string", "timepattern", None],
+				["string", "ignoreregex", ""],
+				["string", "failregex", ""]]
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
 	
 	def convert(self):
 		stream = list()
-		for opt in self.opts:
-			if opt == "logpath":
-				stream.append(["set", self.name, "logpath", self.opts[opt]])
-			elif opt == "timeregex":
-				stream.append(["set", self.name, "timeregex", self.opts[opt]])
+		for opt in self.__opts:
+			if opt == "timeregex":
+				stream.append(["set", self.__name, "timeregex", self.__opts[opt]])
 			elif opt == "timepattern":
-				stream.append(["set", self.name, "timepattern", self.opts[opt]])
+				stream.append(["set", self.__name, "timepattern", self.__opts[opt]])
 			elif opt == "failregex":
-				stream.append(["set", self.name, "failregex", self.opts[opt]])
-			elif opt == "maxtime":
-				stream.append(["set", self.name, "maxtime", self.opts[opt]])
-			elif opt == "maxretry":
-				stream.append(["set", self.name, "maxretry", self.opts[opt]])
+				for regex in self.__opts[opt].split('\n'):
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addfailregex", regex])
+			elif opt == "ignoreregex":
+				for regex in self.__opts[opt].split('\n'):
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addignoreregex", regex])		
 		return stream
 		

client/jailreader.py

@@ -24,7 +24,8 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import logging, re
+import logging, re, glob
+
 from configreader import ConfigReader
 from filterreader import FilterReader
 from actionreader import ActionReader
@@ -38,66 +39,129 @@ class JailReader(ConfigReader):
 	
 	def __init__(self, name):
 		ConfigReader.__init__(self)
-		self.name = name
-		self.filter = None
-		self.actions = list()
+		self.__name = name
+		self.__filter = None
+		self.__actions = list()
 	
 	def setName(self, value):
-		self.name = value
+		self.__name = value
 	
 	def getName(self):
-		return self.name
+		return self.__name
 	
 	def read(self):
 		ConfigReader.read(self, "jail")
 	
 	def isEnabled(self):
-		return self.opts["enabled"]
+		return self.__opts["enabled"]
 	
 	def getOptions(self):
 		opts = [["bool", "enabled", "false"],
-				["int", "maxretry", None],
+				["string", "logpath", "/var/log/messages"],
+				["string", "backend", "auto"],
+				["int", "maxretry", 3],
+				["int", "findtime", 600],
 				["int", "bantime", 600],
+				["string", "failregex", None],
+				["string", "ignoreregex", None],
+				["string", "ignoreip", None],
 				["string", "filter", ""],
 				["string", "action", ""]]
-		self.opts = ConfigReader.getOptions(self, self.name, opts)
+		self.__opts = ConfigReader.getOptions(self, self.__name, opts)
 		
 		if self.isEnabled():
 			# Read filter
-			self.filter = FilterReader(self.opts["filter"], self.name)
-			self.filter.read()
-			self.filter.getOptions(self.opts)
+			self.__filter = FilterReader(self.__opts["filter"], self.__name)
+			ret = self.__filter.read()
+			if ret:
+				self.__filter.getOptions(self.__opts)
+			else:
+				logSys.error("Unable to read the filter")
+				return False
 			
 			# Read action
-			for act in self.opts["action"].split('\n'):
+			for act in self.__opts["action"].split('\n'):
 				try:
 					splitAct = JailReader.splitAction(act)
-					action = ActionReader(splitAct, self.name)
-					action.read()
-					action.getOptions(self.opts)
-					self.actions.append(action)
+					action = ActionReader(splitAct, self.__name)
+					ret = action.read()
+					if ret:
+						action.getOptions(self.__opts)
+						self.__actions.append(action)
+					else:
+						raise AttributeError("Unable to read action")
 				except AttributeError, e:
 					logSys.error("Error in action definition " + act)
 					logSys.debug(e)
+					return False
+		return True
 	
 	def convert(self):
-		stream = [["add", self.name]]
-		for opt in self.opts:
-			if opt == "maxretry":
-				stream.append(["set", self.name, "maxretry", self.opts[opt]])
+		stream = []
+		for opt in self.__opts:
+			if opt == "logpath":
+				for path in self.__opts[opt].split("\n"):
+					pathList = glob.glob(path)
+					if len(pathList) == 0:
+						logSys.error("No file found for " + path)
+					for p in pathList:
+						stream.append(["set", self.__name, "addlogpath", p])
+			elif opt == "backend":
+				backend = self.__opts[opt]
+			elif opt == "maxretry":
+				stream.append(["set", self.__name, "maxretry", self.__opts[opt]])
+			elif opt == "ignoreip":
+				for ip in self.__opts[opt].split():
+					# Do not send a command if the rule is empty.
+					if ip != '':
+						stream.append(["set", self.__name, "addignoreip", ip])
+			elif opt == "findtime":
+				stream.append(["set", self.__name, "findtime", self.__opts[opt]])
 			elif opt == "bantime":
-				stream.append(["set", self.name, "bantime", self.opts[opt]])
-		stream.extend(self.filter.convert())
-		for action in self.actions:
+				stream.append(["set", self.__name, "bantime", self.__opts[opt]])
+			elif opt == "failregex":
+				stream.append(["set", self.__name, "failregex", self.__opts[opt]])
+			elif opt == "ignoreregex":
+				stream.append(["set", self.__name, "ignoreregex", self.__opts[opt]])
+		stream.extend(self.__filter.convert())
+		for action in self.__actions:
 			stream.extend(action.convert())
+		stream.insert(0, ["add", self.__name, backend])
 		return stream
 	
 	@staticmethod
 	def splitAction(action):
 		m = JailReader.actionCRE.match(action)
 		d = dict()
-		if m.group(2) <> None:
-			for param in m.group(2).split(','):
+		if not m.group(2) == None:
+			# Huge bad hack :( This method really sucks. TODO Reimplement it.
+			actions = ""
+			escapeChar = None
+			allowComma = False
+			for c in m.group(2):
+				if c in ('"', "'") and not allowComma:
+					# Start
+					escapeChar = c
+					allowComma = True
+				elif c == escapeChar:
+					# End
+					escapeChar = None
+					allowComma = False
+				else:
+					if c == ',' and allowComma:
+						actions += "<COMMA>"
+					else:
+						actions += c
+			
+			# Split using ,
+			actionsSplit = actions.split(',')
+			# Replace the tag <COMMA> with ,
+			actionsSplit = [n.replace("<COMMA>", ',') for n in actionsSplit]
+			
+			for param in actionsSplit:
 				p = param.split('=')
-				d[p[0].strip()] = p[1].strip()
+				try:
+					d[p[0].strip()] = p[1].strip()
+				except IndexError:
+					logSys.error("Invalid argument %s in '%s'" % (p, m.group(2)))
 		return [m.group(1), d]

client/jailsreader.py

@@ -35,38 +35,38 @@ class JailsReader(ConfigReader):
 	
 	def __init__(self):
 		ConfigReader.__init__(self)
-		self.jails = list()
+		self.__jails = list()
 	
 	def read(self):
 		ConfigReader.read(self, "jail")
 	
 	def getOptions(self):
 		opts = []
-		self.opts = ConfigReader.getOptions(self, "Definition", opts)
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts)
 
 		for sec in self.sections():
 			jail = JailReader(sec)
 			jail.read()
-			jail.getOptions()
-			if jail.isEnabled():
-				# We only add enabled jails
-				self.jails.append(jail)
-	
-	def getFilterOptions(self, file):
-		filter = FilterReader(file)
-		filter.read()
-		return filter.getOptions()
+			ret = jail.getOptions()
+			if ret:
+				if jail.isEnabled():
+					# We only add enabled jails
+					self.__jails.append(jail)
+			else:
+				logSys.error("Errors in jail '" + sec + "'. Skipping...")
+				return False
+		return True
 	
 	def convert(self):
 		stream = list()
-		for opt in self.opts:
+		for opt in self.__opts:
 			if opt == "":
 				stream.append([])
 		# Convert jails
-		for jail in self.jails:
+		for jail in self.__jails:
 			stream.extend(jail.convert())
 		# Start jails
-		for jail in self.jails:
+		for jail in self.__jails:
 			stream.append(["start", jail.getName()])
 		
 		return stream

common/__init__.py

@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"

common/protocol.py

@@ -0,0 +1,136 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import textwrap
+
+##
+# Describes the protocol used to communicate with the server.
+
+protocol = [
+['', "BASIC", ""],
+["start", "starts the server and the jails"], 
+["reload", "reloads the configuration"], 
+["stop", "stops all jails and terminate the server"], 
+["status", "gets the current status of the server"], 
+["ping", "tests if the server is alive"], 
+['', "LOGGING", ""],
+["set loglevel <LEVEL>", "sets logging level to <LEVEL>. 0 is minimal, 4 is debug"], 
+["get loglevel", "gets the logging level"], 
+["set logtarget <TARGET>", "sets logging target to <TARGET>. Can be STDOUT, STDERR, SYSLOG or a file"], 
+["get logtarget", "gets logging target"], 
+['', "JAIL CONTROL", ""],
+["add <JAIL> <BACKEND>", "creates <JAIL> using <BACKEND>"], 
+["start <JAIL>", "starts the jail <JAIL>"], 
+["stop <JAIL>", "stops the jail <JAIL>. The jail is removed"], 
+["status <JAIL>", "gets the current status of <JAIL>"],
+['', "JAIL CONFIGURATION", ""],
+["set <JAIL> idle on|off", "sets the idle state of <JAIL>"], 
+["set <JAIL> addignoreip <IP>", "adds <IP> to the ignore list of <JAIL>"], 
+["set <JAIL> delignoreip <IP>", "removes <IP> from the ignore list of <JAIL>"], 
+["set <JAIL> addlogpath <FILE>", "adds <FILE> to the monitoring list of <JAIL>"], 
+["set <JAIL> dellogpath <FILE>", "removes <FILE> to the monitoring list of <JAIL>"], 
+["set <JAIL> timeregex <REGEX>", "sets the regular expression <REGEX> to match the date format for <JAIL>. This will disable the autodetection feature."], 
+["set <JAIL> timepattern <PATTERN>", "sets the pattern <PATTERN> to match the date format for <JAIL>. This will disable the autodetection feature."], 
+["set <JAIL> addfailregex <REGEX>", "adds the regular expression <REGEX> which must match failures for <JAIL>"], 
+["set <JAIL> delfailregex <INDEX>", "removes the regular expression at <INDEX> for failregex"], 
+["set <JAIL> addignoreregex <REGEX>", "adds the regular expression <REGEX> which should match pattern to exclude for <JAIL>"],
+["set <JAIL> delignoreregex <INDEX>", "removes the regular expression at <INDEX> for ignoreregex"], 
+["set <JAIL> findtime <TIME>", "sets the number of seconds <TIME> for which the filter will look back for <JAIL>"], 
+["set <JAIL> bantime <TIME>", "sets the number of seconds <TIME> a host will be banned for <JAIL>"], 
+["set <JAIL> maxretry <RETRY>", "sets the number of failures <RETRY> before banning the host for <JAIL>"], 
+["set <JAIL> addaction <ACT>", "adds a new action named <NAME> for <JAIL>"], 
+["set <JAIL> delaction <ACT>", "removes the action <NAME> from <JAIL>"], 
+["set <JAIL> setcinfo <ACT> <KEY> <VALUE>", "sets <VALUE> for <KEY> of the action <NAME> for <JAIL>"], 
+["set <JAIL> delcinfo <ACT> <KEY>", "removes <KEY> for the action <NAME> for <JAIL>"], 
+["set <JAIL> actionstart <ACT> <CMD>", "sets the start command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actionstop <ACT> <CMD>", "sets the stop command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actioncheck <ACT> <CMD>", "sets the check command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actionban <ACT> <CMD>", "sets the ban command <CMD> of the action <ACT> for <JAIL>"],
+["set <JAIL> actionunban <ACT> <CMD>", "sets the unban command <CMD> of the action <ACT> for <JAIL>"], 
+['', "JAIL INFORMATION", ""],
+["get <JAIL> logpath", "gets the list of the monitored files for <JAIL>"],
+["get <JAIL> ignoreip", "gets the list of ignored IP addresses for <JAIL>"],
+["get <JAIL> timeregex", "gets the regular expression used for the time detection for <JAIL>"],
+["get <JAIL> timepattern", "gets the pattern used for the time detection for <JAIL>"],
+["get <JAIL> failregex", "gets the list of regular expressions which matches the failures for <JAIL>"],
+["get <JAIL> ignoreregex", "gets the list of regular expressions which matches patterns to ignore for <JAIL>"],
+["get <JAIL> findtime", "gets the time for which the filter will look back for failures for <JAIL>"],
+["get <JAIL> bantime", "gets the time a host is banned for <JAIL>"],
+["get <JAIL> maxretry", "gets the number of failures allowed for <JAIL>"],
+["get <JAIL> addaction", "gets the last action which has been added for <JAIL>"],
+["get <JAIL> actionstart <ACT>", "gets the start command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionstop <ACT>", "gets the stop command for the action <ACT> for <JAIL>"],
+["get <JAIL> actioncheck <ACT>", "gets the check command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionban <ACT>", "gets the ban command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionunban <ACT>", "gets the unban command for the action <ACT> for <JAIL>"],
+]
+
+##
+# Prints the protocol in a "man" format. This is used for the
+# "-h" output of fail2ban-client.
+
+def printFormatted():
+	INDENT=4
+	MARGIN=41
+	WIDTH=34
+	firstHeading = False
+	for m in protocol:
+		if m[0] == '' and firstHeading:
+			print
+		firstHeading = True
+		first = True
+		for n in textwrap.wrap(m[1], WIDTH):
+			if first:
+				line = ' ' * INDENT + m[0] + ' ' * (MARGIN - len(m[0])) + n
+				first = False
+			else:
+				line = ' ' * (INDENT + MARGIN) + n
+			print line
+
+##
+# Prints the protocol in a "mediawiki" format.
+
+def printWiki():
+	firstHeading = False
+	for m in protocol:
+		if m[0] == '':
+			if firstHeading:
+				print "|}"
+			__printWikiHeader(m[1], m[2])
+			firstHeading = True
+		else:
+			print "|-"
+			print "| <span style=\"white-space:nowrap;\"><tt>" + m[0] + "</tt></span> || || " + m[1]
+	print "|}"
+
+def __printWikiHeader(section, desc):
+	print
+	print "=== " + section + " ==="
+	print
+	print desc
+	print
+	print "{|"
+	print "| '''Command''' || || '''Description'''"

common/version.py

@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.0"
+version = "0.7.7"

config/action.d/dummy.conf

@@ -7,48 +7,46 @@
 
 [Definition]
 
-# Option:  fwstart
+# Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstart = touch /tmp/fail2ban.dummy
               echo "<init>" >> /tmp/fail2ban.dummy
 
-# Option:  fwend
+# Option:  actionend
 # Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
+# Values:  CMD
 #
-actionstop = rm /tmp/fail2ban.dummy
+actionstop = rm -f /tmp/fail2ban.dummy
 
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
 #
 actioncheck = 
 
-# Option:  fwban
+# Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
 #          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
 #
 actionban = echo "+<ip>" >> /tmp/fail2ban.dummy
 
-# Option:  fwunban
+# Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
 #
 actionunban = echo "-<ip>" >> /tmp/fail2ban.dummy
 
 [Init]
 
 init = 123
+

config/action.d/hostsdeny.conf

@@ -7,49 +7,44 @@
 
 [Definition]
 
-# Option:  fwstart
+# Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstart = touch <tmpfile>
 
-# Option:  fwend
+# Option:  actionend
 # Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstop = rm -f <tmpfile>
 
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
 #
 actioncheck = 
 
-# Option:  fwban
+# Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
 #          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
 #
 actionban = IP=<ip> &&
             echo "ALL: $IP" >> <file>
 
-# Option:  fwunban
+# Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
 #
-actionunban = IP=<ip> &&
-              grep -v "ALL: $IP" <file> > <tmpfile> &&
-              mv <tmpfile> <file>
+actionunban = IP=<ip> && sed -i.old /ALL:\ $IP/d <file>
 
 [Init]
 
@@ -58,9 +53,3 @@ actionunban = IP=<ip> &&
 # Values:  STR  Default:  /etc/hosts.deny
 #
 file = /etc/hosts.deny
-
-# Option:  file
-# Notes.:  hosts.deny temporary file path.
-# Values:  STR  Default:  /etc/hostsdeny.failban
-#
-tmpfile = /tmp/hosts.deny.tmp

config/action.d/ipfw.conf

@@ -0,0 +1,65 @@
+# Fail2Ban configuration file
+#
+# Author: Nick Munger
+# Modified by: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = 
+
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = 
+
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = ipaction add deny tcp from <ip> to <localhost> <port>
+
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = ipaction delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
+
+[Init]
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]
+#
+port = ssh
+
+# Option:  localhost
+# Notes.:  the local IP address of the network interface
+# Values:  IP
+#
+localhost = 127.0.0.1

config/action.d/iptables-multiport.conf

@@ -0,0 +1,69 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified by Yaroslav Halchenko for multiport banning
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+

config/action.d/iptables-new.conf

@@ -0,0 +1,71 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Copied from iptables.conf and modified by Yaroslav Halchenko 
+#  to fullfill the needs of bugreporter dbts#350746.
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I INPUT -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+

config/action.d/iptables.conf

@@ -7,48 +7,45 @@
 
 [Definition]
 
-# Option:  fwstart
+# Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstart = iptables -N fail2ban-<name>
               iptables -A fail2ban-<name> -j RETURN
               iptables -I INPUT -p <protocol> --dport <port> -j fail2ban-<name>
 
-# Option:  fwend
+# Option:  actionend
 # Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstop = iptables -D INPUT -p <protocol> --dport <port> -j fail2ban-<name>
              iptables -F fail2ban-<name>
              iptables -X fail2ban-<name>
 
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
 #
-actioncheck = iptables -L INPUT | grep -q fail2ban-<name>
+actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
 
-# Option:  fwban
+# Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
 #          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
 #
 actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 
-# Option:  fwunban
+# Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
 #
 actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
 
@@ -69,3 +66,4 @@ port = ssh
 # Values:  [ tcp | udp | icmp | all ] Default: tcp
 #
 protocol = tcp
+

config/action.d/mail-whois-lines.conf

@@ -0,0 +1,75 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified-By: Yaroslav Halchenko to include grepping on IP over log files
+# $Revision$
+#
+
+[Definition]
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = echo -en "Hi,\n
+              The jail <name> has been started successfuly.\n
+              Regards,\n
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = echo -en "Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = echo -en "Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n
+            `whois <ip>`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `grep '\<<ip>\>' <logpath>`\n\n
+            Regards,\n
+            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destinataire of the mail
+#
+dest = root
+
+# Path to the log files which contain relevant lines for the abuser IP
+#
+logpath = /dev/null

config/action.d/mail-whois.conf

@@ -2,44 +2,42 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision: 254 $
+# $Revision$
 #
 
 [Definition]
 
-# Option:  fwstart
+# Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstart = echo -en "Hi,\n
               The jail <name> has been started successfuly.\n
               Regards,\n
               Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
 
-# Option:  fwend
+# Option:  actionend
 # Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstop = echo -en "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
              Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
 
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
 #
 actioncheck = 
 
-# Option:  fwban
+# Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
 #          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
 #
 actionban = echo -en "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
@@ -49,14 +47,13 @@ actionban = echo -en "Hi,\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
 
-# Option:  fwunban
+# Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
 #
 actionunban = 
 
@@ -66,6 +63,7 @@ actionunban =
 #
 name = default
 
-# Destinataire of the mail
+# Destination/Addressee of the mail
 #
 dest = root
+

config/action.d/mail.conf

@@ -2,44 +2,42 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision: 254 $
+# $Revision$
 #
 
 [Definition]
 
-# Option:  fwstart
+# Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstart = echo -en "Hi,\n
               The jail <name> has been started successfuly.\n
               Regards,\n
               Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
 
-# Option:  fwend
+# Option:  actionend
 # Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstop = echo -en "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
              Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
 
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
 #
 actioncheck = 
 
-# Option:  fwban
+# Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
 #          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
 #
 actionban = echo -en "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
@@ -47,14 +45,13 @@ actionban = echo -en "Hi,\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
 
-# Option:  fwunban
+# Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
 #
 actionunban = 
 
@@ -64,6 +61,7 @@ actionunban =
 #
 name = default
 
-# Destinataire of the mail
+# Destination/Addressee of the mail
 #
 dest = root
+

config/action.d/shorewall.conf

@@ -0,0 +1,46 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = 
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = 
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = shorewall reject <ip>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = shorewall allow <ip>

config/fail2ban.conf

@@ -18,7 +18,17 @@
 loglevel = 3
 
 # Option:  logtarget
-# Notes.:  Set the log target. This could be a file, SYSLOG, STDERR.
-# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+# Notes.:  Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
+#          Only one log target can be specified.
+# Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
 #
 logtarget = /var/log/fail2ban.log
+
+# Option: socket
+# Notes.: Set the socket file. This is used to communicate with the daemon. Do
+#         not remove this file when Fail2ban runs. It will not be possible to
+#         communicate with the server afterwards.
+# Values: FILE  Default:  /tmp/fail2ban.sock
+#
+socket = /tmp/fail2ban.sock
+

config/filter.d/apache-auth.conf

@@ -7,36 +7,17 @@
 
 [Definition]
 
-# Option:  maxretry
-# Notes.:  number of failures before IP gets banned.
-# Values:  NUM  Default:  5
-#
-maxretry = 5
-
-# Option:  logfile
-# Notes.:  logfile to monitor.
-# Values:  FILE  Default:  /var/log/httpd/access_log
-#
-logfile = /var/log/httpd/access_log
-
-# Option:  timeregex
-# Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
-#          use timeregex = @[0-9a-f]{24}
-# Values:  [Wed Jan 05 15:08:01 2005]
-# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
-#
-timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
-
-# Option:  timepattern
-# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
-#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
-#          For TAI64N format, use timepattern = tai64n
-# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
-#
-timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
-
 # Option:  failregex
-# Notes.:  regex to match the password failure messages in the logfile.
-# Values:  TEXT  Default:  authentication failure|user .* not found
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
 #
-failregex = authentication failure|user .* not found
+failregex = [[]client <HOST>[]] user .*(?:: authentication failure|not found)
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/apache-noscript.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = [[]client <HOST>[]] File does not exist: .*(\.php|\.asp)
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/courierlogin.conf

@@ -0,0 +1,24 @@
+# Fail2Ban configuration file
+#
+# Author: Christoph Haas
+# Modified by: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = LOGIN FAILED, .*, ip=\[<HOST>\]$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/couriersmtp.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = error,relay=<HOST>,.*550 User unknown
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/exim.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = \[<HOST>\] .*(?:rejected by local_scan|Unrouteable address)
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/postfix.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = reject: RCPT from (.*)\[<HOST>\]: 554
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/proftpd.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values: TEXT
+#
+failregex = USER \S+: no such user found from \S* ?\[<HOST>\] to \S+\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/qmail.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip )<HOST>
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/sasl.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values: TEXT
+#
+failregex = : warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/sshd-ddos.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = sshd\[\S*\]: Did not receive identification string from <HOST>
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/sshd.conf

@@ -7,37 +7,20 @@
 
 [Definition]
 
-# Option:  maxretry
-# Notes.:  number of failures before IP gets banned.
-# Values:  NUM  Default:  5
-#
-maxretry = 5
-
-# Option:  logpath
-# Notes.:  logfile to monitor.
-# Values:  FILE  Default:  /var/log/secure
-#
-logpath = /var/log/secure
-
-# Option:  timeregex
-# Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
-#          use timeregex = @[0-9a-f]{24}
-# Values:  [Mar  7 17:53:28]
-# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-#
-timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-
-# Option:  timepattern
-# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
-#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
-#          For TAI64N format, use timepattern = tai64n
-# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
-#
-timepattern = %%b %%d %%H:%%M:%%S
-
 # Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile.
-# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
 #
-failregex = (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
+failregex = Authentication failure for .* from <HOST>
+            Failed [-/\w+]+ for .* from <HOST>
+            ROOT LOGIN REFUSED .* FROM <HOST>
+            [iI](?:llegal|nvalid) user .* from <HOST>
 
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/vsftpd.conf

@@ -7,34 +7,18 @@
 
 [Definition]
 
-# Option:  maxretry
-# Notes.:  number of failures before IP gets banned.
-# Values:  NUM  Default:  5
-#
-maxretry = 5
-
-# Option: logfile
-# Notes.: logfile to monitor.
-# Values: FILE Default: /var/log/vsftpd.log
-#
-logfile = /var/log/vsftpd.log
-
-# Option: timeregex
-# Notes.: regex to match timestamp in VSFTPD logfile.
-# Values: [Mar 7 17:53:28]
-# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-#
-timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-
-# Option: timepattern
-# Notes.: format used in "timeregex" fields definition. Note that '%' must be
-# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
-# Values: TEXT Default: %%b %%d %%H:%%M:%%S
-#
-timepattern = %%b %%d %%H:%%M:%%S
-
 # Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
-# Values: TEXT Default: Authentication failure|Failed password|Invalid user
+# Notes.: regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values: TEXT
 #
-failregex = FAIL LOGIN
+failregex = vsftpd: .* authentication failure; .* rhost=<HOST>$
+            \[.+\] FAIL LOGIN: Client "<HOST>"$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

config/filter.d/wuftpd.conf

@@ -0,0 +1,14 @@
+# Fail2Ban configuration file for wuftpd
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision:  $
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = wu-ftpd\[\d+\]:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>

config/jail.conf

@@ -5,11 +5,138 @@
 # $Revision$
 #
 
-[dummy]
+# The DEFAULT allows a global definition of the options. They can be override
+# in each jail afterwards.
 
-enabled = false
-filter = sshd
-action = hostsdeny[file=/tmp/hosts.deny]
-         mail[name=SSH, dest=cyril.jaquier@bluewin.ch]
-maxretry = 2
-bantime = 10
+[DEFAULT]
+
+# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
+# ban a host which matches an address in this list. Several addresses can be
+# defined using space separator.
+ignoreip = 127.0.0.1
+
+# "bantime" is the number of seconds that a host is banned.
+bantime  = 600
+
+# A host is banned if it has generated "maxretry" during the last "findtime"
+# seconds.
+findtime  = 600
+
+# "maxretry" is the number of failures before a host get banned.
+maxretry = 3
+
+# "backend" specifies the backend used to get files modification. Available
+# options are "gamin", "polling" and "auto". This option can be overridden in
+# each jail too (use "gamin" for a jail and "polling" for another).
+#
+# gamin:   requires Gamin (a file alteration monitor) to be installed. If Gamin
+#          is not installed, Fail2ban will use polling.
+# polling: uses a polling algorithm which does not require external libraries.
+# auto:    will choose Gamin if available and polling otherwise.
+backend = auto
+
+
+# This jail corresponds to the standard configuration in Fail2ban 0.6.
+# The mail-whois action send a notification e-mail with a whois request
+# in the body.
+
+[ssh-iptables]
+
+enabled  = false
+filter   = sshd
+action   = iptables[name=SSH, port=ssh, protocol=tcp]
+           mail-whois[name=SSH, dest=yourmail@mail.com]
+logpath  = /var/log/sshd.log
+maxretry = 5
+
+[proftpd-iptables]
+
+enabled  = false
+filter   = proftpd
+action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
+           mail-whois[name=ProFTPD, dest=yourmail@mail.com]
+logpath  = /var/log/proftpd/proftpd.log
+maxretry = 6
+
+# This jail forces the backend to "polling".
+
+[sasl-iptables]
+
+enabled  = false
+filter   = sasl
+backend  = polling
+action   = iptables[name=sasl, port=smtp, protocol=tcp]
+           mail-whois[name=sasl, dest=yourmail@mail.com]
+logpath  = /var/log/mail.log
+
+# Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
+# used to avoid banning the user "myuser".
+
+[ssh-tcpwrapper]
+
+enabled     = false
+filter      = sshd
+action      = hostsdeny
+              mail-whois[name=SSH, dest=yourmail@mail.com]
+ignoreregex = for myuser from
+logpath     = /var/log/sshd.log
+
+# This jail demonstrates the use of wildcards in "logpath".
+# Moreover, it is possible to give other files on a new line.
+
+[apache-tcpwrapper]
+
+enabled  = false
+filter	 = apache-auth
+action   = hostsdeny
+logpath  = /var/log/apache*/*access.log
+           /home/www/myhomepage/access.log
+maxretry = 6
+
+# The hosts.deny path can be defined with the "file" argument if it is
+# not in /etc.
+
+[postfix-tcpwrapper]
+
+enabled  = false
+filter   = postfix
+action   = hostsdeny[file=/not/a/standard/path/hosts.deny]
+           mail[name=Postfix, dest=yourmail@mail.com]
+logpath  = /var/log/postfix.log
+bantime  = 300
+
+# Do not ban anybody. Just report information about the remote host.
+# A notification is sent at most every 600 seconds (bantime).
+
+[vsftpd-notification]
+
+enabled  = false
+filter   = vsftpd
+action   = mail-whois[name=VSFTPD, dest=yourmail@mail.com]
+logpath  = /var/log/vsftpd.log
+maxretry = 5
+bantime  = 1800
+
+# Use shorewall instead of iptables.
+
+[apache-shorewall]
+
+enabled  = false
+filter   = apache-noscript
+action   = shorewall
+           mail[name=Postfix, dest=yourmail@mail.com]
+logpath  = /var/log/apache2/error_log
+
+# This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
+# option is overridden in this jail. Moreover, the action "mail-whois" defines
+# the variable "name" which contains a comma using "". The characters '' are
+# valid too.
+
+[ssh-ipfw]
+
+enabled  = false
+filter   = sshd
+action   = ipfw[localhost=192.168.0.1]
+           mail-whois[name="SSH,IPFW", dest=yourmail@mail.com]
+logpath  = /var/log/auth.log
+ignoreip = 168.192.0.1

doc/Doxyfile

@@ -23,7 +23,7 @@ PROJECT_NAME           = Fail2Ban
 # This could be handy for archiving the generated documentation or 
 # if some version control system is used.
 
-PROJECT_NUMBER         = 0.7
+PROJECT_NUMBER         = 0.7-SVN
 
 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) 
 # base path where the generated documentation will be put. 
@@ -193,7 +193,7 @@ OPTIMIZE_OUTPUT_FOR_C  = NO
 # For instance, namespaces will be presented as packages, qualified scopes 
 # will look different, etc.
 
-OPTIMIZE_OUTPUT_JAVA   = YES
+OPTIMIZE_OUTPUT_JAVA   = NO
 
 # If you use STL classes (i.e. std::string, std::vector, etc.) but do not want to 
 # include (a tag file for) the STL sources as input, then you should 
@@ -233,7 +233,7 @@ EXTRACT_ALL            = YES
 # If the EXTRACT_PRIVATE tag is set to YES all private members of a class 
 # will be included in the documentation.
 
-EXTRACT_PRIVATE        = YES
+EXTRACT_PRIVATE        = NO
 
 # If the EXTRACT_STATIC tag is set to YES all static members of a file 
 # will be included in the documentation.
@@ -387,7 +387,7 @@ SHOW_USED_FILES        = YES
 # then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy 
 # in the documentation. The default is NO.
 
-SHOW_DIRECTORIES       = NO
+SHOW_DIRECTORIES       = YES
 
 # The FILE_VERSION_FILTER tag can be used to specify a program or script that 
 # doxygen should invoke to get the current version for each file (typically from the 
@@ -459,7 +459,7 @@ WARN_LOGFILE           =
 # directories like "/usr/src/myproject". Separate the files or directories 
 # with spaces.
 
-INPUT                  = ../server ../client ../testcases ../utils ../
+INPUT                  = ../server ../client ../testcases ../
 
 # If the value of the INPUT tag contains directories, you can use the 
 # FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp 
@@ -1141,7 +1141,7 @@ INCLUDED_BY_GRAPH      = YES
 # So in most cases it will be better to enable call graphs for selected 
 # functions only using the \callgraph command.
 
-CALL_GRAPH             = NO
+CALL_GRAPH             = YES
 
 # If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen 
 # will graphical hierarchy of all classes instead of a textual one.
@@ -1206,7 +1206,7 @@ MAX_DOT_GRAPH_DEPTH    = 0
 # badly anti-aliased labels on the edges of a graph (i.e. they become hard to 
 # read).
 
-DOT_TRANSPARENT        = NO
+DOT_TRANSPARENT        = YES
 
 # Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output 
 # files in one run (i.e. multiple -o and -T options on the command line). This 

fail2ban-client

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -25,16 +25,19 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import sys, string, os, pickle, re, logging, getopt, time
+import sys, string, os, pickle, re, logging, signal
+import getopt, time, readline, shlex, socket
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-sys.path.insert(1, "/usr/lib/fail2ban")
+sys.path.insert(1, "/usr/share/fail2ban")
 
 # Now we can import our modules
-from version import version
+from common.version import version
+from common.protocol import printFormatted
 from client.csocket import CSocket
 from client.configurator import Configurator
+from client.beautifier import Beautifier
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.client")
@@ -45,91 +48,118 @@ logSys = logging.getLogger("fail2ban.client")
 
 class Fail2banClient:
 
+	prompt = "fail2ban> "
+
 	def __init__(self):
-		self.argv = None
-		self.stream = None
-		self.conf = dict()
-		self.conf["conf"] = "/etc/fail2ban"
-		self.conf["dump"] = False
-		self.conf["force"] = False
-		self.conf["verbose"] = 2
+		self.__argv = None
+		self.__stream = None
+		self.__configurator = Configurator()
+		self.__conf = dict()
+		self.__conf["conf"] = "/etc/fail2ban"
+		self.__conf["dump"] = False
+		self.__conf["force"] = False
+		self.__conf["verbose"] = 1
+		self.__conf["interactive"] = False
+		self.__conf["socket"] = None
+		
+	def dispVersion(self):
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2006 Cyril Jaquier"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
 	
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
-		print "Usage: "+self.argv[0]+" [OPTIONS] <COMMAND>"
+		print "Usage: "+self.__argv[0]+" [OPTIONS] <COMMAND>"
 		print
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
 		print
-		print "  <COMMAND>"
-		print
-		print "    start                   start the server and the jails"
-		print "    reload                  reload the configuration"
-		print "    stop                    stop all jails and terminate the server"
-		print "    status                  get the current status"
-		print
-		print "    set loglevel <LEVEL>    set loglevel to <LEVEL>"
-		print "    get loglevel            get loglevel"
-		print "    set logtarget <TARGET>  set log target to <TARGET>"
-		print "    get logtarget           get log target"
-		print
-		print "    add <JAIL>              create <JAIL>"
-		print "    set <JAIL> <CMD>        set the <CMD> value for <JAIL>"
-		print "    get <JAIL> <CMD>        get the <CMD> value for <JAIL>"
-		print "    start <JAIL>            start <JAIL>"
-		print "    stop <JAIL>             stop <JAIL>. The jail is removed"
-		print "    status <JAIL>           get the current status of <JAIL>"
-		print
-		print "  [OPTIONS]"
-		print
+		print "Options:"
 		print "    -c <DIR>                configuration directory"
+		print "    -s <FILE>               socket path"
 		print "    -d                      dump configuration. For debugging"
+		print "    -i                      interactive mode"
 		print "    -v                      increase verbosity"
 		print "    -q                      decrease verbosity"
-		print "    -x                      force execution of the server"
-		print "    -h                      display this help message"
+		print "    -x                      force execution of the server (remove socket file)"
+		print "    -h, --help              display this help message"
+		print "    -V, --version           print the version"
+		print
+		print "Command:"
+		
+		# Prints the protocol
+		printFormatted()
+		
 		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	
-	def getCmdLineOptions(self, optList):
+	def dispInteractive(self):
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print 
+
+	def __sigTERMhandler(self, signum, frame):
+		# Print a new line because we probably come from wait
+		print
+		logSys.warn("Caught signal %d. Exiting" % signum)
+		sys.exit(-1)
+
+	def __getCmdLineOptions(self, optList):
 		""" Gets the command line options
 		"""
 		for opt in optList:
 			if opt[0] == "-c":
-				self.conf["conf"] = opt[1]
+				self.__conf["conf"] = opt[1]
+			elif opt[0] == "-s":
+				self.__conf["socket"] = opt[1]
 			elif opt[0] == "-d":
-				self.conf["dump"] = True
+				self.__conf["dump"] = True
 			elif opt[0] == "-v":
-				self.conf["verbose"] = self.conf["verbose"] + 1
+				self.__conf["verbose"] = self.__conf["verbose"] + 1
 			elif opt[0] == "-q":
-				self.conf["verbose"] = self.conf["verbose"] - 1
+				self.__conf["verbose"] = self.__conf["verbose"] - 1
 			elif opt[0] == "-x":
-				self.conf["force"] = True
+				self.__conf["force"] = True
+			elif opt[0] == "-i":
+				self.__conf["interactive"] = True
 			elif opt[0] in ["-h", "--help"]:
 	 			self.dispUsage()
 	 			sys.exit(0)
+	 		elif opt[0] in ["-V", "--version"]:
+	 			self.dispVersion()
+	 			sys.exit(0)
 	
-	def ping(self):
-		return self.processCmd([["ping"]], False)
+	def __ping(self):
+		return self.__processCmd([["ping"]], False)
 	
-	@staticmethod
-	def processCmd(cmd, showRet = True):
+	def __processCmd(self, cmd, showRet = True):
+		beautifier = Beautifier()
 		for c in cmd:
+			beautifier.setInputCmd(c)
 			try:
-				client = CSocket()
+				client = CSocket(self.__conf["socket"])
+				ret = client.send(c)
+				if ret[0] == 0:
+					logSys.debug("OK : " + `ret[1]`)
+					if showRet:
+						print beautifier.beautify(ret[1])
+				else:
+					logSys.debug("NOK: " + `ret[1].args`)
+					print beautifier.beautifyError(ret[1])
+					return False
+			except socket.error:
+				if showRet:
+					logSys.error("Unable to contact server. Is it running?")
+				return False
 			except Exception, e:
 				if showRet:
 					logSys.error(e)
-					logSys.error("Arrggh... Start the server first")
-				return False
-			ret = client.send(c)
-			if ret[0] == 0:
-				logSys.debug("OK : " + `ret[1]`)
-				if showRet:
-					print `ret[1]`
-			else:
-				logSys.error("NOK: " + `ret[1].args`)
 				return False
 		return True
 		
@@ -139,44 +169,47 @@ class Fail2banClient:
 	# Process one command line and exit.
 	# @param cmd the command line
 
-	def processCommand(self, cmd):
-		if self.conf["dump"]:
-			self.readConfig()
-			self.dumpConfig(self.stream)
-			return True
-		
-		if len(sys.argv) < 2:
-			self.dispUsage()
-			return False
-		
+	def __processCommand(self, cmd):
 		if len(cmd) == 1 and cmd[0] == "start":
-			if self.ping():
-				logSys.info("Server already running")
+			if self.__ping():
+				logSys.error("Server already running")
 				return False
 			else:
-				self.startServerAsync(self.conf["force"])
-				# Read the config while the server is starting
-				self.readConfig()
+				# Read the config
+				ret = self.__readConfig()
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
+				# Start the server
+				self.__startServerAsync(self.__conf["socket"],
+										self.__conf["force"])
 				try:
 					# Wait for the server to start
-					self.waitOnServer()
+					self.__waitOnServer()
 					# Configure the server
-					self.processCmd(self.stream, False)
+					self.__processCmd(self.__stream, False)
 					return True
 				except ServerExecutionException:
-					logSys.error("Could not start server. Try -x option")
+					logSys.error("Could not start server. Maybe an old " +
+								 "socket file is still present. Try to " +
+								 "remove " + self.__conf["socket"] + ". If " +
+								 "you used fail2ban-client to start the " +
+								 "server, adding the -x option will do it")
 					return False
 		elif len(cmd) == 1 and cmd[0] == "reload":
-			if self.ping():
-				self.readConfig()
-				self.processCmd(['stop', 'all'], False)
+			if self.__ping():
+				ret = self.__readConfig()
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
+				self.__processCmd([['stop', 'all']], False)
 				# Configure the server
-				return self.processCmd(self.stream, False)
+				return self.__processCmd(self.__stream, False)
 			else:
 				logSys.error("Could not find server")
 				return False
 		else:
-			return self.processCmd([cmd])
+			return self.__processCmd([cmd])
 	
 	
 	##
@@ -184,44 +217,81 @@ class Fail2banClient:
 	#
 	# Start the Fail2ban server in daemon mode.
 	
-	def startServerAsync(self, force = False):
-		args = list()
-		
-		args.append("fail2ban-server")
-		args.append("-b")
-		if force:
-			args.append("-x")
-		
+	def __startServerAsync(self, socket, force = False):
+		# Forks the current process.
 		pid = os.fork()
 		if pid == 0:
-			os.execv("fail2ban-server", args)
+			args = list()
+			args.append("fail2ban-server")
+			# Start in background mode.
+			args.append("-b")
+			# Set the socket path.
+			args.append("-s")
+			args.append(socket)
+			# Force the execution if needed.
+			if force:
+				args.append("-x")
+			try:
+				# Use the PATH env
+				os.execvp("fail2ban-server", args)
+			except OSError:
+				try:
+					# Use the current directory
+					os.execv("fail2ban-server", args)
+				except OSError:
+					print "Could not find fail2ban-server"
+					os.exit(-1)
 						
 			
-	def waitOnServer(self):
+	def __waitOnServer(self):
 		# Wait for the server to start
 		cnt = 0
-		while not self.ping():
-			if cnt > 10:
+		if self.__conf["verbose"] > 1:
+			pos = 0
+			delta = 1
+			mask = "[          ]"
+		while not self.__ping():
+			# Wonderful visual :)
+			if self.__conf["verbose"] > 1:
+				pos += delta
+				sys.stdout.write("\rINFO   " + mask[:pos] + '#' + mask[pos+1:] +
+								 " Waiting on the server...")
+				sys.stdout.flush()
+				if pos > len(mask)-3:
+					delta = -1
+				elif pos < 2:
+					delta = 1
+			# The server has 30 secondes to start.
+			if cnt >= 300:
+				if self.__conf["verbose"] > 1:
+					sys.stdout.write('\n')
 				raise ServerExecutionException("Failed to start server")
 			time.sleep(0.1)
-			cnt = cnt + 1
+			cnt += 1
+		if self.__conf["verbose"] > 1:
+			sys.stdout.write('\n')
 			
 	
 	def start(self, argv):
 		# Command line options
-		self.argv = argv
+		self.__argv = argv
+		
+		# Install signal handlers
+		signal.signal(signal.SIGTERM, self.__sigTERMhandler)
+		signal.signal(signal.SIGINT, self.__sigTERMhandler)
 		
 		# Reads the command line options.
 		try:
-			cmdOpts = 'hc:xdvq'
-			cmdLongOpts = ['help']
-			optList, args = getopt.getopt(self.argv[1:], cmdOpts, cmdLongOpts)
+			cmdOpts = 'hc:s:xdviqV'
+			cmdLongOpts = ['help', 'version']
+			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
 			self.dispUsage()
+			return False
 			
-		self.getCmdLineOptions(optList)
+		self.__getCmdLineOptions(optList)
 		
-		verbose = self.conf["verbose"]
+		verbose = self.__conf["verbose"]
 		if verbose <= 0:
 			logSys.setLevel(logging.ERROR)
 		elif verbose == 1:
@@ -238,16 +308,54 @@ class Fail2banClient:
 		stdout.setFormatter(formatter)
 		logSys.addHandler(stdout)
 
-		return self.processCommand(args)
+		# Set the configuration path
+		self.__configurator.setBaseDir(self.__conf["conf"])
+		
+		# Set socket path
+		self.__configurator.readEarly()
+		socket = self.__configurator.getEarlyOptions()
+		if self.__conf["socket"] == None:
+			self.__conf["socket"] = socket["socket"]
+		logSys.info("Using socket file " + self.__conf["socket"])
 
-	def readConfig(self):
+		if self.__conf["dump"]:
+			ret = self.__readConfig()
+			self.dumpConfig(self.__stream)
+			return ret
+		
+		# Interactive mode
+		if self.__conf["interactive"]:
+			try:
+				ret = True
+				if len(args) > 0:
+					ret = self.__processCommand(args)
+				if ret:
+					readline.parse_and_bind("tab: complete")
+					self.dispInteractive()
+					while True:
+						cmd = raw_input(self.prompt)
+						if cmd == "exit" or cmd == "quit":
+							# Exit
+							return True
+						if not cmd == "":
+							self.__processCommand(shlex.split(cmd))
+			except (EOFError, KeyboardInterrupt):
+				print
+				return True
+		# Single command mode
+		else:
+			if len(args) < 1:
+				self.dispUsage()
+				return False
+			return self.__processCommand(args)
+
+	def __readConfig(self):
 		# Read the configuration
-		cfg = Configurator()
-		cfg.setBaseDir(self.conf["conf"])
-		cfg.readAll()
-		cfg.getAllOptions()
-		cfg.convertToProtocol()
-		self.stream = cfg.getConfigStream()
+		self.__configurator.readAll()
+		ret = self.__configurator.getAllOptions()
+		self.__configurator.convertToProtocol()
+		self.__stream = self.__configurator.getConfigStream()
+		return ret
 	
 	@staticmethod
 	def dumpConfig(cmd):
@@ -266,4 +374,3 @@ if __name__ == "__main__":
 		sys.exit(0)
 	else:
 		sys.exit(-1)
-

fail2ban-regex

@@ -0,0 +1,298 @@
+#!/usr/bin/python
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import getopt, sys, time, logging, os
+
+# Inserts our own modules path first in the list
+# fix for bug #343821
+sys.path.insert(1, "/usr/share/fail2ban")
+
+from ConfigParser import SafeConfigParser
+from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
+from common.version import version
+from server.filter import Filter
+from server.regex import RegexException
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.regex")
+
+class RegexStat:
+
+	def __init__(self, failregex):
+		self.__stats = 0
+		self.__failregex = failregex
+		self.__ipList = list()
+	
+	def inc(self):
+		self.__stats += 1
+	
+	def getStats(self):
+		return self.__stats
+
+	def getFailRegex(self):
+		return self.__failregex
+	
+	def appendIP(self, value):
+		self.__ipList.extend(value)
+	
+	def getIPList(self):
+		return self.__ipList
+
+class Fail2banRegex:
+	
+	test = None
+	
+	def __init__(self):
+		self.__filter = Filter(None)
+		self.__failregex = list()
+		# Setup logging
+		logging.getLogger("fail2ban").handlers = []
+		self.__hdlr = logging.StreamHandler(Fail2banRegex.test)
+		# set a format which is simpler for console use
+		formatter = logging.Formatter("%(message)s")
+		# tell the handler to use this format
+		self.__hdlr.setFormatter(formatter)
+		logging.getLogger("fail2ban").addHandler(self.__hdlr)
+		logging.getLogger("fail2ban").setLevel(logging.ERROR)
+	
+	@staticmethod
+	def dispVersion():
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2006 Cyril Jaquier"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+	
+	@staticmethod
+	def dispUsage():
+		print "Usage: "+sys.argv[0]+" [OPTIONS] <LOG> <REGEX>"
+		print
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+		print "This tools can test regular expressions for \"fail2ban\"."
+		print
+		print "Options:"
+		print "    -h, --help              display this help message"
+		print "    -V, --version           print the version"
+		print
+		print "Log:"
+		print "    string                  a string representing a log line"
+		print "    filename                path to a log file (/var/log/auth.log)"
+		print
+		print "Regex:"
+		print "    string                  a string representing a 'failregex'"
+		print "    filename                path to a filter file (filter.d/sshd.conf)"
+		print
+		print "Report bugs to <lostcontrol@users.sourceforge.net>"
+	
+	def getCmdLineOptions(self, optList):
+		""" Gets the command line options
+		"""
+		for opt in optList:
+			if opt[0] in ["-h", "--help"]:
+				self.dispUsage()
+				sys.exit(0)
+			elif opt[0] in ["-V", "--version"]:
+				self.dispVersion()
+				sys.exit(0)
+
+	@staticmethod
+	def logIsFile(value):
+		return os.path.isfile(value)
+
+	def readRegex(self, value):
+		if os.path.isfile(value):
+			reader = SafeConfigParser()
+			try:
+				reader.read(value)
+				print "Use regex file : " + value
+				self.__failregex = [RegexStat(m)
+									for m in reader.get("Definition", "failregex").split('\n')]
+			except NoSectionError:
+				print "No [Definition] section in " + value
+				print
+				return False
+			except NoOptionError:
+				print "No failregex option in " + value
+				print
+				return False
+			except MissingSectionHeaderError:
+				print "No section headers in " + value
+				print
+				return False
+		else:
+			if len(value) > 53:
+				stripReg = value[0:50] + "..."
+			else:
+				stripReg = value
+			print "Use regex line : " + stripReg
+			self.__failregex = [RegexStat(value)]
+		return True
+	
+	def testRegex(self, line):
+		found = False
+		for regex in self.__failregex:
+			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
+			try:
+				self.__filter.addFailRegex(regex.getFailRegex())
+				try:
+					ret = self.__filter.findFailure(line)
+					if not len(ret) == 0:
+						if found == True:
+							ret[0].append(True)
+						else:
+							found = True
+							ret[0].append(False)
+						regex.inc()
+						regex.appendIP(ret)
+				except RegexException, e:
+					print e
+					return False
+				except IndexError:
+					print "Sorry, but no <host> found in regex"
+					return False
+			finally:
+				self.__filter.delFailRegex(0)
+				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
+	
+	def printStats(self):
+		print
+		print "Results"
+		print "======="
+		print
+		
+		# Print title
+		cnt = 1
+		print "Failregex:"
+		for failregex in self.__failregex:
+			print "[" + str(cnt) + "] " + failregex.getFailRegex()
+			cnt += 1
+		
+		print
+		
+		# Print stats
+		cnt = 1
+		total = 0
+		print "Number of matches:"
+		for failregex in self.__failregex:
+			match = failregex.getStats()
+			total += match
+			print "[" + str(cnt) + "] " + str(match) + " match(es)"
+			cnt += 1
+		
+		print
+		
+		if total == 0:
+			print "Sorry, no match"
+			print
+			print "Look at the above section 'Running tests' which could contain important"
+			print "information."
+			return False
+		else:
+			# Print stats
+			cnt = 1
+			print "Addresses found:"
+			for failregex in self.__failregex:
+				print "[" + str(cnt) + "]"
+				for ip in failregex.getIPList():
+					timeTuple = time.localtime(ip[1])
+					timeString = time.strftime("%a %b %d %H:%M:%S %Y", timeTuple)
+					if ip[2]:
+						dup = " (already matched)"
+					else:
+						dup = ""
+					print "    " + ip[0] + " (" + timeString + ")" + dup
+				cnt += 1
+			
+			print
+			
+			print "Date template hits:"
+			for template in self.__filter.dateDetector.getTemplates():
+				print `template.getHits()` + " hit: " + template.getName()
+			
+			print
+			
+			print "Success, the total number of match is " + str(total)
+			print
+			print "However, look at the above section 'Running tests' which could contain important"
+			print "information."
+			return True
+
+			
+if __name__ == "__main__":
+	fail2banRegex = Fail2banRegex()
+	# Reads the command line options.
+	try:
+		cmdOpts = 'hV'
+		cmdLongOpts = ['help', 'version']
+		optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
+	except getopt.GetoptError:
+		fail2banRegex.dispUsage()
+		sys.exit(-1)
+	# Process command line
+	fail2banRegex.getCmdLineOptions(optList)
+	# We need exactly 3 parameters
+	if not len(sys.argv) == 3:
+		fail2banRegex.dispUsage()
+		sys.exit(-1)
+	else:
+		print
+		print "Running tests"
+		print "============="
+		print
+
+		if fail2banRegex.readRegex(sys.argv[2]) == False:
+			sys.exit(-1)
+
+		if fail2banRegex.logIsFile(sys.argv[1]):
+			try:
+				hdlr = open(sys.argv[1])
+				print "Use log file   : " + sys.argv[1]
+				print
+				for line in hdlr:
+					fail2banRegex.testRegex(line)
+			except IOError, e:
+				print e
+				print
+				sys.exit(-1)
+		else:
+			if len(sys.argv[1]) > 53:
+				stripLog = sys.argv[1][0:50] + "..."
+			else:
+				stripLog = sys.argv[1]
+			print "Use single line: " + stripLog
+			print
+			fail2banRegex.testRegex(sys.argv[1])
+		
+		if fail2banRegex.printStats():
+			sys.exit(0)
+		else:
+			sys.exit(-1)

fail2ban-server

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -25,15 +25,14 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import locale, getopt, sys
+import getopt, sys
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-sys.path.insert(1, "/usr/lib/fail2ban")
+sys.path.insert(1, "/usr/share/fail2ban")
 
-from version import version
+from common.version import version
 from server.server import Server
-from utils.process import *
 
 ##
 # \mainpage Fail2Ban
@@ -46,76 +45,91 @@ from utils.process import *
 class Fail2banServer:
 	
 	def __init__(self):
-		self.server = None
-		self.argv = None
-		self.conf = dict()
-		self.conf["background"] = True
-		self.conf["force"] = False
+		self.__server = None
+		self.__argv = None
+		self.__conf = dict()
+		self.__conf["background"] = True
+		self.__conf["force"] = False
+		self.__conf["socket"] = "/tmp/fail2ban.sock"
+	
+	def dispVersion(self):
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2006 Cyril Jaquier"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
 	
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
-		print "Usage: "+self.argv[0]+" [OPTIONS]"
+		print "Usage: "+self.__argv[0]+" [OPTIONS]"
 		print
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
 		print
-		print "  -b         start in background"
-		print "  -f         start in foreground"
-		print "  -x         force execution of the server"
-		print "  -h         display this help message"
+		print "Only use this command for debugging purpose. Start the server with"
+		print "fail2ban-client instead. The default behaviour is to start the server"
+		print "in background."
+		print
+		print "Options:"
+		print "    -b                   start in background"
+		print "    -f                   start in foreground"
+		print "    -s <FILE>            socket path"
+		print "    -x                   force execution of the server (remove socket file)"
+		print "    -h, --help           display this help message"
+		print "    -V, --version        print the version"
 		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
-		sys.exit(0)
 	
-	def getCmdLineOptions(self, optList):
+	def __getCmdLineOptions(self, optList):
 		""" Gets the command line options
 		"""
 		for opt in optList:
 			if opt[0] == "-b":
-				self.conf["background"] = True
+				self.__conf["background"] = True
 			if opt[0] == "-f":
-				self.conf["background"] = False
+				self.__conf["background"] = False
+			if opt[0] == "-s":
+				self.__conf["socket"] = opt[1]
 			if opt[0] == "-x":
-				self.conf["force"] = True
+				self.__conf["force"] = True
 			if opt[0] in ["-h", "--help"]:
 	 			self.dispUsage()
-	
-	#def sigTERMhandler(signum, frame):
-	#	""" Handles the TERM signal when in daemon mode in order to
-	#		exit properly.
-	#	"""
-	#	logSys.debug("Signal handler called with sig "+`signum`)
-	#	server.quit()
-	
+				sys.exit(0)
+			if opt[0] in ["-V", "--version"]:
+	 			self.dispVersion()
+				sys.exit(0)
+		
 	def start(self, argv):
 		# Command line options
-		self.argv = argv
+		self.__argv = argv
 		
 		# Reads the command line options.
 		try:
-			cmdOpts = 'bfxh'
-			cmdLongOpts = ['help']
-			optList, args = getopt.getopt(self.argv[1:], cmdOpts, cmdLongOpts)
+			cmdOpts = 'bfs:xhV'
+			cmdLongOpts = ['help', 'version']
+			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
 			self.dispUsage()
+			sys.exit(-1)
 			
-		self.getCmdLineOptions(optList)
-		
-		if self.conf["background"]:
-			retCode = createDaemon()
-			#signal.signal(signal.SIGTERM, sigTERMhandler)
-			if not retCode:
-				print "Unable to start daemon"
-				sys.exit(-1)
+		self.__getCmdLineOptions(optList)
 		
 		try:
-			self.server = Server()
-			self.server.start(self.conf["force"])
+			self.__server = Server(self.__conf["background"])
+			self.__server.start(self.__conf["socket"], self.__conf["force"])
+			return True
 		except Exception, e:
 			print e
-			self.server.quit()
+			self.__server.quit()
+			return False
 		
 if __name__ == "__main__":
 	server = Fail2banServer()
-	server.start(sys.argv)
+	if server.start(sys.argv):
+		sys.exit(0)
+	else:
+		sys.exit(-1)

fail2ban-testcases

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -28,16 +28,19 @@ __license__ = "GPL"
 
 import unittest, logging, sys
 
-# Inserts our own modules path first in the list
-# fix for bug #343821
-sys.path.insert(1, "/usr/lib/fail2ban")
-
-from version import version
+from common.version import version
 from testcases import banmanagertestcase
 from testcases import clientreadertestcase
 from testcases import failmanagertestcase
 from testcases import filtertestcase
 from testcases import servertestcase
+from testcases import datedetectortestcase
+from testcases import actiontestcase
+from server.mytime import MyTime
+
+# Set the time to a fixed, known value
+# Sun Aug 14 12:00:00 CEST 2005
+MyTime.setTime(1124013600)
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban")
@@ -53,16 +56,19 @@ tests = unittest.TestSuite()
 # Filter
 tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
 tests.addTest(unittest.makeSuite(filtertestcase.LogFile))
-#tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
+tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
 # Server
 #tests.addTest(unittest.makeSuite(servertestcase.StartStop))
 #tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
+tests.addTest(unittest.makeSuite(actiontestcase.ExecuteAction))
 # FailManager
 tests.addTest(unittest.makeSuite(failmanagertestcase.AddFailure))
 # BanManager
 tests.addTest(unittest.makeSuite(banmanagertestcase.AddFailure))
 # ClientReader
 tests.addTest(unittest.makeSuite(clientreadertestcase.JailReaderTest))
+# DateDetector
+tests.addTest(unittest.makeSuite(datedetectortestcase.DateDetectorTest))
 
 # Tests runner
 testRunner = unittest.TextTestRunner()

files/cacti/README

@@ -0,0 +1,53 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.7.7)                           2007/??/??
+=============================================================
+
+Cacti is a graphing solution using RRDTool. It is possible to
+use Cacti to display statistics about Fail2ban.
+
+Installation:
+-------------
+
+1/ Install Fail2ban version 0.7 or higher and ensure that it
+   works properly.
+2/ The user running poller.php must have read and write
+   access to the socket used by Fail2ban.
+3/ Copy fail2ban_stats.sh to scripts/. You can test it with
+   bash scripts/fail2ban_stats.sh
+4/ Import the template cacti_host_template_fail2ban.xml
+5/ TO BE CONTINUED...
+
+Contact:
+--------
+
+You need some new features, you found bugs or you just
+appreciate this program, you can contact me at:
+
+Website: http://www.fail2ban.org
+
+Cyril Jaquier: <lostcontrol@users.sourceforge.net>
+
+License:
+--------
+
+Fail2Ban is free software; you can redistribute it
+and/or modify it under the terms of the GNU General Public
+License as published by the Free Software Foundation; either
+version 2 of the License, or (at your option) any later
+version.
+
+Fail2Ban is distributed in the hope that it will be
+useful, but WITHOUT ANY WARRANTY; without even the implied
+warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public
+License along with Fail2Ban; if not, write to the Free
+Software Foundation, Inc., 59 Temple Place, Suite 330,
+Boston, MA  02111-1307  USA

files/cacti/cacti_host_template_fail2ban.xml

@@ -0,0 +1,297 @@
+<cacti>	
+	<hash_02001346a4e9f7498a8129f0dfc2e1c8c7b35a>
+		<name>Fail2ban</name>
+		<graph_templates>hash_0000132fe631a3ac1f1705e332d0aee925d21b</graph_templates>
+		<data_queries></data_queries>
+	</hash_02001346a4e9f7498a8129f0dfc2e1c8c7b35a>
+	<hash_0000132fe631a3ac1f1705e332d0aee925d21b>
+		<name>Fail2ban - Statistics</name>
+		<graph>
+			<t_title>on</t_title>
+			<title>|host_description| - Statistics</title>
+			<t_image_format_id></t_image_format_id>
+			<image_format_id>1</image_format_id>
+			<t_height></t_height>
+			<height>120</height>
+			<t_width></t_width>
+			<width>500</width>
+			<t_auto_scale></t_auto_scale>
+			<auto_scale>on</auto_scale>
+			<t_auto_scale_opts></t_auto_scale_opts>
+			<auto_scale_opts>2</auto_scale_opts>
+			<t_auto_scale_log></t_auto_scale_log>
+			<auto_scale_log></auto_scale_log>
+			<t_auto_scale_rigid></t_auto_scale_rigid>
+			<auto_scale_rigid></auto_scale_rigid>
+			<t_auto_padding></t_auto_padding>
+			<auto_padding>on</auto_padding>
+			<t_export></t_export>
+			<export>on</export>
+			<t_upper_limit></t_upper_limit>
+			<upper_limit>100</upper_limit>
+			<t_lower_limit></t_lower_limit>
+			<lower_limit>0</lower_limit>
+			<t_base_value></t_base_value>
+			<base_value>1000</base_value>
+			<t_unit_value></t_unit_value>
+			<unit_value></unit_value>
+			<t_unit_exponent_value></t_unit_exponent_value>
+			<unit_exponent_value></unit_exponent_value>
+			<t_vertical_label></t_vertical_label>
+			<vertical_label>hits/5min</vertical_label>
+		</graph>
+		<items>
+			<hash_100013f76575fdcd7f2684843e8f2cbae4ef96>
+				<task_item_id>hash_0800132d7bfb27a7ecb33f23433863e6f90612</task_item_id>
+				<color_id>00CF00</color_id>
+				<graph_type_id>4</graph_type_id>
+				<consolidation_function_id>1</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Failed</text_format>
+				<hard_return></hard_return>
+				<sequence>1</sequence>
+			</hash_100013f76575fdcd7f2684843e8f2cbae4ef96>
+			<hash_100013ca0d59c48dde83a1753e21eb1f44a396>
+				<task_item_id>hash_0800132d7bfb27a7ecb33f23433863e6f90612</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>4</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Current:</text_format>
+				<hard_return></hard_return>
+				<sequence>2</sequence>
+			</hash_100013ca0d59c48dde83a1753e21eb1f44a396>
+			<hash_1000132f8d371932ebedbb665f80abf427ffb4>
+				<task_item_id>hash_0800132d7bfb27a7ecb33f23433863e6f90612</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>1</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Average:</text_format>
+				<hard_return></hard_return>
+				<sequence>3</sequence>
+			</hash_1000132f8d371932ebedbb665f80abf427ffb4>
+			<hash_1000131b8e847f7be22014f1f0b3d098c9e702>
+				<task_item_id>hash_0800132d7bfb27a7ecb33f23433863e6f90612</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>3</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Maximum:</text_format>
+				<hard_return>on</hard_return>
+				<sequence>4</sequence>
+			</hash_1000131b8e847f7be22014f1f0b3d098c9e702>
+			<hash_1000130e6084fd4ed86d8c86dea8f84b115eaa>
+				<task_item_id>hash_080013b224f2764ba5a827de959b1ff44cbc1d</task_item_id>
+				<color_id>FF0000</color_id>
+				<graph_type_id>5</graph_type_id>
+				<consolidation_function_id>1</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Banned</text_format>
+				<hard_return></hard_return>
+				<sequence>5</sequence>
+			</hash_1000130e6084fd4ed86d8c86dea8f84b115eaa>
+			<hash_1000132812e5f3ee8261819268854c67093b94>
+				<task_item_id>hash_080013b224f2764ba5a827de959b1ff44cbc1d</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>4</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Current:</text_format>
+				<hard_return></hard_return>
+				<sequence>6</sequence>
+			</hash_1000132812e5f3ee8261819268854c67093b94>
+			<hash_10001336fcfc1d017e975fa22a3ce0d0492daf>
+				<task_item_id>hash_080013b224f2764ba5a827de959b1ff44cbc1d</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>1</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Average:</text_format>
+				<hard_return></hard_return>
+				<sequence>7</sequence>
+			</hash_10001336fcfc1d017e975fa22a3ce0d0492daf>
+			<hash_100013e5fddd5da42b9bf296d7f344b2a00446>
+				<task_item_id>hash_080013b224f2764ba5a827de959b1ff44cbc1d</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>3</consolidation_function_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Maximum:</text_format>
+				<hard_return>on</hard_return>
+				<sequence>8</sequence>
+			</hash_100013e5fddd5da42b9bf296d7f344b2a00446>
+		</items>
+		<inputs>
+			<hash_090013a5d69bc5ca8b53ef62b61221a69b8055>
+				<name>Data Source [banned]</name>
+				<description></description>
+				<column_name>task_item_id</column_name>
+				<items>hash_0000130e6084fd4ed86d8c86dea8f84b115eaa|hash_0000132812e5f3ee8261819268854c67093b94|hash_00001336fcfc1d017e975fa22a3ce0d0492daf|hash_000013e5fddd5da42b9bf296d7f344b2a00446</items>
+			</hash_090013a5d69bc5ca8b53ef62b61221a69b8055>
+			<hash_0900132cee6f79f051b0dd39cafcbfcfd87960>
+				<name>Data Source [failed]</name>
+				<description></description>
+				<column_name>task_item_id</column_name>
+				<items>hash_000013f76575fdcd7f2684843e8f2cbae4ef96|hash_000013ca0d59c48dde83a1753e21eb1f44a396|hash_0000131b8e847f7be22014f1f0b3d098c9e702|hash_0000132f8d371932ebedbb665f80abf427ffb4</items>
+			</hash_0900132cee6f79f051b0dd39cafcbfcfd87960>
+		</inputs>
+	</hash_0000132fe631a3ac1f1705e332d0aee925d21b>
+	<hash_0100130fce21647570158d210c7832cd50e98a>
+		<name>Fail2ban - Statistics</name>
+		<ds>
+			<t_name></t_name>
+			<name>|host_description| - Statistics</name>
+			<data_input_id>hash_030013a3adf3f2607747859b08262d972eabf0</data_input_id>
+			<t_rra_id></t_rra_id>
+			<t_rrd_step></t_rrd_step>
+			<rrd_step>300</rrd_step>
+			<t_active></t_active>
+			<active>on</active>
+			<rra_items>hash_150013c21df5178e5c955013591239eb0afd46|hash_1500130d9c0af8b8acdc7807943937b3208e29|hash_1500136fc2d038fb42950138b0ce3e9874cc60|hash_150013e36f3adb9f152adfa5dc50fd2b23337e</rra_items>
+		</ds>
+		<items>
+			<hash_0800132d7bfb27a7ecb33f23433863e6f90612>
+				<t_data_source_name></t_data_source_name>
+				<data_source_name>failed</data_source_name>
+				<t_rrd_minimum></t_rrd_minimum>
+				<rrd_minimum>0</rrd_minimum>
+				<t_rrd_maximum></t_rrd_maximum>
+				<rrd_maximum>0</rrd_maximum>
+				<t_data_source_type_id></t_data_source_type_id>
+				<data_source_type_id>2</data_source_type_id>
+				<t_rrd_heartbeat></t_rrd_heartbeat>
+				<rrd_heartbeat>600</rrd_heartbeat>
+				<t_data_input_field_id></t_data_input_field_id>
+				<data_input_field_id>hash_0700134027ae7d3baefb02f510c09de07d159f</data_input_field_id>
+			</hash_0800132d7bfb27a7ecb33f23433863e6f90612>
+			<hash_080013b224f2764ba5a827de959b1ff44cbc1d>
+				<t_data_source_name></t_data_source_name>
+				<data_source_name>banned</data_source_name>
+				<t_rrd_minimum></t_rrd_minimum>
+				<rrd_minimum>0</rrd_minimum>
+				<t_rrd_maximum></t_rrd_maximum>
+				<rrd_maximum>0</rrd_maximum>
+				<t_data_source_type_id></t_data_source_type_id>
+				<data_source_type_id>2</data_source_type_id>
+				<t_rrd_heartbeat></t_rrd_heartbeat>
+				<rrd_heartbeat>600</rrd_heartbeat>
+				<t_data_input_field_id></t_data_input_field_id>
+				<data_input_field_id>hash_07001319c32c9466152aa6cfc2bbc639a246d8</data_input_field_id>
+			</hash_080013b224f2764ba5a827de959b1ff44cbc1d>
+		</items>
+		<data>
+			<item_000>
+				<data_input_field_id>hash_0700131cda0f872b68c87e508a29e8976a6a7a</data_input_field_id>
+				<t_value>on</t_value>
+				<value>ssh-iptables</value>
+			</item_000>
+		</data>
+	</hash_0100130fce21647570158d210c7832cd50e98a>
+	<hash_030013a3adf3f2607747859b08262d972eabf0>
+		<name>Fail2ban - Get statistics</name>
+		<type_id>1</type_id>
+		<input_string>bash &lt;path_cacti&gt;/scripts/fail2ban_stats.sh &lt;jail&gt;</input_string>
+		<fields>
+			<hash_0700131cda0f872b68c87e508a29e8976a6a7a>
+				<name>Jail name</name>
+				<update_rra></update_rra>
+				<regexp_match></regexp_match>
+				<allow_nulls></allow_nulls>
+				<type_code></type_code>
+				<input_output>in</input_output>
+				<data_name>jail</data_name>
+			</hash_0700131cda0f872b68c87e508a29e8976a6a7a>
+			<hash_0700134027ae7d3baefb02f510c09de07d159f>
+				<name>Total of failed logins</name>
+				<update_rra>on</update_rra>
+				<regexp_match></regexp_match>
+				<allow_nulls></allow_nulls>
+				<type_code></type_code>
+				<input_output>out</input_output>
+				<data_name>failed</data_name>
+			</hash_0700134027ae7d3baefb02f510c09de07d159f>
+			<hash_07001319c32c9466152aa6cfc2bbc639a246d8>
+				<name>Total of banned hosts</name>
+				<update_rra>on</update_rra>
+				<regexp_match></regexp_match>
+				<allow_nulls></allow_nulls>
+				<type_code></type_code>
+				<input_output>out</input_output>
+				<data_name>banned</data_name>
+			</hash_07001319c32c9466152aa6cfc2bbc639a246d8>
+		</fields>
+	</hash_030013a3adf3f2607747859b08262d972eabf0>
+	<hash_150013c21df5178e5c955013591239eb0afd46>
+		<name>Daily (5 Minute Average)</name>
+		<x_files_factor>0.5</x_files_factor>
+		<steps>1</steps>
+		<rows>600</rows>
+		<timespan>86400</timespan>
+		<cf_items>1|2|3|4</cf_items>
+	</hash_150013c21df5178e5c955013591239eb0afd46>
+	<hash_1500130d9c0af8b8acdc7807943937b3208e29>
+		<name>Weekly (30 Minute Average)</name>
+		<x_files_factor>0.5</x_files_factor>
+		<steps>6</steps>
+		<rows>700</rows>
+		<timespan>604800</timespan>
+		<cf_items>1|2|3|4</cf_items>
+	</hash_1500130d9c0af8b8acdc7807943937b3208e29>
+	<hash_1500136fc2d038fb42950138b0ce3e9874cc60>
+		<name>Monthly (2 Hour Average)</name>
+		<x_files_factor>0.5</x_files_factor>
+		<steps>24</steps>
+		<rows>775</rows>
+		<timespan>2678400</timespan>
+		<cf_items>1|2|3|4</cf_items>
+	</hash_1500136fc2d038fb42950138b0ce3e9874cc60>
+	<hash_150013e36f3adb9f152adfa5dc50fd2b23337e>
+		<name>Yearly (1 Day Average)</name>
+		<x_files_factor>0.5</x_files_factor>
+		<steps>288</steps>
+		<rows>797</rows>
+		<timespan>33053184</timespan>
+		<cf_items>1|2|3|4</cf_items>
+	</hash_150013e36f3adb9f152adfa5dc50fd2b23337e>
+	<hash_050013e961cc8ec04fda6ed4981cf5ad501aa5>
+		<name>Make Per 5 Minutes</name>
+		<items>
+			<hash_14001340bb7a1143b0f2e2efca14eb356236de>
+				<sequence>1</sequence>
+				<type>4</type>
+				<value>CURRENT_DATA_SOURCE</value>
+			</hash_14001340bb7a1143b0f2e2efca14eb356236de>
+			<hash_140013faf1b148b2c0e0527362ed5b8ca1d351>
+				<sequence>2</sequence>
+				<type>6</type>
+				<value>300</value>
+			</hash_140013faf1b148b2c0e0527362ed5b8ca1d351>
+			<hash_14001342686ea0925c0220924b7d333599cd67>
+				<sequence>3</sequence>
+				<type>2</type>
+				<value>3</value>
+			</hash_14001342686ea0925c0220924b7d333599cd67>
+		</items>
+	</hash_050013e961cc8ec04fda6ed4981cf5ad501aa5>
+	<hash_060013e9c43831e54eca8069317a2ce8c6f751>
+		<name>Normal</name>
+		<gprint_text>%8.2lf %s</gprint_text>
+	</hash_060013e9c43831e54eca8069317a2ce8c6f751>
+</cacti>

files/cacti/fail2ban_stats.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# This script can be used to collect data for Cacti. One parameter is needed,
+# the jail name. It must be a currently running jail. The script returns two
+# value: the number of failures and the number of banned host.
+#
+# If Fail2ban is not available in the path, you can change the value of the
+# variable FAIL2BAN below.. You can add option to this variable too. Please
+# look at the man page of fail2ban-client for more information.
+#
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+FAIL2BAN="fail2ban-client"
+
+JAIL=$1
+
+if [ -z $JAIL ]; then
+	echo "Usage:" `basename $0` "<jail>"
+	exit
+fi
+
+IFS=""
+
+STATS=$($FAIL2BAN status $JAIL)
+
+TOTAL_FAILED=$(echo $STATS | grep "Total failed:" | awk '{ print $5 }')
+TOTAL_BANNED=$(echo $STATS | grep "Total banned:" | awk '{ print $4 }')
+
+echo "failed:"$TOTAL_FAILED "banned:"$TOTAL_BANNED
+

files/gentoo-initd

@@ -0,0 +1,78 @@
+#!/sbin/runscript
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# Author: Sireyessire, Cyril Jaquier
+# 
+# $Revision$
+
+opts="start stop restart reload showlog"
+
+FAIL2BAN="/usr/bin/fail2ban-client"
+
+depend() {
+	need net
+	need logger
+	after iptables
+}
+
+start() {
+	ebegin "Starting fail2ban"
+	${FAIL2BAN} start &> /dev/null
+	eend $? "Failed to start fail2ban"
+}
+
+stop() {
+	ebegin "Stopping fail2ban"
+	${FAIL2BAN} stop &> /dev/null
+	eend $? "Failed to stop fail2ban"
+}
+
+restart() {
+    if ! service_stopped "${SVCNAME}" ; then
+            svc_stop || return "$?"
+            einfon "Waiting for server to shutdown ."
+			cnt=0
+			while [ 1 ]; do
+				# Ping fail2ban-server
+				${FAIL2BAN} ping &> /dev/null
+				if [ ! "$?" == "0" ]; then
+					break
+				fi
+				cnt=`expr $cnt + 1`
+				if [ $cnt -gt 60 ] ; then
+					# We have waited 1 minute. Failed
+					echo
+					eend 1 "Failed"
+					break
+				fi
+				sleep 1
+				echo -n "."
+			done
+			echo
+    fi
+    svc_start
+}
+
+reload() {
+	ebegin "Reloading fail2ban"
+	${FAIL2BAN} reload > /dev/null
+	eend $? "Failed to reload fail2ban"
+}
+
+showlog(){
+	less /var/log/fail2ban.log
+}

files/redhat-initd

@@ -0,0 +1,90 @@
+#!/bin/bash
+#
+# chkconfig: 345 92 08
+# description: Fail2ban daemon
+#              http://fail2ban.sourceforge.net/wiki/index.php/Main_Page
+# process name: fail2ban-server
+#
+#
+# Author: Tyler Owen
+#
+
+# Source function library.
+. /etc/init.d/functions
+
+# Check that the config file exists
+[ -f /etc/fail2ban/fail2ban.conf ] || exit 0
+
+FAIL2BAN="/usr/bin/fail2ban-client"
+
+RETVAL=0
+
+getpid() {
+        #pid=`ps -ef | grep fail2ban-|grep -v grep|grep -v bash|awk '{print $2}'`
+        pid=`ps -ef | grep fail2ban-|grep -v grep|awk '{print $2}'`
+}
+
+start() {
+    echo -n $"Starting fail2ban: "
+    getpid
+    if [ -z "$pid" ]; then
+        $FAIL2BAN start > /dev/null
+        RETVAL=$?
+    fi
+    if [ $RETVAL -eq 0 ]; then
+        touch /var/lock/subsys/fail2ban
+        echo_success
+    else
+        echo_failure
+    fi
+    echo
+    return $RETVAL
+}
+
+stop() {
+    echo -n $"Stopping fail2ban: "
+    getpid
+    RETVAL=$?
+    if [ -n "$pid" ]; then
+        $FAIL2BAN stop > /dev/null
+    fi
+    sleep 1
+    getpid
+    if [ -z "$pid" ]; then
+        rm -f /var/lock/subsys/fail2ban
+        echo_success
+    else
+        echo_failure
+    fi
+    echo
+    return $RETVAL
+}
+
+# See how we were called.
+case "$1" in
+  start)
+        start
+        ;;
+  stop)
+        stop
+        ;;
+  status)
+        getpid
+        if [ -n "$pid" ]; then
+                echo "Fail2ban (pid $pid) is running..."
+        else
+                RETVAL=1
+                echo "Fail2ban is stopped"
+        fi
+        ;;
+  restart)
+  		stop
+        start
+        ;;
+  *)
+        echo $"Usage: $0 {start|stop|status|restart}"
+        exit 1
+        ;;
+esac
+
+exit $RETVAL

man/fail2ban-client.1

@@ -0,0 +1,270 @@
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
+.TH FAIL2BAN-CLIENT "1" "February 2007" "fail2ban-client v0.7.7" "User Commands"
+.SH NAME
+fail2ban-client \- configure and control the server
+.SH DESCRIPTION
+[?1034hUsage: ../fail2ban\-client [OPTIONS] <COMMAND>
+.PP
+Fail2Ban v0.7.7 reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules.
+.SH OPTIONS
+.TP
+\fB\-c\fR <DIR>
+configuration directory
+.TP
+\fB\-s\fR <FILE>
+socket path
+.TP
+\fB\-d\fR
+dump configuration. For debugging
+.TP
+\fB\-i\fR
+interactive mode
+.TP
+\fB\-v\fR
+increase verbosity
+.TP
+\fB\-q\fR
+decrease verbosity
+.TP
+\fB\-x\fR
+force execution of the server (remove socket file)
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+display this help message
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+print the version
+.SH COMMAND
+.IP
+BASIC
+.TP
+\fBstart\fR
+starts the server and the jails
+.TP
+\fBreload\fR
+reloads the configuration
+.TP
+\fBstop\fR
+stops all jails and terminate the
+server
+.TP
+\fBstatus\fR
+gets the current status of the
+server
+.TP
+\fBping\fR
+tests if the server is alive
+.IP
+LOGGING
+.TP
+\fBset loglevel <LEVEL>\fR
+sets logging level to <LEVEL>. 0
+is minimal, 4 is debug
+.TP
+\fBget loglevel\fR
+gets the logging level
+.TP
+\fBset logtarget <TARGET>\fR
+sets logging target to <TARGET>.
+Can be STDOUT, STDERR, SYSLOG or a
+file
+.TP
+\fBget logtarget\fR
+gets logging target
+.IP
+JAIL CONTROL
+.TP
+\fBadd <JAIL> <BACKEND>\fR
+creates <JAIL> using <BACKEND>
+.TP
+\fBstart <JAIL>\fR
+starts the jail <JAIL>
+.TP
+\fBstop <JAIL>\fR
+stops the jail <JAIL>. The jail is
+removed
+.TP
+\fBstatus <JAIL>\fR
+gets the current status of <JAIL>
+.IP
+JAIL CONFIGURATION
+.TP
+\fBset <JAIL> idle on|off\fR
+sets the idle state of <JAIL>
+.TP
+\fBset <JAIL> addignoreip <IP>\fR
+adds <IP> to the ignore list of
+<JAIL>
+.TP
+\fBset <JAIL> delignoreip <IP>\fR
+removes <IP> from the ignore list
+of <JAIL>
+.TP
+\fBset <JAIL> addlogpath <FILE>\fR
+adds <FILE> to the monitoring list
+of <JAIL>
+.TP
+\fBset <JAIL> dellogpath <FILE>\fR
+removes <FILE> to the monitoring
+list of <JAIL>
+.TP
+\fBset <JAIL> timeregex <REGEX>\fR
+sets the regular expression
+<REGEX> to match the date format
+for <JAIL>. This will disable the
+autodetection feature.
+.TP
+\fBset <JAIL> timepattern <PATTERN>\fR
+sets the pattern <PATTERN> to
+match the date format for <JAIL>.
+This will disable the
+autodetection feature.
+.TP
+\fBset <JAIL> addfailregex <REGEX>\fR
+adds the regular expression
+<REGEX> which must match failures
+for <JAIL>
+.TP
+\fBset <JAIL> delfailregex <INDEX>\fR
+removes the regular expression at
+<INDEX> for failregex
+.TP
+\fBset <JAIL> addignoreregex <REGEX>\fR
+adds the regular expression
+<REGEX> which should match pattern
+to exclude for <JAIL>
+.TP
+\fBset <JAIL> delignoreregex <INDEX>\fR
+removes the regular expression at
+<INDEX> for ignoreregex
+.TP
+\fBset <JAIL> findtime <TIME>\fR
+sets the number of seconds <TIME>
+for which the filter will look
+back for <JAIL>
+.TP
+\fBset <JAIL> bantime <TIME>\fR
+sets the number of seconds <TIME>
+a host will be banned for <JAIL>
+.TP
+\fBset <JAIL> maxretry <RETRY>\fR
+sets the number of failures
+<RETRY> before banning the host
+for <JAIL>
+.TP
+\fBset <JAIL> addaction <ACT>\fR
+adds a new action named <NAME> for
+<JAIL>
+.TP
+\fBset <JAIL> delaction <ACT>\fR
+removes the action <NAME> from
+<JAIL>
+.TP
+\fBset <JAIL> setcinfo <ACT> <KEY> <VALUE>\fR
+sets <VALUE> for <KEY> of the
+action <NAME> for <JAIL>
+.TP
+\fBset <JAIL> delcinfo <ACT> <KEY>\fR
+removes <KEY> for the action
+<NAME> for <JAIL>
+.TP
+\fBset <JAIL> actionstart <ACT> <CMD>\fR
+sets the start command <CMD> of
+the action <ACT> for <JAIL>
+.TP
+\fBset <JAIL> actionstop <ACT> <CMD>\fR
+sets the stop command <CMD> of the
+action <ACT> for <JAIL>
+.TP
+\fBset <JAIL> actioncheck <ACT> <CMD>\fR
+sets the check command <CMD> of
+the action <ACT> for <JAIL>
+.TP
+\fBset <JAIL> actionban <ACT> <CMD>\fR
+sets the ban command <CMD> of the
+action <ACT> for <JAIL>
+.TP
+\fBset <JAIL> actionunban <ACT> <CMD>\fR
+sets the unban command <CMD> of
+the action <ACT> for <JAIL>
+.IP
+JAIL INFORMATION
+.TP
+\fBget <JAIL> logpath\fR
+gets the list of the monitored
+files for <JAIL>
+.TP
+\fBget <JAIL> ignoreip\fR
+gets the list of ignored IP
+addresses for <JAIL>
+.TP
+\fBget <JAIL> timeregex\fR
+gets the regular expression used
+for the time detection for <JAIL>
+.TP
+\fBget <JAIL> timepattern\fR
+gets the pattern used for the time
+detection for <JAIL>
+.TP
+\fBget <JAIL> failregex\fR
+gets the list of regular
+expressions which matches the
+failures for <JAIL>
+.TP
+\fBget <JAIL> ignoreregex\fR
+gets the list of regular
+expressions which matches patterns
+to ignore for <JAIL>
+.TP
+\fBget <JAIL> findtime\fR
+gets the time for which the filter
+will look back for failures for
+<JAIL>
+.TP
+\fBget <JAIL> bantime\fR
+gets the time a host is banned for
+<JAIL>
+.TP
+\fBget <JAIL> maxretry\fR
+gets the number of failures
+allowed for <JAIL>
+.TP
+\fBget <JAIL> addaction\fR
+gets the last action which has
+been added for <JAIL>
+.TP
+\fBget <JAIL> actionstart <ACT>\fR
+gets the start command for the
+action <ACT> for <JAIL>
+.TP
+\fBget <JAIL> actionstop <ACT>\fR
+gets the stop command for the
+action <ACT> for <JAIL>
+.TP
+\fBget <JAIL> actioncheck <ACT>\fR
+gets the check command for the
+action <ACT> for <JAIL>
+.TP
+\fBget <JAIL> actionban <ACT>\fR
+gets the ban command for the
+action <ACT> for <JAIL>
+.TP
+\fBget <JAIL> actionunban <ACT>\fR
+gets the unban command for the
+action <ACT> for <JAIL>
+.SH FILES
+\fI/etc/fail2ban/*\fR
+.SH AUTHOR
+Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
+.SH "REPORTING BUGS"
+Report bugs to <lostcontrol@users.sourceforge.net>
+.SH COPYRIGHT
+Copyright \(co 2004-2006 Cyril Jaquier
+.br
+Copyright of modifications held by their respective authors.
+Licensed under the GNU General Public License v2 (GPL).
+.SH "SEE ALSO"
+.br 
+fail2ban-server(1)

man/fail2ban-client.h2m

@@ -0,0 +1,12 @@
+Include file for help2man man page
+$Id:  $
+
+[name]
+fail2ban-client \- configure and control the server
+
+[files]
+\fI/etc/fail2ban/*\fR
+
+[see also]
+.br 
+fail2ban-server(1)

man/fail2ban-regex.1

@@ -0,0 +1,47 @@
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
+.TH FAIL2BAN-REGEX "1" "February 2007" "fail2ban-regex v0.7.7" "User Commands"
+.SH NAME
+fail2ban-regex \- test Fail2ban "failregex" option
+.SH SYNOPSIS
+.B fail2ban-regex
+[\fIOPTIONS\fR] \fI<LOG> <REGEX>\fR
+.SH DESCRIPTION
+Fail2Ban v0.7.7 reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules.
+.PP
+This tools can test regular expressions for "fail2ban".
+.SH OPTIONS
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+display this help message
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+print the version
+.SH LOG
+.TP
+\fBstring\fR
+a string representing a log line
+.TP
+\fBfilename\fR
+path to a log file (/var/log/auth.log)
+.SH REGEX
+.TP
+\fBstring\fR
+a string representing a 'failregex'
+.TP
+\fBfilename\fR
+path to a filter file (filter.d/sshd.conf)
+.SH AUTHOR
+Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
+.SH "REPORTING BUGS"
+Report bugs to <lostcontrol@users.sourceforge.net>
+.SH COPYRIGHT
+Copyright \(co 2004-2006 Cyril Jaquier
+.br
+Copyright of modifications held by their respective authors.
+Licensed under the GNU General Public License v2 (GPL).
+.SH "SEE ALSO"
+.br 
+fail2ban-client(1)
+fail2ban-server(1)

man/fail2ban-regex.h2m

@@ -0,0 +1,10 @@
+Include file for help2man man page
+$Id:  $
+
+[name]
+fail2ban-regex \- test Fail2ban "failregex" option
+
+[see also]
+.br 
+fail2ban-client(1)
+fail2ban-server(1)

man/fail2ban-server.1

@@ -0,0 +1,46 @@
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
+.TH FAIL2BAN-SERVER "1" "February 2007" "fail2ban-server v0.7.7" "User Commands"
+.SH NAME
+fail2ban-server \- start the server
+.SH SYNOPSIS
+.B fail2ban-server
+[\fIOPTIONS\fR]
+.SH DESCRIPTION
+Fail2Ban v0.7.7 reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules.
+.PP
+Only use this command for debugging purpose. Start the server with
+fail2ban\-client instead. The default behaviour is to start the server
+in background.
+.SH OPTIONS
+.TP
+\fB\-b\fR
+start in background
+.TP
+\fB\-f\fR
+start in foreground
+.TP
+\fB\-s\fR <FILE>
+socket path
+.TP
+\fB\-x\fR
+force execution of the server (remove socket file)
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+display this help message
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+print the version
+.SH AUTHOR
+Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
+.SH "REPORTING BUGS"
+Report bugs to <lostcontrol@users.sourceforge.net>
+.SH COPYRIGHT
+Copyright \(co 2004-2006 Cyril Jaquier
+.br
+Copyright of modifications held by their respective authors.
+Licensed under the GNU General Public License v2 (GPL).
+.SH "SEE ALSO"
+.br 
+fail2ban-client(1)

man/fail2ban-server.h2m

@@ -0,0 +1,9 @@
+Include file for help2man man page
+$Id:  $
+
+[name]
+fail2ban-server \- start the server
+
+[see also]
+.br 
+fail2ban-client(1)

man/generate-man

@@ -0,0 +1,69 @@
+#!/bin/bash
+
+# fail2ban-client
+echo -n "Generating fail2ban-client "
+help2man --section=1 --no-info --include=fail2ban-client.h2m --output fail2ban-client.1 ../fail2ban-client
+echo "[done]"
+echo -n "Patching fail2ban-client   "
+# Changes the title.
+sed -i -e 's/.SS "Command:"/.SH COMMAND/' fail2ban-client.1
+# Sets bold font for commands.
+IFS="
+"
+NEXT=0
+FOUND=0
+LINES=$( cat fail2ban-client.1 )
+echo -n "" > fail2ban-client.1
+for LINE in $LINES; do
+	if [ "$LINE" = ".SH COMMAND" ]; then
+		FOUND=1
+	fi
+	if [ $NEXT -eq 1 ] && [ $FOUND -eq 1 ]; then
+		echo "\fB$LINE\fR" >> fail2ban-client.1
+	else
+		echo "$LINE" >> fail2ban-client.1
+	fi
+	if [ "$LINE" = ".TP" ]; then
+		NEXT=1
+	else
+		NEXT=0
+	fi
+done
+echo "[done]"
+
+# fail2ban-server
+echo -n "Generating fail2ban-server "
+help2man --section=1 --no-info --include=fail2ban-server.h2m --output fail2ban-server.1 ../fail2ban-server
+echo "[done]"
+
+# fail2ban-regex
+echo -n "Generating fail2ban-regex  "
+help2man --section=1 --no-info --include=fail2ban-regex.h2m --output fail2ban-regex.1 ../fail2ban-regex
+echo "[done]"
+echo -n "Patching fail2ban-regex    "
+# Changes the title.
+sed -i -e 's/.SS "Log:"/.SH LOG/' fail2ban-regex.1
+sed -i -e 's/.SS "Regex:"/.SH REGEX/' fail2ban-regex.1
+# Sets bold font for commands.
+IFS="
+"
+NEXT=0
+FOUND=0
+LINES=$( cat fail2ban-regex.1 )
+echo -n "" > fail2ban-regex.1
+for LINE in $LINES; do
+	if [ "$LINE" = ".SH LOG" ]; then
+		FOUND=1
+	fi
+	if [ $NEXT -eq 1 ] && [ $FOUND -eq 1 ]; then
+		echo "\fB$LINE\fR" >> fail2ban-regex.1
+	else
+		echo "$LINE" >> fail2ban-regex.1
+	fi
+	if [ "$LINE" = ".TP" ]; then
+		NEXT=1
+	else
+		NEXT=0
+	fi
+done
+echo "[done]"

server/__init__.py

@@ -22,4 +22,4 @@ __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
 __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
+__license__ = "GPL"

server/action.py

@@ -24,7 +24,8 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, logging, os
+import logging, os
+#from subprocess import call
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.actions.action")
@@ -39,34 +40,34 @@ logSys = logging.getLogger("fail2ban.actions.action")
 class Action:
 	
 	def __init__(self, name):
-		self.name = name
-		self.cInfo = dict()
+		self.__name = name
+		self.__cInfo = dict()
 		## Command executed in order to initialize the system.
-		self.actionStart = ''
+		self.__actionStart = ''
 		## Command executed when an IP address gets banned.
-		self.actionBan = ''
+		self.__actionBan = ''
 		## Command executed when an IP address gets removed.
-		self.actionUnban = ''
+		self.__actionUnban = ''
 		## Command executed in order to check requirements.
-		self.actionCheck = ''
+		self.__actionCheck = ''
 		## Command executed in order to stop the system.
-		self.actionStop = ''
+		self.__actionStop = ''
 		logSys.debug("Created Action")
 	
 	def setName(self, name):
-		self.name = name
+		self.__name = name
 	
 	def getName(self):
-		return self.name
+		return self.__name
 	
 	def setCInfo(self, key, value):
-		self.cInfo[key] = value
+		self.__cInfo[key] = value
 	
 	def getCInfo(self, key):
-		return self.cInfo[key]
+		return self.__cInfo[key]
 	
 	def delCInfo(self, key):
-		del self.cInfo[key]
+		del self.__cInfo[key]
 	
 	##
 	# Set the "start" command.
@@ -74,7 +75,7 @@ class Action:
 	# @param value the command
 		
 	def setActionStart(self, value):
-		self.actionStart = value
+		self.__actionStart = value
 		logSys.info("Set actionStart = %s" % value)
 	
 	##
@@ -83,10 +84,10 @@ class Action:
 	# @return the command
 	
 	def getActionStart(self):
-		return self.actionStart
+		return self.__actionStart
 	
 	def execActionStart(self):
-		startCmd = Action.replaceTag(self.actionStart, self.cInfo)
+		startCmd = Action.replaceTag(self.__actionStart, self.__cInfo)
 		return Action.executeCmd(startCmd)
 	
 	##
@@ -95,7 +96,7 @@ class Action:
 	# @param value the command
 	
 	def setActionBan(self, value):
-		self.actionBan = value
+		self.__actionBan = value
 		logSys.info("Set actionBan = %s" % value)
 	
 	##
@@ -104,10 +105,10 @@ class Action:
 	# @return the command
 	
 	def getActionBan(self):
-		return self.actionBan
+		return self.__actionBan
 	
 	def execActionBan(self, aInfo):
-		return self.processCmd(self.actionBan, aInfo);
+		return self.__processCmd(self.__actionBan, aInfo)
 	
 	##
 	# Set the "unban" command.
@@ -115,7 +116,7 @@ class Action:
 	# @param value the command
 	
 	def setActionUnban(self, value):
-		self.actionUnban = value
+		self.__actionUnban = value
 		logSys.info("Set actionUnban = %s" % value)
 	
 	##
@@ -124,10 +125,10 @@ class Action:
 	# @return the command
 	
 	def getActionUnban(self):
-		return self.actionUnban
+		return self.__actionUnban
 	
 	def execActionUnban(self, aInfo):
-		return self.processCmd(self.actionUnban, aInfo);
+		return self.__processCmd(self.__actionUnban, aInfo)
 	
 	##
 	# Set the "check" command.
@@ -135,7 +136,7 @@ class Action:
 	# @param value the command
 	
 	def setActionCheck(self, value):
-		self.actionCheck = value
+		self.__actionCheck = value
 		logSys.info("Set actionCheck = %s" % value)
 	
 	##
@@ -144,7 +145,7 @@ class Action:
 	# @return the command
 	
 	def getActionCheck(self):
-		return self.actionCheck
+		return self.__actionCheck
 	
 	##
 	# Set the "stop" command.
@@ -152,7 +153,7 @@ class Action:
 	# @param value the command
 	
 	def setActionStop(self, value):
-		self.actionStop = value
+		self.__actionStop = value
 		logSys.info("Set actionStop = %s" % value)
 	
 	##
@@ -161,10 +162,10 @@ class Action:
 	# @return the command
 	
 	def getActionStop(self):
-		return self.actionStop
+		return self.__actionStop
 	
 	def execActionStop(self):
-		stopCmd = Action.replaceTag(self.actionStop, self.cInfo)
+		stopCmd = Action.replaceTag(self.__actionStop, self.__cInfo)
 		return Action.executeCmd(stopCmd)
 	
 	@staticmethod
@@ -178,20 +179,20 @@ class Action:
 		string = string.replace("<br>", '\n')
 		return string
 	
-	def processCmd(self, cmd, aInfo = None):
+	def __processCmd(self, cmd, aInfo = None):
 		""" Executes an OS command.
 		"""
 		if cmd == "":
 			logSys.debug("Nothing to do")
 			return True
 		
-		checkCmd = Action.replaceTag(self.actionCheck, self.cInfo)
+		checkCmd = Action.replaceTag(self.__actionCheck, self.__cInfo)
 		if not Action.executeCmd(checkCmd):
 			logSys.error("Invariant check failed. Trying to restore a sane" +
 						 " environment")
-			stopCmd = Action.replaceTag(self.actionStop, self.cInfo)
+			stopCmd = Action.replaceTag(self.__actionStop, self.__cInfo)
 			Action.executeCmd(stopCmd)
-			startCmd = Action.replaceTag(self.actionStart, self.cInfo)
+			startCmd = Action.replaceTag(self.__actionStart, self.__cInfo)
 			Action.executeCmd(startCmd)
 			if not Action.executeCmd(checkCmd):
 				logSys.fatal("Unable to restore environment")
@@ -204,20 +205,22 @@ class Action:
 			realCmd = cmd
 		
 		# Replace static fields
-		realCmd = Action.replaceTag(realCmd, self.cInfo)
+		realCmd = Action.replaceTag(realCmd, self.__cInfo)
 		
-  		return Action.executeCmd(realCmd)
+		return Action.executeCmd(realCmd)
 
-  	@staticmethod
+	@staticmethod
 	def executeCmd(realCmd):
 		logSys.debug(realCmd)
-		retval = os.system(realCmd)
-		#if not retval == 0:
-		#	logSys.error("'" + cmd + "' returned " + `retval`)
-		#	raise Exception("Execution of command '%s' failed" % cmd)
-		if retval == 0:
-			return True
-		else:
-			logSys.error("%s returned %x" % (realCmd, retval))
-			return False
-		
+		try:
+			# The following line gives deadlock with multiple jails
+			#retcode = call(realCmd, shell=True)
+			retcode = os.system(realCmd)
+			if retcode == 0:
+				logSys.debug("%s returned successfully" % realCmd)
+				return True
+			else:
+				logSys.error("%s returned %x" % (realCmd, retcode))
+		except OSError, e:
+			logSys.error("%s failed with %s" % (realCmd, e))
+		return False

server/actions.py

@@ -25,10 +25,10 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 from banmanager import BanManager
-from failmanager import FailManager, FailManagerEmpty
 from jailthread import JailThread
 from action import Action
-import time, logging, os
+from mytime import MyTime
+import time, logging
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.actions")
@@ -49,32 +49,32 @@ class Actions(JailThread):
 	# @param jail the jail object
 	
 	def __init__(self, jail):
-		JailThread.__init__(self, jail)
+		JailThread.__init__(self)
 		## The jail which contains this action.
 		self.jail = jail
-		self.actions = list()
+		self.__actions = list()
 		## The ban manager.
-		self.banManager = BanManager()
+		self.__banManager = BanManager()
 	
 	def addAction(self, name):
 		action = Action(name)
-		self.actions.append(action)
+		self.__actions.append(action)
 	
 	def delAction(self, name):
-		for action in self.actions:
+		for action in self.__actions:
 			if action.getName() == name:
-				self.actions.remove(action)
+				self.__actions.remove(action)
 				break
 	
 	def getAction(self, name):
-		for action in self.actions:
+		for action in self.__actions:
 			if action.getName() == name:
 				return action
 		raise KeyError
 	
 	def getLastAction(self):
-		action = self.actions.pop()
-		self.actions.append(action)
+		action = self.__actions.pop()
+		self.__actions.append(action)
 		return action
 	
 	##
@@ -83,7 +83,7 @@ class Actions(JailThread):
 	# @param value the time
 	
 	def setBanTime(self, value):
-		self.banManager.setBanTime(value)
+		self.__banManager.setBanTime(value)
 		logSys.info("Set banTime = %s" % value)
 	
 	##
@@ -92,7 +92,7 @@ class Actions(JailThread):
 	# @return the time
 	
 	def getBanTime(self):
-		return self.banManager.getBanTime()
+		return self.__banManager.getBanTime()
 	
 	##
 	# Main loop.
@@ -102,20 +102,20 @@ class Actions(JailThread):
 	# @return True when the thread exits nicely
 	
 	def run(self):
-		for action in self.actions:
+		for action in self.__actions:
 			action.execActionStart()
 		self.setActive(True)
 		while self.isActive():
-			if not self.isIdle:
+			if not self.getIdle():
 				#logSys.debug(self.jail.getName() + ": action")
-				ret = self.checkBan()
+				ret = self.__checkBan()
 				if not ret:
-					self.checkUnBan()
-					time.sleep(self.sleepTime)
+					self.__checkUnBan()
+					time.sleep(self.getSleepTime())
 			else:
-				time.sleep(self.sleepTime)
-		self.flushBan()
-		for action in self.actions:
+				time.sleep(self.getSleepTime())
+		self.__flushBan()
+		for action in self.__actions:
 			action.execActionStop()
 		logSys.debug(self.jail.getName() + ": action terminated")
 		return True
@@ -127,19 +127,22 @@ class Actions(JailThread):
 	# it executes the "ban" command and add a ticket to the BanManager.
 	# @return True if an IP address get banned
 	
-	def checkBan(self):
-		logSys.debug("Check for IP address to ban")
+	def __checkBan(self):
 		ticket = self.jail.getFailTicket()
 		if ticket != False:
 			aInfo = dict()
 			bTicket = BanManager.createBanTicket(ticket)
 			aInfo["ip"] = bTicket.getIP()
 			aInfo["failures"] = bTicket.getAttempt()
-			logSys.info("Ban %s" % aInfo["ip"])
-			for action in self.actions:
-				action.execActionBan(aInfo)
-			self.banManager.addBanTicket(bTicket)
-			return True
+			aInfo["time"] = bTicket.getTime()
+			if self.__banManager.addBanTicket(bTicket):
+				logSys.warn("[%s] Ban %s" % (self.jail.getName(), aInfo["ip"]))
+				for action in self.__actions:
+					action.execActionBan(aInfo)
+				return True
+			else:
+				logSys.warn("[%s] %s already banned" % (self.jail.getName(), 
+														aInfo["ip"]))
 		return False
 	
 	##
@@ -147,28 +150,35 @@ class Actions(JailThread):
 	#
 	# Unban IP address which are outdated.
 	
-	def checkUnBan(self):
-		logSys.debug("Check for IP address to unban")
-		for ticket in self.banManager.unBanList(time.time()):
-			aInfo = dict()
-			aInfo["ip"] = ticket.getIP()
-			logSys.info("Unban %s" % aInfo["ip"])
-			for action in self.actions:
-				action.execActionUnban(aInfo)
+	def __checkUnBan(self):
+		for ticket in self.__banManager.unBanList(MyTime.time()):
+			self.__unBan(ticket)
 	
 	##
 	# Flush the ban list.
 	#
 	# Unban all IP address which are still in the banning list.
 	
-	def flushBan(self):
+	def __flushBan(self):
 		logSys.debug("Flush ban list")
-		for ticket in self.banManager.flushBanList():
-			aInfo = dict()
-			aInfo["ip"] = ticket.getIP()
-			logSys.info("Unban %s" % aInfo["ip"])
-			for action in self.actions:
-				action.execActionUnban(aInfo)
+		for ticket in self.__banManager.flushBanList():
+			self.__unBan(ticket)
+	
+	##
+	# Unbans host corresponding to the ticket.
+	#
+	# Executes the actions in order to unban the host given in the
+	# ticket.
+	
+	def __unBan(self, ticket):
+		aInfo = dict()
+		aInfo["ip"] = ticket.getIP()
+		aInfo["failures"] = ticket.getAttempt()
+		aInfo["time"] = ticket.getTime()
+		logSys.warn("[%s] Unban %s" % (self.jail.getName(), aInfo["ip"]))
+		for action in self.__actions:
+			action.execActionUnban(aInfo)
+			
 	
 	##
 	# Get the status of the filter.
@@ -178,7 +188,7 @@ class Actions(JailThread):
 	# @return a list with tuple
 	
 	def status(self):
-		ret = [("Currently banned", self.banManager.size()),
-			   ("Total banned", self.banManager.getBanTotal())]
+		ret = [("Currently banned", self.__banManager.size()), 
+			   ("Total banned", self.__banManager.getBanTotal()),
+			   ("IP list", self.__banManager.getBanList())]
 		return ret
-		

server/banmanager.py

@@ -26,7 +26,8 @@ __license__ = "GPL"
 
 from banticket import BanTicket
 from threading import Lock
-import time, logging
+from mytime import MyTime
+import logging
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.action")
@@ -46,13 +47,13 @@ class BanManager:
 	
 	def __init__(self):
 		## Mutex used to protect the ban list.
-		self.lock = Lock()
+		self.__lock = Lock()
 		## The ban list.
-		self.banList = list()
+		self.__banList = list()
 		## The amount of time an IP address gets banned.
-		self.banTime = 600
+		self.__banTime = 600
 		## Total number of banned IP address
-		self.banTotal = 0
+		self.__banTotal = 0
 	
 	##
 	# Set the ban time.
@@ -61,7 +62,9 @@ class BanManager:
 	# @param value the time
 	
 	def setBanTime(self, value):
-		self.banTime = int(value)
+		self.__lock.acquire()
+		self.__banTime = int(value)
+		self.__lock.release()
 	
 	##
 	# Get the ban time.
@@ -70,7 +73,11 @@ class BanManager:
 	# @return the time
 	
 	def getBanTime(self):
-		return self.banTime
+		try:
+			self.__lock.acquire()
+			return self.__banTime
+		finally:
+			self.__lock.release()
 	
 	##
 	# Set the total number of banned address.
@@ -78,7 +85,9 @@ class BanManager:
 	# @param value total number
 	
 	def setBanTotal(self, value):
-		self.banTotal = value
+		self.__lock.acquire()
+		self.__banTotal = value
+		self.__lock.release()
 	
 	##
 	# Get the total number of banned address.
@@ -86,8 +95,24 @@ class BanManager:
 	# @return the total number
 	
 	def getBanTotal(self):
-		return self.banTotal
+		try:
+			self.__lock.acquire()
+			return self.__banTotal
+		finally:
+			self.__lock.release()
+
+	##
+	# Returns a copy of the IP list.
+	#
+	# @return IP list
 	
+	def getBanList(self):
+		try:
+			self.__lock.acquire()
+			return [m.getIP() for m in self.__banList]
+		finally:
+			self.__lock.release()
+
 	##
 	# Create a ban ticket.
 	#
@@ -100,7 +125,7 @@ class BanManager:
 	def createBanTicket(ticket):
 		ip = ticket.getIP()
 		#lastTime = ticket.getTime()
-		lastTime = time.time()
+		lastTime = MyTime.time()
 		banTicket = BanTicket(ip, lastTime)
 		banTicket.setAttempt(ticket.getAttempt())
 		return banTicket
@@ -113,23 +138,16 @@ class BanManager:
 	# @return True if the IP address is not in the ban list
 	
 	def addBanTicket(self, ticket):
-		self.lock.acquire()
-		if not self.inBanList(ticket):
-			self.banList.append(ticket)
-			self.banTotal += 1
-			self.lock.release()
-			return True
-		self.lock.release()
-		return False
+		try:
+			self.__lock.acquire()
+			if not self.__inBanList(ticket):
+				self.__banList.append(ticket)
+				self.__banTotal += 1
+				return True
+			return False
+		finally:
+			self.__lock.release()
 	
-	##
-	# Delete a ban ticket.
-	#
-	# Remove a BanTicket from the ban list.
-	# @param ticket the ticket
-	
-	def delBanTicket(self, ticket):
-		self.banList.remove(ticket)
 	
 	##
 	# Get the size of the ban list.
@@ -137,7 +155,11 @@ class BanManager:
 	# @return the size
 	
 	def size(self):
-		return len(self.banList)
+		try:
+			self.__lock.acquire()
+			return len(self.__banList)
+		finally:
+			self.__lock.release()
 	
 	##
 	# Check if a ticket is in the list.
@@ -147,8 +169,8 @@ class BanManager:
 	# @param ticket the ticket
 	# @return True if a ticket already exists
 	
-	def inBanList(self, ticket):
-		for i in self.banList:
+	def __inBanList(self, ticket):
+		for i in self.__banList:
 			if ticket.getIP() == i.getIP():
 				return True
 		return False
@@ -159,17 +181,25 @@ class BanManager:
 	# Return a list of BanTicket which need to be unbanned.
 	# @param time the time
 	# @return the list of ticket to unban
-	# @todo Check the delete operation
 	
 	def unBanList(self, time):
-		uBList = list()
-		self.lock.acquire()
-		for ticket in self.banList:
-			if ticket.getTime() < time - self.banTime:
-				uBList.append(ticket)
-				self.delBanTicket(ticket)
-		self.lock.release()
-		return uBList
+		try:
+			self.__lock.acquire()
+			# Permanent banning
+			if self.__banTime < 0:
+				return list()
+
+			# Gets the list of ticket to remove.
+			unBanList = [ticket for ticket in self.__banList
+						 if ticket.getTime() < time - self.__banTime]
+			
+			# Removes tickets.
+			self.__banList = [ticket for ticket in self.__banList
+							  if ticket not in unBanList]
+						
+			return unBanList
+		finally:
+			self.__lock.release()
 	
 	##
 	# Flush the ban list.
@@ -178,9 +208,10 @@ class BanManager:
 	# @return the complete ban list
 	
 	def flushBanList(self):
-		self.lock.acquire()
-		uBList = self.banList
-		self.banList = list()
-		self.lock.release()
-		return uBList
-	
+		try:
+			self.__lock.acquire()
+			uBList = self.__banList
+			self.__banList = list()
+			return uBList
+		finally:
+			self.__lock.release()

server/banticket.py

@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, logging
+import logging
 from ticket import Ticket
 
 # Gets the instance of the logger.

server/datedetector.py

@@ -0,0 +1,150 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time, logging
+
+from datestrptime import DateStrptime
+from datetai64n	import DateTai64n
+from dateepoch import DateEpoch
+from threading import Lock
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.filter.datedetector")
+
+class DateDetector:
+	
+	def __init__(self):
+		self.__lock = Lock()
+		self.__templates = list()
+		self.__defTemplate = DateStrptime()
+	
+	def addDefaultTemplate(self):
+		# standard
+		template = DateStrptime()
+		template.setName("Month Day Hour:Minute:Second")
+		template.setRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+		template.setPattern("%b %d %H:%M:%S")
+		self.__templates.append(template)
+		# asctime
+		template = DateStrptime()
+		template.setName("Weekday Month Day Hour:Minute:Second Year")
+		template.setRegex("\S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}")
+		template.setPattern("%a %b %d %H:%M:%S %Y")
+		self.__templates.append(template)
+		# simple date
+		template = DateStrptime()
+		template.setName("Year/Month/Day Hour:Minute:Second")
+		template.setRegex("\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
+		template.setPattern("%Y/%m/%d %H:%M:%S")
+		self.__templates.append(template)
+		# Apache format [31/Oct/2006:09:22:55 -0000]
+		template = DateStrptime()
+		template.setName("Day/Month/Year:Hour:Minute:Second")
+		template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}")
+		template.setPattern("%d/%b/%Y:%H:%M:%S")
+		self.__templates.append(template)
+		# Exim 2006-12-21 06:43:20
+		template = DateStrptime()
+		template.setName("Year-Month-Day Hour:Minute:Second")
+		template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
+		template.setPattern("%Y-%m-%d %H:%M:%S")
+		self.__templates.append(template)
+		# TAI64N
+		template = DateTai64n()
+		template.setName("TAI64N")
+		self.__templates.append(template)
+		# Epoch
+		template = DateEpoch()
+		template.setName("Epoch")
+		self.__templates.append(template)
+	
+	def getTemplates(self):
+		return self.__templates
+	
+	def setDefaultRegex(self, value):
+		self.__defTemplate.setRegex(value)
+	
+	def getDefaultRegex(self):
+		return self.__defTemplate.getRegex()
+	
+	def setDefaultPattern(self, value):
+		self.__defTemplate.setPattern(value)
+	
+	def getDefaultPattern(self):
+		return self.__defTemplate.getPattern()
+	
+	def matchTime(self, line):
+		if self.__defTemplate.isValid():
+			return self.__defTemplate.matchDate(line)
+		else:
+			self.__lock.acquire()
+			for template in self.__templates:
+				match = template.matchDate(line)
+				if not match == None:
+					self.__lock.release()
+					return match
+			self.__lock.release()
+			return None
+
+	def getTime(self, line):
+		if self.__defTemplate.isValid():
+			try:
+				date = self.__defTemplate.getDate(line)
+				return date
+			except ValueError:
+				return None
+		else:
+			self.__lock.acquire()
+			for template in self.__templates:
+				try:
+					date = template.getDate(line)
+					if date == None:
+						continue
+					template.incHits()
+					self.__lock.release()
+					return date
+				except ValueError:
+					pass
+			self.__lock.release()
+			return None
+
+	def getUnixTime(self, line):
+		date = self.getTime(line)
+		if date == None:
+			return None
+		else:
+			return time.mktime(date)
+
+	##
+	# Sort the template lists using the hits score. This method is not called
+	# in this object and thus should be called from time to time.
+	
+	def sortTemplate(self):
+		self.__lock.acquire()
+		logSys.debug("Sorting the template list")
+		self.__templates.sort(cmp = lambda x, y: cmp(x.getHits(), y.getHits()), 
+							reverse=True)
+		self.__lock.release()

server/dateepoch.py

@@ -0,0 +1,44 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time
+
+from datetemplate import DateTemplate
+
+class DateEpoch(DateTemplate):
+	
+	def __init__(self):
+		DateTemplate.__init__(self)
+		# We already know the format for TAI64N
+		self.setRegex("^\d{10}(\.\d{6})?")
+	
+	def getDate(self, line):
+		date = None
+		dateMatch = self.matchDate(line)
+		if dateMatch:
+			# extract part of format which represents seconds since epoch
+			date = list(time.gmtime(float(dateMatch.group())))
+		return date

server/datestrptime.py

@@ -0,0 +1,84 @@
+# -*- coding: utf8 -*-
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from mytime import MyTime
+import time
+
+from datetemplate import DateTemplate
+
+##
+# Use strptime() to parse a date. Our current locale is the 'C'
+# one because we do not set the locale explicitly. This is POSIX
+# standard.
+
+class DateStrptime(DateTemplate):
+	
+	TABLE = dict()
+	TABLE["Jan"] = []
+	TABLE["Feb"] = [u"Fév"]
+	TABLE["Mar"] = [u"Mär"]
+	TABLE["Apr"] = ["Avr"]
+	TABLE["May"] = ["Mai"]
+	TABLE["Jun"] = []
+	TABLE["Jul"] = []
+	TABLE["Aug"] = ["Aou"]
+	TABLE["Sep"] = []
+	TABLE["Oct"] = ["Okt"]
+	TABLE["Nov"] = []
+	TABLE["Dec"] = [u"Déc", "Dez"]
+	
+	def __init__(self):
+		DateTemplate.__init__(self)
+	
+	@staticmethod
+	def convertLocale(date):
+		for t in DateStrptime.TABLE:
+			for m in DateStrptime.TABLE[t]:
+				if date.find(m) >= 0:
+					return date.replace(m, t)
+		return date
+	
+	def getDate(self, line):
+		date = None
+		dateMatch = self.matchDate(line)
+		if dateMatch:
+			try:
+				# Try first with 'C' locale
+				date = list(time.strptime(dateMatch.group(), self.getPattern()))
+			except ValueError:
+				# Try to convert date string to 'C' locale
+				conv = self.convertLocale(dateMatch.group())
+				date = list(time.strptime(conv, self.getPattern()))
+			if date[0] < 2000:
+				# There is probably no year field in the logs
+				date[0] = MyTime.gmtime()[0]
+				# Bug fix for #1241756
+				# If the date is greater than the current time, we suppose
+				# that the log is not from this year but from the year before
+				if time.mktime(date) > MyTime.time():
+					date[0] -= 1
+		return date

server/datetai64n.py

@@ -0,0 +1,46 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time
+
+from datetemplate import DateTemplate
+
+class DateTai64n(DateTemplate):
+	
+	def __init__(self):
+		DateTemplate.__init__(self)
+		# We already know the format for TAI64N
+		self.setRegex("@[0-9a-f]{24}")
+	
+	def getDate(self, line):
+		date = None
+		dateMatch = self.matchDate(line)
+		if dateMatch:
+			# extract part of format which represents seconds since epoch
+			value = dateMatch.group()
+			seconds_since_epoch = value[2:17]
+			date = list(time.gmtime(int(seconds_since_epoch, 16)))
+		return date

server/datetemplate.py

@@ -0,0 +1,71 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import re
+
+class DateTemplate:
+	
+	def __init__(self):
+		self.__name = ""
+		self.__regex = ""
+		self.__cRegex = None
+		self.__pattern = ""
+		self.__hits = 0
+	
+	def setName(self, name):
+		self.__name = name
+		
+	def getName(self):
+		return self.__name
+	
+	def setRegex(self, regex):
+		self.__regex = regex.strip()
+		self.__cRegex = re.compile(regex)
+		
+	def getRegex(self):
+		return self.__regex
+	
+	def setPattern(self, pattern):
+		self.__pattern = pattern.strip()
+		
+	def getPattern(self):
+		return self.__pattern
+	
+	def isValid(self):
+		return self.__regex != "" and self.__pattern != ""
+	
+	def incHits(self):
+		self.__hits = self.__hits + 1
+	
+	def getHits(self):
+		return self.__hits
+	
+	def matchDate(self, line):
+		dateMatch = self.__cRegex.search(line)
+		return dateMatch
+	
+	def getDate(self, line):
+		raise Exception("matchDate() is abstract")

server/faildata.py

@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, logging
+import logging
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban")
@@ -32,22 +32,22 @@ logSys = logging.getLogger("fail2ban")
 class FailData:
 	
 	def __init__(self):
-		self.retry = 0
-		self.lastTime = 0
+		self.__retry = 0
+		self.__lastTime = 0
 	
 	def setRetry(self, value):
-		self.retry = value
+		self.__retry = value
 	
 	def getRetry(self):
-		return self.retry
+		return self.__retry
 	
 	def inc(self):
-		self.retry += 1
+		self.__retry += 1
 	
 	def setLastTime(self, value):
-		if value > self.lastTime:
-			self.lastTime = value
+		if value > self.__lastTime:
+			self.__lastTime = value
 	
 	def getLastTime(self):
-		return self.lastTime
+		return self.__lastTime
 	

server/failmanager.py

@@ -27,7 +27,7 @@ __license__ = "GPL"
 from faildata import FailData
 from failticket import FailTicket
 from threading import Lock
-import time, logging
+import logging
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.filter")
@@ -35,74 +35,97 @@ logSys = logging.getLogger("fail2ban.filter")
 class FailManager:
 	
 	def __init__(self):
-		self.lock = Lock()
-		self.failList = dict()
-		self.maxRetry = 3
-		self.maxTime = 600
-		self.failTotal = 0
+		self.__lock = Lock()
+		self.__failList = dict()
+		self.__maxRetry = 3
+		self.__maxTime = 600
+		self.__failTotal = 0
 	
 	def setFailTotal(self, value):
-		self.failTotal = value
+		self.__lock.acquire()
+		self.__failTotal = value
+		self.__lock.release()
 		
 	def getFailTotal(self):
-		return self.failTotal
+		try:
+			self.__lock.acquire()
+			return self.__failTotal
+		finally:
+			self.__lock.release()
 	
 	def setMaxRetry(self, value):
-		self.maxRetry = value
+		self.__lock.acquire()
+		self.__maxRetry = value
+		self.__lock.release()
 	
 	def getMaxRetry(self):
-		return self.maxRetry
+		try:
+			self.__lock.acquire()
+			return self.__maxRetry
+		finally:
+			self.__lock.release()
 	
 	def setMaxTime(self, value):
-		self.maxTime = value
+		self.__lock.acquire()
+		self.__maxTime = value
+		self.__lock.release()
 	
 	def getMaxTime(self):
-		return self.maxTime
+		try:
+			self.__lock.acquire()
+			return self.__maxTime
+		finally:
+			self.__lock.release()
 
 	def addFailure(self, ticket):
-		self.lock.acquire()
+		self.__lock.acquire()
 		ip = ticket.getIP()
 		unixTime = ticket.getTime()
-		if self.failList.has_key(ip):
-			fData = self.failList[ip]
+		if self.__failList.has_key(ip):
+			fData = self.__failList[ip]
 			fData.inc()
 			fData.setLastTime(unixTime)
 		else:
 			fData = FailData()
 			fData.inc()
 			fData.setLastTime(unixTime)
-			self.failList[ip] = fData
-		self.failTotal += 1
-		self.lock.release()
+			self.__failList[ip] = fData
+		self.__failTotal += 1
+		self.__lock.release()
 	
 	def size(self):
-		return len(self.failList)
+		try:
+			self.__lock.acquire()
+			return len(self.__failList)
+		finally:
+			self.__lock.release()
 	
 	def cleanup(self, time):
-		self.lock.acquire()
-		tmp = self.failList.copy()
+		self.__lock.acquire()
+		tmp = self.__failList.copy()
 		for item in tmp:
-			if tmp[item].getLastTime() < time - self.maxTime:
-				self.delFailure(item)
-		self.lock.release()
+			if tmp[item].getLastTime() < time - self.__maxTime:
+				self.__delFailure(item)
+		self.__lock.release()
 	
-	def delFailure(self, ip):
-		if self.failList.has_key(ip):
-			del self.failList[ip]
+	def __delFailure(self, ip):
+		if self.__failList.has_key(ip):
+			del self.__failList[ip]
 	
 	def toBan(self):
-		self.lock.acquire()
-		for ip in self.failList:
-			data = self.failList[ip]
-			if data.getRetry() >= self.maxRetry:
-				self.delFailure(ip)
-				self.lock.release()
-				# Create a FailTicket from BanData
-				failTicket = FailTicket(ip, data.getLastTime())
-				failTicket.setAttempt(data.getRetry())
-				return failTicket
-		self.lock.release()
-		raise FailManagerEmpty
+		try:
+			self.__lock.acquire()
+			for ip in self.__failList:
+				data = self.__failList[ip]
+				if data.getRetry() >= self.__maxRetry:
+					self.__delFailure(ip)
+					# Create a FailTicket from BanData
+					failTicket = FailTicket(ip, data.getLastTime())
+					failTicket.setAttempt(data.getRetry())
+					return failTicket
+			raise FailManagerEmpty
+		finally:
+			self.__lock.release()
 
 class FailManagerEmpty(Exception):
 	pass

server/failregex.py

@@ -0,0 +1,62 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from regex import Regex, RegexException
+
+##
+# Regular expression class.
+#
+# This class represents a regular expression with its compiled version.
+
+class FailRegex(Regex):
+
+	##
+	# Constructor.
+	#
+	# Creates a new object. This method can throw RegexException in order to
+	# avoid construction of invalid object.
+	# @param value the regular expression
+	
+	def __init__(self, value):
+		# Replace "<HOST>" with default regular expression for host.
+		regex = value.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>\S+)")
+		# Initializes the parent.
+		Regex.__init__(self, regex)
+		# Check for group "host"
+		if "host" not in self._regexObj.groupindex:
+			raise RegexException("No 'host' group in '%s'" % self._regex)
+	
+	##
+	# Returns the matched host.
+	#
+	# This corresponds to the pattern matched by the named group "host".
+	# @return the matched host
+	
+	def getHost(self):
+		host = self._matchCache.group("host")
+		if host == None:
+			raise RegexException("Unexpected error. Please check your regex")
+		return host

server/failticket.py

@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, logging
+import logging
 from ticket import Ticket
 
 # Gets the instance of the logger.

server/filter.py

@@ -25,10 +25,14 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 from failmanager import FailManager
-from failmanager import FailManagerEmpty
 from failticket import FailTicket
 from jailthread import JailThread
-import time, logging, os, re, sys, socket
+from datedetector import DateDetector
+from mytime import MyTime
+from regex import Regex, RegexException
+from failregex import FailRegex
+
+import logging, re
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.filter")
@@ -49,45 +53,54 @@ class Filter(JailThread):
 	# @param jail the jail object
 	
 	def __init__(self, jail):
-		JailThread.__init__(self, jail)
+		JailThread.__init__(self)
 		## The jail which contains this filter.
 		self.jail = jail
 		## The failures manager.
 		self.failManager = FailManager()
 		## The log file handler.
-		self.fileHandler = None
+		self.__crtHandler = None
+		self.__crtFilename = None
 		## The log file path.
-		self.logPath = ''
-		## The regular expression matching the date.
-		self.timeRegex = ''
-		self.timeRegexObj = None
-		## The pattern matching the date.
-		self.timePattern = ''
-		## The regular expression matching the failure.
-		self.failRegex = ''
-		self.failRegexObj = None
+		self.__logPath = []
+		## The regular expression list matching the failures.
+		self.__failRegex = list()
+		## The regular expression list with expressions to ignore.
+		self.__ignoreRegex = list()
 		## The amount of time to look back.
-		self.findTime = 6000
+		self.__findTime = 6000
 		## The ignore IP list.
-		self.ignoreIpList = []
-		## The time of the last modification of the file.
-		self.lastModTime = 0
+		self.__ignoreIpList = []
 		## The last position of the file.
-		self.lastPos = 0
+		self.__lastPos = dict()
 		## The last date in tht log file.
-		self.lastDate = 0
-		## The file statistics.
-		self.logStats = None
+		self.__lastDate = dict()
+		
+		self.dateDetector = DateDetector()
+		self.dateDetector.addDefaultTemplate()
 		logSys.info("Created Filter")
 
-	##
-	# Set the log file path
-	#
-	# @param value log file path
 
-	def setLogPath(self, value):
-		self.logPath = value
-		logSys.info("Set logfile = %s" % value)
+	##
+	# Add a log file path
+	#
+	# @param path log file path
+
+	def addLogPath(self, path):
+		self.getLogPath().append(path)
+		# Initialize default values
+		self.__lastDate[path] = 0
+		self.__lastPos[path] = 0
+	
+	##
+	# Delete a log path
+	#
+	# @param path the log file to delete
+	
+	def delLogPath(self, path):
+		self.getLogPath().remove(path)
+		del self.__lastDate[path]
+		del self.__lastPos[path]
 
 	##
 	# Get the log file path
@@ -95,7 +108,20 @@ class Filter(JailThread):
 	# @return log file path
 		
 	def getLogPath(self):
-		return self.logPath
+		return self.__logPath
+	
+	##
+	# Check whether path is already monitored.
+	#
+	# @param path The path
+	# @return True if the path is already monitored else False
+	
+	def containsLogPath(self, path):
+		try:
+			self.getLogPath().index(path)
+			return True
+		except ValueError:
+			return False
 	
 	##
 	# Set the regular expression which matches the time.
@@ -103,9 +129,8 @@ class Filter(JailThread):
 	# @param value the regular expression
 	
 	def setTimeRegex(self, value):
-		self.timeRegex = value
-		self.timeRegexObj = re.compile(value)
-		logSys.info("Set timeregex = %s" % value)
+		self.dateDetector.setDefaultRegex(value)
+		logSys.info("Set default regex = %s" % value)
 	
 	##
 	# Get the regular expression which matches the time.
@@ -113,7 +138,7 @@ class Filter(JailThread):
 	# @return the regular expression
 		
 	def getTimeRegex(self):
-		return self.timeRegex
+		return self.dateDetector.getDefaultRegex()
 	
 	##
 	# Set the time pattern.
@@ -121,8 +146,8 @@ class Filter(JailThread):
 	# @param value the time pattern
 	
 	def setTimePattern(self, value):
-		self.timePattern = value
-		logSys.info("Set timepattern = %s" % value)
+		self.dateDetector.setDefaultPattern(value)
+		logSys.info("Set default pattern = %s" % value)
 	
 	##
 	# Get the time pattern.
@@ -130,19 +155,29 @@ class Filter(JailThread):
 	# @return the time pattern
 	
 	def getTimePattern(self):
-		return self.timePattern
+		return self.dateDetector.getDefaultPattern()
 	
 	##
-	# Set the regular expression which matches the failure.
+	# Add a regular expression which matches the failure.
 	#
 	# The regular expression can also match any other pattern than failures
 	# and thus can be used for many purporse.
 	# @param value the regular expression
 	
-	def setFailRegex(self, value):
-		self.failRegex = value
-		self.failRegexObj = re.compile(value)
-		logSys.info("Set failregex = %s" % value)
+	def addFailRegex(self, value):
+		try:
+			regex = FailRegex(value)
+			self.__failRegex.append(regex)
+		except RegexException, e:
+			logSys.error(e)
+	
+
+	def delFailRegex(self, index):
+		try:
+			del self.__failRegex[index]
+		except IndexError:
+			logSys.error("Cannot remove regular expression. Index %d is not "
+						 "valid" % index)
 	
 	##
 	# Get the regular expression which matches the failure.
@@ -150,7 +185,42 @@ class Filter(JailThread):
 	# @return the regular expression
 	
 	def getFailRegex(self):
-		return self.failRegex
+		failRegex = list()
+		for regex in self.__failRegex:
+			failRegex.append(regex.getRegex())
+		return failRegex
+	
+	##
+	# Add the regular expression which matches the failure.
+	#
+	# The regular expression can also match any other pattern than failures
+	# and thus can be used for many purporse.
+	# @param value the regular expression
+	
+	def addIgnoreRegex(self, value):
+		try:
+			regex = Regex(value)
+			self.__ignoreRegex.append(regex)
+		except RegexException, e:
+			logSys.error(e)
+	
+	def delIgnoreRegex(self, index):
+		try:
+			del self.__ignoreRegex[index]
+		except IndexError:
+			logSys.error("Cannot remove regular expression. Index %d is not "
+						 "valid" % index)
+	
+	##
+	# Get the regular expression which matches the failure.
+	#
+	# @return the regular expression
+	
+	def getIgnoreRegex(self):
+		ignoreRegex = list()
+		for regex in self.__ignoreRegex:
+			ignoreRegex.append(regex.getRegex())
+		return ignoreRegex
 	
 	##
 	# Set the time needed to find a failure.
@@ -160,7 +230,8 @@ class Filter(JailThread):
 	# @param value the time
 	
 	def setFindTime(self, value):
-		self.findTime = value
+		self.__findTime = value
+		self.failManager.setMaxTime(value)
 		logSys.info("Set findtime = %s" % value)
 	
 	##
@@ -169,7 +240,7 @@ class Filter(JailThread):
 	# @return the time
 	
 	def getFindTime(self):
-		return self.findTime
+		return self.__findTime
 	
 	##
 	# Set the maximum retry value.
@@ -188,23 +259,6 @@ class Filter(JailThread):
 	def getMaxRetry(self):
 		return self.failManager.getMaxRetry()
 	
-	##
-	# Set the maximum time a failure stays in the list.
-	#
-	# @param value the maximum time
-	
-	def setMaxTime(self, value):
-		self.failManager.setMaxTime(value)
-		logSys.info("Set maxTime = %s" % value)
-	
-	##
-	# Get the maximum time a failure stays in the list.
-	#
-	# @return the time value
-	
-	def getMaxTime(self):
-		return self.failManager.getMaxTime()
-
 	##
 	# Main loop.
 	#
@@ -213,43 +267,39 @@ class Filter(JailThread):
 	# @return True when the thread exits nicely
 
 	def run(self):
-		self.setActive(True)
-		while self.isActive():
-			if not self.isIdle:
-				if self.isModified():
-					self.getFailures()
-				try:
-					ticket = self.failManager.toBan()
-					self.jail.putFailTicket(ticket)
-				except FailManagerEmpty:
-					self.failManager.cleanup(time.time())
-					time.sleep(self.sleepTime)
-			else:
-				time.sleep(self.sleepTime)
-		logSys.debug(self.jail.getName() + ": filter terminated")
-		return True
+		raise Exception("run() is abstract")
 	
 	##
-	# Add an IP to the ignore list.
+	# Add an IP/DNS to the ignore list.
 	#
 	# IP addresses in the ignore list are not taken into account
-	# when finding failures. CIDR mask are also accepted.
+	# when finding failures. CIDR mask and DNS are also accepted.
 	# @param ip IP address to ignore
 	
 	def addIgnoreIP(self, ip):
 		logSys.debug("Add " + ip + " to ignore list")
-		self.ignoreIpList.append(ip)
+		self.__ignoreIpList.append(ip)
+		
+	def delIgnoreIP(self, ip):
+		logSys.debug("Remove " + ip + " from ignore list")
+		self.__ignoreIpList.remove(ip)
+		
+	def getIgnoreIP(self):
+		return self.__ignoreIpList
 	
 	##
-	# Check if IP address is in the ignore list.
+	# Check if IP address/DNS is in the ignore list.
 	#
-	# Check if the given IP address matches an IP address or a CIDR
+	# Check if the given IP address matches an IP address/DNS or a CIDR
 	# mask in the ignore list.
 	# @param ip IP address
 	# @return True if IP address is in ignore list
 	
 	def inIgnoreIPList(self, ip):
-		for i in self.ignoreIpList:
+		for i in self.__ignoreIpList:
+			# An empty string is always false
+			if i == "":
+				return False
 			s = i.split('/', 1)
 			# IP address without CIDR mask
 			if len(s) == 1:
@@ -259,7 +309,12 @@ class Filter(JailThread):
 				a = DNSUtils.cidr(s[0], s[1])
 				b = DNSUtils.cidr(ip, s[1])
 			except Exception:
-				return False
+				# Check if IP in DNS
+				ips = DNSUtils.dnsToIp(i)
+				if ip in ips:
+					return True
+				else:
+					return False
 			if a == b:
 				return True
 		return False
@@ -267,38 +322,27 @@ class Filter(JailThread):
 	##
 	# Open the log file.
 	
-	def openLogFile(self):
+	def __openLogFile(self, filename):
 		""" Opens the log file specified on init.
 		"""
 		try:
-			self.fileHandler = open(self.logPath)
+			self.__crtFilename = filename
+			self.__crtHandler = open(filename)
+			logSys.debug("Opened " + filename)
+			return True
 		except OSError:
-			logSys.error("Unable to open "+self.logPath)
+			logSys.error("Unable to open " + filename)
+		except IOError:
+			logSys.error("Unable to read " + filename +
+						 ". Please check permissions")
+		return False
 	
 	##
 	# Close the log file.
 	
-	def closeLogFile(self):
-		self.fileHandler.close()
-	
-	##
-	# Checks if the log file has been modified.
-	#
-	# Checks if the log file has been modified using os.stat().
-	# @return True if log file has been modified
-	
-	def isModified(self):
-		try:
-			self.logStats = os.stat(self.logPath)
-			if self.lastModTime == self.logStats.st_mtime:
-				return False
-			else:
-				logSys.debug(self.logPath + " has been modified")
-				self.lastModTime = self.logStats.st_mtime
-				return True
-		except OSError:
-			logSys.error("Unable to get stat on " + self.logPath)
-			return False
+	def __closeLogFile(self):
+		self.__crtFilename = None
+		self.__crtHandler.close()
 
 	##
 	# Set the file position.
@@ -307,61 +351,67 @@ class Filter(JailThread):
 	# and reset the position to 0 in that case. Use the log message
 	# timestamp in order to detect this.
 	
-	def setFilePos(self):
-		line = self.fileHandler.readline()
-		if self.lastDate < self.getTime(line):
-			logSys.debug("Date " + `self.lastDate` + " is " + "smaller than " +
-							`self.getTime(line)`)
-			logSys.debug("Log rotation detected for " + self.logPath)
-			self.lastPos = 0
-		
-		logSys.debug("Setting file position to " + `self.lastPos` + " for " +
-						self.logPath)
-		self.fileHandler.seek(self.lastPos)
+	def __setFilePos(self):
+		line = self.__crtHandler.readline()
+		lastDate = self.__lastDate[self.__crtFilename]
+		lineDate = self.dateDetector.getUnixTime(line)
+		if lastDate < lineDate:
+			logSys.debug("Date " + `lastDate` + " is smaller than " + `lineDate`)
+			logSys.debug("Log rotation detected for " + self.__crtFilename)
+			self.__lastPos[self.__crtFilename] = 0
+		lastPos = self.__lastPos[self.__crtFilename]
+		logSys.debug("Setting file position to " + `lastPos` + " for " +
+					 self.__crtFilename)
+		self.__crtHandler.seek(lastPos)
 
 	##
 	# Get the file position.
 	
-	def getFilePos(self):
-		return self.fileHandler.tell()
+	def __getFilePos(self):
+		return self.__crtHandler.tell()
 
 	##
 	# Gets all the failure in the log file.
 	#
 	# Gets all the failure in the log file which are newer than
-	# time.time()-self.findTime. When a failure is detected, a FailTicket
+	# MyTime.time()-self.findTime. When a failure is detected, a FailTicket
 	# is created and is added to the FailManager.
 	
-	def getFailures(self):
-		ipList = dict()
-		logSys.debug(self.logPath)
-		self.openLogFile()
-		self.setFilePos()
+	def getFailures(self, filename):
+		# Try to open log file.
+		if not self.__openLogFile(filename):
+			logSys.error("Unable to get failures in " + filename)
+			return False
+		self.__setFilePos()
 		lastLine = None
-		for line in self.fileHandler:
+		for line in self.__crtHandler:
+			if not self.isActive():
+				# The jail has been stopped
+				break
 			try:
-				# Try to convert UTF-8 string to Latin-1
-				line = line.decode('utf-8').encode('latin-1')
+				# Decode line to UTF-8
+				line = line.decode('utf-8')
 			except UnicodeDecodeError:
 				pass
-			if not self.hasTime(line):
+			if not self.dateDetector.matchTime(line):
 				# There is no valid time in this line
 				continue
 			lastLine = line
 			for element in self.findFailure(line):
 				ip = element[0]
 				unixTime = element[1]
-				if unixTime < time.time()-self.findTime:
+				if unixTime < MyTime.time()-self.__findTime:
 					break
 				if self.inIgnoreIPList(ip):
 					logSys.debug("Ignore "+ip)
 					continue
 				logSys.debug("Found "+ip)
 				self.failManager.addFailure(FailTicket(ip, unixTime))
-		self.lastPos = self.getFilePos()
+		self.__lastPos[filename] = self.__getFilePos()
 		if lastLine:
-			self.lastDate = self.getTime(lastLine)
-		self.closeLogFile()
+			self.__lastDate[filename] = self.dateDetector.getUnixTime(lastLine)
+		self.__closeLogFile()
+		return True
 
 	##
 	# Finds the failure in a line.
@@ -372,78 +422,37 @@ class Filter(JailThread):
 
 	def findFailure(self, line):
 		failList = list()
-		match = self.failRegexObj.search(line)
-		if match:
-			timeMatch = self.timeRegexObj.search(match.string)
-			if timeMatch:
-				date = self.getUnixTime(timeMatch.group())
-				try:
-					ipMatch = DNSUtils.textToIp(match.group("host"))
-					if ipMatch:
-						for ip in ipMatch:
-							failList.append([ip, date])
-				except IndexError:
-					logSys.error("There is no 'host' group in the rule. " +
-								 "Please correct your configuration.")
+		# Checks if we must ignore this line.
+		for ignoreRegex in self.__ignoreRegex:
+			ignoreRegex.search(line)
+			if ignoreRegex.hasMatched():
+				# The ignoreregex matched. Return.
+				logSys.debug("Ignoring this line")
+				return failList
+		# Iterates over all the regular expressions.
+		for failRegex in self.__failRegex:
+			failRegex.search(line)
+			if failRegex.hasMatched():
+				# The failregex matched.
+				date = self.dateDetector.getUnixTime(line)
+				if date == None:
+					logSys.debug("Found a match but no valid date/time found "
+								 + "for " + line + ". Please contact the "
+								 + "author in order to get support for this "
+								 + "format")
+				else:
+					try:
+						host = failRegex.getHost()
+						ipMatch = DNSUtils.textToIp(host)
+						if ipMatch:
+							for ip in ipMatch:
+								failList.append([ip, date])
+							# We matched a regex, it is enough to stop.
+							break
+					except RegexException, e:
+						logSys.error(e)
 		return failList
 	
-	##
-	# Check is a line contains a valid date.
-	#
-	# @param line the line
-	# @return True if the line contains a valid date
-	
-	def hasTime(self, line):
-		timeMatch = re.search(self.timeRegex, line)
-		if timeMatch:
-			return True
-		else:
-			return False
-
-	##
-	# Get the time of a log line.
-	#
-	# @param line the line
-	# @return the timestamp of the log line
-	
-	def getTime(self, line):
-		date = 0
-		timeMatch = re.search(self.timeRegex, line)
-		if timeMatch:
-			date = self.getUnixTime(timeMatch.group())
-		return date
-
-	##
-	# Get the Unix timestamp.
-	#
-	# Get the Unix timestamp of a given date. Pattern should describe the
-	# date construction of value.
-	# @param value the date
-	# @return the Unix timestamp
-		
-	def getUnixTime(self, value):
-		try:
-			# Check if the parsed value is in TAI64N format
-			if not self.timePattern.lower() == "tai64n":
-				date = list(time.strptime(value, self.timePattern))
-			else:
-				# extract part of format which represents seconds since epoch
-				seconds_since_epoch = value[2:17]
-				date = list(time.gmtime(int(seconds_since_epoch, 16)))
-		except ValueError, e:
-			logSys.error(e)
-			logSys.error("Please check the format and your locale settings.")
-			return None
-		if date[0] < 2000:
-			# There is probably no year field in the logs
-			date[0] = time.gmtime()[0]
-			# Bug fix for #1241756
-			# If the date is greater than the current time, we suppose
-			# that the log is not from this year but from the year before
-			if time.mktime(date) > time.time():
-				date[0] -= 1
-		unixTime = time.mktime(date)
-		return unixTime
 
 	##
 	# Get the status of the filter.
@@ -453,7 +462,7 @@ class Filter(JailThread):
 	# @return a list with tuple
 	
 	def status(self):
-		ret = [("Currently failed", self.failManager.size()),
+		ret = [("Currently failed", self.failManager.size()), 
 			   ("Total failed", self.failManager.getFailTotal())]
 		return ret
 
@@ -468,8 +477,8 @@ import socket, struct
 
 class DNSUtils:
 	
-	dnsCRE = re.compile("(?:(?:\w|-)+\.){2,}\w+")
-	ipCRE = re.compile("(?:\d{1,3}\.){3}\d{1,3}")
+	DNS_CRE = re.compile("(?:(?:\w|-)+\.){2,}\w+")
+	IP_CRE = re.compile("(?:\d{1,3}\.){3}\d{1,3}")
 	
 	@staticmethod
 	def dnsToIp(dns):
@@ -479,6 +488,8 @@ class DNSUtils:
 		try:
 			return socket.gethostbyname_ex(dns)[2]
 		except socket.gaierror:
+			logSys.warn("Unable to find a corresponding IP address for %s"
+						% dns)
 			return list()
 	
 	@staticmethod
@@ -486,7 +497,7 @@ class DNSUtils:
 		""" Search for possible DNS in an arbitrary text.
 			Thanks to Tom Pike.
 		"""
-		match = DNSUtils.dnsCRE.match(text)
+		match = DNSUtils.DNS_CRE.match(text)
 		if match:
 			return match
 		else:
@@ -497,17 +508,17 @@ class DNSUtils:
 		""" Search if an IP address if directly available and return
 			it.
 		"""
-		match = DNSUtils.ipCRE.match(text)
+		match = DNSUtils.IP_CRE.match(text)
 		if match:
 			return match
 		else:
 			return None
 	
 	@staticmethod
-	def isValidIP(str):
+	def isValidIP(string):
 		""" Return true if str is a valid IP
 		"""
-		s = str.split('/', 1)
+		s = string.split('/', 1)
 		try:
 			socket.inet_aton(s[0])
 			return True
@@ -544,10 +555,10 @@ class DNSUtils:
 		return ~(MASK >> n) & MASK & DNSUtils.addr2bin(i)
 	
 	@staticmethod
-	def addr2bin(str):
+	def addr2bin(string):
 		""" Convert a string IPv4 address into an unsigned integer.
 		"""
-		return struct.unpack("!L", socket.inet_aton(str))[0]
+		return struct.unpack("!L", socket.inet_aton(string))[0]
 	
 	@staticmethod
 	def bin2addr(addr):

server/filtergamin.py

@@ -0,0 +1,121 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from failmanager import FailManagerEmpty
+from filter import Filter
+from mytime import MyTime
+
+import time, logging, gamin
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.filter")
+
+##
+# Log reader class.
+#
+# This class reads a log file and detects login failures or anything else
+# that matches a given regular expression. This class is instanciated by
+# a Jail object.
+
+class FilterGamin(Filter):
+
+	##
+	# Constructor.
+	#
+	# Initialize the filter object with default values.
+	# @param jail the jail object
+	
+	def __init__(self, jail):
+		Filter.__init__(self, jail)
+		self.__modified = False
+		# Gamin monitor
+		self.monitor = gamin.WatchMonitor()
+		logSys.info("Created FilterGamin")
+
+
+	def callback(self, path, event):
+		logSys.debug("Got event: " + `event` + " for " + path)
+		if event in (gamin.GAMCreated, gamin.GAMChanged, gamin.GAMExists):
+			logSys.debug("File changed: " + path)
+			self.getFailures(path)
+			self.__modified = True
+
+
+	##
+	# Add a log file path
+	#
+	# @param path log file path
+
+	def addLogPath(self, path):
+		if self.containsLogPath(path):
+			logSys.error(path + " already exists")
+		else:
+			self.monitor.watch_file(path, self.callback)
+			Filter.addLogPath(self, path)
+			logSys.info("Added logfile = %s" % path)			
+	
+	##
+	# Delete a log path
+	#
+	# @param path the log file to delete
+	
+	def delLogPath(self, path):
+		if not self.containsLogPath(path):
+			logSys.error(path + " is not monitored")
+		else:
+			self.monitor.stop_watch(path)
+			Filter.delLogPath(self, path)
+			logSys.info("Removed logfile = %s" % path)
+		
+	##
+	# Main loop.
+	#
+	# This function is the main loop of the thread. It checks if the
+	# file has been modified and looks for failures.
+	# @return True when the thread exits nicely
+
+	def run(self):
+		self.setActive(True)
+		while self.isActive():
+			if not self.getIdle():
+				# We cannot block here because we want to be able to
+				# exit.
+				if self.monitor.event_pending():
+					self.monitor.handle_events()
+
+				if self.__modified:
+					try:
+						ticket = self.failManager.toBan()
+						self.jail.putFailTicket(ticket)
+					except FailManagerEmpty:
+						self.failManager.cleanup(MyTime.time())
+					self.dateDetector.sortTemplate()
+					self.__modified = False
+				time.sleep(self.getSleepTime())
+			else:
+				time.sleep(self.getSleepTime())
+		logSys.debug(self.jail.getName() + ": filter terminated")
+		return True

server/filterpoll.py

@@ -0,0 +1,141 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from failmanager import FailManagerEmpty
+from filter import Filter
+from mytime import MyTime
+
+import time, logging, os
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.filter")
+
+##
+# Log reader class.
+#
+# This class reads a log file and detects login failures or anything else
+# that matches a given regular expression. This class is instanciated by
+# a Jail object.
+
+class FilterPoll(Filter):
+
+	##
+	# Constructor.
+	#
+	# Initialize the filter object with default values.
+	# @param jail the jail object
+	
+	def __init__(self, jail):
+		Filter.__init__(self, jail)
+		self.__modified = False
+		## The time of the last modification of the file.
+		self.__lastModTime = dict()
+		self.__file404Cnt = dict()
+		logSys.info("Created FilterPoll")
+
+	##
+	# Add a log file path
+	#
+	# @param path log file path
+
+	def addLogPath(self, path):
+		if self.containsLogPath(path):
+			logSys.error(path + " already exists")
+		else:
+			self.__lastModTime[path] = 0
+			self.__file404Cnt[path] = 0
+			Filter.addLogPath(self, path)
+			logSys.info("Added logfile = %s" % path)	
+	
+	##
+	# Delete a log path
+	#
+	# @param path the log file to delete
+	
+	def delLogPath(self, path):
+		if not self.containsLogPath(path):
+			logSys.error(path + " is not monitored")
+		else:
+			del self.__lastModTime[path]
+			del self.__file404Cnt[path]
+			Filter.delLogPath(self, path)
+			logSys.info("Removed logfile = %s" % path)
+	
+	##
+	# Main loop.
+	#
+	# This function is the main loop of the thread. It checks if the
+	# file has been modified and looks for failures.
+	# @return True when the thread exits nicely
+
+	def run(self):
+		self.setActive(True)
+		while self.isActive():
+			if not self.getIdle():
+				# Get file modification
+				for f in self.getLogPath():
+					if self.isModified(f):
+						self.getFailures(f)
+						self.__modified = True
+
+				if self.__modified:
+					try:
+						ticket = self.failManager.toBan()
+						self.jail.putFailTicket(ticket)
+					except FailManagerEmpty:
+						self.failManager.cleanup(MyTime.time())
+					self.dateDetector.sortTemplate()
+					self.__modified = False
+				time.sleep(self.getSleepTime())
+			else:
+				time.sleep(self.getSleepTime())
+		logSys.debug(self.jail.getName() + ": filter terminated")
+		return True
+
+	##
+	# Checks if the log file has been modified.
+	#
+	# Checks if the log file has been modified using os.stat().
+	# @return True if log file has been modified
+	
+	def isModified(self, filename):
+		try:
+			logStats = os.stat(filename)
+			self.__file404Cnt[filename] = 0
+			if self.__lastModTime[filename] == logStats.st_mtime:
+				return False
+			else:
+				logSys.debug(filename + " has been modified")
+				self.__lastModTime[filename] = logStats.st_mtime
+				return True
+		except OSError:
+			logSys.error("Unable to get stat on " + filename)
+			self.__file404Cnt[filename] = self.__file404Cnt[filename] + 1
+			if self.__file404Cnt[filename] > 2:
+				logSys.warn("Too much read error. Set the jail idle")
+				self.jail.setIdle(True)
+				self.__file404Cnt[filename] = 0
+			return False

server/jail.py

@@ -24,72 +24,86 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from actions import Actions
-from filter import Filter
-import Queue
+import Queue, logging
 
+from actions import Actions
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.jail")
 
 class Jail:
 	
-	def __init__(self, name, filter = None, action = None):
-		self.name = name
-		self.queue = Queue.Queue()
-		self.filter = Filter(self)
-		self.action = Actions(self)
+	def __init__(self, name, backend = "auto"):
+		self.__name = name
+		self.__queue = Queue.Queue()
+		self.__filter = None
+		if backend == "polling":
+			self.__initPoller()
+		else:
+			try:
+				self.__initGamin()
+			except ImportError:
+				self.__initPoller()
+		self.__action = Actions(self)
+	
+	def __initPoller(self):
+		logSys.info("Using poller")
+		from filterpoll import FilterPoll
+		self.__filter = FilterPoll(self)
+	
+	def __initGamin(self):
+		# Try to import gamin
+		import gamin
+		logSys.info("Using Gamin")
+		from filtergamin import FilterGamin
+		self.__filter = FilterGamin(self)
 	
 	def setName(self, name):
-		self.name = name
+		self.__name = name
 	
 	def getName(self):
-		return self.name
-	
-	def setFilter(self, filter):
-		self.filter = filter
+		return self.__name
 	
 	def getFilter(self):
-		return self.filter
-	
-	def setAction(self, action):
-		self.action = action
+		return self.__filter
 	
 	def getAction(self):
-		return self.action
+		return self.__action
 	
 	def putFailTicket(self, ticket):
-		self.queue.put(ticket)
+		self.__queue.put(ticket)
 	
 	def getFailTicket(self):
 		try:
-			return self.queue.get(False)
+			return self.__queue.get(False)
 		except Queue.Empty:
 			return False
 	
 	def start(self):
-		self.filter.start()
-		self.action.start()
+		self.__filter.start()
+		self.__action.start()
 	
 	def stop(self):
-		self.filter.stop()
-		self.action.stop()
-		self.filter.join()
-		self.action.join()
+		self.__filter.stop()
+		self.__action.stop()
+		self.__filter.join()
+		self.__action.join()
 	
 	def isActive(self):
-		isActive0 = self.filter.isActive()
-		isActive1 = self.action.isActive()
+		isActive0 = self.__filter.isActive()
+		isActive1 = self.__action.isActive()
 		return isActive0 or isActive1
 	
 	def setIdle(self, value):
-		self.filter.setIdle(value)
-		self.action.setIdle(value)
+		self.__filter.setIdle(value)
+		self.__action.setIdle(value)
 	
 	def getIdle(self):
-		return self.filter.getIdle() or self.action.getIdle()
+		return self.__filter.getIdle() or self.__action.getIdle()
 	
 	def getStatus(self):
-		fStatus = self.filter.status()
-		aStatus = self.action.status()
-		ret = [("filter", fStatus),
+		fStatus = self.__filter.status()
+		aStatus = self.__action.status()
+		ret = [("filter", fStatus), 
 			   ("action", aStatus)]
 		return ret
-	

server/jails.py

@@ -0,0 +1,165 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+
+from jail import Jail
+from threading import Lock
+
+##
+# Handles the jails.
+#
+# This class handles the jails. Creation, deletion or access to a jail must be
+# done through this class. This class is thread-safe which is not the case of
+# the jail itself, including filter and actions.
+
+class Jails:
+	
+	##
+	# Constructor.
+	
+	def __init__(self):
+		self.__lock = Lock()
+		self.__jails = dict()
+	
+	##
+	# Adds a jail.
+	#
+	# Adds a new jail which should use the given backend. Raises a
+	# <code>DuplicateJailException</code> if the jail is already defined.
+	# @param name The name of the jail
+	# @param backend The backend to use
+	
+	def add(self, name, backend):
+		try:
+			self.__lock.acquire()
+			if self.__jails.has_key(name):
+				raise DuplicateJailException(name)
+			else:
+				self.__jails[name] = Jail(name, backend)
+		finally:
+			self.__lock.release()
+	
+	##
+	# Removes a jail.
+	#
+	# Removes the jail <code>name</code>. Raise an <code>UnknownJailException</code>
+	# if the jail does not exist.
+	# @param name The name of the jail
+	
+	def remove(self, name):
+		try:
+			self.__lock.acquire()
+			if self.__jails.has_key(name):
+				del self.__jails[name]
+			else:
+				raise UnknownJailException(name)
+		finally:
+			self.__lock.release()
+	
+	##
+	# Returns a jail.
+	#
+	# Returns the jail <code>name</code>. Raise an <code>UnknownJailException</code>
+	# if the jail does not exist.
+	# @param name The name of the jail
+	
+	def get(self, name):
+		try:
+			self.__lock.acquire()
+			if self.__jails.has_key(name):
+				jail = self.__jails[name]
+				return jail
+			else:
+				raise UnknownJailException(name)
+		finally:
+			self.__lock.release()
+	
+	##
+	# Returns an action class instance.
+	#
+	# Returns the action object of the jail <code>name</code>. Raise an
+	# <code>UnknownJailException</code> if the jail does not exist.
+	# @param name The name of the jail
+	
+	def getAction(self, name):
+		try:
+			self.__lock.acquire()
+			if self.__jails.has_key(name):
+				action = self.__jails[name].getAction()
+				return action
+			else:
+				raise UnknownJailException(name)
+		finally:
+			self.__lock.release()
+	
+	##
+	# Returns a filter class instance.
+	#
+	# Returns the filter object of the jail <code>name</code>. Raise an
+	# <code>UnknownJailException</code> if the jail does not exist.
+	# @param name The name of the jail
+	
+	def getFilter(self, name):
+		try:
+			self.__lock.acquire()
+			if self.__jails.has_key(name):
+				action = self.__jails[name].getFilter()
+				return action
+			else:
+				raise UnknownJailException(name)
+		finally:
+			self.__lock.release()
+	
+	##
+	# Returns the jails.
+	#
+	# Returns a copy of the jails list.
+	
+	def getAll(self):
+		try:
+			self.__lock.acquire()
+			return self.__jails.copy()
+		finally:
+			self.__lock.release()
+	
+	##
+	# Returns the size of the jails.
+	#
+	# Returns the number of jails.
+	
+	def size(self):
+		try:
+			self.__lock.acquire()
+			return len(self.__jails)
+		finally:
+			self.__lock.release()
+
+
+class DuplicateJailException(Exception):
+	pass
+
+class UnknownJailException(Exception):
+	pass

server/jailthread.py

@@ -25,6 +25,10 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 from threading import Thread
+import logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.server")
 
 class JailThread(Thread):
 	
@@ -34,14 +38,14 @@ class JailThread(Thread):
 	# Initialize the filter object with default values.
 	# @param jail the jail object
 	
-	def __init__(self, jail):
+	def __init__(self):
 		Thread.__init__(self)
 		## Control the state of the thread.
-		self.isRunning = False
+		self.__isRunning = False
 		## Control the idle state of the thread.
-		self.isIdle = False
+		self.__isIdle = False
 		## The time the thread sleeps in the loop.
-		self.sleepTime = 1
+		self.__sleepTime = 1
 	
 	##
 	# Set the time that the thread sleeps.
@@ -51,7 +55,7 @@ class JailThread(Thread):
 	# @param value the polling time (second)
 	
 	def setSleepTime(self, value):
-		self.sleepTime = value
+		self.__sleepTime = value
 		logSys.info("Set sleeptime = " + value)
 	
 	##
@@ -60,7 +64,7 @@ class JailThread(Thread):
 	# @return the polling time
 	
 	def getSleepTime(self):
-		return self.sleeptime
+		return self.__sleepTime
 	
 	##
 	# Set the idle flag.
@@ -69,7 +73,7 @@ class JailThread(Thread):
 	# @param value boolean value
 	
 	def setIdle(self, value):
-		self.isIdle = value
+		self.__isIdle = value
 	
 	##
 	# Get the idle state.
@@ -77,7 +81,7 @@ class JailThread(Thread):
 	# @return the idle state
 	
 	def getIdle(self):
-		return self.isIdle
+		return self.__isIdle
 	
 	##
 	# Stop the thread.
@@ -85,7 +89,7 @@ class JailThread(Thread):
 	# Stop the exection of the thread and quit.
 	
 	def stop(self):
-		self.isRunning = False
+		self.__isRunning = False
 	
 	##
 	# Set the isRunning flag.
@@ -93,7 +97,7 @@ class JailThread(Thread):
 	# @param value True if the thread is running
 	
 	def setActive(self, value):
-		self.isRunning = value
+		self.__isRunning = value
 	
 	##
 	# Check if the thread is active.
@@ -102,7 +106,7 @@ class JailThread(Thread):
 	# @return True if the thread is running
 	
 	def isActive(self):
-		return self.isRunning
+		return self.__isRunning
 	
 	##
 	# Get the status of the thread
@@ -111,4 +115,4 @@ class JailThread(Thread):
 	# @return a list with tuple
 	
 	def status(self):
-		pass
+		pass

server/mytime.py

@@ -0,0 +1,50 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time
+
+class MyTime:
+	
+	myTime = None
+	
+	@staticmethod
+	def setTime(t):
+		MyTime.myTime = t
+	
+	@staticmethod
+	def time():
+		if MyTime.myTime == None:
+			return time.time()
+		else:
+			return MyTime.myTime
+	
+	@staticmethod
+	def gmtime():
+		if MyTime.myTime == None:
+			return time.gmtime()
+		else:
+			return time.gmtime(MyTime.myTime)
+	

server/regex.py

@@ -0,0 +1,90 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import re, sre_constants
+
+##
+# Regular expression class.
+#
+# This class represents a regular expression with its compiled version.
+
+class Regex:
+
+	##
+	# Constructor.
+	#
+	# Creates a new object. This method can throw RegexException in order to
+	# avoid construction of invalid object.
+	# @param value the regular expression
+	
+	def __init__(self, regex):
+		self._matchCache = None
+		if regex.lstrip() == '':
+			raise RegexException("Cannot add empty regex")
+		try:
+			self._regexObj = re.compile(regex)
+			self._regex = regex
+		except sre_constants.error:
+			raise RegexException("Unable to compile regular expression '%s'" %
+								 regex)
+	
+	##
+	# Gets the regular expression.
+	#
+	# The effective regular expression used is returned.
+	# @return the regular expression
+	
+	def getRegex(self):
+		return self._regex
+	
+	##
+	# Searches the regular expression.
+	#
+	# Sets an internal cache (match object) in order to avoid searching for
+	# the pattern again. This method must be called before calling any other
+	# method of this object.
+	# @param value the line
+	
+	def search(self, value):
+		self._matchCache = self._regexObj.search(value)
+	
+	##
+	# Checks if the previous call to search() matched.
+	#
+	# @return True if a match was found, False otherwise
+	
+	def hasMatched(self):
+		if self._matchCache:
+			return True
+		else:
+			return False
+
+
+##
+# Exception dedicated to the class Regex.
+
+class RegexException(Exception):
+	pass

server/server.py

@@ -24,274 +24,244 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from jail import Jail
+from threading import Lock, RLock
+from jails import Jails
 from transmitter import Transmitter
-import locale, logging, sys
+from ssocket import SSocket
+from ssocket import SSocketErrorException
+import logging, logging.handlers, sys, os, signal
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.server")
 
 class Server:
-	
-	def __init__(self):
-		self.jails = dict()
-		self.transm = Transmitter(self)
-		self.logLevel = 3
-		self.logTarget = "STDERR"
+
+	def __init__(self, daemon = False):
+		self.__loggingLock = Lock()
+		self.__lock = RLock()
+		self.__jails = Jails()
+		self.__daemon = daemon
+		self.__transm = Transmitter(self)
+		self.__socket = SSocket(self.__transm)
+		self.__logLevel = 3
+		self.__logTarget = "STDOUT"
 		# Set logging level
-		self.setLogLevel(self.logLevel)
-		self.setLogTarget(self.logTarget)
+		self.setLogLevel(self.__logLevel)
+		self.setLogTarget(self.__logTarget)
 	
-	def start(self, force):
+	def __sigTERMhandler(self, signum, frame):
+		logSys.debug("Caught signal %d. Exiting" % signum)
+		self.quit()
+	
+	def start(self, sock, force = False):
+		logSys.info("Starting Fail2ban")
+		
+		# Install signal handlers
+		signal.signal(signal.SIGTERM, self.__sigTERMhandler)
+		signal.signal(signal.SIGINT, self.__sigTERMhandler)
+		
+		# First set the mask to only allow access to owner
+		os.umask(0077)
+		if self.__daemon:
+			ret = self.__createDaemon()
+			if ret:
+				logSys.info("Daemon started")
+			else:
+				logSys.error("Could not create daemon")
+				raise ServerInitializationError("Could not create daemon")
 		# Start the communication
-		self.transm.start(force)
+		logSys.debug("Starting communication")
+		try:
+			self.__socket.initialize(sock, force)
+			self.__socket.start()
+			# Workaround (???) for join() bug.
+			# https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1167930&group_id=5470
+			while self.__socket.isAlive():
+				self.__socket.join(1)
+		except SSocketErrorException:
+			logSys.error("Could not start server")
+		logSys.info("Exiting Fail2ban")
 	
 	def quit(self):
 		self.stopAllJail()
-		self.transm.stop()
+		# Stop communication
+		self.__socket.stop()
 	
-	def addJail(self, name):
-		self.jails[name] = Jail(name)
+	def addJail(self, name, backend):
+		self.__jails.add(name, backend)
 		
 	def delJail(self, name):
-		if self.jails.has_key(name):
-			del self.jails[name]
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.remove(name)
 	
 	def startJail(self, name):
-		if self.jails.has_key(name):
-			self.jails[name].start()
-		else:
-			raise ServerUnknownJail(name)
+		try:
+			self.__lock.acquire()
+			if not self.isActive(name):
+				self.__jails.get(name).start()
+		finally:
+			self.__lock.release()
 	
 	def stopJail(self, name):
-		if self.jails.has_key(name):
+		try:
+			self.__lock.acquire()
 			if self.isActive(name):
-				self.jails[name].stop()
+				self.__jails.get(name).stop()
 				self.delJail(name)
-		else:
-			raise ServerUnknownJail(name)
+		finally:
+			self.__lock.release()
 	
 	def stopAllJail(self):
-		for jail in self.jails.copy():
-			self.stopJail(jail)
-			
+		try:
+			self.__lock.acquire()
+			for jail in self.__jails.getAll():
+				self.stopJail(jail)
+		finally:
+			self.__lock.release()
+	
 	def isActive(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].isActive()
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.get(name).isActive()
 	
 	def setIdleJail(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].setIdle(value)
-			return True
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.get(name).setIdle(value)
+		return True
 
 	def getIdleJail(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getIdle()
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.get(name).getIdle()
 	
 	# Filter
-	def setLogPath(self, name, file):
-		if self.jails.has_key(name):
-			self.jails[name].getFilter().setLogPath(file)
+	def addIgnoreIP(self, name, ip):
+		self.__jails.getFilter(name).addIgnoreIP(ip)
+	
+	def delIgnoreIP(self, name, ip):
+		self.__jails.getFilter(name).delIgnoreIP(ip)
+	
+	def getIgnoreIP(self, name):
+		return self.__jails.getFilter(name).getIgnoreIP()
+	
+	def addLogPath(self, name, fileName):
+		self.__jails.getFilter(name).addLogPath(fileName)
+	
+	def delLogPath(self, name, fileName):
+		self.__jails.getFilter(name).delLogPath(fileName)
 	
 	def getLogPath(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getFilter().getLogPath()
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.getFilter(name).getLogPath()
 	
 	def setTimeRegex(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getFilter().setTimeRegex(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.getFilter(name).setTimeRegex(value)
 	
 	def getTimeRegex(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getFilter().getTimeRegex()
-		else:
-			raise ServerUnknownJail(name)
-	
+		return self.__jails.getFilter(name).getTimeRegex()
+
 	def setTimePattern(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getFilter().setTimePattern(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.getFilter(name).setTimePattern(value)
 	
 	def getTimePattern(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getFilter().getTimePattern()
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.getFilter(name).getTimePattern()
+	
+	def setFindTime(self, name, value):
+		self.__jails.getFilter(name).setFindTime(value)
+	
+	def getFindTime(self, name):
+		return self.__jails.getFilter(name).getFindTime()
 
-	def setFailRegex(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getFilter().setFailRegex(value)
-		else:
-			raise ServerUnknownJail(name)
+	def addFailRegex(self, name, value):
+		self.__jails.getFilter(name).addFailRegex(value)
+	
+	def delFailRegex(self, name, index):
+		self.__jails.getFilter(name).delFailRegex(index)
 	
 	def getFailRegex(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getFilter().getFailRegex()
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.getFilter(name).getFailRegex()
+	
+	def addIgnoreRegex(self, name, value):
+		self.__jails.getFilter(name).addIgnoreRegex(value)
+	
+	def delIgnoreRegex(self, name, index):
+		self.__jails.getFilter(name).delIgnoreRegex(index)
+	
+	def getIgnoreRegex(self, name):
+		return self.__jails.getFilter(name).getIgnoreRegex()
 	
 	def setMaxRetry(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getFilter().setMaxRetry(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.getFilter(name).setMaxRetry(value)
 	
 	def getMaxRetry(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getFilter().getMaxRetry()
-		else:
-			raise ServerUnknownJail(name)
-	
-	def setMaxTime(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getFilter().setMaxTime(value)
-		else:
-			raise ServerUnknownJail(name)
-	
-	def getMaxTime(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getFilter().getMaxTime()
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.getFilter(name).getMaxRetry()
 	
 	# Action
 	def addAction(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().addAction(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.getAction(name).addAction(value)
 	
 	def getLastAction(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getLastAction()
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.getAction(name).getLastAction()
 	
 	def delAction(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().delAction(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.getAction(name).delAction(value)
 	
 	def setCInfo(self, name, action, key, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).setCInfo(key, value)
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.getAction(name).getAction(action).setCInfo(key, value)
 	
 	def getCInfo(self, name, action, key):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getAction(action).getCInfo(key)
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.getAction(name).getAction(action).getCInfo(key)
 	
 	def delCInfo(self, name, action, key):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).delCInfo(key)
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.getAction(name).getAction(action).delCInfo(key)
 	
 	def setBanTime(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().setBanTime(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.getAction(name).setBanTime(value)
 	
 	def getBanTime(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getBanTime()
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.getAction(name).getBanTime()
 	
 	def setActionStart(self, name, action, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).setActionStart(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.getAction(name).getAction(action).setActionStart(value)
 	
 	def getActionStart(self, name, action):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getAction(action).getActionStart()
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.getAction(name).getAction(action).getActionStart()
 		
 	def setActionStop(self, name, action, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).setActionStop(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.getAction(name).getAction(action).setActionStop(value)
 	
 	def getActionStop(self, name, action):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getAction(action).getActionStop()
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.getAction(name).getAction(action).getActionStop()
 	
 	def setActionCheck(self, name, action, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).setActionCheck(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.getAction(name).getAction(action).setActionCheck(value)
 	
 	def getActionCheck(self, name, action):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getAction(action).getActionCheck()
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.getAction(name).getAction(action).getActionCheck()
 	
 	def setActionBan(self, name, action, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).setActionBan(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.getAction(name).getAction(action).setActionBan(value)
 	
 	def getActionBan(self, name, action):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getAction(action).getActionBan()
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.getAction(name).getAction(action).getActionBan()
 	
 	def setActionUnban(self, name, action, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).setActionUnban(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.__jails.getAction(name).getAction(action).setActionUnban(value)
 	
 	def getActionUnban(self, name, action):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getAction(action).getActionUnban()
-		else:
-			raise ServerUnknownJail(name)
+		return self.__jails.getAction(name).getAction(action).getActionUnban()
 		
 	# Status
 	def status(self):
-		jailList = ''
-		for jail in self.jails:
-			jailList += jail + ', '
-		length = len(jailList)
-		if not length == 0:
-			jailList = jailList[:length-2]
-		ret = [("Number of jail", len(self.jails)),
-			   ("Jail list", jailList)]
-		return ret
+		try:
+			self.__lock.acquire()
+			jailList = ''
+			for jail in self.__jails.getAll():
+				jailList += jail + ', '
+			length = len(jailList)
+			if not length == 0:
+				jailList = jailList[:length-2]
+			ret = [("Number of jail", self.__jails.size()), 
+				   ("Jail list", jailList)]
+			return ret
+		finally:
+			self.__lock.release()
 	
 	def statusJail(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getStatus()
-		raise ServerUnknownJail(name)
+		return self.__jails.get(name).getStatus()
 	
 	# Logging
 	
@@ -307,17 +277,21 @@ class Server:
 	# @param value the level
 	
 	def setLogLevel(self, value):
-		self.logLevel = value
-		logLevel = logging.DEBUG
-		if value == 0:
-			logLevel = logging.FATAL
-		elif value == 1:
-			logLevel = logging.ERROR
-		elif value == 2:
-			logLevel = logging.WARNING
-		elif value == 3:
-			logLevel = logging.INFO
-		logging.getLogger("fail2ban").setLevel(logLevel)
+		try:
+			self.__loggingLock.acquire()
+			self.__logLevel = value
+			logLevel = logging.DEBUG
+			if value == 0:
+				logLevel = logging.FATAL
+			elif value == 1:
+				logLevel = logging.ERROR
+			elif value == 2:
+				logLevel = logging.WARNING
+			elif value == 3:
+				logLevel = logging.INFO
+			logging.getLogger("fail2ban").setLevel(logLevel)
+		finally:
+			self.__loggingLock.release()
 	
 	##
 	# Get the logging level.
@@ -326,34 +300,129 @@ class Server:
 	# @return the log level
 	
 	def getLogLevel(self):
-		return self.logLevel
+		try:
+			self.__loggingLock.acquire()
+			return self.__logLevel
+		finally:
+			self.__loggingLock.release()
+	
+	##
+	# Sets the logging target.
+	#
+	# target can be a file, SYSLOG, STDOUT or STDERR.
+	# @param target the logging target
 	
 	def setLogTarget(self, target):
-		# Remove previous handler
-		logging.getLogger("fail2ban").handlers = []
-		self.logTarget = target
-		if target == "SYSLOG":
-			logSys.error("Not yet implemented")
-			return False
-		elif target == "STDERR":
-			hdlr = logging.StreamHandler(sys.stderr)
-		else:
-			# Target should be a file
-			try:
-				open(target, "a")
-				hdlr = logging.FileHandler(target)
-			except IOError:
-				logSys.error("Unable to log to " + target)
-				return False
-		# set a format which is simpler for console use
-		formatter = logging.Formatter('%(name)-16s: %(levelname)-6s %(message)s')
-		# tell the handler to use this format
-		hdlr.setFormatter(formatter)
-		logging.getLogger("fail2ban").addHandler(hdlr)
-		return True
+		try:
+			self.__loggingLock.acquire()
+			if target == "SYSLOG":
+				facility = logging.handlers.SysLogHandler.LOG_DAEMON
+				hdlr = logging.handlers.SysLogHandler("/dev/log", 
+													  facility = facility)
+			elif target == "STDOUT":
+				hdlr = logging.StreamHandler(sys.stdout)
+			elif target == "STDERR":
+				hdlr = logging.StreamHandler(sys.stderr)
+			else:
+				# Target should be a file
+				try:
+					open(target, "a")
+					hdlr = logging.FileHandler(target)
+				except IOError:
+					logSys.error("Unable to log to " + target)
+					logSys.info("Logging to previous target " + self.__logTarget)
+					return False
+			self.__logTarget = target
+			# Remove previous handler
+			logging.getLogger("fail2ban").handlers = []
+			# set a format which is simpler for console use
+			formatter = logging.Formatter("%(asctime)s %(name)-16s: %(levelname)-6s %(message)s")
+			# tell the handler to use this format
+			hdlr.setFormatter(formatter)
+			logging.getLogger("fail2ban").addHandler(hdlr)
+			return True
+		finally:
+			self.__loggingLock.release()
 	
 	def getLogTarget(self):
-		return self.logTarget
+		try:
+			self.__loggingLock.acquire()
+			return self.__logTarget
+		finally:
+			self.__loggingLock.release()
+	
+	def __createDaemon(self):
+		""" Detach a process from the controlling terminal and run it in the
+			background as a daemon.
+		
+			http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
+		"""
+	
+		try:
+			# Fork a child process so the parent can exit.  This will return control
+			# to the command line or shell.  This is required so that the new process
+			# is guaranteed not to be a process group leader.  We have this guarantee
+			# because the process GID of the parent is inherited by the child, but
+			# the child gets a new PID, making it impossible for its PID to equal its
+			# PGID.
+			pid = os.fork()
+		except OSError, e:
+			return((e.errno, e.strerror))	 # ERROR (return a tuple)
+		
+		if pid == 0:	   # The first child.
+	
+			# Next we call os.setsid() to become the session leader of this new
+			# session.  The process also becomes the process group leader of the
+			# new process group.  Since a controlling terminal is associated with a
+			# session, and this new session has not yet acquired a controlling
+			# terminal our process now has no controlling terminal.  This shouldn't
+			# fail, since we're guaranteed that the child is not a process group
+			# leader.
+			os.setsid()
+		
+			# When the first child terminates, all processes in the second child
+			# are sent a SIGHUP, so it's ignored.
+			signal.signal(signal.SIGHUP, signal.SIG_IGN)
+		
+			try:
+				# Fork a second child to prevent zombies.  Since the first child is
+				# a session leader without a controlling terminal, it's possible for
+				# it to acquire one by opening a terminal in the future.  This second
+				# fork guarantees that the child is no longer a session leader, thus
+				# preventing the daemon from ever acquiring a controlling terminal.
+				pid = os.fork()		# Fork a second child.
+			except OSError, e:
+				return((e.errno, e.strerror))  # ERROR (return a tuple)
+		
+			if (pid == 0):	  # The second child.
+				# Ensure that the daemon doesn't keep any directory in use.  Failure
+				# to do this could make a filesystem unmountable.
+				os.chdir("/")
+			else:
+				os._exit(0)	  # Exit parent (the first child) of the second child.
+		else:
+			os._exit(0)		 # Exit parent of the first child.
+		
+		# Close all open files.  Try the system configuration variable, SC_OPEN_MAX,
+		# for the maximum number of open files to close.  If it doesn't exist, use
+		# the default value (configurable).
+		try:
+			maxfd = os.sysconf("SC_OPEN_MAX")
+		except (AttributeError, ValueError):
+			maxfd = 256	   # default maximum
+	
+		for fd in range(0, maxfd):
+			try:
+				os.close(fd)
+			except OSError:   # ERROR (ignore)
+				pass
+	
+		# Redirect the standard file descriptors to /dev/null.
+		os.open("/dev/null", os.O_RDONLY)	# standard input (0)
+		os.open("/dev/null", os.O_RDWR)		# standard output (1)
+		os.open("/dev/null", os.O_RDWR)		# standard error (2)
+		return True
 
-class ServerUnknownJail(Exception):
-	pass
+
+class ServerInitializationError(Exception):
+	pass

server/ssocket.py

@@ -25,63 +25,66 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 from threading import Thread
-import socket, time, logging, pickle, os, os.path
+# cPickle generates an exception with Python 2.5
+#from cPickle import dumps, loads, HIGHEST_PROTOCOL
+from pickle import dumps, loads, HIGHEST_PROTOCOL
+import socket, logging, os, os.path
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.comm")
 
 class SSocket(Thread):
 	
+	END_STRING = "<F2B_END_COMMAND>"
+	
 	def __init__(self, transmitter):
 		Thread.__init__(self)
-		self.socketFile = "/tmp/fail2ban.sock"
-		self.transmit = transmitter
-		self.isRunning = False
+		self.__transmit = transmitter
+		self.__isRunning = False
+		self.__socket = "/tmp/fail2ban.sock"
+		self.__ssock = None
 		logSys.debug("Created SSocket")
 	
-	def initialize(self, force = False):
+	def initialize(self, sock = "/tmp/fail2ban.sock", force = False):
+		self.__socket = sock
 		# Remove socket
-		if os.path.exists(self.socketFile):
+		if os.path.exists(sock):
 			logSys.error("Fail2ban seems to be already running")
 			if force:
 				logSys.warn("Forcing execution of the server")
-				os.remove(self.socketFile)
+				os.remove(sock)
 			else:
 				raise SSocketErrorException("Server already running")
 		# Create an INET, STREAMing socket
-		#self.ssock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-		self.ssock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-		#self.ssock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-		self.ssock.setblocking(False)
+		#self.__ssock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+		self.__ssock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+		#self.__ssock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+		#self.__ssock.setblocking(False)
+		# Do not use a blocking socket as there is problem at shutdown.
+		# Use a timeout instead. Daemon exits at most 'timeout' seconds
+		# after the command.
+		self.__ssock.settimeout(1)
 		# Bind the socket to a public host and a well-known port
-		#self.ssock.bind(("localhost", 2222))
-		self.ssock.bind(self.socketFile)
+		#self.__ssock.bind(("localhost", 2222))
+		self.__ssock.bind(sock)
 		# Become a server socket
-		self.ssock.listen(1)
+		self.__ssock.listen(5)
 	
 	def run(self):
-		self.isRunning = True
-		stime = 1.0
-		while self.isRunning:
+		self.__isRunning = True
+		while self.__isRunning:
 			try:
-				# Accept connections from outside
-				(csock, address) = self.ssock.accept()
-				stime /= 10
-				logSys.debug("Connection accepted")
-				msg = self.receive(csock)
-				msg = self.transmit.proceed(msg)
-				self.send(csock, msg)
-				csock.close()
-			except Exception:
-				time.sleep(stime)
-				stime += 0.05
-				if stime > 1.0:
-					stime = 1.0
-		self.ssock.close()
+				(csock, address) = self.__ssock.accept()
+				thread = SocketWorker(csock, self.__transmit)
+				thread.start()
+			except socket.timeout:
+				# Do nothing here
+				pass
+		self.__ssock.close()
 		# Remove socket
-		if os.path.exists(self.socketFile):
-			logSys.debug("Removed socket file " + self.socketFile)
-			os.remove(self.socketFile)
+		if os.path.exists(self.__socket):
+			logSys.debug("Removed socket file " + self.__socket)
+			os.remove(self.__socket)
 		logSys.debug("Socket shutdown")
 		return True
 	
@@ -92,20 +95,38 @@ class SSocket(Thread):
 	# @bug It seems to be some concurrency problem with this flag
 	
 	def stop(self):
-		self.isRunning = False
+		self.__isRunning = False
+
+
+class SocketWorker(Thread):
 	
-	def send(self, socket, msg):
-		obj = pickle.dumps(msg)
-		socket.send(obj + "<F2B_END_COMMAND>")
+	def __init__(self, csock, transmitter):
+		Thread.__init__(self)
+		self.__csock = csock
+		self.__transmit = transmitter
+		
+	def run(self):
+		logSys.debug("Starting new thread to handle the request")
+		msg = self.__receive(self.__csock)
+		msg = self.__transmit.proceed(msg)
+		self.__send(self.__csock, msg)
+		self.__csock.close()
+		logSys.debug("Connection closed")
 	
-	def receive(self, socket):
+	@staticmethod
+	def __send(sock, msg):
+		obj = dumps(msg, HIGHEST_PROTOCOL)
+		sock.send(obj + SSocket.END_STRING)
+	
+	@staticmethod
+	def __receive(sock):
 		msg = ''
-		while msg.rfind("<F2B_END_COMMAND>") == -1:
-			chunk = socket.recv(6)
+		while msg.rfind(SSocket.END_STRING) == -1:
+			chunk = sock.recv(6)
 			if chunk == '':
 				raise RuntimeError, "socket connection broken"
 			msg = msg + chunk
-		return pickle.loads(msg)
+		return loads(msg)
 
 
 class SSocketErrorException(Exception):

server/ticket.py

@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, logging
+import logging
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban")
@@ -32,25 +32,25 @@ logSys = logging.getLogger("fail2ban")
 class Ticket:
 	
 	def __init__(self, ip, time):
-		self.ip = ip
-		self.time = time
-		self.attempt = 0
+		self.__ip = ip
+		self.__time = time
+		self.__attempt = 0
 	
 	def setIP(self, value):
-		self.ip = value
+		self.__ip = value
 	
 	def getIP(self):
-		return self.ip
+		return self.__ip
 	
 	def setTime(self, value):
-		self.time = value
+		self.__time = value
 	
 	def getTime(self):
-		return self.time
+		return self.__time
 	
 	def setAttempt(self, value):
-		self.attempt = value
+		self.__attempt = value
 	
 	def getAttempt(self):
-		return self.attempt
+		return self.__attempt
 	

server/transmitter.py

@@ -24,194 +24,250 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from ssocket import SSocket
-from ssocket import SSocketErrorException
-import re, pickle, logging
+import logging, time
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.comm")
 
 class Transmitter:
 	
-	def __init__(self, server):
-		self.server = server
-		self.socket = SSocket(self)
-	
-	def start(self, force):
-		try:
-			self.socket.initialize(force)
-			self.socket.start()
-		except SSocketErrorException:
-			logSys.error("Could not start server")
-	
 	##
-	# Stop the transmitter.
+	# Constructor.
 	#
-	# @bug Fix the issue with join(). When using servertestcase.py, errors
-	# happen which disappear when using join() in this function.
+	# @param The server reference
 	
-	def stop(self):
-		self.socket.stop()
-		#self.socket.join()
+	def __init__(self, server):
+		self.__server = server
 		
-	def proceed(self, action):
+	##
+	# Proceeds a command.
+	#
+	# Proceeds an incoming command.
+	# @param command The incoming command
+	
+	def proceed(self, command):
 		# Deserialize object
-		logSys.debug("Action: " + `action`)
+		logSys.debug("Command: " + `command`)
 		try:
-			ret = self.actionHandler(action)
+			ret = self.__commandHandler(command)
 			ack = 0, ret
 		except Exception, e:
-			logSys.warn("Invalid command")
+			logSys.warn("Invalid command: " + `command`)
 			ack = 1, e
 		return ack
 	
 	##
-	# Handle an action.
+	# Handle an command.
 	#
 	# 
 	
-	def actionHandler(self, action):
-		if action[0] == "ping":
+	def __commandHandler(self, command):
+		if command[0] == "ping":
 			return "pong"
-		elif action[0] == "add":
-			name = action[1]
+		elif command[0] == "add":
+			name = command[1]
 			if name == "all":
 				raise Exception("Reserved name")
-			self.server.addJail(name)
+			try:
+				backend = command[2]
+			except IndexError:
+				backend = "auto"
+			self.__server.addJail(name, backend)
 			return name
-		elif action[0] == "start":
-			name = action[1]
-			self.server.startJail(name)
+		elif command[0] == "start":
+			name = command[1]
+			self.__server.startJail(name)
 			return None
-		elif action[0] == "stop":
-			if len(action) == 1:
-				self.server.quit()
-			elif action[1] == "all":
-				self.server.stopAllJail()
+		elif command[0] == "stop":
+			if len(command) == 1:
+				self.__server.quit()
+			elif command[1] == "all":
+				self.__server.stopAllJail()
 			else:
-				name = action[1]
-				self.server.stopJail(name)
+				name = command[1]
+				self.__server.stopJail(name)
 			return None
-		elif action[0] == "sleep":
-			value = action[1]
+		elif command[0] == "sleep":
+			value = command[1]
 			time.sleep(int(value))
 			return None
-		elif action[0] == "set":
-			return self.actionSet(action[1:])
-		elif action[0] == "get":
-			return self.actionGet(action[1:])
-		elif action[0] == "status":
-			return self.status(action[1:])			
+		elif command[0] == "set":
+			return self.__commandSet(command[1:])
+		elif command[0] == "get":
+			return self.__commandGet(command[1:])
+		elif command[0] == "status":
+			return self.status(command[1:])			
 		raise Exception("Invalid command")
 	
-	def actionSet(self, action):
-		name = action[0]
+	def __commandSet(self, command):
+		name = command[0]
 		# Logging
 		if name == "loglevel":
-			value = int(action[1])
-			self.server.setLogLevel(value)
-			return self.server.getLogLevel()
+			value = int(command[1])
+			self.__server.setLogLevel(value)
+			return self.__server.getLogLevel()
 		elif name == "logtarget":
-			value = action[1]
-			self.server.setLogTarget(value)
-			return self.server.getLogTarget()
+			value = command[1]
+			self.__server.setLogTarget(value)
+			return self.__server.getLogTarget()
 		# Jail
-		elif action[1] == "idle":
-			if action[2] == "on":
-				self.server.setIdleJail(name, True)
-			elif action[2] == "off":
-				self.server.setIdleJail(name, False)
-			return self.server.getIdleJail(name)
+		elif command[1] == "idle":
+			if command[2] == "on":
+				self.__server.setIdleJail(name, True)
+			elif command[2] == "off":
+				self.__server.setIdleJail(name, False)
+			return self.__server.getIdleJail(name)
 		# Filter
-		elif action[1] == "logpath":
-			value = action[2]
-			self.server.setLogPath(name, value)
-			return self.server.getLogPath(name)
-		elif action[1] == "timeregex":
-			value = action[2]
-			self.server.setTimeRegex(name, value)
-			return self.server.getTimeRegex(name)
-		elif action[1] == "timepattern":
-			value = action[2]
-			self.server.setTimePattern(name, value)
-			return self.server.getTimePattern(name)
-		elif action[1] == "failregex":
-			value = action[2]
-			self.server.setFailRegex(name, value)
-			return self.server.getFailRegex(name)
-		elif action[1] == "maxtime":
-			value = action[2]
-			self.server.setMaxTime(name, int(value))
-			return self.server.getMaxTime(name)
-		elif action[1] == "maxretry":
-			value = action[2]
-			self.server.setMaxRetry(name, int(value))
-			return self.server.getMaxRetry(name)
-		# Action
-		elif action[1] == "bantime":
-			value = action[2]
-			self.server.setBanTime(name, int(value))
-			return self.server.getBanTime(name)
-		elif action[1] == "addaction":
-			value = action[2]
-			self.server.addAction(name, value)
-			return self.server.getLastAction(name).getName()
-		elif action[1] == "delaction":
-			self.server.delAction(name, value)
+		elif command[1] == "addignoreip":
+			value = command[2]
+			self.__server.addIgnoreIP(name, value)
+			return self.__server.getIgnoreIP(name)
+		elif command[1] == "delignoreip":
+			value = command[2]
+			self.__server.delIgnoreIP(name, value)
+			return self.__server.getIgnoreIP(name)
+		elif command[1] == "addlogpath":
+			value = command[2:]
+			for path in value:
+				self.__server.addLogPath(name, path)
+			return self.__server.getLogPath(name)
+		elif command[1] == "dellogpath":
+			value = command[2]
+			self.__server.delLogPath(name, value)
+			return self.__server.getLogPath(name)
+		elif command[1] == "timeregex":
+			value = command[2]
+			self.__server.setTimeRegex(name, value)
+			return self.__server.getTimeRegex(name)
+		elif command[1] == "timepattern":
+			value = command[2]
+			self.__server.setTimePattern(name, value)
+			return self.__server.getTimePattern(name)
+		elif command[1] == "addfailregex":
+			value = command[2]
+			self.__server.addFailRegex(name, value)
+			return self.__server.getFailRegex(name)
+		elif command[1] == "delfailregex":
+			value = int(command[2])
+			self.__server.delFailRegex(name, value)
+			return self.__server.getFailRegex(name)
+		elif command[1] == "addignoreregex":
+			value = command[2]
+			self.__server.addIgnoreRegex(name, value)
+			return self.__server.getIgnoreRegex(name)
+		elif command[1] == "delignoreregex":
+			value = int(command[2])
+			self.__server.delIgnoreRegex(name, value)
+			return self.__server.getIgnoreRegex(name)
+		elif command[1] == "findtime":
+			value = command[2]
+			self.__server.setFindTime(name, int(value))
+			return self.__server.getFindTime(name)
+		elif command[1] == "maxretry":
+			value = command[2]
+			self.__server.setMaxRetry(name, int(value))
+			return self.__server.getMaxRetry(name)
+		# command
+		elif command[1] == "bantime":
+			value = command[2]
+			self.__server.setBanTime(name, int(value))
+			return self.__server.getBanTime(name)
+		elif command[1] == "addaction":
+			value = command[2]
+			self.__server.addAction(name, value)
+			return self.__server.getLastAction(name).getName()
+		elif command[1] == "delaction":
+			self.__server.delAction(name, value)
 			return None
-		elif action[1] == "setcinfo":
-			act = action[2]
-			key = action[3]
-			value = action[4]
-			self.server.setCInfo(name, act, key, value)
-			return self.server.getCInfo(name, act, key)
-		elif action[1] == "delcinfo":
-			act = action[2]
-			key = action[3]
-			self.server.delCInfo(name, act, key)
+		elif command[1] == "setcinfo":
+			act = command[2]
+			key = command[3]
+			value = command[4]
+			self.__server.setCInfo(name, act, key, value)
+			return self.__server.getCInfo(name, act, key)
+		elif command[1] == "delcinfo":
+			act = command[2]
+			key = command[3]
+			self.__server.delCInfo(name, act, key)
 			return None
-		elif action[1] == "actionstart":
-			act = action[2]
-			value = action[3]
-			self.server.setActionStart(name, act, value)
-			return self.server.getActionStart(name, act)
-		elif action[1] == "actionstop":
-			act = action[2]
-			value = action[3]
-			self.server.setActionStop(name, act, value)
-			return self.server.getActionStop(name, act)
-		elif action[1] == "actioncheck":
-			act = action[2]
-			value = action[3]
-			self.server.setActionCheck(name, act, value)
-			return self.server.getActionCheck(name, act)
-		elif action[1] == "actionban":
-			act = action[2]
-			value = action[3]
-			self.server.setActionBan(name, act, value)
-			return self.server.getActionBan(name, act)
-		elif action[1] == "actionunban":
-			act = action[2]
-			value = action[3]
-			self.server.setActionUnban(name, act, value)
-			return self.server.getActionUnban(name, act)
-		raise Exception("Invalid command (no set action)")
+		elif command[1] == "actionstart":
+			act = command[2]
+			value = command[3]
+			self.__server.setActionStart(name, act, value)
+			return self.__server.getActionStart(name, act)
+		elif command[1] == "actionstop":
+			act = command[2]
+			value = command[3]
+			self.__server.setActionStop(name, act, value)
+			return self.__server.getActionStop(name, act)
+		elif command[1] == "actioncheck":
+			act = command[2]
+			value = command[3]
+			self.__server.setActionCheck(name, act, value)
+			return self.__server.getActionCheck(name, act)
+		elif command[1] == "actionban":
+			act = command[2]
+			value = command[3]
+			self.__server.setActionBan(name, act, value)
+			return self.__server.getActionBan(name, act)
+		elif command[1] == "actionunban":
+			act = command[2]
+			value = command[3]
+			self.__server.setActionUnban(name, act, value)
+			return self.__server.getActionUnban(name, act)
+		raise Exception("Invalid command (no set action or not yet implemented)")
 	
-	def actionGet(self, action):
-		name = action[0]
+	def __commandGet(self, command):
+		name = command[0]
 		# Logging
 		if name == "loglevel":
-			return self.server.getLogLevel()
+			return self.__server.getLogLevel()
+		elif name == "logtarget":
+			return self.__server.getLogTarget()
 		# Filter
-		if action[1] == "logpath":
-			return self.server.getLogPath(name)
-		raise Exception("Invalid command (no get action)")
+		elif command[1] == "logpath":
+			return self.__server.getLogPath(name)
+		elif command[1] == "ignoreip":
+			return self.__server.getIgnoreIP(name)
+		elif command[1] == "timeregex":
+			return self.__server.getTimeRegex(name)
+		elif command[1] == "timepattern":
+			return self.__server.getTimePattern(name)
+		elif command[1] == "failregex":
+			return self.__server.getFailRegex(name)
+		elif command[1] == "ignoreregex":
+			return self.__server.getIgnoreRegex(name)
+		elif command[1] == "findtime":
+			return self.__server.getFindTime(name)
+		elif command[1] == "maxretry":
+			return self.__server.getMaxRetry(name)
+		# Action
+		elif command[1] == "bantime":
+			return self.__server.getBanTime(name)
+		elif command[1] == "addaction":
+			return self.__server.getLastAction(name).getName()
+		elif command[1] == "actionstart":
+			act = command[2]
+			return self.__server.getActionStart(name, act)
+		elif command[1] == "actionstop":
+			act = command[2]
+			return self.__server.getActionStop(name, act)
+		elif command[1] == "actioncheck":
+			act = command[2]
+			return self.__server.getActionCheck(name, act)
+		elif command[1] == "actionban":
+			act = command[2]
+			return self.__server.getActionBan(name, act)
+		elif command[1] == "actionunban":
+			act = command[2]
+			return self.__server.getActionUnban(name, act)
+		raise Exception("Invalid command (no get action or not yet implemented)")
 	
-	def status(self, action):
-		if len(action) == 0:
-			return self.server.status()
+	def status(self, command):
+		if len(command) == 0:
+			return self.__server.status()
 		else:
-			name = action[0]
-			return self.server.statusJail(name)
+			name = command[0]
+			return self.__server.statusJail(name)
 		raise Exception("Invalid command (no status)")
 	

setup.cfg

@@ -1,5 +1,5 @@
 [install]
-install-purelib=/usr/lib/fail2ban
+install-purelib=/usr/share/fail2ban
 
 [sdist]
 formats=bztar

setup.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 
 # This file is part of Fail2Ban.
 #
@@ -27,9 +27,10 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 from distutils.core import setup
-from version import version
-from os.path import isfile, join
-from sys import exit, argv
+from common.version import version
+from os.path import isfile, join, isdir
+from sys import argv
+from glob import glob
 
 longdesc = '''
 Fail2Ban scans log files like /var/log/pwdfail or
@@ -39,46 +40,34 @@ to reject the IP address or executes user defined
 commands.'''
 
 setup(
-	name = "fail2ban",
-	version = version,
-	description = "Ban IPs that make too many password failure",
-	long_description = longdesc,
-	author = "Cyril Jaquier",
-	author_email = "lostcontrol@users.sourceforge.net",
-	url = "http://fail2ban.sourceforge.net",
-	license = "GPL",
-	platforms = "Posix",
+	name = "fail2ban", 
+	version = version, 
+	description = "Ban IPs that make too many password failure", 
+	long_description = longdesc, 
+	author = "Cyril Jaquier", 
+	author_email = "lostcontrol@users.sourceforge.net", 
+	url = "http://fail2ban.sourceforge.net", 
+	license = "GPL", 
+	platforms = "Posix", 
 	scripts =	[
-					'fail2ban-client',
-					'fail2ban-server'
-				],
-	py_modules =	['version'],
+					'fail2ban-client', 
+					'fail2ban-server', 
+					'fail2ban-regex'
+				], 
 	packages =	[
-					'client',
+					'common', 
+					'client', 
 					'server'
-				],
+				], 
 	data_files =	[
-						('/etc/fail2ban',
-							[
-								'config/fail2ban.conf',
-								'config/jail.conf'
-							]
-						),
-						('/etc/fail2ban/filter.d',
-							[
-								'config/filter.d/vsftpd.conf',
-								'config/filter.d/apache-auth.conf',
-								'config/filter.d/sshd.conf'
-							]
-						),
-						('/etc/fail2ban/action.d',
-							[
-								'config/action.d/iptables.conf',
-								'config/action.d/mail-whois.conf',
-								'config/action.d/dummy.conf',
-								'config/action.d/mail.conf',
-								'config/action.d/hostsdeny.conf'
-							]
+						('/etc/fail2ban', 
+							glob("config/*.conf")
+						), 
+						('/etc/fail2ban/filter.d', 
+							glob("config/filter.d/*.conf")
+						), 
+						('/etc/fail2ban/action.d', 
+							glob("config/action.d/*.conf")
 						)
 					]
 )
@@ -90,24 +79,30 @@ elements =	{
 				"/etc/":
 					[
 						"fail2ban.conf"
-					],
+					], 
 				"/usr/bin/":
 					[
 						"fail2ban.py"
-					],
+					], 
 				"/usr/lib/fail2ban/firewall/":
 					[
-						"iptables.py",
-						"ipfwadm.py",
+						"iptables.py", 
+						"ipfwadm.py", 
 						"ipfw.py"
+					],
+				"/usr/lib/fail2ban/":
+					[
+						"version.py", 
+						"protocol.py"
 					]
 			}
 
-for dir in elements:
-	for f in elements[dir]:
-		path = join(dir, f)
+for directory in elements:
+	for f in elements[directory]:
+		path = join(directory, f)
 		if isfile(path):
 			obsoleteFiles.append(path)
+
 if obsoleteFiles:
 	print
 	print "Obsolete files from previous Fail2Ban versions were found on " \
@@ -118,6 +113,13 @@ if obsoleteFiles:
 		print "\t" + f
 	print
 
+if isdir("/usr/lib/fail2ban"):
+	print
+	print "Fail2ban is not installed under /usr/lib anymore. The new " \
+		  "location is under /usr/share. Please remove the directory " \
+		  "/usr/lib/fail2ban and everything under this directory."
+	print
+
 # Update config file
 if argv[1] == "install":
 	print

testcases/actiontestcase.py

@@ -0,0 +1,47 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import unittest, time
+from server.action import Action
+
+class ExecuteAction(unittest.TestCase):
+
+	def setUp(self):
+		"""Call before every test case."""
+		self.__action = Action("Test")
+
+	def tearDown(self):
+		"""Call after every test case."""
+		self.__action.execActionStop()
+	
+	def testExecuteActionBan(self):
+		self.__action.setActionStart("touch /tmp/fail2ban.test")
+		self.__action.setActionStop("rm -f /tmp/fail2ban.test")
+		self.__action.setActionBan("echo -n")
+		self.__action.setActionCheck("[ -e /tmp/fail2ban.test ]")
+		
+		self.assertTrue(self.__action.execActionBan(None))
+		

testcases/banmanagertestcase.py

@@ -32,25 +32,25 @@ class AddFailure(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.ticket = BanTicket('193.168.0.128', 1167605999.0)
-		self.banManager = BanManager()
-		self.assertTrue(self.banManager.addBanTicket(self.ticket))
+		self.__ticket = BanTicket('193.168.0.128', 1167605999.0)
+		self.__banManager = BanManager()
+		self.assertTrue(self.__banManager.addBanTicket(self.__ticket))
 
 	def tearDown(self):
 		"""Call after every test case."""
 	
 	def testAdd(self):
-		self.assertEqual(self.banManager.size(), 1)
+		self.assertEqual(self.__banManager.size(), 1)
 	
 	def testAddDuplicate(self):
-		self.assertFalse(self.banManager.addBanTicket(self.ticket))
-		self.assertEqual(self.banManager.size(), 1)
+		self.assertFalse(self.__banManager.addBanTicket(self.__ticket))
+		self.assertEqual(self.__banManager.size(), 1)
 		
-	def testInListOK(self):
+	def _testInListOK(self):
 		ticket = BanTicket('193.168.0.128', 1167605999.0)
-		self.assertTrue(self.banManager.inBanList(ticket))
+		self.assertTrue(self.__banManager.inBanList(ticket))
 	
-	def testInListNOK(self):
+	def _testInListNOK(self):
 		ticket = BanTicket('111.111.1.111', 1167605999.0)
-		self.assertFalse(self.banManager.inBanList(ticket))
+		self.assertFalse(self.__banManager.inBanList(ticket))
 		

testcases/clientreadertestcase.py

@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 253 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 253 $"
-__date__ = "$Date: 2006-07-17 00:21:58 +0200 (Mon, 17 Jul 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 

testcases/datedetectortestcase.py

@@ -0,0 +1,67 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import unittest
+from server.datedetector import DateDetector
+from server.datetemplate import DateTemplate
+
+class DateDetectorTest(unittest.TestCase):
+
+	def setUp(self):
+		"""Call before every test case."""
+		self.__datedetector = DateDetector()
+		self.__datedetector.addDefaultTemplate()
+
+	def tearDown(self):
+		"""Call after every test case."""
+	
+	def testGetEpochTime(self):
+		log = "1138049999 [sshd] error: PAM: Authentication failure"
+		date = [2006, 1, 23, 20, 59, 59, 0, 23, 0]
+		dateUnix = 1138046399.0
+		
+		self.assertEqual(self.__datedetector.getTime(log), date)
+		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
+	
+	def testGetTime(self):
+		log = "Jan 23 21:59:59 [sshd] error: PAM: Authentication failure"
+		date = [2005, 1, 23, 21, 59, 59, 1, 23, -1]
+		dateUnix = 1106513999.0
+	
+		self.assertEqual(self.__datedetector.getTime(log), date)
+		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
+
+	def testDefaultTempate(self):
+		self.__datedetector.setDefaultRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+		self.__datedetector.setDefaultPattern("%b %d %H:%M:%S")
+		
+		log = "Jan 23 21:59:59 [sshd] error: PAM: Authentication failure"
+		date = [2005, 1, 23, 21, 59, 59, 1, 23, -1]
+		dateUnix = 1106513999.0
+		
+		self.assertEqual(self.__datedetector.getTime(log), date)
+		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
+	

testcases/failmanagertestcase.py

@@ -33,47 +33,47 @@ class AddFailure(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.items = [['193.168.0.128', 1167605999.0],
-					  ['193.168.0.128', 1167605999.0],
-					  ['193.168.0.128', 1167605999.0],
-					  ['193.168.0.128', 1167605999.0],
-					  ['193.168.0.128', 1167605999.0],
-					  ['87.142.124.10', 1167605999.0],
-					  ['87.142.124.10', 1167605999.0],
-					  ['87.142.124.10', 1167605999.0]]
+		self.__items = [['193.168.0.128', 1167605999.0],
+					    ['193.168.0.128', 1167605999.0],
+					    ['193.168.0.128', 1167605999.0],
+					    ['193.168.0.128', 1167605999.0],
+					    ['193.168.0.128', 1167605999.0],
+					    ['87.142.124.10', 1167605999.0],
+					    ['87.142.124.10', 1167605999.0],
+					    ['87.142.124.10', 1167605999.0]]
 		
-		self.failManager = FailManager()
-		for i in self.items:
-			self.failManager.addFailure(FailTicket(i[0], i[1]))
+		self.__failManager = FailManager()
+		for i in self.__items:
+			self.__failManager.addFailure(FailTicket(i[0], i[1]))
 
 	def tearDown(self):
 		"""Call after every test case."""
 	
 	def testAdd(self):
-		self.assertEqual(self.failManager.size(), 2)
+		self.assertEqual(self.__failManager.size(), 2)
 	
-	def testDel(self):
-		self.failManager.delFailure('193.168.0.128')
-		self.failManager.delFailure('111.111.1.111')
+	def _testDel(self):
+		self.__failManager.delFailure('193.168.0.128')
+		self.__failManager.delFailure('111.111.1.111')
 		
-		self.assertEqual(self.failManager.size(), 1)
+		self.assertEqual(self.__failManager.size(), 1)
 		
 	def testCleanupOK(self):
 		timestamp = 1167606999.0
-		self.failManager.cleanup(timestamp)
-		self.assertEqual(self.failManager.size(), 0)
+		self.__failManager.cleanup(timestamp)
+		self.assertEqual(self.__failManager.size(), 0)
 		
 	def testCleanupNOK(self):
 		timestamp = 1167605990.0
-		self.failManager.cleanup(timestamp)
-		self.assertEqual(self.failManager.size(), 2)
+		self.__failManager.cleanup(timestamp)
+		self.assertEqual(self.__failManager.size(), 2)
 	
 	def testbanOK(self):
-		self.failManager.setMaxRetry(5)
+		self.__failManager.setMaxRetry(5)
 		#ticket = FailTicket('193.168.0.128', None)
-		ticket = self.failManager.toBan()
+		ticket = self.__failManager.toBan()
 		self.assertEqual(ticket.getIP(), "193.168.0.128")
 	
 	def testbanNOK(self):
-		self.failManager.setMaxRetry(10)
-		self.assertRaises(FailManagerEmpty, self.failManager.toBan)
+		self.__failManager.setMaxRetry(10)
+		self.assertRaises(FailManagerEmpty, self.__failManager.toBan)

testcases/files/testcase01.log

@@ -1,18 +1,19 @@
-Déc 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Déc 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Déc 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
-Dez 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dez 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dez 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-De  31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-De  31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-De  31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
+Déc 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Déc 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Déc 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
+Dez 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dez 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dez 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+De  31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+De  31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+De  31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10

testcases/files/testcase02.log

@@ -1,10 +1,13 @@
-Mar 16 04:57:00 i60p295 sshd[11437]: input_userauth_request: illegal user test123
-Mar 16 04:57:00 i60p295 sshd[11437]: Failed password for illegal user test123 from ::ffff:66.38.192.238 port 51381 ssh2
-Mar 16 04:57:00 i60p295 sshd[11437]: Connection closed by ::ffff:66.38.192.238
-Mar 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mar 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mar 16 10:33:59 i60p295 sshd[12365]: Postponed keyboard-interactive for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mar 16 10:34:01 i60p295 sshd[12365]: Postponed keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mar 16 10:34:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mär 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mär 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:51:00 i60p295 sshd[11437]: input_userauth_request: illegal user test123
+Aug 14 11:52:00 i60p295 sshd[11437]: Failed password for illegal user test123 from ::ffff:66.38.192.238 port 51381 ssh2
+Aug 14 11:53:00 i60p295 sshd[11437]: Connection closed by ::ffff:66.38.192.238
+Aug 14 11:53:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:54:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:55:59 i60p295 sshd[12365]: Postponed keyboard-interactive for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:56:01 i60p295 sshd[12365]: Postponed keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:57:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:57:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:59:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:59:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:59:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2

testcases/files/testcase03.log

@@ -0,0 +1,9 @@
+Aug 14 11:53:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aug 14 11:54:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aug 14 11:55:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aou 14 11:56:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aou 14 11:57:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aoü 14 11:58:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aug 14 11:59:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aug 14 12:50:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aug 14 12:51:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.

testcases/files/testcase04.log

@@ -0,0 +1,15 @@
+Sep 21 22:03:07 [sshd] Invalid user toto from 212.41.96.185
+1124012400 [sshd] Invalid user fuck from 212.41.96.185
+Sep 21 21:03:38 [sshd] Invalid user toto from 212.41.96.185
+1124012500 [sshd] Invalid user fuck from 212.41.96.185
+Sep 21 21:03:46 [sshd] Invalid user toto from 212.41.96.185
+Aug 14 11:58:48 [sshd] Invalid user fuck from 212.41.96.185
+Aug 14 11:59:58 [sshd] Invalid user toto from 212.41.96.185
+Sep 21 21:04:03 [sshd] Invalid user fuck from 212.41.96.185
+                - Last output repeated twice -
+2005/08/14 11:57:00 [sshd] Invalid user toto from 212.41.96.186
+2005/08/14 11:58:00 [sshd] Invalid user fuck from 212.41.96.186
+2005/08/14 11:59:00 [sshd] Invalid user toto from 212.41.96.186
+2005/08/14 12:00:00 [sshd] Invalid user fuck from 212.41.96.186
+                - Last output repeated twice -
+Sep 21 21:09:01 [sshd] Invalid user toto from 212.41.96.185