BF: add missing files to MANIFEST (I think we shoult not rely on sdist anyways -- 'git tag' tarballs are more thorough ;) )

All the (version) updates for the release of 0.8.9
BF: (travis) relax the test for needed to be presented installed directories -- allow new
2013-05-13 11:24:07 -04:00 · 2013-05-13 11:00:44 -04:00 · 2013-05-12 23:42:57 -04:00 · 2013-05-12 23:42:01 -04:00 · 2013-05-12 23:27:32 -04:00 · 2013-05-12 23:22:55 -04:00
175 changed files with 6729 additions and 1551 deletions
@@ -0,0 +1,4 @@
+
+[run]
+branch = True
+omit = /usr*
@@ -0,0 +1,8 @@
+*~
+build
+dist
+*.pyc
+htmlcov
+.coverage
+*.orig
+*.rej
@@ -0,0 +1,37 @@
+# Custom pylint configuration for the Fail2Ban project
+#
+# Set your PYLINTRC environment variable to point to this file
+# e.g.
+#      export PYLINTRC=$PWD/.pylintrc
+
+[FORMAT]
+indent-string='\t'
+
+[BASIC]
+# Fail2Ban uses non-conventional to Python world camel-casing
+# These regexps were originally borrowed from 0.4.x series of
+# PyMVPA which had similar conventions.
+
+# Regular expression which should only match correct module names
+module-rgx=(([a-z][a-z0-9_]*)|([A-Z][a-zA-Z0-9_]+))$
+
+attr-rgx=[a-z_][a-zA-Z0-9_]{2,30}
+
+# Regular expression which should only match correct class names
+class-rgx=[A-Z_]+[a-zA-Z0-9]+$
+
+# Regular expression which should only match correct function names
+function-rgx=[a-z_]+[a-z_][a-zA-Z0-9]*$
+
+# Regular expression which should only match correct method names
+method-rgx=([a-z_]|__)[a-zA-Z0-9]*(__)?$
+
+# Regular expression which should only match correct argument names
+argument-rgx=[a-z][a-zA-Z0-9]*_*[a-zA-Z0-9]*_*[a-zA-Z0-9]*_?$
+
+# Regular expression which should only match correct variable names
+variable-rgx=([a-z_]+[a-zA-Z0-9]*_*[a-zA-Z0-9]*_*[a-zA-Z0-9]*_?||(__.*__))$||[A-Z]
+
+# Regular expression which should only match correct module level names
+# Default: (([A-Z_][A-Z1-9_]*)|(__.*__))$
+const-rgx=([a-z_]+[a-zA-Z0-9]*_*[a-zA-Z0-9]*_*[a-zA-Z0-9]*_?|__.*__)$||[A-Z]
@@ -0,0 +1,18 @@
+# vim ft=yaml
+# travis-ci.org definition for Fail2Ban build
+language: python
+python:
+  - "2.5"
+  - "2.6"
+  - "2.7"
+before_install:
+  - sudo apt-get update -qq
+install:
+  - pip install pyinotify
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get install -qq python-gamin; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then pip install -q coveralls; fi
+script:
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then export PYTHONPATH="$PYTHONPATH:/usr/share/pyshared:/usr/lib/pyshared/python2.7"; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coverage run --rcfile=.travis_coveragerc fail2ban-testcases; else python ./fail2ban-testcases; fi
+after_success:
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coveralls; fi
@@ -0,0 +1,6 @@
+
+[run]
+branch = True
+omit =
+    /usr/*
+    /home/travis/virtualenv/*
@@ -4,9 +4,279 @@
                       |_| \__,_|_|_/___|_.__/\__,_|_||_|

 ================================================================================
-Fail2Ban (version 0.8.5)                                              2011/07/28
+Fail2Ban (version 0.8.9)                                              2013/05/13
 ================================================================================

+ver. 0.8.9 (2013/05/13) - wanna-be-stable
+----------
+
+Originally targeted as a bugfix release, it incorporated many new
+enhancements, few new features, and more importantly -- quite extended
+tests battery with current 94% coverage (from 56% of 0.8.8).
+
+This release introduces over 200 of non-merge commits from 16
+contributors (sorted by number of commits): Yaroslav Halchenko, Daniel
+Black, Steven Hiscocks, James Stout, Orion Poplawski, Enrico Labedzki,
+ArndRa, hamilton5, pigsyn, Erwan Ben Souiden, Michael Gebetsroither,
+Artur Penttinen, blotus, sebres, Nicolas Collignon, Pascal Borreli.
+
+Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom
+Hendrikx, Yehuda Katz and other TBN heroes supporting users on
+fail2ban-users mailing list and IRC.
+
+- Fixes: Yaroslav Halchenko
+   * [6f4dad46] python-2.4 is the minimal version.
+   * [1eb23cf8] do not rely on scripts being under /usr -- might differ e.g.
+     on Fedora. Closes gh-112. Thanks to Camusensei for the bug report.
+   * [bf4d4af1] Changes for atomic writes. Thanks to Steven Hiscocks for
+     insight. Closes gh-103.
+   * [ab044b75] delay check for the existence of config directory until read.
+   * [3b4084d4] fixing up for handling of TAI64N timestamps.
+   * [154aa38e] do not shutdown logging until all jails stop.
+   * [f2156604] pyinotify -- monitor IN_MOVED_TO events. Closes gh-184.
+     Thanks to Jon Foster for report and troubleshooting.
+  Orion Poplawski
+   * [e4aedfdc00] pyinotify - use bitwise op on masks and do not try tracking
+     newly created directories.
+  Nicolas Collignon
+   * [39667ff6] Avoid leaking file descriptors. Closes gh-167.
+  Sergey Brester
+   * [b6bb2f88 and d17b4153] invalid date recognition, irregular because of
+     sorting template list.
+  Steven Hiscocks
+   * [7a442f07] When changing log target with python2.{4,5} handle KeyError.
+     Closes gh-147, gh-148.
+   * [b6a68f51] Fix delaction on server side. Closes gh-124.
+  Daniel Black
+   * [f0610c01] Allow more that a one word command when changing and Action via
+     the fail2ban-client. Closes gh-134.
+   * [945ad3d9] Fix dates on email actions to work in different locals. Closes
+     gh-70. Thanks to iGeorgeX for the idea.
+  blotus
+   * [96eb8986] ' and " should also be escaped in action tags Closes gh-109
+  Christoph Theis, Nick Hilliard, Daniel Black
+   * [b3bd877d,cde71080] Make syslog -v and syslog -vv formats work on FreeBSD
+- New features:
+  Yaroslav Halchenko
+   * [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile}
+     to provide additional flexibility to system adminstrators. Thanks to
+     beilber for the idea. Closes gh-114.
+   * [3ce53e87] Add exim filter.
+  Erwan Ben Souiden
+   * [d7d5228] add nagios integration documentation and script to ensure
+     fail2ban is running. Closes gh-166.
+  Artur Penttinen
+   * [29d0df5] Add mysqld filter. Closes gh-152.
+  ArndRaphael Brandes
+   * [bba3fd8] Add Sogo filter. Closes gh-117.
+  Michael Gebetsriother
+   * [f9b78ba] Add action route to block at routing level.
+  Teodor Micu & Yaroslav Halchenko
+   * [5f2d383] Add roundcube auth filter. Closes Debian bug #699442.
+  Daniel Black
+   * [be06b1b] Add action for iptables-ipsets. Closes gh-102.
+  Nick Munger, Ken Menzel, Daniel Black, Christoph Theis & Fabian Wenk
+   * [b6d0e8a] Add and enhance the bsd-ipfw action from
+     FreeBSD ports.
+  Soulard Morgan
+   * [f336d9f] Add filter for webmin. Closes gh-99.
+  Steven Hiscocks
+   * [..746c7d9] bash interactive shell completions for fail2ban-*'s
+  Nick Hilliard
+   * [0c5a9c5] Add pf action.
+- Enhancements:
+  Enrico Labedzki
+   * [24a8d07] Added new date format for ASSP SMTP Proxy.
+  Steven Hiscocks
+   * [3d6791f] Ensure restart of Actions after a check fails occurs
+     consistently. Closes gh-172.
+   * [MANY] Improvements to test cases, travis, and code coverage (coveralls).
+   * [b36835f] Add get cinfo to fail2ban-client. Closes gh-124.
+   * [ce3ab34] Added ability to specify PID file.
+  Orion Poplawski
+   * [ddebcab] Enhance fail2ban.service definition dependencies and Pidfile.
+     Closes gh-142.
+  Yaroslav Halchenko
+   * [MANY] Lots of improvements to log messages, man pages and test cases.
+   * [91d5736] Postfix filter improvements - empty helo, from and rcpt to.
+     Closes gh-126. Bug report by Michael Heuberger.
+   * [40c5a2d] adding more of diagnostic messages into -client while starting
+     the daemon.
+   * [8e63d4c] Compare against None with 'is' instead of '=='.
+   * [6fef85f] Strip CR and LF while analyzing the log line
+  Daniel Black
+   * [3aeb1a9] Add jail.conf manual page. Closes gh-143.
+   * [MANY] man page edits.
+   * [7cd6dab] Added help command to fail2ban-client.
+   * [c8c7b0b,23bbc60] Better logging of log file read errors.
+   * [3665e6d] Added code coverage to development process.
+   * [41b9f7b,32d10e9,39750b8] More complete ssh filter rules to match openssh
+     source. Also include BSD changes.
+   * [1d9abd1] Action files can have tags in definition that refer to other
+     tags.
+   * [10886e7,cec5da2,adb991a] Change actions to response with ICMP port
+     unreachable rather than just a drop of the packet.
+  Pascal Borreli
+   * [a2b29b4] Fixed lots of typos in config files and documentation.
+  hamilton5
+   * [7ede1e8] Update dovecot filter config.
+  Romain Riviere
+   * [0ac8746] Enhance named-refused filter for views.
+  James Stout
+   * [..2143cdf] Solaris support enhancements:
+     - README.Solaris
+     - failregex'es tune ups (sshd.conf)
+     - hostsdeny: do not rely on support of '-i' in sed
+
+ver. 0.8.8 (2012/12/06) - stable
+----------
+- Fixes:
+  Alan Jenkins
+   * [8c38907] Removed 'POSSIBLE BREAK-IN ATTEMPT' from sshd filter to avoid
+     banning due to misconfigured DNS. Closes gh-64
+  Yaroslav Halchenko
+   * [83109bc] IMPORTANT: escape the content of <matches> (if used in
+     custom action files) since its value could contain arbitrary
+     symbols.  Thanks for discovery go to the NBS System security
+     team
+   * [0935566,5becaf8] Various python 2.4 and 2.5 compatibility fixes. Closes gh-83
+   * [b159eab] do not enable pyinotify backend if pyinotify < 0.8.3
+   * [37a2e59] store IP as a base, non-unicode str to avoid spurious messages
+     in the console. Closes gh-91
+- New features:
+  David Engeset
+   * [2d672d1,6288ec2] 'unbanip' command for the client + avoidance of touching
+     the log file to take 'banip' or 'unbanip' in effect. Closes gh-81, gh-86
+  Yaroslav Halchenko
+- Enhancements:
+   * [2d66f31] replaced uninformative "Invalid command" message with warning log
+     exception why command actually failed
+   * [958a1b0] improved failregex to "support" auth.backend = "htdigest"
+   * [9e7a3b7] until we make it proper module -- adjusted sys.path only if
+     system-wide run
+   * [f52ba99] downgraded "already banned" from WARN to INFO level. Closes gh-79
+   * [f105379] added hints into the log on some failure return codes (e.g. 0x7f00
+     for this gh-87)
+   * Various others: travis-ci integration, script to run tests
+     against all available Python versions, etc
+
+ver. 0.8.7.1 (2012/07/31) - stable
+----------
+
+- Fixes:
+  Yaroslav Halchenko
+   * [e9762f3] Removed sneaked in comment on sys.path.insert
+
+ver. 0.8.7 (2012/07/31) - stable
+----------
+
+- Fixes:
+  Tom Hendrikx & Jeremy Olexa
+   * [0eaa4c2,444e4ac] Fix Gentoo init script: $opts variable is deprecated.
+     See http://forums.gentoo.org/viewtopic-t-899018.html
+  Chris Reffett
+   * [a018a26] Fixed addBannedIP to add enough failures to trigger a ban,
+     rather than just one failure.
+  Yaroslav Halchenko
+   * [4c76fb3] allow trailing white-spaces in lighttpd-auth.conf
+   * [25f1e8d] allow trailing whitespace in few missing it regexes for sshd.conf
+   * [ed16ecc] enforce "ip" field returned as str, not unicode so that log
+     message stays non-unicode. Close gh-32
+   * [b257be4] added %m-%d-%Y pattern + do not add %Y for Feb 29 fix if
+     already present in the pattern
+   * [47e956b] replace "|" with "_" in ipmasq-ZZZzzz|fail2ban.rul to be
+     friend to developers stuck with Windows (Closes gh-66)
+   * [80b191c] anchor grep regexp in actioncheck to not match partial names
+     of the jails (Closes: #672228) (Thanks Szépe Viktor for the report)
+- New features:
+  François Boulogne
+   * [a7cb20e..] add lighttpd-auth filter/jail
+  Lee Clemens & Yaroslav Halchenko
+   * [e442503] pyinotify backend (default if backend='auto' and pyinotify
+     is available)
+   * [d73a71f,3989d24] usedns parameter for the jails to allow disabling
+     use of DNS
+  Tom Hendrikx
+   * [f94a121..] 'recidive' filter/jail to monitor fail2ban.conf to ban
+     repeated offenders. Close gh-19
+  Xavier Devlamynck
+   * [7d465f9..] Add asterisk support
+  Zbigniew Jędrzejewski-Szmek
+   * [de502cf..] allow running fail2ban as non-root user (disabled by
+     default) via xt_recent. See doc/run-rootless.txt
+- Enhancements
+  Lee Clemens
+   * [47c03a2] files/nagios - spelling/grammar fixes
+   * [b083038] updated Free Software Foundation's address
+   * [9092a63] changed TLDs to invalid domains, in accordance with RFC 2606
+   * [642d9af,3282f86] reformated printing of jail's name to be consistent
+     with init's info messages
+   * [3282f86] uniform use of capitalized Jail in the messages
+  Leonardo Chiquitto
+   * [4502adf] Fix comments in dshield.conf and mynetwatchman.conf
+     to reflect code
+   * [a7d47e8] Update Free Software Foundation's address
+  Petr Voralek
+   * [4007751] catch failed ssh logins due to being listed in DenyUsers.
+     Close gh-47 (Closes: #669063)
+  Yaroslav Halchenko
+   * [MANY]    extended and robustified unittests: test different backends
+   * [d9248a6] refactored Filter's to avoid duplicate functionality
+   * [7821174] direct users to issues on github
+   * [d2ffee0..] re-factored fail2ban-regex -- more condensed output by
+     default with -v to control verbosity
+   * [b4099da] adjusted header for config/*.conf to mention .local and way
+     to comment (Thanks Stefano Forli for the note)
+   * [6ad55f6] added failregex for wu-ftpd to match against syslog instead
+     of DoS-prone auth.log's rhost (Closes: #514239)
+   * [2082fee] match possibly present "pam_unix(sshd:auth):" portion for
+     sshd filter (Closes: #648020)
+  Yehuda Katz & Yaroslav Halchenko
+   * [322f53e,bd40cc7] ./DEVELOP -- documentation for developers
+
+ver. 0.8.6 (2011/11/28) - stable
+----------
+- Fixes:
+  Markos Chandras & Yaroslav Halchenko
+   * [492d8e5,bd658fc] Use hashlib (instead of deprecated md5) where available
+  Robert Trace & Michael Lorant
+   * [c48c2b1] gentoo-initd cleanup and fixes: assure /var/run + remove stale
+     sock file
+  Michael Saavedra
+   * [3a58d0e] Lock server's executeCmd to prevent racing among iptables calls:
+     see http://bugs.debian.org/554162
+  Yaroslav Halchenko
+   * [3eb5e3b] Allow for trailing spaces in sasl logs
+   * [1632244] Stop server-side communication before stopping the
+     jails (prevents lockup if actions use fail2ban-client upon
+     unban): see https://github.com/fail2ban/fail2ban/issues/7
+   * [5a2d518] Various changes to reincarnate unittests
+  Yehuda Katz
+   * Wiki was cleaned from SPAM
+- Enhancements:
+  Adam Spiers
+   * [3152afb] Recognise time-stamped kernel messages
+  Guido Bozzetto
+   * [713fea6] Added ipmasq rule file to restart fail2ban when iptables are
+     wiped out: see http://bugs.debian.org/461417
+  Łukasz
+   * [5f23542] Matching of month names in Polish (thanks michaelberg79
+     for QA)
+  Tom Hendrikx
+   * [9fa54cf] Added Date: header for sendmail*.conf actions
+  Yaroslav Halchenko & Tom Hendrikx
+   * [b52d420..22b7007] <matches> in action files now can be used
+     to provide matched loglines which triggered action
+  Yaroslav Halchenko
+   * [ed0bf3a] Removed duplicate entry for DataCha0s/2\.0 in badbots:
+     see http://bugs.debian.org/519557
+   * [dad91f7] sshd.conf: allow user names to have spaces and
+     trailing spaces in the line
+   * [a9be451] removed expansions for few Date and Revision SVN keywords
+   * [a33135c] set/getFile for ticket.py -- found in source distribution
+     of 0.8.4
+   * [fbce415] additional logging while stopping the jails
+
 ver. 0.8.5 (2011/07/28) - stable
 ----------
 - Fix: use addfailregex instead of failregex while processing per-jail
@@ -290,7 +560,7 @@ ver. 0.6.1 (2006/03/16) - stable
 - Added parsing of timestamp in TAI64N format (#1275325). Thanks to Mark
  Edgington
 - Added patch #1382936 (Default formatted syslog logging). Thanks to Patrick
-  B�rjesson
+  Börjesson
 - Removed 192.168.0.0/16 from ignoreip. Attacks could also come from the local
  network.
 - Robust startup: if iptables module does not get fully initialized after
@@ -0,0 +1,345 @@
+                         __      _ _ ___ _               
+                        / _|__ _(_) |_  ) |__  __ _ _ _  
+                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+================================================================================
+How to develop for Fail2Ban
+================================================================================
+
+Fail2Ban uses GIT (http://git-scm.com/) distributed source control. This gives
+each developer their own complete copy of the entire repository. Developers can
+add and switch branches and commit changes when ever they want and then ask a
+maintainer to merge their changes.
+
+Fail2Ban uses GitHub (https://github.com/fail2ban/fail2ban) to manage access to
+the Git repository. GitHub provides free hosting for open-source projects as
+well as a web-based Git repository browser and an issue tracker.
+
+If you are familiar with Python and you have a bug fix or a feature that you
+would like to add to Fail2Ban, the best way to do so it to use the GitHub Pull
+Request feature. You can find more details on the Fail2Ban wiki
+(http://www.fail2ban.org/wiki/index.php/Get_Involved)
+
+Pull Requests
+=============
+
+When submitting pull requests on GitHub we ask you to:
+* Clearly describe the problem you're solving;
+* Don't introduce regressions that will make it hard for systems adminstrators 
+  to update;
+* If adding a major feature rebase your changes on master and get to a single commit;
+* Include test cases (see below);
+* Include sample logs (if relevant);
+* Include a change to the relevant section of the ChangeLog; and
+* Include yourself in THANKS if not already there.
+
+Testing
+=======
+
+Existing tests can be run by executing `fail2ban-testcases`. This has options
+like --log-level that will probably be useful. `fail2ban-testcases --help` for
+full options.
+
+Test cases should cover all usual cases, all exception cases and all inside
+/ outside boundary conditions.
+
+Test cases should cover all branches. The coverage tool will help identify
+missing branches. Also see http://nedbatchelder.com/code/coverage/branch.html
+for more details.
+
+Install the package python-coverage to visualise your test coverage. Run the
+following (note: on Debian-based systems, the script is called
+`python-coverage`):
+
+coverage run fail2ban-testcases
+coverage html
+
+Then look at htmlcov/index.html and see how much coverage your test cases
+exert over the codebase. Full coverage is a good thing however it may not be
+complete. Try to ensure tests cover as many independent paths through the
+code.
+
+Manual Execution. To run in a development environment do:
+
+./fail2ban-client -c config/ -s /tmp/f2b.sock -i start
+
+some quick commands:
+
+status
+add test pyinotify
+status test
+set test addaction iptables
+set test actionban iptables echo <ip> <cidr> >> /tmp/ban
+set test actionunban iptables echo <ip> <cidr> >> /tmp/unban
+get test actionban iptables
+get test actionunban iptables
+set test banip 192.168.2.2
+status test
+
+
+
+Coding Standards
+================
+
+Style
+-----
+
+Please use tabs for now. Keep to 80 columns, at least for readable text.
+
+Tests
+-----
+
+Add tests. They should test all the code you add in a meaning way.
+
+Coverage
+--------
+
+Test coverage should always increase as you add code.
+
+You may use "# pragma: no cover" in the code for branches of code that support
+older versions on python. For all other uses of "pragma: no cover" or
+"pragma: no branch" document the reason why its not covered. "I haven't written
+a test case" isn't a sufficient reason.
+
+Documentation
+-------------
+
+Ensure this documentation is up to date after changes. Also ensure that the man
+pages still are accurate. Ensure that there is sufficient documentation for
+your new features to be used.
+
+Bugs
+----
+
+Remove them and don't add any more.
+
+Git
+---
+
+Use the following tags in your commit messages:
+
+'BF:' for bug fixes
+'DOC:' for documentation fixes
+'ENH:' for enhancements
+'TST:' for commits concerning tests only (thus not touching the main code-base)
+
+Multiple tags could be joined with +, e.g. "BF+TST:".
+
+Adding Actions
+--------------
+
+If you add an action.d/*.conf file also add a example in config/jail.conf
+with enabled=false and maxretry=5 for ssh.
+
+
+Design
+======
+
+Fail2Ban was initially developed with Python 2.3 (IIRC). It should
+still be compatible with Python 2.4 and such compatibility assurance
+makes code ... old-fashioned in many places (RF-Note).  In 0.7 the
+design went through major refactoring into client/server,
+a-thread-per-jail design which made it a bit difficult to follow.
+Below you can find a sketchy description of the main components of the
+system to orient yourself better.
+
+server/
+------
+
+Core classes hierarchy (feel welcome to draw a better/more complete
+one)::
+
+ ->   inheritance
+ +    delegation
+ *    storage of multiple instances
+
+ RF-Note   just a note which might be useful to address while doing RF
+
+ JailThread -> Filter -> FileFilter -> {FilterPoll, FilterPyinotify, ...}
+               |         * FileContainer
+               + FailManager
+               + DateDetector
+			   + Jail (provided in __init__) which contains this Filter
+                 (used for passing tickets from FailManager to Jail's __queue)
+ Server
+   + Jails
+      * Jail
+        + Filter  (in __filter)
+        * tickets (in __queue)
+        + Actions (in __action)
+          * Action
+          + BanManager
+
+
+failmanager.py
+~~~~~~~~~~~~~~
+
+FailManager
+
+  Keeps track of failures, recorded as 'tickets'.  All operations are
+  done via acquiring a lock
+
+FailManagerEmpty(Exception)
+
+  raised by FailManager.toBan after reaching the list of tickets
+  (RF-Note: asks to become a generator ;) )
+
+
+filter.py
+~~~~~~~~~~
+
+Filter(JailThread)
+
+  Wraps (non-threaded) FailManager (and proxies to it quite a bit),
+  and provides all primary logic for processing new lines, what IPs to
+  ignore, etc
+
+  .failManager  [FailManager]
+  .dateDetector [DateDetector]
+  .__failRegex  [list]
+  .__ignoreRegex [list]
+    Contains regular expressions for failures and ignores
+  .__findTime   [numeric]
+    Used in `processLineAndAdd` to skip old lines
+
+FileFilter(Filter):
+
+  Files-aware Filter
+
+  .__logPath [list]
+    keeps the tracked files (added 1-by-1 using addLogPath)
+    stored as FileContainer's
+  .getFailures
+    actually just returns
+    True
+      if managed to open and get lines (until empty)
+    False
+      if failed to open or absent container matching the filename
+
+FileContainer
+
+  Adapter for a file to deal with log rotation.
+
+  .open,.close,.readline
+     RF-Note: readline returns "" with handler absent... shouldn't it be None?
+  .__pos
+    Keeps the position pointer
+
+
+dnsutils.py
+~~~~~~~~~~~
+
+DNSUtils
+
+  Utility class for DNS and IP handling
+
+
+filter*.py
+~~~~~~~~~~
+
+Implementations of FileFilter's for specific backends.  Derived
+classes should provide an implementation of `run` and usually
+override `addLogPath`, `delLogPath` methods.  In run() method they all
+one way or another provide
+
+		try:
+			while True:
+				ticket = self.failManager.toBan()
+				self.jail.putFailTicket(ticket)
+		except FailManagerEmpty:
+			self.failManager.cleanup(MyTime.time())
+
+thus channeling "ban tickets" from their failManager to the
+corresponding jail.
+
+action.py
+~~~~~~~~~
+
+Takes care about executing start/check/ban/unban/stop commands
+
+
+Releasing
+=========
+
+# Check distribution patches and see if they can be included
+
+  * https://apps.fedoraproject.org/packages/fail2ban/sources
+  * http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/
+  * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/
+  * https://build.opensuse.org/package/show?package=fail2ban&project=openSUSE%3AFactory
+  * http://sophie.zarb.org/sources/fail2ban (Mageia)
+  * https://trac.macports.org/browser/trunk/dports/security/fail2ban
+
+# Check distribution outstanding bugs
+
+  * https://github.com/fail2ban/fail2ban/issues?sort=updated&state=open
+  * http://bugs.debian.org/cgi-bin/pkgreport.cgi?dist=unstable;package=fail2ban
+  * http://bugs.sabayon.org/buglist.cgi?quicksearch=net-analyzer%2Ffail2ban
+  * https://bugs.gentoo.org/buglist.cgi?query_format=advanced&short_desc=fail2ban&bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=IN_PROGRESS&short_desc_type=allwords
+  * https://bugzilla.redhat.com/buglist.cgi?query_format=advanced&bug_status=NEW&bug_status=ASSIGNED&component=fail2ban&classification=Red%20Hat&classification=Fedora
+  * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
+
+# Provide a release sample to distributors
+
+  * Debian: Yaroslav Halchenko <debian@onerussian.com>
+            http://packages.qa.debian.org/f/fail2ban.html
+  * FreeBSD: Christoph Theis theis@gmx.at>, Nick Hilliard <nick@foobar.org>
+            http://svnweb.freebsd.org/ports/head/security/py-fail2ban/Makefile?view=markup
+  * Fedora: Axel Thimm <Axel.Thimm@atrpms.net>
+            https://apps.fedoraproject.org/packages/fail2ban
+  * Gentoo: netmon@gentoo.org
+            http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/metadata.xml?view=markup
+  * openSUSE: Stephan Kulow <coolo@suse.com>
+            https://build.opensuse.org/package/users?package=fail2ban&project=openSUSE%3AFactory
+  * Mac Ports: @Malbrouck on github (gh-49)
+            https://trac.macports.org/browser/trunk/dports/security/fail2ban/Portfile
+
+# Wait for feedback from distributors
+
+# Ensure the version is correct in ./common/version.py
+
+# Add/finalize the corresponding entry in the ChangeLog
+
+  To generate a list of committers use e.g.
+
+  git shortlog -sn 0.8.8.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
+
+  Ensure the top of the ChangeLog has the right version and current date.
+
+  Ensure the top entry of the ChangeLog has the right version and current date.
+
+# Update man pages
+
+  (cd man ; ./generate-man )
+  git commit -m 'update man pages for release' man/*
+
+# Make sure the tests pass
+
+  ./fail2ban-testcases-all
+
+# Prepare/upload source and rpm binary distributions
+
+  python setup.py check
+  python setup.py sdist
+  python setup.py bdist_rpm
+  python setup.py upload
+
+# Run the following and update the wiki with output:
+
+  python -c 'import common.protocol; common.protocol.printWiki()'
+
+# Email users and development list of release
+
+# notify distributors
+
+Post Release
+============
+
+Add the following to the top of the ChangeLog
+
+ver. 0.8.9 (2013/XX/XXX) - wanna-be-stable
+- Fixes
+- New Features
+- Enhancements
+
@@ -1,7 +1,11 @@
-README
+README.md
+README.Solaris
 ChangeLog
 TODO
+THANKS
 COPYING
+DEVELOP
+doc/run-rootless.txt
 fail2ban-client
 fail2ban-server
 fail2ban-testcases
@@ -19,6 +23,7 @@ client/configurator.py
 client/csocket.py
 server/asyncserver.py
 server/filter.py
+server/filterpyinotify.py
 server/filtergamin.py
 server/filterpoll.py
 server/iso8601.py
@@ -38,6 +43,30 @@ server/banmanager.py
 server/datetemplate.py
 server/mytime.py
 server/failregex.py
+testcases/files/testcase-usedns.log
+testcases/files/logs/bsd/syslog-plain.txt
+testcases/files/logs/bsd/syslog-v.txt
+testcases/files/logs/bsd/syslog-vv.txt
+testcases/files/logs/apache-overflows
+testcases/files/logs/assp
+testcases/files/logs/asterisk
+testcases/files/logs/dovecot
+testcases/files/logs/exim
+testcases/files/logs/lighttpd
+testcases/files/logs/mysqld.log
+testcases/files/logs/named-refused
+testcases/files/logs/pam-generic
+testcases/files/logs/postfix
+testcases/files/logs/proftpd
+testcases/files/logs/pure-ftpd
+testcases/files/logs/roundcube-auth
+testcases/files/logs/sasl
+testcases/files/logs/sogo-auth
+testcases/files/logs/sshd
+testcases/files/logs/sshd-ddos
+testcases/files/logs/vsftpd
+testcases/files/logs/webmin-auth
+testcases/files/logs/wu-ftpd
 testcases/banmanagertestcase.py
 testcases/failmanagertestcase.py
 testcases/clientreadertestcase.py
@@ -46,13 +75,17 @@ testcases/__init__.py
 testcases/datedetectortestcase.py
 testcases/actiontestcase.py
 testcases/servertestcase.py
+testcases/sockettestcase.py
 testcases/files/testcase01.log
 testcases/files/testcase02.log
 testcases/files/testcase03.log
 testcases/files/testcase04.log
+testcases/misctestcase.py
+testcases/utils.py
 setup.py
 setup.cfg
 common/__init__.py
+common/exceptions.py
 common/helpers.py
 common/version.py
 common/protocol.py
@@ -84,6 +117,22 @@ config/filter.d/vsftpd.conf
 config/filter.d/webmin-auth.conf
 config/filter.d/wuftpd.conf
 config/filter.d/xinetd-fail.conf
+config/filter.d/asterisk.conf
+config/filter.d/dovecot.conf
+config/filter.d/dropbear.conf
+config/filter.d/lighttpd-auth.conf
+config/filter.d/recidive.conf
+config/filter.d/roundcube-auth.conf
+config/filter.d/assp.conf
+config/filter.d/mysqld-auth.conf
+config/filter.d/sogo-auth.conf
+config/action.d/bsd-ipfw.conf
+config/action.d/dummy.conf
+config/action.d/iptables-blocktype.conf
+config/action.d/iptables-ipset-proto4.conf
+config/action.d/iptables-ipset-proto6.conf
+config/action.d/iptables-xt_recent-echo.conf
+config/action.d/route.conf
 config/action.d/complain.conf
 config/action.d/dshield.conf
 config/action.d/hostsdeny.conf
@@ -99,6 +148,7 @@ config/action.d/mail-buffered.conf
 config/action.d/mail-whois.conf
 config/action.d/mail-whois-lines.conf
 config/action.d/mynetwatchman.conf
+config/action.d/pf.conf
 config/action.d/sendmail.conf
 config/action.d/sendmail-buffered.conf
 config/action.d/sendmail-whois.conf
@@ -106,6 +156,8 @@ config/action.d/sendmail-whois-lines.conf
 config/action.d/shorewall.conf
 config/fail2ban.conf
 man/fail2ban-client.1
+man/fail2ban.1
+man/jail.conf.5
 man/fail2ban-client.h2m
 man/fail2ban-server.1
 man/fail2ban-server.h2m
@@ -119,8 +171,14 @@ files/macosx-initd
 files/solaris-fail2ban.xml
 files/solaris-svc-fail2ban
 files/suse-initd
+files/fail2ban-logrotate
 files/cacti/fail2ban_stats.sh
 files/cacti/cacti_host_template_fail2ban.xml
 files/cacti/README
 files/nagios/check_fail2ban
 files/nagios/f2ban.txt
+files/bash-completion
+files/fail2ban-tmpfiles.conf
+files/fail2ban.service
+files/ipmasq-ZZZzzz_fail2ban.rul
+files/nagios/README
@@ -1,91 +0,0 @@
-                         __      _ _ ___ _               
-                        / _|__ _(_) |_  ) |__  __ _ _ _  
-                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
-                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
-
-================================================================================
-Fail2Ban (version 0.8.5)                                              2011/07/26
-================================================================================
-
-Fail2Ban scans log files like /var/log/pwdfail and bans IP that makes too many
-password failures. It updates firewall rules to reject the IP address. These
-rules can be defined by the user. Fail2Ban can read multiple log files such as
-sshd or Apache web server ones.
-
-This README is a quick introduction to Fail2ban. More documentation, FAQ, HOWTOs
-are available on the project website: http://www.fail2ban.org
-
-Installation:
-------------
-
-Required:
-   >=python-2.3 (http://www.python.org)
-
-Optional:
-   >=gamin-0.0.21 (http://www.gnome.org/~veillard/gamin)
-
-To install, just do:
-
-> tar xvfj fail2ban-0.8.4.tar.bz2
-> cd fail2ban-0.8.4
-> python setup.py install
-
-This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
-placed into /usr/bin.
-
-It is possible that Fail2ban is already packaged for your distribution. In this
-case, you should use it.
-
-Fail2Ban should be correctly installed now. Just type:
-
-> fail2ban-client -h
-
-to see if everything is alright. You should always use fail2ban-client and never
-call fail2ban-server directly.
-
-Configuration:
--------------
-
-You can configure Fail2ban using the files in /etc/fail2ban. It is possible to
-configure the server using commands sent to it by fail2ban-client. The available
-commands are described in the man page of fail2ban-client. Please refer to it or
-to the website: http://www.fail2ban.org
-
-Contact:
--------
-
-You need some new features, you found bugs or you just appreciate this program,
-you can contact me at:
-
-Website: http://www.fail2ban.org
-
-Cyril Jaquier: <cyril.jaquier@fail2ban.org>
-
-Thanks:
-------
-
-Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker, Tom Pike, Iain Lea,
-Andrey G. Grozin, Yaroslav Halchenko, Jonathan Kamens, Stephen Gildea, Markus
-Hoffmann, Mark Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler, Nick
-Munger, Christoph Haas, Justin Shore, Joël Bertrand, René Berber, mEDI, Axel
-Thimm, Eric Gerbier, Christian Rauch, Michael C. Haller, Jonathan Underwood,
-Hanno 'Rince' Wagner, Daniel B. Cid, David Nutter, Raphaël Marichez, Guillaume
-Delvit, Vaclav Misek, Adrien Clerc, Michael Hanselmann, Vincent Deffontaines,
-Bill Heaton, Russell Odom, Christos Psonis, Arturo 'Buanzo' Busleiman and many
-others.
-
-License:
--------
-
-Fail2Ban is free software; you can redistribute it and/or modify it under the
-terms of the GNU General Public License as published by the Free Software
-Foundation; either version 2 of the License, or (at your option) any later
-version.
-
-Fail2Ban is distributed in the hope that it will be useful, but WITHOUT ANY
-WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
-PARTICULAR PURPOSE. See the GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License along with
-Fail2Ban; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
-Suite 330, Boston, MA  02111-1307  USA
@@ -0,0 +1,141 @@
+# vim:tw=80:ft=txt
+
+README FOR SOLARIS INSTALLATIONS
+
+By Roy Sigurd Karlsbakk <roy@karlsbakk.net>
+
+ABOUT
+
+This readme is meant for those wanting to install fail2ban on Solaris 10,
+OpenSolaris, OpenIndiana etc. To some degree it may as well be useful for
+users of older Solaris versions and Nexenta, but don't rely on it.
+
+READ ME FIRST
+
+If I use the term Solaris, I am talking about any Solaris dialect, that is, the
+official Sun/Oracle ones or derivates. If I describe an OS as
+"OpenSolaris-based", it means it's either OpenSolaris, OpenIndiana or one of the
+other, but /not/ the Nexenta family, since this only uses the OpenSolaris/
+IllumOS kernel and not the userland. If I say Solaris 10, I mean Solaris 10 and
+perhaps, if you're lucky and have some good gods on your side, it may also apply
+to Solaris 9 or even 8 and hopefully in the new Solaris 11 whenever that may be
+released. Quoted lines of code, settings et cetera are indented with two spaces.
+This does _not_ mean you should use that indentation, especially in config files
+where they can be harmful. Optional settings are prefixed with OPT: while
+required settings are prefixed with REQ:. If no prefix is found, regard it as a
+required setting.
+
+INSTALLATION ON SOLARIS
+
+The installation is straight forward on Solaris as well as on linux/bsd/etc.
+./setup.py install installs the general packages in /usr/bin on OpenSolaris-
+based distros or (at least on this box) under /usr/sfw/bin on Solaris 10. In
+the files/ directory you will find the file solaris-fail2ban.xml containing the
+Solaris service. To install this, run the following command as root (or with
+sudo):
+
+  svccfg import files/solaris-fail2ban.xml
+
+This should normally without giving an error. If you get an error, deal with it,
+and please post any relevant info (or fixes?) to the fail2ban mailing list.
+Next install the service handler - copy the script in and allow it to be executed:
+
+  cp files/solaris-svc-fail2ban /lib/svc/method/svc-fail2ban
+  chmod +x /lib/svc/method/svc-fail2ban
+
+CONFIGURE SYSLOG
+
+For some reason, a default Solaris installation does not log ssh login attempts,
+and since fail2ban works by monitoring logs, enabling this logging is rather
+important for it to work. To enable this, edit /etc/syslog.conf and add a line
+at the end:
+
+  auth.info					/var/adm/auth.log
+
+Save the file and exit, and run
+
+  touch /var/adm/auth.log
+
+The Solaris system logger will _not_ create a non-existing file. Now, restart
+the system logger.
+
+  svcadm restart system-log
+
+Try to ssh into localhost with ssh asdf@localhost and enter an invalid password.
+Make sure this is logged in the above file. When done, you may configure
+fail2ban.
+
+FAIL2BAN CONFIGURATION
+
+OPT: Create /etc/fail2ban/fail2ban.local containing:
+
+# Fail2Ban main configuration file
+#
+# Comments: use '#' for comment lines and ';' (following a space) for inline comments
+#
+# Changes:  in most of the cases you should not modify this
+#           file, but provide customizations in fail2ban.local file, e.g.:
+#
+# [Definition]
+# loglevel = 4
+#
+[Definition]
+
+# Option:  logtarget
+# Notes.:  Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
+#          Only one log target can be specified.
+#          If you change logtarget from the default value and you are
+#          using logrotate -- also adjust or disable rotation in the
+#          corresponding configuration file
+#          (e.g. /etc/logrotate.d/fail2ban on Debian systems)
+# Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+#
+logtarget = /var/adm/fail2ban.log
+
+
+REQ: Create /etc/fail2ban/jail.local containing:
+
+[ssh-tcpwrapper]
+
+enabled     = true
+filter      = sshd
+action      = hostsdeny
+              sendmail-whois[name=SSH, dest=you@example.com]
+ignoreregex = for myuser from
+logpath     = /var/adm/auth.log
+
+Set the sendmail dest address to something useful or drop the line to stop it spamming you.
+Set 'myuser' to your username to avoid banning yourself or drop it.
+
+START (OR RESTART) FAIL2BAN
+
+Enable the fail2ban service with
+
+  svcadm enable fail2ban
+
+When done, check that all services are running well
+
+  svcs -xv
+
+GOTCHAS AND FIXMES
+
+* It seems the installation may be starting fail2ban automatically. If this is
+  done, fail2ban will not start, but no errors will be returned from svcs
+  (above). Check if it's running with 'ps -ef | grep fail2ban' and manually kill
+  the PID if it is. Re-enable fail2ban and try again
+
+    svcadm disable fail2ban
+    svcadm enable fail2ban
+
+* If svcs -xv says that fail2ban failed to start or svcs says it's in maintenance mode
+  chcek /var/svc/log/network-fail2ban:default.log for clues. 
+  Check permissions on /var/adm, /var/adm/auth.log /var/adm/fail2ban.log and /var/run/fail2ban
+  You may need to:
+
+  sudo mkdir /var/run/fail2ban
+
+* Fail2ban adds lines like these to /etc/hosts.deny:
+
+    ALL: 1.2.3.4
+
+  wouldn't it be better to just block sshd?
@@ -0,0 +1,100 @@
+                         __      _ _ ___ _               
+                        / _|__ _(_) |_  ) |__  __ _ _ _  
+                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
+                       v0.8.9                  2013/05/13
+
+## Fail2Ban: ban hosts that cause multiple authentication errors 
+
+Fail2Ban scans log files like /var/log/pwdfail and bans IP that makes too many
+password failures. It updates firewall rules to reject the IP address. These
+rules can be defined by the user. Fail2Ban can read multiple log files such as
+sshd or Apache web server ones.
+
+This README is a quick introduction to Fail2ban. More documentation, FAQ, HOWTOs
+are available in fail2ban(1) manpage and on the website http://www.fail2ban.org
+
+Installation:
+-------------
+
+**It is possible that Fail2ban is already packaged for your distribution.  In
+this case, you should use it instead.**
+
+Required:
+- [Python >= 2.4](http://www.python.org)
+
+Optional:
+- [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify)
+  - Linux >= 2.6.13
+- [gamin >= 0.0.21](http://www.gnome.org/~veillard/gamin)
+
+To install, just do:
+
+    tar xvfj fail2ban-0.8.9.tar.bz2
+    cd fail2ban-0.8.9
+    python setup.py install
+
+This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
+placed into /usr/bin, and configuration under /etc/fail2ban.
+
+Fail2Ban should be correctly installed now. Just type:
+
+    fail2ban-client -h
+
+to see if everything is alright. You should always use fail2ban-client and
+never call fail2ban-server directly.
+
+Configuration:
+--------------
+
+You can configure Fail2Ban using the files in /etc/fail2ban. It is possible to
+configure the server using commands sent to it by fail2ban-client. The
+available commands are described in the fail2ban-client(1) manpage.  Also see
+fail2ban(1) manpage for further references and find even more documentation on
+the website: http://www.fail2ban.org
+
+Code status:
+------------
+
+* [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.png?branch=master)](https://travis-ci.org/fail2ban/fail2ban) travis-ci.org (master branch)
+
+* [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.png?branch=master)](https://coveralls.io/r/fail2ban/fail2ban)
+
+Contact:
+--------
+
+### You need some new features, you found bugs?
+visit [Issues](https://github.com/fail2ban/fail2ban/issues)
+and if your issue is not yet known -- file a bug report.
+
+### You would like to troubleshoot or discuss?
+join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
+
+### You would like to contribute (new filters/actions/code/documentation)?
+send a pull request
+
+### You just appreciate this program:
+send kudos to the original author ([Cyril Jaquier](mailto: Cyril Jaquier <cyril.jaquier@fail2ban.org>)
+or better to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
+since Fail2Ban is "community-driven" for years now.
+
+Thanks:
+-------
+
+See [THANKS](https://github.com/fail2ban/fail2ban/blob/master/THANKS) file.
+
+License:
+--------
+
+Fail2Ban is free software; you can redistribute it and/or modify it under the
+terms of the GNU General Public License as published by the Free Software
+Foundation; either version 2 of the License, or (at your option) any later
+version.
+
+Fail2Ban is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with
+Fail2Ban; if not, write to the Free Software Foundation, Inc., 51 Franklin
+Street, Fifth Floor, Boston, MA 02110, USA
@@ -0,0 +1,50 @@
+Fail2Ban is an open source project with many contributions from its
+users community. Below is an alphabetically sorted partial list of the
+contributors to the project.  If you have been left off, please let us
+know (preferably send a pull request on github with the "fix") and you
+will be added
+
+Adrien Clerc
+Andrey G. Grozin
+Arturo 'Buanzo' Busleiman
+Axel Thimm
+Bill Heaton
+Christian Rauch
+Christoph Haas
+Christos Psonis
+Daniel B. Cid
+Daniel Black
+David Nutter
+Eric Gerbier
+Enrico Labedzki
+Guillaume Delvit
+Hanno 'Rince' Wagner
+Iain Lea
+Jonathan Kamens
+Jonathan Underwood
+Joël Bertrand
+Justin Shore
+Kévin Drapel
+kojiro
+Mark Edgington
+Markus Hoffmann
+Marvin Rouge
+mEDI
+Michael C. Haller
+Michael Hanselmann
+NickMunger
+Patrick Börjesson
+Raphaël Marichez
+René Berber
+Robert Edeker
+Russell Odom
+Sireyessire
+Stephen Gildea
+Steven Hiscocks
+Tom Pike
+Tyler
+Vaclav Misek
+Vincent Deffontaines
+Yaroslav Halchenko
+Yehuda Katz
+zugeschmiert
@@ -4,7 +4,7 @@
                       |_| \__,_|_|_/___|_.__/\__,_|_||_|

 ================================================================================
-ToDo                                                            $Revision$
+ToDo
 ================================================================================

 Legend:
@@ -13,16 +13,19 @@ Legend:
 # partially done
 * done

- Removed relative imports
+- more detailed explaination in DEVELOP for new developers (eg. howto build this HEX numbers in ChangeLog)

- Cleanup fail2ban-client and fail2ban-server. Move code to server/ and client/
+- Run tests though all filters/examples files - (see sshd example file) as unit
+  test
+
+* Removed relative imports
+
+* Cleanup fail2ban-client and fail2ban-server. Move code to server/ and client/

 - Add timeout to external commands (signal alarm, watchdog thread, etc)

- New backend: pyinotify
-
 - Uniformize filters and actions name. Use the software name (openssh, postfix,
-  proftp)
+  proftp) and possible qualifier (e.g. auth) after a '-'

 - Added <USER> tag for failregex. Add features using this information. Maybe add
  more tags
@@ -52,3 +55,5 @@ Legend:
 # better return values in function

 # refactoring in server.py, actions.py, filter.py
+
+* New backend: pyinotify
@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,14 +15,11 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 # Author: Cyril Jaquier
 # 
-# $Revision$

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,15 +15,12 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 # Author: Cyril Jaquier
 # 
-# $Revision$

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -32,8 +32,8 @@ logSys = logging.getLogger("fail2ban.client.config")

 class ActionReader(ConfigReader):
 	
-	def __init__(self, action, name):
-		ConfigReader.__init__(self)
+	def __init__(self, action, name, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
 		self.__file = action[0]
 		self.__cInfo = action[1]
 		self.__name = name
@@ -87,4 +87,4 @@ class ActionReader(ConfigReader):
 				stream.append(head + ["setcinfo", self.__file, p, self.__cInfo[p]])

 		return stream
-		
+		
@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,22 +15,16 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2013- Yaroslav Halchenko"
 __license__ = "GPL"

-from server.jails import UnknownJailException
-from server.jails import DuplicateJailException
 import logging

+from common.exceptions import UnknownJailException, DuplicateJailException
+
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.client.config")

@@ -59,10 +56,10 @@ class Beautifier:
 				msg = "Jail started"
 			elif inC[0] == "stop":
 				if len(inC) == 1:
-					if response == None:
+					if response is None:
 						msg = "Shutdown successful"
 				else:
-					if response == None:
+					if response is None:
 						msg = "Jail stopped"
 			elif inC[0] == "add":
 				msg = "Added jail " + response
@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,15 +15,12 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 # Author: Yaroslav Halchenko
 # Modified: Cyril Jaquier
-# $Revision$

 __author__ = 'Yaroslav Halhenko'
-__revision__ = '$Revision: $'
-__date__ = '$Date:  $'
 __copyright__ = 'Copyright (c) 2007 Yaroslav Halchenko'
 __license__ = 'GPL'

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,19 +15,16 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 # Author: Cyril Jaquier
 # Modified by: Yaroslav Halchenko (SafeConfigParserWithIncludes)
-# $Revision$

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

-import logging, os
+import glob, logging, os
 from configparserinc import SafeConfigParserWithIncludes
 from ConfigParser import NoOptionError, NoSectionError

@@ -32,36 +32,57 @@ from ConfigParser import NoOptionError, NoSectionError
 logSys = logging.getLogger("fail2ban.client.config")

 class ConfigReader(SafeConfigParserWithIncludes):
+
+	DEFAULT_BASEDIR = '/etc/fail2ban'
 	
-	BASE_DIRECTORY = "/etc/fail2ban/"
-	
-	def __init__(self):
+	def __init__(self, basedir=None):
 		SafeConfigParserWithIncludes.__init__(self)
+		self.setBaseDir(basedir)
 		self.__opts = None
 	
-	#@staticmethod
-	def setBaseDir(folderName):
-		path = folderName.rstrip('/')
-		ConfigReader.BASE_DIRECTORY = path + '/'
-	setBaseDir = staticmethod(setBaseDir)
-		
-	#@staticmethod
-	def getBaseDir():
-		return ConfigReader.BASE_DIRECTORY
-	getBaseDir = staticmethod(getBaseDir)
+	def setBaseDir(self, basedir):
+		if basedir is None:
+			basedir = ConfigReader.DEFAULT_BASEDIR	# stock system location
+		self._basedir = basedir.rstrip('/')
+	
+	def getBaseDir(self):
+		return self._basedir
 	
 	def read(self, filename):
-		basename = ConfigReader.BASE_DIRECTORY + filename
-		logSys.debug("Reading " + basename)
-		bConf = basename + ".conf"
-		bLocal = basename + ".local"
-		if os.path.exists(bConf) or os.path.exists(bLocal):
-			SafeConfigParserWithIncludes.read(self, [bConf, bLocal])
-			return True
-		else:
-			logSys.error(bConf + " and " + bLocal + " do not exist")
+		if not os.path.exists(self._basedir):
+			raise ValueError("Base configuration directory %s does not exist "
+							  % self._basedir)
+		basename = os.path.join(self._basedir, filename)
+		logSys.debug("Reading configs for %s under %s "  % (basename, self._basedir))
+		config_files = [ basename + ".conf",
+						 basename + ".local" ]
+
+		# choose only existing ones
+		config_files = filter(os.path.exists, config_files)
+
+		# possible further customizations under a .conf.d directory
+		config_dir = basename + '.d'
+		config_files += sorted(glob.glob('%s/*.conf' % config_dir))
+
+		if len(config_files):
+			# at least one config exists and accessible
+			logSys.debug("Reading config files: " + ', '.join(config_files))
+			config_files_read = SafeConfigParserWithIncludes.read(self, config_files)
+			missed = [ cf for cf in config_files if cf not in config_files_read ]
+			if missed:
+				logSys.error("Could not read config files: " + ', '.join(missed))
+			if config_files_read:
+				return True
+			logSys.error("Found no accessible config files for %r under %s" %
+						 ( filename, self.getBaseDir() ))
 			return False
-	
+		else:
+			logSys.error("Found no accessible config files for %r " % filename
+						 + (["under %s" % self.getBaseDir(),
+							 "among existing ones: " + ', '.join(config_files)][bool(len(config_files))]))
+
+			return False
+
 	##
 	# Read the options.
 	#
@@ -82,7 +103,7 @@ class ConfigReader(SafeConfigParserWithIncludes):
 					v = self.getint(sec, option[1])
 				else:
 					v = self.get(sec, option[1])
-				if not pOptions == None and option[1] in pOptions:
+				if not pOptions is None and option[1] in pOptions:
 					continue
 				values[option[1]] = v
 			except NoSectionError, e:
@@ -90,9 +111,9 @@ class ConfigReader(SafeConfigParserWithIncludes):
 				logSys.error(e)
 				values[option[1]] = option[2]
 			except NoOptionError:
-				if not option[2] == None:
-					logSys.warn("'%s' not defined in '%s'. Using default value"
-								% (option[1], sec))
+				if not option[2] is None:
+					logSys.warn("'%s' not defined in '%s'. Using default one: %r"
+								% (option[1], sec, option[2]))
 					values[option[1]] = option[2]
 			except ValueError:
 				logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +
@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,15 +15,12 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 # Author: Cyril Jaquier
 # 
-# $Revision$

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -40,15 +40,19 @@ class Configurator:
 		self.__fail2ban = Fail2banReader()
 		self.__jails = JailsReader()
 	
-	#@staticmethod
-	def setBaseDir(folderName):
-		ConfigReader.setBaseDir(folderName)
-	setBaseDir = staticmethod(setBaseDir)
+	def setBaseDir(self, folderName):
+		self.__fail2ban.setBaseDir(folderName)
+		self.__jails.setBaseDir(folderName)
 	
-	#@staticmethod
-	def getBaseDir():
-		return ConfigReader.getBaseDir()
-	getBaseDir = staticmethod(getBaseDir)
+	def getBaseDir(self):
+		fail2ban_basedir = self.__fail2ban.getBaseDir()
+		jails_basedir = self.__jails.getBaseDir()
+		if fail2ban_basedir != jails_basedir:
+			logSys.error("fail2ban.conf and jails.conf readers have differing "
+						 "basedirs: %r and %r. "
+						 "Returning the one for fail2ban.conf"
+						 % (fail2ban_basedir, jails_basedir))
+		return fail2ban_basedir
 	
 	def readEarly(self):
 		self.__fail2ban.read()
@@ -75,4 +79,4 @@ class Configurator:
 		for opt in self.__streams["jails"]:
 			cmds.append(opt)
 		return cmds
-	
+	
@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,15 +15,12 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 # Author: Cyril Jaquier
 # 
-# $Revision$

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,15 +15,12 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 # Author: Cyril Jaquier
 # 
-# $Revision$

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -32,14 +32,15 @@ logSys = logging.getLogger("fail2ban.client.config")

 class Fail2banReader(ConfigReader):
 	
-	def __init__(self):
-		ConfigReader.__init__(self)
+	def __init__(self, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
 	
 	def read(self):
 		ConfigReader.read(self, "fail2ban")
 	
 	def getEarlyOptions(self):
-		opts = [["string", "socket", "/tmp/fail2ban.sock"]]
+		opts = [["string", "socket", "/tmp/fail2ban.sock"],
+				["string", "pidfile", "/var/run/fail2ban/fail2ban.pid"]]
 		return ConfigReader.getOptions(self, "Definition", opts)
 	
 	def getOptions(self):
@@ -55,4 +56,4 @@ class Fail2banReader(ConfigReader):
 			elif opt == "logtarget":
 				stream.append(["set", "logtarget", self.__opts[opt]])
 		return stream
-	
+	
@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,15 +15,12 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 # Author: Cyril Jaquier
 # 
-# $Revision$

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -32,8 +32,8 @@ logSys = logging.getLogger("fail2ban.client.config")

 class FilterReader(ConfigReader):
 	
-	def __init__(self, fileName, name):
-		ConfigReader.__init__(self)
+	def __init__(self, fileName, name, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
 		self.__file = fileName
 		self.__name = name
 	
@@ -71,4 +71,4 @@ class FilterReader(ConfigReader):
 					if regex != '':
 						stream.append(["set", self.__name, "addignoreregex", regex])		
 		return stream
-		
+		
@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,15 +15,12 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 # Author: Cyril Jaquier
 # 
-# $Revision$

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -37,10 +37,11 @@ class JailReader(ConfigReader):
 	
 	actionCRE = re.compile("^((?:\w|-|_|\.)+)(?:\[(.*)\])?$")
 	
-	def __init__(self, name):
-		ConfigReader.__init__(self)
+	def __init__(self, name, force_enable=False, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
 		self.__name = name
 		self.__filter = None
+		self.__force_enable = force_enable
 		self.__actions = list()
 	
 	def setName(self, value):
@@ -50,10 +51,10 @@ class JailReader(ConfigReader):
 		return self.__name
 	
 	def read(self):
-		ConfigReader.read(self, "jail")
+		return ConfigReader.read(self, "jail")
 	
 	def isEnabled(self):
-		return self.__opts["enabled"]
+		return self.__force_enable or self.__opts["enabled"]
 	
 	def getOptions(self):
 		opts = [["bool", "enabled", "false"],
@@ -62,6 +63,7 @@ class JailReader(ConfigReader):
 				["int", "maxretry", 3],
 				["int", "findtime", 600],
 				["int", "bantime", 600],
+				["string", "usedns", "warn"],
 				["string", "failregex", None],
 				["string", "ignoreregex", None],
 				["string", "ignoreip", None],
@@ -71,7 +73,8 @@ class JailReader(ConfigReader):
 		
 		if self.isEnabled():
 			# Read filter
-			self.__filter = FilterReader(self.__opts["filter"], self.__name)
+			self.__filter = FilterReader(self.__opts["filter"], self.__name,
+										 basedir=self.getBaseDir())
 			ret = self.__filter.read()
 			if ret:
 				self.__filter.getOptions(self.__opts)
@@ -82,8 +85,10 @@ class JailReader(ConfigReader):
 			# Read action
 			for act in self.__opts["action"].split('\n'):
 				try:
+					if not act:			  # skip empty actions
+						continue
 					splitAct = JailReader.splitAction(act)
-					action = ActionReader(splitAct, self.__name)
+					action = ActionReader(splitAct, self.__name, basedir=self.getBaseDir())
 					ret = action.read()
 					if ret:
 						action.getOptions(self.__opts)
@@ -92,8 +97,10 @@ class JailReader(ConfigReader):
 						raise AttributeError("Unable to read action")
 				except Exception, e:
 					logSys.error("Error in action definition " + act)
-					logSys.debug(e)
+					logSys.debug("Caught exception: %s" % (e,))
 					return False
+			if not len(self.__actions):
+				logSys.warn("No actions were defined for %s" % self.__name)
 		return True
 	
 	def convert(self):
@@ -119,6 +126,8 @@ class JailReader(ConfigReader):
 				stream.append(["set", self.__name, "findtime", self.__opts[opt]])
 			elif opt == "bantime":
 				stream.append(["set", self.__name, "bantime", self.__opts[opt]])
+			elif opt == "usedns":
+				stream.append(["set", self.__name, "usedns", self.__opts[opt]])
 			elif opt == "failregex":
 				stream.append(["set", self.__name, "addfailregex", self.__opts[opt]])
 			elif opt == "ignoreregex":
@@ -136,12 +145,20 @@ class JailReader(ConfigReader):
 	def splitAction(action):
 		m = JailReader.actionCRE.match(action)
 		d = dict()
-		if not m.group(2) == None:
+		mgroups = m.groups()
+		if len(mgroups) == 2:
+			action_name, action_opts = mgroups
+		elif len(mgroups) == 1:
+			action_name, action_opts = mgroups[0], None
+		else:
+			raise ValueError("While reading action %s we should have got up to "
+							 "2 groups. Got: %r" % (action, mgroups))
+		if not action_opts is None:
 			# Huge bad hack :( This method really sucks. TODO Reimplement it.
 			actions = ""
 			escapeChar = None
 			allowComma = False
-			for c in m.group(2):
+			for c in action_opts:
 				if c in ('"', "'") and not allowComma:
 					# Start
 					escapeChar = c
@@ -166,6 +183,6 @@ class JailReader(ConfigReader):
 				try:
 					d[p[0].strip()] = p[1].strip()
 				except IndexError:
-					logSys.error("Invalid argument %s in '%s'" % (p, m.group(2)))
-		return [m.group(1), d]
+					logSys.error("Invalid argument %s in '%s'" % (p, action_opts))
+		return [action_name, d]
 	splitAction = staticmethod(splitAction)
@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,15 +15,12 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 # Author: Cyril Jaquier
 # 
-# $Revision$

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -33,12 +33,20 @@ logSys = logging.getLogger("fail2ban.client.config")

 class JailsReader(ConfigReader):
 	
-	def __init__(self):
-		ConfigReader.__init__(self)
+	def __init__(self, force_enable=False, **kwargs):
+		"""
+		Parameters
+		----------
+		force_enable : bool, optional
+		  Passed to JailReader to force enable the jails.
+		  It is for internal use
+		"""
+		ConfigReader.__init__(self, **kwargs)
 		self.__jails = list()
+		self.__force_enable = force_enable
 	
 	def read(self):
-		ConfigReader.read(self, "jail")
+		return ConfigReader.read(self, "jail")
 	
 	def getOptions(self, section = None):
 		opts = []
@@ -46,7 +54,7 @@ class JailsReader(ConfigReader):

 		if section:
 			# Get the options of a specific jail.
-			jail = JailReader(section)
+			jail = JailReader(section, basedir=self.getBaseDir(), force_enable=self.__force_enable)
 			jail.read()
 			ret = jail.getOptions()
 			if ret:
@@ -59,7 +67,7 @@ class JailsReader(ConfigReader):
 		else:
 			# Get the options of all jails.
 			for sec in self.sections():
-				jail = JailReader(sec)
+				jail = JailReader(sec, basedir=self.getBaseDir(), force_enable=self.__force_enable)
 				jail.read()
 				ret = jail.getOptions()
 				if ret:
@@ -84,4 +92,4 @@ class JailsReader(ConfigReader):
 			stream.append(["start", jail.getName()])
 		
 		return stream
-		
+		
@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,14 +15,11 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 # Author: Cyril Jaquier
 # 
-# $Revision$

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
@@ -0,0 +1,36 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+"""Fail2Ban exceptions used by both client and server
+
+"""
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav Halchenko"
+__license__ = "GPL"
+
+#
+# Jails
+#
+class DuplicateJailException(Exception):
+	pass
+
+class UnknownJailException(Exception):
+	pass
+
+
+
@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,27 +15,26 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

-# Author: Cyril Jaquier
-# Author: Arturo 'Buanzo' Busleiman
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__author__ = "Cyril Jaquier, Arturo 'Buanzo' Busleiman"
 __copyright__ = "Copyright (c) 2009 Cyril Jaquier"
 __license__ = "GPL"


 def formatExceptionInfo():
-    """ Author: Arturo 'Buanzo' Busleiman """
-    import sys
-    cla, exc = sys.exc_info()[:2]
-    excName = cla.__name__
-    try:
-        excArgs = exc.__dict__["args"]
-    except KeyError:
-        excArgs = str(exc)
-    return (excName, excArgs)
+	""" Author: Arturo 'Buanzo' Busleiman """
+	import sys
+	cla, exc = sys.exc_info()[:2]
+	excName = cla.__name__
+	try:
+		excArgs = exc.__dict__["args"]
+		# Assure that we always return a string, without unneeded
+		# 'decorations' with python <= 2.5 where args would be a tuple
+		if isinstance(excArgs, tuple) and len(excArgs) == 1:
+			excArgs = excArgs[0]
+		excArgs = str(excArgs)
+	except KeyError:
+		# And always provide a string output
+		excArgs = str(exc)
+	return (excName, excArgs)
@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,15 +15,12 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 # Author: Cyril Jaquier
 # 
-# $Revision$

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -37,6 +37,7 @@ protocol = [
 ["stop", "stops all jails and terminate the server"], 
 ["status", "gets the current status of the server"], 
 ["ping", "tests if the server is alive"], 
+["help", "return this output"], 
 ['', "LOGGING", ""],
 ["set loglevel <LEVEL>", "sets logging level to <LEVEL>. 0 is minimal, 4 is debug"], 
 ["get loglevel", "gets the logging level"], 
@@ -59,7 +60,9 @@ protocol = [
 ["set <JAIL> delignoreregex <INDEX>", "removes the regular expression at <INDEX> for ignoreregex"], 
 ["set <JAIL> findtime <TIME>", "sets the number of seconds <TIME> for which the filter will look back for <JAIL>"], 
 ["set <JAIL> bantime <TIME>", "sets the number of seconds <TIME> a host will be banned for <JAIL>"], 
+["set <JAIL> usedns <VALUE>", "sets the usedns mode for <JAIL>"],
 ["set <JAIL> banip <IP>", "manually Ban <IP> for <JAIL>"], 
+["set <JAIL> unbanip <IP>", "manually Unban <IP> in <JAIL>"], 
 ["set <JAIL> maxretry <RETRY>", "sets the number of failures <RETRY> before banning the host for <JAIL>"], 
 ["set <JAIL> addaction <ACT>", "adds a new action named <NAME> for <JAIL>"], 
 ["set <JAIL> delaction <ACT>", "removes the action <NAME> from <JAIL>"], 
@@ -77,6 +80,7 @@ protocol = [
 ["get <JAIL> ignoreregex", "gets the list of regular expressions which matches patterns to ignore for <JAIL>"],
 ["get <JAIL> findtime", "gets the time for which the filter will look back for failures for <JAIL>"],
 ["get <JAIL> bantime", "gets the time a host is banned for <JAIL>"],
+["get <JAIL> usedns", "gets the usedns setting for <JAIL>"],
 ["get <JAIL> maxretry", "gets the number of failures allowed for <JAIL>"],
 ["get <JAIL> addaction", "gets the last action which has been added for <JAIL>"],
 ["get <JAIL> actionstart <ACT>", "gets the start command for the action <ACT> for <JAIL>"],
@@ -84,6 +88,7 @@ protocol = [
 ["get <JAIL> actioncheck <ACT>", "gets the check command for the action <ACT> for <JAIL>"],
 ["get <JAIL> actionban <ACT>", "gets the ban command for the action <ACT> for <JAIL>"],
 ["get <JAIL> actionunban <ACT>", "gets the unban command for the action <ACT> for <JAIL>"],
+["get <JAIL> cinfo <ACT> <KEY>", "gets the value for <KEY> for the action <ACT> for <JAIL>"],
 ]

 ##
@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -12,16 +15,13 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 # Author: Cyril Jaquier
-# 
-# $Revision$
+#

-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011 Yaroslav Halchenko"
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2013 Yaroslav Halchenko"
 __license__ = "GPL"

-version = "0.8.5"
+version = "0.8.9"
@@ -0,0 +1,82 @@
+# Fail2Ban configuration file
+#
+# Author: Nick Munger
+# Modified by: Ken Menzel
+#              Daniel Black (start/stop)
+#              Fabian Wenk (many ideas as per fail2ban users list)
+#
+# Ensure firewall_enable="YES" in the top of /etc/rc.conf
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = ipfw show | fgrep -q 'table(<table>)' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e <br> else exit b }'; num=$?; ipfw -q add $num deny <block> from table\(<table>\) to me <port>; echo $num > "<startstatefile>" )
+
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop =  [ -f <startstatefile> ] && ( read num < "<startstatefile>" <br> ipfw -q delete $num <br> rm "<startstatefile>" )
+
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+# requires an ipfw rule like "deny ip from table(1) to me"
+actionban = ipfw table <table> add <ip>
+
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = ipfw table <table> delete <ip>
+
+[Init]
+# Option:  table
+# Notes:   The ipfw table to use. If a ipfw rule using this table already exists,
+#          this action will not create a ipfw rule to block it and the following
+#          options will have no effect.
+# Values:  NUM
+table = 1
+
+# Option:  port
+# Notes.:  Specifies port to monitor. Blank indicate block all ports.
+# Values:  [ NUM | STRING ]
+#
+port = 
+
+# Option:  startstatefile
+# Notes:   A file to indicate that the table rule that was added. Ensure it is unique per table.
+# Values:  STRING
+startstatefile = /var/run/fail2ban/ipfw-started-table_<table>
+
+# Option:  action
+# Notes:   This is the action to take for automaticly created rules. See the 
+#          ACTION defination at the top of man ipfw for allowed values.
+#          "deny" and "unreach port" are probably the useful.
+# Values:  STRING
+action = deny
+
+# Option: block
+# Notes:  This is how much to block.
+#         Can be "ip", "tcp", "udp" or various other options.
+# Values: STRING
+block = ip
@@ -12,8 +12,22 @@
 # any other addresses found in the whois record, with a few exceptions.
 # If no addresses are found, no e-mail is sent.
 #
-# $Revision$
+# WARNING
+# -------
 #
+# Please do not use this action unless you are certain that fail2ban
+# does not result in "false positives" for your deployment.  False
+# positive reports could serve a mis-favor to the original cause by
+# flooding corresponding contact addresses, and complicating the work
+# of administration personnel responsible for handling (verified) legit
+# complains.
+#
+# Please consider using e.g. sendmail-whois-lines.conf action which
+# would send the reports with relevant information to you, so the
+# report could be first reviewed and then forwarded to a corresponding
+# contact if legit.
+#
+

 [Definition]

@@ -38,10 +52,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = ADDRESSES=`whois <ip> | perl -e 'while (<STDIN>) { next if /^changed|@(ripe|apnic)\.net/io; $m += (/abuse|trouble:|report|spam|security/io?3:0); if (/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)/io) { while (s/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)//io) { if ($m) { $a{lc($1)}=$m } else { $b{lc($1)}=$m } } $m=0 } else { $m && --$m } } if (%%a) {print join(",",keys(%%a))} else {print join(",",keys(%%b))}'`
@@ -53,9 +64,7 @@ actionban = ADDRESSES=`whois <ip> | perl -e 'while (<STDIN>) { next if /^changed
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban =
@@ -25,7 +25,6 @@
 # configured at DShield), and <lines>/<minreportinterval>/<maxbufferage> (to
 # configure how often the buffer is flushed).
 #
-# $Revision$

 [Definition]

@@ -54,9 +53,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 # See http://www.dshield.org/specs.html for more on report format/notes
@@ -91,9 +88,7 @@ actionban = TZONE=`date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'`
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = if [ -f <tmpfile>.first ]; then
@@ -116,7 +111,7 @@ actionunban = if [ -f <tmpfile>.first ]; then
 port = ???

 # Option:  userid
-# Notes.:  Your DSheild user ID. Should be provided either in the jail config or
+# Notes.:  Your DShield user ID. Should be provided either in the jail config or
 #          in a .local file.
 #          Register at https://secure.dshield.org/register.html
 # Values:  [ NUM ]  Default: 0
@@ -124,13 +119,13 @@ port = ???
 userid = 0

 # Option:  myip
-# Notes.:  TThe target IP for the attack (your public IP). Should be provided
+# Notes.:  The target IP for the attack (your public IP). Should be provided
 #          either in the jail config or in a .local file unless your PUBLIC IP
 #          is the first IP assigned to eth0
 # Values:  [ an IP address ]  Default: Tries to find the IP address of eth0,
 #          which in most cases will be a private IP, and therefore incorrect
 #
-myip = `ip -4 addr show dev eth0 | grep inet | head -1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`
+myip = `ip -4 addr show dev eth0 | grep inet | head -n 1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`

 # Option:  protocol
 # Notes.:  The protocol over which the attack is happening
@@ -159,7 +154,6 @@ minreportinterval = 3600
 #          submit the batch, even if we haven't reached <lines> yet. Note that
 #          this is only checked on each ban/unban, and that we always send
 #          anything in the buffer on shutdown. Must be greater than
-#          <minreportinterval>.
 # Values:  [ NUM ]  Default: 21600 (6 hours)
 #
 maxbufferage = 21600
@@ -204,7 +198,7 @@ dest = reports@dshield.org

 # Option:  tmpfile
 # Notes.:  Base name of temporary files used for buffering
-# Values:  [ STRING ]  Default: /tmp/fail2ban-dshield
+# Values:  [ STRING ]  Default: /var/run/fail2ban/tmp-dshield
 #
 tmpfile = /var/run/fail2ban/tmp-dshield

@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -29,9 +28,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "+<ip>\n" >> /tmp/fail2ban.dummy
@@ -39,9 +36,7 @@ actionban = printf %%b "+<ip>\n" >> /tmp/fail2ban.dummy
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = printf %%b "-<ip>\n" >> /tmp/fail2ban.dummy
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -28,9 +27,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = IP=<ip> &&
@@ -39,12 +36,10 @@ actionban = IP=<ip> &&
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = IP=<ip> && sed -i.old /ALL:\ $IP/d <file>
+actionunban = IP=<ip> && sed  /ALL:\ $IP/d <file> > <file>.new && mv <file>.new <file>

 [Init]

@@ -34,24 +34,25 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = echo block in quick from <ip>/32 | /sbin/ipf -f -
+actionban = echo block <blocktype> in quick from <ip>/32 | /sbin/ipf -f -


 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 # note -r option used to remove matching rule
-actionunban = echo block in quick from <ip>/32 | /sbin/ipf -r -f -
+actionunban = echo block <blocktype> in quick from <ip>/32 | /sbin/ipf -r -f -

 [Init]

+# Option: Blocktype
+# Notes : This is the return-icmp[return-code] mentioned in the ipf man page section 5. Keep this quoted to prevent
+#         Shell expansion. This should be blank (unquoted) to drop the packet.
+# Values: STRING
+blocktype = "return-icmp(port-unr)"
@@ -3,7 +3,6 @@
 # Author: Nick Munger
 # Modified by: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -32,20 +31,16 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipfw add deny tcp from <ip> to <localhost> <port>
+actionban = ipfw add <blocktype> tcp from <ip> to <localhost> <port>


 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
@@ -63,3 +58,11 @@ port = ssh
 # Values:  IP
 #
 localhost = 127.0.0.1
+
+
+# Option:  blocktype
+# Notes.:  How to block the traffic. Use a action from man 5 ipfw
+#          Common values: deny, unreach port, reset
+# Values:  STRING
+#
+blocktype = unreach port
@@ -4,9 +4,13 @@
 # Modified: Yaroslav O. Halchenko <debian@onerussian.com>
 # 			made active on all ports from original iptables.conf
 #
-# $Revision$
 #

+[INCLUDES]
+
+before = iptables-blocktype.conf
+
+
 [Definition]

 # Option:  actionstart
@@ -29,31 +33,27 @@ actionstop = iptables -D <chain> -p <protocol> -j fail2ban-<name>
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
+actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>

 [Init]

-# Defaut name of the chain
+# Default name of the chain
 #
 name = default

@@ -0,0 +1,22 @@
+# Fail2Ban configuration file
+#
+# Author: Daniel Black
+#
+# This is a included configuration file and includes the defination for the blocktype
+# used in all iptables based actions by default.
+#
+# The user can override the default in iptables-blocktype.local
+
+[INCLUDES]
+
+after = iptables-blocktype.local
+
+[Init]
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+blocktype = REJECT --reject-with icmp-port-unreachable
+
@@ -0,0 +1,74 @@
+# Fail2Ban configuration file
+#
+# Author: Daniel Black
+#
+# This is for ipset protocol 4 (ipset v4.2). If you have a later version
+# of ipset try to use the iptables-ipset-proto6.conf as it does some things
+# nicer.
+# 
+# This requires the program ipset which is normally in package called ipset.
+#
+# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0 kernels.
+#
+# If you are running on an older kernel you make need to patch in external
+# modules.
+#
+# On Debian machines this can be done with:
+#
+# apt-get install ipset xtables-addons-source 
+# module-assistant auto-install xtables-addons
+
+[INCLUDES]
+
+before = iptables-blocktype.conf
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = ipset --create fail2ban-<name> iphash
+              iptables -I INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
+             ipset --flush fail2ban-<name>
+             ipset --destroy fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = ipset --test fail2ban-<name> <ip> ||  ipset --add fail2ban-<name> <ip>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = ipset --test fail2ban-<name> <ip> && ipset --del fail2ban-<name> <ip>
+
+[Init]
+
+# Default name of the ipset
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default: ssh
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
@@ -0,0 +1,81 @@
+# Fail2Ban configuration file
+#
+# Author: Daniel Black
+#
+# This is for ipset protocol 6 (and hopefully later) (ipset v6.14).
+# Use ipset -V to see the protocol and version. Version 4 should use
+# iptables-ipset-proto4.conf.
+#
+# This requires the program ipset which is normally in package called ipset.
+#
+# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0 kernels.
+#
+# If you are running on an older kernel you make need to patch in external
+# modules.
+#
+# On Debian machines this can be done with:
+#
+# apt-get install ipset xtables-addons-source 
+# module-assistant auto-install xtables-addons
+
+[INCLUDES]
+
+before = iptables-blocktype.conf
+
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
+              iptables -I INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j DROP
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j DROP
+             ipset flush fail2ban-<name>
+             ipset destroy fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = ipset del fail2ban-<name> <ip> -exist
+
+[Init]
+
+# Default name of the ipset
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default: ssh
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option: bantime
+# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
+# Values:  [ NUM ]  Default: 600
+
+bantime = 600
@@ -7,9 +7,12 @@
 # make "fail2ban-<name>-log" chain to log and drop
 # insert a jump to fail2ban-<name> from -I <chain> if proto/port match
 #
-# $Revision$
 #

+[INCLUDES]
+
+before = iptables-blocktype.conf
+
 [Definition]

 # Option:  actionstart
@@ -21,7 +24,7 @@ actionstart = iptables -N fail2ban-<name>
              iptables -I <chain> 1 -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
              iptables -N fail2ban-<name>-log
              iptables -I fail2ban-<name>-log -j LOG --log-prefix "$(expr fail2ban-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
-              iptables -A fail2ban-<name>-log -j DROP
+              iptables -A fail2ban-<name>-log -j <blocktype>

 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
@@ -42,9 +45,7 @@ actioncheck = iptables -n -L fail2ban-<name>-log >/dev/null
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = iptables -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log
@@ -52,16 +53,14 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = iptables -D fail2ban-<name> -s <ip> -j fail2ban-<name>-log

 [Init]

-# Defaut name of the chain
+# Default name of the chain
 #
 name = default

@@ -2,9 +2,12 @@
 #
 # Author: Cyril Jaquier
 # Modified by Yaroslav Halchenko for multiport banning
-# $Revision$
 #

+[INCLUDES]
+
+before = iptables-blocktype.conf
+
 [Definition]

 # Option:  actionstart
@@ -27,31 +30,27 @@ actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j f
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
+actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>

 [Init]

-# Defaut name of the chain
+# Default name of the chain
 #
 name = default

@@ -4,9 +4,13 @@
 # Copied from iptables.conf and modified by Yaroslav Halchenko 
 #  to fullfill the needs of bugreporter dbts#350746.
 #
-# $Revision$
 #

+[INCLUDES]
+
+before = iptables-blocktype.conf
+
+
 [Definition]

 # Option:  actionstart
@@ -29,31 +33,27 @@ actionstop = iptables -D <chain> -m state --state NEW -p <protocol> --dport <por
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
+actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>

 [Init]

-# Defaut name of the chain
+# Default name of the chain
 #
 name = default

@@ -0,0 +1,76 @@
+# Fail2Ban configuration file
+#
+# Author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
+#
+#
+
+[INCLUDES]
+
+before = iptables-blocktype.conf
+
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+# Changing iptables rules requires root privileges. If fail2ban is
+# configured to run as root, firewall setup can be performed by
+# fail2ban automatically. However, if fail2ban is configured to run as
+# a normal user, the configuration must be done by some other means
+# (e.g. using static firewall configuration with the
+# iptables-persistent package).
+# 
+# Explanation of the rule below:
+#    Check if any packets coming from an IP on the fail2ban-<name>
+#    list have been seen in the last 3600 seconds. If yes, update the
+#    timestamp for this IP and drop the packet. If not, let the packet
+#    through.
+#
+#    Fail2ban inserts blacklisted hosts into the fail2ban-<name> list
+#    and removes them from the list after some time, according to its
+#    own rules. The 3600 second timeout is independent and acts as a
+#    safeguard in case the fail2ban process dies unexpectedly. The
+#    shorter of the two timeouts actually matters.
+actionstart = iptables -I INPUT -m recent --update --seconds 3600 --name fail2ban-<name> -j <blocktype>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = echo / > /proc/net/xt_recent/fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = test -e /proc/net/xt_recent/fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = echo +<ip> > /proc/net/xt_recent/fail2ban-<name>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = echo -<ip> > /proc/net/xt_recent/fail2ban-<name>
+
+[Init]
+
+# Default name of the chain
+#
+name = default
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
@@ -2,9 +2,12 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

+[INCLUDES]
+
+before = iptables-blocktype.conf
+
 [Definition]

 # Option:  actionstart
@@ -27,31 +30,27 @@ actionstop = iptables -D <chain> -p <protocol> --dport <port> -j fail2ban-<name>
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
+actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>

 [Init]

-# Defaut name of the chain
+# Default name of the chain
 #
 name = default

@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -43,9 +42,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
@@ -62,9 +59,7 @@ actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 # Modified-By: Yaroslav Halchenko to include grepping on IP over log files
-# $Revision$
 #

 [Definition]
@@ -34,10 +33,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "Hi,\n
@@ -53,16 +49,14 @@ actionban = printf %%b "Hi,\n
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 

 [Init]

-# Defaut name of the chain
+# Default name of the chain
 #
 name = default

@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -34,9 +33,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "Hi,\n
@@ -50,16 +47,14 @@ actionban = printf %%b "Hi,\n
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 

 [Init]

-# Defaut name of the chain
+# Default name of the chain
 #
 name = default

@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -34,9 +33,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "Hi,\n
@@ -48,16 +45,14 @@ actionban = printf %%b "Hi,\n
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 

 [Init]

-# Defaut name of the chain
+# Default name of the chain
 #
 name = default

@@ -24,7 +24,6 @@
 # Another useful configuration value is <getcmd>, if you don't have wget
 # installed (an example config for curl is given below)
 #
-# $Revision$

 [Definition]

@@ -49,9 +48,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 #
@@ -71,9 +68,7 @@ actionban = MNWLOGIN=`perl -e '$s=shift;$s=~s/([\W])/"%%".uc(sprintf("%%2.2x",or
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban =
@@ -102,13 +97,13 @@ mnwlogin =
 mnwpass =

 # Option:  myip
-# Notes.:  TThe target IP for the attack (your public IP). Should be overridden
+# Notes.:  The target IP for the attack (your public IP). Should be overridden
 #          either in the jail config or in a .local file unless your PUBLIC IP
 #          is the first IP assigned to eth0
 # Values:  [ an IP address ]  Default: Tries to find the IP address of eth0,
 #          which in most cases will be a private IP, and therefore incorrect
 #
-myip = `ip -4 addr show dev eth0 | grep inet | head -1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`
+myip = `ip -4 addr show dev eth0 | grep inet | head -n 1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`

 # Option:  protocol
 # Notes.:  The protocol over which the attack is happening
@@ -139,6 +134,6 @@ mnwurl = http://mynetwatchman.com/insertwebreport.asp

 # Option:  tmpfile
 # Notes.:  Base name of temporary files
-# Values:  [ STRING ]  Default: /tmp/fail2ban-mynetwatchman
+# Values:  [ STRING ]  Default: /var/run/fail2ban/tmp-mynetwatchman
 #
 tmpfile = /var/run/fail2ban/tmp-mynetwatchman
@@ -0,0 +1,62 @@
+# Fail2Ban configuration file
+#
+# OpenBSD pf ban/unban
+#
+# Author: Nick Hilliard <nick@foobar.org>
+#
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+# we don't enable PF automatically, as it will be enabled elsewhere
+actionstart = 
+
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+# we don't disable PF automatically either
+actionstop = 
+
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = /sbin/pfctl -t <tablename> -T add <ip>/32
+
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+# note -r option used to remove matching rule
+actionunban = /sbin/pfctl -t <tablename> -T delete <ip>/32
+
+[Init]
+# Option:  tablename
+# Notes.:  The pf table name.
+# Values:  [ STRING ]  Default: fail2ban
+#
+tablename = fail2ban
+
@@ -0,0 +1,24 @@
+# Fail2Ban configuration file
+#
+# Author: Michael Gebetsroither
+#
+# This is for blocking whole hosts through blackhole routes.
+#
+# PRO:
+#   - Works on all kernel versions and as no compatibility problems (back to debian lenny and WAY further).
+#   - It's FAST for very large numbers of blocked ips.
+#   - It's FAST because it Blocks traffic before it enters common iptables chains used for filtering.
+#   - It's per host, ideal as action against ssh password bruteforcing to block further attack attempts.
+#   - No additional software required beside iproute/iproute2
+#
+# CON:
+#   - Blocking is per IP and NOT per service, but ideal as action against ssh password bruteforcing hosts
+
+[Definition]
+actionban   = ip route add <blocktype> <ip>
+actionunban = ip route del <blocktype> <ip>
+
+# Option:  blocktype
+# Note:    Type can be blackhole, unreachable and prohibit. Unreachable and prohibit correspond to the ICMP reject messages.
+# Values:  STRING
+blocktype = unreachable
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -52,9 +51,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
@@ -74,16 +71,14 @@ actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 

 [Init]

-# Defaut name of the chain
+# Default name of the chain
 #
 name = default

@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -12,6 +11,7 @@
 # Values:  CMD
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
              From: Fail2Ban <<sender>>
              To: <dest>\n
              Hi,\n
@@ -24,6 +24,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 # Values:  CMD
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: Fail2Ban <<sender>>
             To: <dest>\n
             Hi,\n
@@ -40,12 +41,11 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
            From: Fail2Ban <<sender>>
            To: <dest>\n
            Hi,\n
@@ -54,23 +54,21 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
            Here are more information about <ip>:\n
            `/usr/bin/whois <ip>`\n\n
            Lines containing IP:<ip> in <logpath>\n
-            `/bin/grep '\<<ip>\>' <logpath>`\n\n
+            `grep '\<<ip>\>' <logpath>`\n\n
            Regards,\n
            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 

 [Init]

-# Defaut name of the chain
+# Default name of the chain
 #
 name = default

@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -12,6 +11,7 @@
 # Values:  CMD
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
              From: Fail2Ban <<sender>>
              To: <dest>\n
              Hi,\n
@@ -24,6 +24,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 # Values:  CMD
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: Fail2Ban <<sender>>
             To: <dest>\n
             Hi,\n
@@ -40,12 +41,11 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
            From: Fail2Ban <<sender>>
            To: <dest>\n
            Hi,\n
@@ -59,16 +59,14 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 

 [Init]

-# Defaut name of the chain
+# Default name of the chain
 #
 name = default

@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -12,6 +11,7 @@
 # Values:  CMD
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
              From: Fail2Ban <<sender>>
              To: <dest>\n
              Hi,\n
@@ -24,6 +24,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 # Values:  CMD
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: Fail2Ban <<sender>>
             To: <dest>\n
             Hi,\n
@@ -40,12 +41,11 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
            From: Fail2Ban <<sender>>
            To: <dest>\n
            Hi,\n
@@ -57,16 +57,14 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 

 [Init]

-# Defaut name of the chain
+# Default name of the chain
 #
 name = default

@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 # The default Shorewall configuration is with "BLACKLISTNEWONLY=Yes" (see
 # file /etc/shorewall/shorewall.conf). This means that when Fail2ban adds a
@@ -36,19 +35,21 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = shorewall drop <ip>
+actionban = shorewall <blocktype> <ip>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = shorewall allow <ip>
+
+# Option:  blocktype
+# Note:    This is what the action does with rules.
+#          See man page of shorewall for options that include drop, logdrop, reject, or logreject
+# Values:  STRING
+blocktype = reject
@@ -1,8 +1,12 @@
-# Fail2Ban configuration file
+# Fail2Ban main configuration file
 #
-# Author: Cyril Jaquier
+# Comments: use '#' for comment lines and ';' (following a space) for inline comments
 #
-# $Revision$
+# Changes:  in most of the cases you should not modify this
+#           file, but provide customizations in fail2ban.local file, e.g.:
+#
+# [Definition]
+# loglevel = 4
 #

 [Definition]
@@ -20,6 +24,10 @@ loglevel = 3
 # Option:  logtarget
 # Notes.:  Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
 #          Only one log target can be specified.
+#          If you change logtarget from the default value and you are
+#          using logrotate -- also adjust or disable rotation in the
+#          corresponding configuration file
+#          (e.g. /etc/logrotate.d/fail2ban on Debian systems)
 # Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
 #
 logtarget = /var/log/fail2ban.log
@@ -32,3 +40,10 @@ logtarget = /var/log/fail2ban.log
 #
 socket = /var/run/fail2ban/fail2ban.sock

+# Option: pidfile
+# Notes.: Set the PID file. This is used to store the process ID of the
+#         fail2ban server.
+# Values: FILE  Default:  /var/run/fail2ban/fail2ban.pid
+#
+pidfile = /var/run/fail2ban/fail2ban.pid
+
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -5,18 +5,17 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
 #

 [Definition]

 badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider
-badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|DataCha0s/2\.0|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|MVAClient|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|sogou spider|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|WebVulnCrawl\.blogspot\.com/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
+badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|MVAClient|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|sogou spider|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|WebVulnCrawl\.blogspot\.com/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00

 # Option:  failregex
 # Notes.:  Regexp to catch known spambots and software alike. Please verify
 #          that it is your intent to block IPs which were driven by
-#          abovementioned bots.
+#          above mentioned bots.
 # Values:  TEXT
 #
 failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
@@ -2,7 +2,6 @@
 #
 # Author: Yaroslav O. Halchenko <debian@onerussian.com>
 #
-# $Revision$
 #

 [Definition]
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -2,7 +2,6 @@
 #
 # Author: Tim Connors
 #
-# $Revision$
 #

 [Definition]
@@ -0,0 +1,33 @@
+# Fail2Ban configuration file
+# for Anti-Spam SMTP Proxy Server also known as ASSP
+#    Honmepage:   http://www.magicvillage.de/~Fritz_Borgstedt/assp/0003D91C-8000001C/
+#    ProjektSite: http://sourceforge.net/projects/assp/?source=directory
+#
+# Author: Enrico Labedzki (enrico.labedzki@deiwos.de)
+#
+
+[Definition] 
+
+# Option:  failregex
+# Notes.:  regex to match the SMTP failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+# Examples: Apr-27-13 02:33:09 Blocking 217.194.197.97 - too much AUTH errors (41);
+#           Dec-29-12 17:10:31 [SSL-out] 200.247.87.82 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
+#           Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded 
+__assp_actions = (dropping|refusing)
+
+failregex = <HOST> max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: [a-zA-Z0-9]+;$
+			<HOST> SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$
+			Blocking <HOST> - too much AUTH errors \(\d{,3}\);$
+
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
+
@@ -0,0 +1,38 @@
+# Fail2Ban configuration file
+#
+# Author: Xavier Devlamynck
+#
+#
+
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - Wrong password$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - No matching peer found$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - Peer is not supposed to register$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - ACL error (permit/deny)$
+            NOTICE%(__pid_re)s <HOST> failed to authenticate as '.*'$
+            NOTICE%(__pid_re)s .*: No registration for peer '.*' \(from <HOST>\)$
+            NOTICE%(__pid_re)s .*: Host <HOST> failed MD5 authentication for '.*' (.*)$
+            NOTICE%(__pid_re)s .*: Failed to authenticate user .*@<HOST>.*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex =
@@ -3,7 +3,6 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
 #

 [INCLUDES]
@@ -28,14 +27,30 @@ __pid_re = (?:\[\d+\])
 # EXAMPLES: pam_rhosts_auth, [sshd], pop(pam_unix)
 __daemon_re = [\[\(]?%(_daemon)s(?:\(\S+\))?[\]\)]?:?

+# extra daemon info
+# EXAMPLE: [ID 800047 auth.info]
+__daemon_extra_re = (?:\[ID \d+ \S+\])
+
 # Combinations of daemon name and PID
 # EXAMPLES: sshd[31607], pop(pam_unix)[4920]
 __daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)

+# Some messages have a kernel prefix with a timestamp
+# EXAMPLES: kernel: [769570.846956]
+__kernel_prefix = kernel: \[\d+\.\d+\]
+
+__hostname = \S+
+
+
+# bsdverbose is where syslogd is started with -v or -vv and results in <4.3> or
+# <auth.info> appearing before the host as per testcases/files/logs/bsd/*.
+__bsd_syslog_verbose = (<[^.]+\.[^.]+>)
+
 #
 # Common line prefixes (beginnings) which could be used in filters
 #
-#       [hostname] [vserver tag] daemon_id spaces
-# this can be optional (for instance if we match named native log files)
-__prefix_line = \s*(?:\S+ )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*
+#      [bsdverbose]? [hostname] [vserver tag] daemon_id spaces
+#
+# This can be optional (for instance if we match named native log files)
+__prefix_line = \s*%(__bsd_syslog_verbose)s?\s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s%(__daemon_extra_re)s?\s*

@@ -3,7 +3,6 @@
 # Author: Christoph Haas
 # Modified by: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -2,7 +2,6 @@
 #
 # Author: Jan Wagner <waja@cyconet.org>
 #
-# $Revision$
 #

 [Definition]
@@ -2,7 +2,6 @@
 #
 # Author: Martin Waschbuesch
 #
-# $Revision: $
 #

 [Definition]
@@ -14,7 +13,8 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = .*(?:pop3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
+failregex = .*(?:pop3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*\s+rip=(?P<host>\S*),.*
+            pam.*dovecot.*(?:authentication failure).*\s+rhost=<HOST>(?:\s+user=.*)?\s*$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -3,7 +3,6 @@
 # Author: Francis Russell
 #         Zak B. Elep
 #
-# $Revision$
 #
 # More information: http://bugs.debian.org/546913

@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -15,6 +14,7 @@
 # Values:  TEXT
 #
 failregex = \[<HOST>\] .*(?:rejected by local_scan|Unrouteable address)
+             login authenticator failed for .* \[<HOST>\]: 535 Incorrect authentication data \(set_id=.*\)\s*$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -2,7 +2,6 @@
 #
 # Author: Kevin Zembower (copied from wsftpd.conf)
 #
-# $Revision$
 #

 [Definition]
@@ -0,0 +1,18 @@
+# Fail2Ban configuration file
+#
+# Author: Francois Boulogne <fboulogne@april.org>
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match wrong passwords as notified by lighttpd's auth Module
+# Values:  TEXT
+#
+failregex = .*http_auth.*(password doesn\'t match|wrong password).*IP: <HOST>\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -0,0 +1,31 @@
+# Fail2Ban configuration file for unsuccesfull MySQL authentication attempts
+#
+# Authors: Artur Penttinen
+#          Yaroslav O. Halchenko
+#
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+
+[Definition]
+
+#_daemon = mysqld
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values:  TEXT
+# 130322 11:26:54 [Warning] Access denied for user 'root'@'127.0.0.1' (using password: YES)
+failregex = Access denied for user '\w+'@'<HOST>' (to database '[^']*'|\(using password: (YES|NO)\))*\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -4,7 +4,6 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
 #

 [Definition]
@@ -26,7 +25,7 @@ __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT
 #
-failregex = %(__line_prefix)sclient <HOST>#.+: query(?: \(cache\))? '.*' denied\s*$
+failregex = %(__line_prefix)sclient <HOST>#\S+: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -2,7 +2,6 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision:  $
 #

 [Definition]
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -15,6 +14,7 @@
 # Values:  TEXT
 #
 failregex = reject: RCPT from (.*)\[<HOST>\]: 554
+            reject: RCPT from (.*)\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -2,7 +2,6 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
 #

 [Definition]
@@ -3,7 +3,6 @@
 # Author: Cyril Jaquier
 # Modified: Yaroslav Halchenko for pure-ftpd
 #
-# $Revision: 3$
 #

 [Definition]
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -0,0 +1,38 @@
+# Fail2Ban configuration file
+#
+# Author: Tom Hendrikx, modifications by Amir Caspi 
+# 
+# This filter monitors the fail2ban log file, and enables you to add long 
+# time bans for ip addresses that get banned by fail2ban multiple times.
+# Reasons to use this: block very persistent attackers for a longer time, 
+# stop receiving email notifications about the same attacker over and 
+# over again.
+#
+# This jail is only useful if you set the 'findtime' and 'bantime' parameters 
+# in jail.conf to a higher value than the other jails. Also, this jail has its
+# drawbacks, namely in that it works only with iptables, or if you use a 
+# different blocking mechanism for this jail versus others (e.g. hostsdeny 
+# for most jails, and shorewall for this one).
+#
+
+[Definition]
+
+# The name of the jail that this filter is used for. In jail.conf, name the 
+# jail using this filter 'recidive', or change this line!
+_jailname = recidive
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = fail2ban.actions:\s+WARNING\s+\[(?:.*)\]\s+Ban\s+<HOST>
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+# Ignore our own bans, to keep our counts exact.
+ignoreregex = fail2ban.actions:\s+WARNING\s+\[%(_jailname)s\]\s+Ban\s+<HOST>
@@ -0,0 +1,22 @@
+# Fail2Ban configuration file for roundcube web server
+#
+# Author: Teodor Micu & Yaroslav Halchenko
+#
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values:  TEXT
+#
+failregex = FAILED login for .*. from <HOST>\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
@@ -2,7 +2,6 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
 #

 [Definition]
@@ -14,7 +13,7 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values: TEXT
 #
-failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?$
+failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -2,7 +2,6 @@
 #
 # Author: Jan Wagner <waja@cyconet.org>
 #
-# $Revision$
 #

 [Definition]
@@ -0,0 +1,20 @@
+# /etc/fail2ban/filter.d/sogo-auth.conf
+#
+# Fail2Ban configuration file
+# By Arnd Brandes
+# SOGo
+#
+
+[Definition]
+# Option: failregex
+# Filter Ban in /var/log/sogo/sogo.log
+# Note: the error log may contain multiple hosts, whereas the first one 
+# is the client and all others are poxys. We match the first one, only
+
+failregex = Login from '<HOST>' for user '.*' might not have worked( - password policy: \d*  grace: -?\d*  expire: -?\d*  bound: -?\d*)?\s*$
+
+# Option: ignoreregex
+# Notes.: regex to ignore. If this regex matches, the line is ignored.
+# Values: TEXT
+#
+ignoreregex = 
@@ -2,11 +2,24 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
+# The regex here also relates to a exploit:
 #
+#  http://www.securityfocus.com/bid/17958/exploit
+#  The example code here shows the pushing of the exploit straight after
+#  reading the server version. This is where the client version string normally
+#  pushed. As such the server will read this unparsible information as
+#  "Did not receive identification string".
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf

 [Definition]

+_daemon = sshd
+
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
@@ -14,7 +27,7 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = sshd(?:\[\d+\])?: Did not receive identification string from <HOST>$
+failregex = ^%(__prefix_line)sDid not receive identification string from <HOST>\s*$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [INCLUDES]
@@ -23,16 +22,17 @@ _daemon = sshd
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
+failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error) for .* from <HOST>( via \S+)?\s*$
            ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
-            ^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
+            ^%(__prefix_line)sFailed \S+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?\s*$
            ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
            ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
-            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$
-            ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
+            ^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$
+            ^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$
+            ^%(__prefix_line)sUser .+ from <HOST> not allowed because not in any group\s*$
            ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
-            ^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\s*$
-            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$
+            ^%(__prefix_line)sUser .+ from <HOST> not allowed because a group is listed in DenyGroups\s*$
+            ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #

 [Definition]
@@ -3,7 +3,6 @@
 # Author: Cyril Jaquier
 # Rule by : Delvit Guillaume
 #
-# $Revision$
 #

 [Definition]
@@ -18,8 +17,8 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = webmin.* Non-existent login as .+ from <HOST>$
-            webmin.* Invalid login as .+ from <HOST>$
+failregex = webmin.* Non-existent login as .+ from <HOST>\s*$
+            webmin.* Invalid login as .+ from <HOST>\s*$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -2,7 +2,6 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
 #

 [Definition]
@@ -12,6 +11,7 @@
 # Values: TEXT
 #
 failregex = wu-ftpd(?:\[\d+\])?:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>$
+            wu-ftpd(?:\[\d+\])?: *failed login from .*\[<HOST>\] *$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -2,7 +2,6 @@
 #
 # Author: Guido Bozzetto
 #
-# $Revision$
 #

 [Definition]
@@ -1,8 +1,15 @@
-# Fail2Ban configuration file
+# Fail2Ban jail specifications file
 #
-# Author: Cyril Jaquier
+# Comments: use '#' for comment lines and ';' (following a space) for inline comments
 #
-# $Revision$
+# Changes:  in most of the cases you should not modify this
+#           file, but provide customizations in jail.local file, e.g.:
+#
+# [DEFAULT]
+# bantime = 3600
+#
+# [ssh-iptables]
+# enabled = true
 #

 # The DEFAULT allows a global definition of the options. They can be overridden
@@ -25,16 +32,29 @@ findtime  = 600
 # "maxretry" is the number of failures before a host get banned.
 maxretry = 3

-# "backend" specifies the backend used to get files modification. Available
-# options are "gamin", "polling" and "auto". This option can be overridden in
-# each jail too (use "gamin" for a jail and "polling" for another).
+# "backend" specifies the backend used to get files modification.
+# Available options are "pyinotify", "gamin", "polling" and "auto".
+# This option can be overridden in each jail as well.
 #
-# gamin:   requires Gamin (a file alteration monitor) to be installed. If Gamin
-#          is not installed, Fail2ban will use polling.
-# polling: uses a polling algorithm which does not require external libraries.
-# auto:    will choose Gamin if available and polling otherwise.
+# pyinotify: requires pyinotify (a file alteration monitor) to be installed.
+#              If pyinotify is not installed, Fail2ban will use auto.
+# gamin:     requires Gamin (a file alteration monitor) to be installed.
+#              If Gamin is not installed, Fail2ban will use auto.
+# polling:   uses a polling algorithm which does not require external libraries.
+# auto:      will try to use the following backends, in order:
+#              pyinotify, gamin, polling.
 backend = auto

+# "usedns" specifies if jails should trust hostnames in logs,
+#   warn when DNS lookups are performed, or ignore all hostnames in logs
+#
+# yes:   if a hostname is encountered, a DNS lookup will be performed.
+# warn:  if a hostname is encountered, a DNS lookup will be performed,
+#        but it will be logged as a warning.
+# no:    if a hostname is encountered, will not be used for banning,
+#        but it will be logged as info.
+usedns = warn
+

 # This jail corresponds to the standard configuration in Fail2ban 0.6.
 # The mail-whois action send a notification e-mail with a whois request
@@ -69,6 +89,13 @@ action   = iptables[name=sasl, port=smtp, protocol=tcp]
           sendmail-whois[name=sasl, dest=you@example.com]
 logpath  = /var/log/mail.log

+# ASSP SMTP Proxy Jail
+[assp]
+enabled  = false
+filter   = assp
+action = iptables-multiport[name=assp,port="25,465,587"]
+logpath  = /root/path/to/assp/logs/maillog.txt
+
 # Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
 # used to avoid banning the user "myuser".

@@ -81,6 +108,50 @@ action      = hostsdeny
 ignoreregex = for myuser from
 logpath     = /var/log/sshd.log

+# Here we use blackhole routes for not requiring any additional kernel support
+# to store large volumes of banned IPs
+
+[ssh-route]
+
+enabled = false
+filter = sshd
+action = route
+logpath = /var/log/sshd.log
+maxretry = 5
+
+# Here we use a combination of Netfilter/Iptables and IPsets
+# for storing large volumes of banned IPs
+#
+# IPset comes in two versions. See ipset -V for which one to use
+# requires the ipset package and kernel support.
+[ssh-iptables-ipset4]
+
+enabled  = false
+filter   = sshd
+action   = iptables-ipset-proto4[name=SSH, port=ssh, protocol=tcp]
+logpath  = /var/log/sshd.log
+maxretry = 5
+
+[ssh-iptables-ipset6]
+enabled  = false
+filter   = sshd
+action   = iptables-ipset-proto6[name=SSH, port=ssh, protocol=tcp, bantime=600]
+logpath  = /var/log/sshd.log
+maxretry = 5
+
+# bsd-ipfw is ipfw used by BSD. It uses ipfw tables.
+# table number must be unique.
+# 
+# This will create a deny rule for that table ONLY if a rule 
+# for the table doesn't ready exist.
+#
+[ssh-bsd-ipfw]
+enabled  = false
+filter   = sshd
+action   = bsd-ipfw[port=ssh,table=1]
+logpath  = /var/log/auth.log
+maxretry = 5
+
 # This jail demonstrates the use of wildcards in "logpath".
 # Moreover, it is possible to give other files on a new line.

@@ -152,6 +223,29 @@ action   = shorewall
           sendmail[name=Postfix, dest=you@example.com]
 logpath  = /var/log/apache2/error_log

+# Monitor roundcube server
+
+[roundcube-iptables]
+
+enabled  = false
+filter   = roundcube-auth
+action   = iptables[name=RoundCube, port="http,https"]
+logpath  = /var/log/roundcube/userlogins
+
+
+# Monitor SOGo groupware server
+
+[sogo-iptables]
+
+enabled  = false
+filter   = sogo-auth
+port     = http, https
+# without proxy this would be:
+# port    = 20000
+
+action   = iptables[name=SOGo, port="http,https"]
+logpath  = /var/log/sogo/sogo.log
+
 # Ban attackers that try to use PHP's URL-fopen() functionality
 # through GET/POST variables. - Experimental, with more than a year
 # of usage in production environments.
@@ -180,6 +274,18 @@ filter  = lighttpd-fastcgi
 logpath = /var/log/lighttpd/error.log
 maxretry = 2

+# Same as above for mod_auth
+# It catches wrong authentications
+
+[lighttpd-auth]
+
+enabled = false
+port    = http,https
+filter  = lighttpd-auth
+# adapt the following two items as needed
+logpath = /var/log/lighttpd/error.log
+maxretry = 2
+
 # This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
 # option is overridden in this jail. Moreover, the action "mail-whois" defines
 # the variable "name" which contains a comma using "". The characters '' are
@@ -239,3 +345,62 @@ action   = iptables-multiport[name=Named, port="domain,953", protocol=tcp]
 logpath  = /var/log/named/security.log
 ignoreip = 168.192.0.1

+# Multiple jails, 1 per protocol, are necessary ATM:
+# see https://github.com/fail2ban/fail2ban/issues/37
+[asterisk-tcp]
+
+enabled  = false
+filter   = asterisk
+action   = iptables-multiport[name=asterisk-tcp, port="5060,5061", protocol=tcp]
+           sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com]
+logpath  = /var/log/asterisk/messages
+maxretry = 10
+
+[asterisk-udp]
+
+enabled  = false
+filter	 = asterisk
+action   = iptables-multiport[name=asterisk-udp, port="5060,5061", protocol=udp]
+           sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com]
+logpath  = /var/log/asterisk/messages
+maxretry = 10
+
+# To log wrong MySQL access attempts add to /etc/my.cnf:
+# log-error=/var/log/mysqld.log
+# log-warning = 2
+[mysqld-iptables]
+
+enabled  = false
+filter   = mysqld-auth
+action   = iptables[name=mysql, port=3306, protocol=tcp]
+           sendmail-whois[name=MySQL, dest=root, sender=fail2ban@example.com]
+logpath  = /var/log/mysqld.log
+maxretry = 5
+
+
+# Jail for more extended banning of persistent abusers
+# !!! WARNING !!!
+#   Make sure that your loglevel specified in fail2ban.conf/.local
+#   is not at DEBUG level -- which might then cause fail2ban to fall into
+#   an infinite loop constantly feeding itself with non-informative lines
+[recidive]
+
+enabled  = false
+filter   = recidive
+logpath  = /var/log/fail2ban.log
+action   = iptables-allports[name=recidive]
+           sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log]
+bantime  = 604800  ; 1 week
+findtime = 86400   ; 1 day
+maxretry = 5
+
+# PF is a BSD based firewall
+[ssh-pf]
+
+enabled=false
+filter = sshd
+action = pf
+logpath  = /var/log/sshd.log
+maxretry=5
+
+
@@ -0,0 +1,92 @@
+Fail2ban normally requires root privileges to insert iptables rules
+through calls to /sbin/iptables and also to read the logfiles.
+Fail2ban can run as an unprivileged user provided that those two
+capabilities are preserved. The idea is to run fail2ban as a normal
+user (e.g. fail2ban) who belongs to a group which is allowed to read
+logfiles. The user should also be allowed to write to
+/proc/net/xt_recent/fail2ban-<name> (name is specified in the iptables
+rule).
+
+/proc/net/xt_recent/* is created by the xt_recent kernel module when
+an iptables rule with '-m limit' is inserted. This file contains a
+dynamic list of IP addresses which can than be used in iptables rules.
+Addresses can be matched against this list, with an optional timeout.
+One way to use xt_recent is to insert IPs into this list from an
+iptables rule, e.g. after connecting to the SSH port three times in a
+minute. This is the standard usage described in iptables(3).
+
+Another way to use xt_recent is by inserting the rules by writing to
+/proc/net/xt_recent/fail2ban-<name>. This can be performed by a fail2ban
+action. Files in /proc/net/xt_recent/ are protected by normal
+filesystem rules, so can be chown'ed and chmod'ed to be writable by a
+certain user. After the necessary iptables rules are inserted (which
+requires root privileges), blacklisting can be performed by an
+unprivileged user.
+
+Using fail2ban with xt_recent allows smarter filtering than normal
+iptables rules with the xt_recent module can provide.
+
+The disadvantage is that fail2ban cannot perform the setup by itself,
+which would require the privilege to call /sbin/iptables, and it must
+be done through other means.
+
+The primary advantage is obvious: it's generally better to run
+services not as root. This setup is more robust, because xt_recent has
+it's own memory management and should behave smartly in case a very
+large amount of IPs is blocked. Also in case the fail2ban process dies
+the rules expire automatically. In case of a large amount of blocked
+IPs, traversing rules linearly for each SYN packet as fail2ban
+normally inserts them will be slow, but xt_recent with the same number
+of IPs would be much faster. (Didn't test this, so this is pure
+handwaving, but it should really be this way ;)) From the
+administrators point of view, a setup with xt_recent might also be
+easier, because it's very simple to modify the permissions on
+/proc/net/xt_recent/fail2ban-<name> to be readable or writable by
+some user and thus allow delisting IPs by helper administrators
+without the ability to mess up other iptables rules.
+
+The xt_recent-echo jail can be used under the root user without
+further configuration. To run not as root, further setup is necessary:
+
+- Create user:
+
+  - set FAIL2BAN_USER in /etc/default/fail2ban.
+
+    This probably should be fail2ban.
+
+  - add user fail2ban who can read /var/log/auth.log and other
+    necessary log files. Log files are owned by group 'adm', so
+    it is enough if this user belongs to this group.
+
+    The user can be created e.g. with
+
+     useradd --system --no-create-home --home-dir / --groups adm fail2ban
+
+- Statically initialize chains firewall:
+
+  - put a rule to check the xt_recent list in the static firewall initialization
+    script, with names like fail2ban-ssh (action uses separate chains per each
+    jail, so define here the ones you need 1-per-jail)
+
+    Sample invocation might be
+
+     iptables -I INPUT -m recent --update --seconds 3600 --name fail2ban-<name> -j DROP
+
+    with <name> suitably replaced.
+
+  - suppress actionstart for iptables-xt_recent-echo action by creating an override file
+    iptables-xt_recent-echo.local to accompany iptables-xt_recent-echo.conf with
+
+     [Definition]
+     actionstart =
+
+- Permissions:
+
+  make sure that configuration files under /etc/fail2ban are readable by
+  fail2ban user. Make sure that logfiles of fail2ban itself are writable
+  by the fail2ban user. /etc/init.d/fail2ban will change the ownership at
+  startup, but it is also necessary to modify /etc/logrotate.d/fail2ban.
+
+  The simplest way is to replace '# create ...' with the following
+    # create 640 fail2ban adm
+
@@ -1,4 +1,7 @@
 #!/usr/bin/python
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -13,15 +16,9 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

@@ -30,10 +27,13 @@ import getopt, time, shlex, socket

 # Inserts our own modules path first in the list
 # fix for bug #343821
-sys.path.insert(1, "/usr/share/fail2ban")
+try:
+	from common.version import version
+except ImportError, e:
+	sys.path.insert(1, "/usr/share/fail2ban")
+	from common.version import version

-# Now we can import our modules
-from common.version import version
+# Now we can import the rest of modules
 from common.protocol import printFormatted
 from client.csocket import CSocket
 from client.configurator import Configurator
@@ -62,17 +62,18 @@ class Fail2banClient:
 		self.__conf["verbose"] = 1
 		self.__conf["interactive"] = False
 		self.__conf["socket"] = None
-		
+		self.__conf["pidfile"] = None
+
 	def dispVersion(self):
 		print "Fail2Ban v" + version
 		print
-		print "Copyright (c) 2004-2008 Cyril Jaquier"
+		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
 		print "Copyright of modifications held by their respective authors."
 		print "Licensed under the GNU General Public License v2 (GPL)."
 		print
 		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
 		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
-	
+
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
@@ -84,6 +85,7 @@ class Fail2banClient:
 		print "Options:"
 		print "    -c <DIR>                configuration directory"
 		print "    -s <FILE>               socket path"
+		print "    -p <FILE>               pidfile path"
 		print "    -d                      dump configuration. For debugging"
 		print "    -i                      interactive mode"
 		print "    -v                      increase verbosity"
@@ -93,17 +95,17 @@ class Fail2banClient:
 		print "    -V, --version           print the version"
 		print
 		print "Command:"
-		
+
 		# Prints the protocol
 		printFormatted()
-		
+
 		print
-		print "Report bugs to <cyril.jaquier@fail2ban.org>"
-	
+		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
+
 	def dispInteractive(self):
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
-		print 
+		print

 	def __sigTERMhandler(self, signum, frame):
 		# Print a new line because we probably come from wait
@@ -119,6 +121,8 @@ class Fail2banClient:
 				self.__conf["conf"] = opt[1]
 			elif opt[0] == "-s":
 				self.__conf["socket"] = opt[1]
+			elif opt[0] == "-p":
+				self.__conf["pidfile"] = opt[1]
 			elif opt[0] == "-d":
 				self.__conf["dump"] = True
 			elif opt[0] == "-v":
@@ -130,15 +134,15 @@ class Fail2banClient:
 			elif opt[0] == "-i":
 				self.__conf["interactive"] = True
 			elif opt[0] in ["-h", "--help"]:
-	 			self.dispUsage()
-	 			sys.exit(0)
-	 		elif opt[0] in ["-V", "--version"]:
-	 			self.dispVersion()
-	 			sys.exit(0)
-	
+				self.dispUsage()
+				sys.exit(0)
+			elif opt[0] in ["-V", "--version"]:
+				self.dispVersion()
+				sys.exit(0)
+
 	def __ping(self):
 		return self.__processCmd([["ping"]], False)
-	
+
 	def __processCmd(self, cmd, showRet = True):
 		beautifier = Beautifier()
 		for c in cmd:
@@ -163,7 +167,7 @@ class Fail2banClient:
 					logSys.error(e)
 				return False
 		return True
-		
+
 	##
 	# Process a command line.
 	#
@@ -181,8 +185,21 @@ class Fail2banClient:
 				# Do not continue if configuration is not 100% valid
 				if not ret:
 					return False
+				# verify that directory for the socket file exists
+				socket_dir = os.path.dirname(self.__conf["socket"])
+				if not os.path.exists(socket_dir):
+					logSys.error(
+						"There is no directory %s to contain the socket file %s."
+						% (socket_dir, self.__conf["socket"]))
+					return False
+				if not os.access(socket_dir, os.W_OK | os.X_OK):
+					logSys.error(
+						"Directory %s exists but not accessible for writing"
+						% (socket_dir,))
+					return False
 				# Start the server
 				self.__startServerAsync(self.__conf["socket"],
+										self.__conf["pidfile"],
 										self.__conf["force"])
 				try:
 					# Wait for the server to start
@@ -191,10 +208,10 @@ class Fail2banClient:
 					self.__processCmd(self.__stream, False)
 					return True
 				except ServerExecutionException:
-					logSys.error("Could not start server. Maybe an old " +
-								 "socket file is still present. Try to " +
-								 "remove " + self.__conf["socket"] + ". If " +
-								 "you used fail2ban-client to start the " +
+					logSys.error("Could not start server. Maybe an old "
+								 "socket file is still present. Try to "
+								 "remove " + self.__conf["socket"] + ". If "
+								 "you used fail2ban-client to start the "
 								 "server, adding the -x option will do it")
 					return False
 		elif len(cmd) == 1 and cmd[0] == "reload":
@@ -224,14 +241,14 @@ class Fail2banClient:
 				return False
 		else:
 			return self.__processCmd([cmd])
-	
-	
+
+
 	##
 	# Start Fail2Ban server.
 	#
 	# Start the Fail2ban server in daemon mode.
-	
-	def __startServerAsync(self, socket, force = False):
+
+	def __startServerAsync(self, socket, pidfile, force = False):
 		# Forks the current process.
 		pid = os.fork()
 		if pid == 0:
@@ -242,22 +259,26 @@ class Fail2banClient:
 			# Set the socket path.
 			args.append("-s")
 			args.append(socket)
+			# Set the pidfile
+			args.append("-p")
+			args.append(pidfile)
 			# Force the execution if needed.
 			if force:
 				args.append("-x")
 			try:
 				# Use the current directory.
 				exe = os.path.abspath(os.path.join(sys.path[0], self.SERVER))
+				logSys.debug("Starting %r with args %r" % (exe, args))
 				os.execv(exe, args)
 			except OSError:
 				try:
 					# Use the PATH env.
+					logSys.warning("Initial start attempt failed.  Starting %r with the same args" % (self.SERVER,))
 					os.execvp(self.SERVER, args)
 				except OSError:
-					print "Could not find %s" % self.SERVER
+					logSys.error("Could not start %s" % self.SERVER)
 					os.exit(-1)
-						
-			
+
 	def __waitOnServer(self):
 		# Wait for the server to start
 		cnt = 0
@@ -276,7 +297,7 @@ class Fail2banClient:
 					delta = -1
 				elif pos < 2:
 					delta = 1
-			# The server has 30 secondes to start.
+			# The server has 30 seconds to start.
 			if cnt >= 300:
 				if self.__conf["verbose"] > 1:
 					sys.stdout.write('\n')
@@ -285,27 +306,27 @@ class Fail2banClient:
 			cnt += 1
 		if self.__conf["verbose"] > 1:
 			sys.stdout.write('\n')
-			
-	
+
+
 	def start(self, argv):
 		# Command line options
 		self.__argv = argv
-		
+
 		# Install signal handlers
 		signal.signal(signal.SIGTERM, self.__sigTERMhandler)
 		signal.signal(signal.SIGINT, self.__sigTERMhandler)
-		
+
 		# Reads the command line options.
 		try:
-			cmdOpts = 'hc:s:xdviqV'
+			cmdOpts = 'hc:s:p:xdviqV'
 			cmdLongOpts = ['help', 'version']
 			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
 			self.dispUsage()
 			return False
-			
+
 		self.__getCmdLineOptions(optList)
-		
+
 		verbose = self.__conf["verbose"]
 		if verbose <= 0:
 			logSys.setLevel(logging.ERROR)
@@ -325,19 +346,21 @@ class Fail2banClient:

 		# Set the configuration path
 		self.__configurator.setBaseDir(self.__conf["conf"])
-		
+
 		# Set socket path
 		self.__configurator.readEarly()
-		socket = self.__configurator.getEarlyOptions()
-		if self.__conf["socket"] == None:
-			self.__conf["socket"] = socket["socket"]
+		conf = self.__configurator.getEarlyOptions()
+		if self.__conf["socket"] is None:
+			self.__conf["socket"] = conf["socket"]
+		if self.__conf["pidfile"] is None:
+			self.__conf["pidfile"] = conf["pidfile"]
 		logSys.info("Using socket file " + self.__conf["socket"])

 		if self.__conf["dump"]:
 			ret = self.__readConfig()
 			self.dumpConfig(self.__stream)
 			return ret
-		
+
 		# Interactive mode
 		if self.__conf["interactive"]:
 			try:
@@ -357,7 +380,9 @@ class Fail2banClient:
 						if cmd == "exit" or cmd == "quit":
 							# Exit
 							return True
-						if not cmd == "":
+						if cmd == "help":
+							self.dispUsage()
+						elif not cmd == "":
 							self.__processCommand(shlex.split(cmd))
 			except (EOFError, KeyboardInterrupt):
 				print
@@ -376,14 +401,14 @@ class Fail2banClient:
 		self.__configurator.convertToProtocol()
 		self.__stream = self.__configurator.getConfigStream()
 		return ret
-	
+
 	def __readJailConfig(self, jail):
 		self.__configurator.readAll()
 		ret = self.__configurator.getOptions(jail)
 		self.__configurator.convertToProtocol()
 		self.__stream = self.__configurator.getConfigStream()
 		return ret
-	
+
 	#@staticmethod
 	def dumpConfig(cmd):
 		for c in cmd:
@@ -395,7 +420,7 @@ class Fail2banClient:
 class ServerExecutionException(Exception):
 	pass

-if __name__ == "__main__":
+if __name__ == "__main__": # pragma: no cover - can't test main
 	client = Fail2banClient()
 	# Exit with correct return value
 	if client.start(sys.argv):
@@ -1,4 +1,7 @@
 #!/usr/bin/python
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+#
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -13,27 +16,24 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2012 Yaroslav Halchenko"
 __license__ = "GPL"

 import getopt, sys, time, logging, os

 # Inserts our own modules path first in the list
 # fix for bug #343821
-sys.path.insert(1, "/usr/share/fail2ban")
+try:
+	from common.version import version
+except ImportError, e:
+	sys.path.insert(1, "/usr/share/fail2ban")
+	from common.version import version

 from client.configparserinc import SafeConfigParserWithIncludes
 from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
-from common.version import version
 from server.filter import Filter
 from server.failregex import RegexException

@@ -46,24 +46,28 @@ class RegexStat:
 		self.__stats = 0
 		self.__failregex = failregex
 		self.__ipList = list()
-	
+
+	def __str__(self):
+		return "%s(%r) %d failed: %s" \
+		  % (self.__class__, self.__failregex, self.__stats, self.__ipList)
+
 	def inc(self):
 		self.__stats += 1
-	
+
 	def getStats(self):
 		return self.__stats

 	def getFailRegex(self):
 		return self.__failregex
-	
+
 	def appendIP(self, value):
 		self.__ipList.extend(value)
-	
+
 	def getIPList(self):
 		return self.__ipList

 class Fail2banRegex:
-	
+
 	test = None

 	CONFIG_DEFAULTS = {'configpath' : "/etc/fail2ban/"}
@@ -72,6 +76,7 @@ class Fail2banRegex:
 		self.__filter = Filter(None)
 		self.__ignoreregex = list()
 		self.__failregex = list()
+		self.__verbose = False
 		# Setup logging
 		logging.getLogger("fail2ban").handlers = []
 		self.__hdlr = logging.StreamHandler(Fail2banRegex.test)
@@ -79,9 +84,10 @@ class Fail2banRegex:
 		formatter = logging.Formatter("%(message)s")
 		# tell the handler to use this format
 		self.__hdlr.setFormatter(formatter)
+		self.__logging_level = self.__verbose and logging.DEBUG or logging.WARN
 		logging.getLogger("fail2ban").addHandler(self.__hdlr)
 		logging.getLogger("fail2ban").setLevel(logging.ERROR)
-	
+
 	#@staticmethod
 	def dispVersion():
 		print "Fail2Ban v" + version
@@ -93,7 +99,7 @@ class Fail2banRegex:
 		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
 		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
 	dispVersion = staticmethod(dispVersion)
-	
+
 	#@staticmethod
 	def dispUsage():
 		print "Usage: "+sys.argv[0]+" [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]"
@@ -106,6 +112,7 @@ class Fail2banRegex:
 		print "Options:"
 		print "    -h, --help              display this help message"
 		print "    -V, --version           print the version"
+		print "    -v, --verbose           verbose output"
 		print
 		print "Log:"
 		print "    string                  a string representing a log line"
@@ -119,9 +126,9 @@ class Fail2banRegex:
 		print "    string                  a string representing an 'ignoreregex'"
 		print "    filename                path to a filter file (filter.d/sshd.conf)"
 		print
-		print "Report bugs to <cyril.jaquier@fail2ban.org>"
+		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
 	dispUsage = staticmethod(dispUsage)
-	
+
 	def getCmdLineOptions(self, optList):
 		""" Gets the command line options
 		"""
@@ -132,6 +139,8 @@ class Fail2banRegex:
 			elif opt[0] in ["-V", "--version"]:
 				self.dispVersion()
 				sys.exit(0)
+			elif opt[0] in ["-v", "--verbose"]:
+				self.__verbose = True

 	#@staticmethod
 	def logIsFile(value):
@@ -195,11 +204,11 @@ class Fail2banRegex:
 			print "Use regex line : " + stripReg
 			self.__failregex = [RegexStat(value)]
 		return True
-	
+
 	def testIgnoreRegex(self, line):
 		found = False
 		for regex in self.__ignoreregex:
-			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
+			logging.getLogger("fail2ban").setLevel(self.__logging_level)
 			try:
 				self.__filter.addIgnoreRegex(regex.getFailRegex())
 				try:
@@ -211,8 +220,8 @@ class Fail2banRegex:
 					return False
 			finally:
 				self.__filter.delIgnoreRegex(0)
-				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
-	
+				logging.getLogger("fail2ban").setLevel(self.__logging_level)
+
 	def testRegex(self, line):
 		found = False
 		for regex in self.__ignoreregex:
@@ -242,60 +251,37 @@ class Fail2banRegex:
 				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
 		for regex in self.__ignoreregex:
 					self.__filter.delIgnoreRegex(0)
-	
+
 	def printStats(self):
 		print
 		print "Results"
 		print "======="
 		print
-		
+
+		def print_failregexes(title, failregexes):
+			# Print title
+			total, out = 0, []
+			for cnt, failregex in enumerate(failregexes):
+				match = failregex.getStats()
+				total += match
+				if (match or self.__verbose):
+					out.append("|  %d) [%d] %s" % (cnt+1, match, failregex.getFailRegex()))
+			print "%s: %d total" % (title, total)
+			if len(out):
+				print "|- #) [# of hits] regular expression"
+				print '\n'.join(out)
+				print '`-'
+			print
+			return total
+
 		# Print title
-		cnt = 1
-		print "Failregex"
-		print "|- Regular expressions:"
-		for failregex in self.__failregex:
-			print "|  [" + str(cnt) + "] " + failregex.getFailRegex()
-			cnt += 1
-		cnt = 1
-		
-		print "|"
-		
-		# Print stats
-		cnt = 1
-		total = 0
-		print "`- Number of matches:"
-		for failregex in self.__failregex:
-			match = failregex.getStats()
-			total += match
-			print "   [" + str(cnt) + "] " + str(match) + " match(es)"
-			cnt += 1
-		
-		print
-		
-		# Print title
-		cnt = 1
-		print "Ignoreregex"
-		print "|- Regular expressions:"
-		for failregex in self.__ignoreregex:
-			print "|  [" + str(cnt) + "] " + failregex.getFailRegex()
-			cnt += 1
-		cnt = 1
-		
-		print "|"
-		
-		# Print stats
-		cnt = 1
-		print "`- Number of matches:"
-		for failregex in self.__ignoreregex:
-			match = failregex.getStats()
-			print "   [" + str(cnt) + "] " + str(match) + " match(es)"
-			cnt += 1
-		
-		print
+		total = print_failregexes("Failregex", self.__failregex)
+		_ = print_failregexes("Ignoreregex", self.__ignoreregex)
+
 		print "Summary"
 		print "======="
 		print
-		
+
 		if total == 0:
 			print "Sorry, no match"
 			print
@@ -304,49 +290,45 @@ class Fail2banRegex:
 			return False
 		else:
 			# Print stats
-			cnt = 1
 			print "Addresses found:"
-			for failregex in self.__failregex:
-				print "[" + str(cnt) + "]"
-				for ip in failregex.getIPList():
-					timeTuple = time.localtime(ip[1])
-					timeString = time.strftime("%a %b %d %H:%M:%S %Y", timeTuple)
-					if ip[2]:
-						dup = " (already matched)"
-					else:
-						dup = ""
-					print "    " + ip[0] + " (" + timeString + ")" + dup
-				cnt += 1
-			
+			for cnt, failregex in enumerate(self.__failregex):
+				if self.__verbose or len(failregex.getIPList()):
+					print "[%d]" % (cnt+1)
+					for ip in failregex.getIPList():
+						timeTuple = time.localtime(ip[1])
+						timeString = time.strftime("%a %b %d %H:%M:%S %Y", timeTuple)
+						print "    %s (%s)%s" % (
+							ip[0], timeString, ip[2] and " (already matched)" or "")
 			print
-			
+
 			print "Date template hits:"
 			for template in self.__filter.dateDetector.getTemplates():
-				print `template.getHits()` + " hit(s): " + template.getName()
-			
+				if self.__verbose or template.getHits():
+					print `template.getHits()` + " hit(s): " + template.getName()
 			print
-			
+
 			print "Success, the total number of match is " + str(total)
 			print
 			print "However, look at the above section 'Running tests' which could contain important"
 			print "information."
 			return True

-			
+
 if __name__ == "__main__":
 	fail2banRegex = Fail2banRegex()
 	# Reads the command line options.
 	try:
-		cmdOpts = 'hV'
-		cmdLongOpts = ['help', 'version']
+		cmdOpts = 'hVcv'
+		cmdLongOpts = ['help', 'version', 'verbose']
 		optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
 	except getopt.GetoptError:
 		fail2banRegex.dispUsage()
 		sys.exit(-1)
 	# Process command line
 	fail2banRegex.getCmdLineOptions(optList)
-	# We need exactly 3 parameters
-	if not len(sys.argv) in (3, 4):
+
+	# We need 2 or 3 parameters
+	if not len(args) in (2, 3):
 		fail2banRegex.dispUsage()
 		sys.exit(-1)
 	else:
@@ -355,17 +337,17 @@ if __name__ == "__main__":
 		print "============="
 		print

-		if len(sys.argv) == 4:
-			if fail2banRegex.readIgnoreRegex(sys.argv[3]) == False:
-				sys.exit(-1)
+		cmd_log, cmd_regex = args[:2]

-		if fail2banRegex.readRegex(sys.argv[2]) == False:
-			sys.exit(-1)
+		if len(args) == 3:
+			fail2banRegex.readIgnoreRegex(args[2]) or sys.exit(-1)

-		if fail2banRegex.logIsFile(sys.argv[1]):
+		fail2banRegex.readRegex(cmd_regex) or sys.exit(-1)
+
+		if fail2banRegex.logIsFile(cmd_log):
 			try:
-				hdlr = open(sys.argv[1])
-				print "Use log file   : " + sys.argv[1]
+				hdlr = open(cmd_log)
+				print "Use log file   : " + cmd_log
 				print
 				for line in hdlr:
 					fail2banRegex.testIgnoreRegex(line)
@@ -376,15 +358,12 @@ if __name__ == "__main__":
 				sys.exit(-1)
 		else:
 			if len(sys.argv[1]) > 53:
-				stripLog = sys.argv[1][0:50] + "..."
+				stripLog = cmd_log[0:50] + "..."
 			else:
-				stripLog = sys.argv[1]
+				stripLog = cmd_log
 			print "Use single line: " + stripLog
 			print
-			fail2banRegex.testIgnoreRegex(sys.argv[1])
-			fail2banRegex.testRegex(sys.argv[1])
-		
-		if fail2banRegex.printStats():
-			sys.exit(0)
-		else:
-			sys.exit(-1)
+			fail2banRegex.testIgnoreRegex(cmd_log)
+			fail2banRegex.testRegex(cmd_log)
+
+		fail2banRegex.printStats() or sys.exit(-1)
@@ -1,4 +1,7 @@
 #!/usr/bin/python
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -13,25 +16,22 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

-import getopt, sys, logging
+import getopt, sys, logging, os

 # Inserts our own modules path first in the list
 # fix for bug #343821
-sys.path.insert(1, "/usr/share/fail2ban")
+try:
+	from common.version import version
+except ImportError, e:
+	sys.path.insert(1, "/usr/share/fail2ban")
+	from common.version import version

-from common.version import version
 from server.server import Server

 # Gets the instance of the logger.
@@ -46,7 +46,7 @@ logSys = logging.getLogger("fail2ban")
 # Its first goal was to protect a SSH server.

 class Fail2banServer:
-	
+
 	def __init__(self):
 		self.__server = None
 		self.__argv = None
@@ -54,17 +54,18 @@ class Fail2banServer:
 		self.__conf["background"] = True
 		self.__conf["force"] = False
 		self.__conf["socket"] = "/var/run/fail2ban/fail2ban.sock"
-	
+		self.__conf["pidfile"] = "/var/run/fail2ban/fail2ban.pid"
+
 	def dispVersion(self):
 		print "Fail2Ban v" + version
 		print
-		print "Copyright (c) 2004-2008 Cyril Jaquier"
+		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
 		print "Copyright of modifications held by their respective authors."
 		print "Licensed under the GNU General Public License v2 (GPL)."
 		print
 		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
 		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
-	
+
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
@@ -81,12 +82,13 @@ class Fail2banServer:
 		print "    -b                   start in background"
 		print "    -f                   start in foreground"
 		print "    -s <FILE>            socket path"
+		print "    -p <FILE>            pidfile path"
 		print "    -x                   force execution of the server (remove socket file)"
 		print "    -h, --help           display this help message"
 		print "    -V, --version        print the version"
 		print
-		print "Report bugs to <cyril.jaquier@fail2ban.org>"
-	
+		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
+
 	def __getCmdLineOptions(self, optList):
 		""" Gets the command line options
 		"""
@@ -97,6 +99,8 @@ class Fail2banServer:
 				self.__conf["background"] = False
 			if opt[0] == "-s":
 				self.__conf["socket"] = opt[1]
+			if opt[0] == "-p":
+				self.__conf["pidfile"] = opt[1]
 			if opt[0] == "-x":
 				self.__conf["force"] = True
 			if opt[0] in ["-h", "--help"]:
@@ -105,31 +109,33 @@ class Fail2banServer:
 			if opt[0] in ["-V", "--version"]:
 	 			self.dispVersion()
 				sys.exit(0)
-		
+
 	def start(self, argv):
 		# Command line options
 		self.__argv = argv
-		
+
 		# Reads the command line options.
 		try:
-			cmdOpts = 'bfs:xhV'
+			cmdOpts = 'bfs:p:xhV'
 			cmdLongOpts = ['help', 'version']
 			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
 			self.dispUsage()
 			sys.exit(-1)
-			
+
 		self.__getCmdLineOptions(optList)
-		
+
 		try:
 			self.__server = Server(self.__conf["background"])
-			self.__server.start(self.__conf["socket"], self.__conf["force"])
+			self.__server.start(self.__conf["socket"],
+								self.__conf["pidfile"],
+								self.__conf["force"])
 			return True
 		except Exception, e:
 			logSys.exception(e)
 			self.__server.quit()
 			return False
-		
+
 if __name__ == "__main__":
 	server = Fail2banServer()
 	if server.start(sys.argv):
@@ -1,4 +1,9 @@
 #!/usr/bin/python
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+"""Script to run Fail2Ban tests battery
+"""
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -13,20 +18,14 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2012- Yaroslav Halchenko"
 __license__ = "GPL"


-import unittest, logging, sys
+import unittest, logging, sys, time, os

 from common.version import version
 from testcases import banmanagertestcase
@@ -36,40 +35,194 @@ from testcases import filtertestcase
 from testcases import servertestcase
 from testcases import datedetectortestcase
 from testcases import actiontestcase
+from testcases import sockettestcase
+from testcases import misctestcase
+
+from testcases.utils import FormatterWithTraceBack
 from server.mytime import MyTime

-# Set the time to a fixed, known value
-# Sun Aug 14 12:00:00 CEST 2005
-MyTime.setTime(1124013600)
+from optparse import OptionParser, Option

-# Gets the instance of the logger.
+def get_opt_parser():
+	# use module docstring for help output
+	p = OptionParser(
+				usage="%s [OPTIONS] [regexps]\n" % sys.argv[0] + __doc__,
+				version="%prog " + version)
+
+	p.add_options([
+		Option('-l', "--log-level", type="choice",
+			   dest="log_level",
+			   choices=('debug', 'info', 'warn', 'error', 'fatal'),
+			   default=None,
+			   help="Log level for the logger to use during running tests"),
+		Option('-n', "--no-network", action="store_true",
+			   dest="no_network",
+			   help="Do not run tests that require the network"),
+		Option("-t", "--log-traceback", action='store_true',
+			   help="Enrich log-messages with compressed tracebacks"),
+		Option("--full-traceback", action='store_true',
+			   help="Either to make the tracebacks full, not compressed (as by default)"),
+
+		])
+
+	return p
+
+parser = get_opt_parser()
+(opts, regexps) = parser.parse_args()
+
+#
+# Logging
+#
 logSys = logging.getLogger("fail2ban")
+
+# Numerical level of verbosity corresponding to a log "level"
+verbosity = {'debug': 3,
+			 'info': 2,
+			 'warn': 1,
+			 'error': 1,
+			 'fatal': 0,
+			 None: 1}[opts.log_level]
+
+if opts.log_level is not None: # pragma: no cover
+	# so we had explicit settings
+	logSys.setLevel(getattr(logging, opts.log_level.upper()))
+else: # pragma: no cover
+	# suppress the logging but it would leave unittests' progress dots
+	# ticking, unless like with '-l fatal' which would be silent
+	# unless error occurs
+	logSys.setLevel(getattr(logging, 'FATAL'))
+
 # Add the default logging handler
 stdout = logging.StreamHandler(sys.stdout)
+
+fmt = ' %(message)s'
+
+if opts.log_traceback:
+	Formatter = FormatterWithTraceBack
+	fmt = (opts.full_traceback and ' %(tb)s' or ' %(tbc)s') + fmt
+else:
+	Formatter = logging.Formatter
+
+# Custom log format for the verbose tests runs
+if verbosity > 1: # pragma: no cover
+	stdout.setFormatter(Formatter(' %(asctime)-15s %(thread)s' + fmt))
+else: # pragma: no cover
+	# just prefix with the space
+	stdout.setFormatter(Formatter(fmt))
 logSys.addHandler(stdout)
-logSys.setLevel(logging.FATAL)

-print "Fail2ban " + version + " test suite. Please wait..."
+#
+# Let know the version
+#
+if not opts.log_level or opts.log_level != 'fatal': # pragma: no cover
+	print "Fail2ban %s test suite. Python %s. Please wait..." \
+	    % (version, str(sys.version).replace('\n', ''))

-tests = unittest.TestSuite()

-# Filter
-tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
-tests.addTest(unittest.makeSuite(filtertestcase.LogFile))
-tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
+#
+# Gather the tests
+#
+if not len(regexps): # pragma: no cover
+	tests = unittest.TestSuite()
+else: # pragma: no cover
+	import re
+	class FilteredTestSuite(unittest.TestSuite):
+		_regexps = [re.compile(r) for r in regexps]
+		def addTest(self, suite):
+			suite_str = str(suite)
+			for r in self._regexps:
+				if r.search(suite_str):
+					super(FilteredTestSuite, self).addTest(suite)
+					return
+
+	tests = FilteredTestSuite()
+
 # Server
 #tests.addTest(unittest.makeSuite(servertestcase.StartStop))
-#tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
+tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
+tests.addTest(unittest.makeSuite(servertestcase.JailTests))
 tests.addTest(unittest.makeSuite(actiontestcase.ExecuteAction))
 # FailManager
 tests.addTest(unittest.makeSuite(failmanagertestcase.AddFailure))
 # BanManager
 tests.addTest(unittest.makeSuite(banmanagertestcase.AddFailure))
-# ClientReader
+# ClientReaders
+tests.addTest(unittest.makeSuite(clientreadertestcase.ConfigReaderTest))
 tests.addTest(unittest.makeSuite(clientreadertestcase.JailReaderTest))
+tests.addTest(unittest.makeSuite(clientreadertestcase.JailsReaderTest))
+# CSocket and AsyncServer
+tests.addTest(unittest.makeSuite(sockettestcase.Socket))
+# Misc helpers
+tests.addTest(unittest.makeSuite(misctestcase.HelpersTest))
+tests.addTest(unittest.makeSuite(misctestcase.SetupTest))
+tests.addTest(unittest.makeSuite(misctestcase.TestsUtilsTest))
+
+# Filter
+if not opts.no_network:
+    tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
+tests.addTest(unittest.makeSuite(filtertestcase.LogFile))
+tests.addTest(unittest.makeSuite(filtertestcase.LogFileMonitor))
+if not opts.no_network:
+    tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
+    tests.addTest(unittest.makeSuite(filtertestcase.DNSUtilsTests))
+tests.addTest(unittest.makeSuite(filtertestcase.JailTests))
+
 # DateDetector
 tests.addTest(unittest.makeSuite(datedetectortestcase.DateDetectorTest))

-# Tests runner
-testRunner = unittest.TextTestRunner()
-testRunner.run(tests)
+#
+# Extensive use-tests of different available filters backends
+#
+
+from server.filterpoll import FilterPoll
+filters = [FilterPoll]					  # always available
+
+# Additional filters available only if external modules are available
+# yoh: Since I do not know better way for parametric tests
+#      with good old unittest
+try:
+	from server.filtergamin import FilterGamin
+	filters.append(FilterGamin)
+except Exception, e: # pragma: no cover
+	print "I: Skipping gamin backend testing. Got exception '%s'" % e
+
+try:
+	from server.filterpyinotify import FilterPyinotify
+	filters.append(FilterPyinotify)
+except Exception, e: # pragma: no cover
+	print "I: Skipping pyinotify backend testing. Got exception '%s'" % e
+
+for Filter_ in filters:
+	tests.addTest(unittest.makeSuite(
+		filtertestcase.get_monitor_failures_testcase(Filter_)))
+
+# Server test for logging elements which break logging used to support
+# testcases analysis
+tests.addTest(unittest.makeSuite(servertestcase.TransmitterLogging))
+
+#
+# Run the tests
+#
+testRunner = unittest.TextTestRunner(verbosity=verbosity)
+
+try:
+	# Set the time to a fixed, known value
+	# Sun Aug 14 12:00:00 CEST 2005
+	# yoh: we need to adjust TZ to match the one used by Cyril so all the timestamps match
+	old_TZ = os.environ.get('TZ', None)
+	os.environ['TZ'] = 'Europe/Zurich'
+	time.tzset()
+	MyTime.setTime(1124013600)
+
+	tests_results = testRunner.run(tests)
+
+finally: # pragma: no cover
+	# Just for the sake of it reset the TZ
+	# yoh: move all this into setup/teardown methods within tests
+	os.environ.pop('TZ')
+	if old_TZ:
+		os.environ['TZ'] = old_TZ
+	time.tzset()
+
+if not tests_results.wasSuccessful(): # pragma: no cover
+	sys.exit(1)
@@ -0,0 +1,18 @@
+#!/bin/bash
+# Simple helper script to exercise unittests using all available
+# (under /usr/bin and /usr/local/bin python2.*)
+
+set -eu
+
+failed=
+for python in /usr/{,local/}bin/python2.[0-9]{,.*}{,-dbg}
+do
+	[ -e "$python" ] || continue
+	echo "Testing using $python"
+	$python ./fail2ban-testcases "$@" || failed+=" $python"
+done
+
+if [ ! -z "$failed" ]; then
+	echo "E: Failed with $failed"
+	exit 1
+fi
@@ -0,0 +1,149 @@
+# fail2ban bash-completion                                 -*- shell-script -*-
+#
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+__fail2ban_jails () {
+    "$1" status 2>/dev/null | awk -F"\t+" '/Jail list/{print $2}' | sed 's/, / /g'
+}
+
+_fail2ban () {
+    local cur prev words cword
+    _init_completion || return 
+
+    case $prev in
+        -V|--version|-h|--help)
+            return 0 # No further completion valid
+            ;;
+        -c)
+            _filedir -d # Directories
+            return 0
+            ;;
+        -s|-p)
+            _filedir # Files
+            return 0
+            ;;
+        *)
+            if [[ "$cur" == "-"* ]];then
+                COMPREPLY=( $( compgen -W \
+                    "$( _parse_help "$1" --help 2>/dev/null) -V" \
+                     -- "$cur") )
+                return 0
+            fi
+            ;;
+    esac
+
+    if [[ "$1" == *"fail2ban-regex" ]];then
+        _filedir
+        return 0
+    elif [[ "$1" == *"fail2ban-client" ]];then
+        local cmd jail
+        case $prev in
+            "$1")
+                COMPREPLY=( $( compgen -W \
+                    "$( "$1" --help 2>/dev/null | awk '/^    [a-z]+/{print $1}')" \
+                    -- "$cur") )
+                return 0
+                ;;
+            start|reload|stop|status)
+                COMPREPLY=( $(compgen -W "$(__fail2ban_jails "$1")" -- "$cur" ) )
+                return 0
+                ;;
+            set|get)
+                COMPREPLY=( $( compgen -W \
+                    "$( "$1" --help 2>/dev/null | awk '/^    '$prev' [^<]/{print $2}')" \
+                    -- "$cur") )
+                COMPREPLY+=( $(compgen -W "$(__fail2ban_jails "$1")" -- "$cur" ) )
+                return 0
+                ;;
+            *)
+                if [[ "${words[$cword-2]}" == "add" ]];then
+                    COMPREPLY=( $( compgen -W "auto polling gamin pyinotify" -- "$cur" ) )
+                    return 0
+                elif [[ "${words[$cword-2]}" == "set" ||  "${words[$cword-2]}" == "get" ]];then
+                    cmd="${words[cword-2]}"
+                    # Handle in section below
+                elif [[ "${words[$cword-3]}" == "set" || "${words[$cword-3]}" == "get" ]];then
+                    cmd="${words[$cword-3]}"
+                    jail="${words[$cword-2]}"
+                    # Handle in section below
+                fi
+            ;;
+        esac
+
+        if [[ -z "$jail" && -n "$cmd" ]];then
+            case $prev in
+                loglevel)
+                    if [[ "$cmd" == "set" ]];then
+                        COMPREPLY=( $( compgen -W "0 1 2 3 4" -- "$cur" ) )
+                    fi
+                    return 0
+                    ;;
+                logtarget)
+                    if [[ "$cmd" == "set" ]];then
+                        COMPREPLY=( $( compgen -W "STDOUT STDERR SYSLOG" -- "$cur" ) )
+                        _filedir # And files
+                    fi
+                    return 0
+                    ;;
+                *) # Jail name
+                    COMPREPLY=( $( compgen -W \
+                        "$( "$1" --help 2>/dev/null | awk '/^    '${cmd}' <JAIL>/{print $3}')" \
+                        -- "$cur") )
+                    return 0
+                    ;;
+            esac
+        elif [[ -n "$jail" && "$cmd" == "set" ]];then
+            case $prev in
+                addlogpath)
+                    _filedir
+                    return 0
+                    ;;
+                dellogpath|delignoreip)
+                    COMPREPLY=( $( compgen -W \
+                        "$( "$1" get "$jail" "${prev/del/}" 2>/dev/null | awk -F- '{print $2}')" \
+                    -- "$cur" ) )
+                    if [[ -z "$COMPREPLY" && "$prev" == "dellogpath" ]];then
+                        _filedir
+                    fi
+                    return 0
+                    ;;
+                delfailregex|delignoregex)
+                    COMPREPLY=( $( compgen -W \
+                        "$( "$1" get "$jail" "${prev/del/}" 2>/dev/null | awk -F"[][]" '{print $2}')" \
+                    -- "$cur" ) )
+                    return 0
+                    ;;
+                unbanip)
+                    COMPREPLY=( $( compgen -W \
+                        "$( "$1" status "$jail" 2>/dev/null | awk -F"\t+" '/IP list:/{print $2}')" \
+                    -- "$cur" ) )
+                    return 0
+                    ;;
+                idle)
+                    COMPREPLY=( $( compgen -W "on off" -- "$cur" ) )
+                    return 0
+                    ;;
+                usedns)
+                    COMPREPLY=( $( compgen -W "yes no warn" -- "$cur" ) )
+                    return 0
+                    ;;
+            esac
+        fi
+
+    fi # fail2ban-client
+} &&
+complete -F _fail2ban fail2ban-client fail2ban-server fail2ban-regex
--- a/Show More
+++ b/Show More