fixed possible RCE vulnerability, unset escape variable (default tilde) stops consider "~" char after new-line as composing escape sequence

closes GHSA-m985-3f3v-cwmm for 0.9

.coveragerc

@@ -7,6 +7,5 @@ source =
 
 [report]
 exclude_lines =
-    pragma: ?no ?cover
-    pragma: ?${F2B_PY}.x no ?cover
-    pragma: ?systemd no ?cover
+    pragma: no cover
+    pragma: systemd no cover

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,11 +1,9 @@
 Before submitting your PR, please review the following checklist:
 
-- [ ] **CHOOSE CORRECT BRANCH**: if filing a bugfix/enhancement
-      against 0.9.x series, choose `master` branch
 - [ ] **CONSIDER adding a unit test** if your PR resolves an issue
 - [ ] **LIST ISSUES** this PR resolves
-- [ ] **MAKE SURE** this PR doesn't break existing tests
+- [ ] **MAKE SURE** this PR doesn't break existing tests 
 - [ ] **KEEP PR small** so it could be easily reviewed.
 - [ ] **AVOID** making unnecessary stylistic changes in unrelated code
-- [ ] **ACCOMPANY** each new `failregex` for filter `X` with sample log lines
-      within `fail2ban/tests/files/logs/X` file
+- [ ] **ACCOMPANY** each new `failregex` for filter `X` with sample log lines 
+      within `fail2ban/tests/files/logs/X` file

.travis.yml

@@ -1,37 +1,22 @@
 # vim ft=yaml
 # travis-ci.org definition for Fail2Ban build
 # https://travis-ci.org/fail2ban/fail2ban/
-
-#os: linux
-
 language: python
-dist: xenial
-
-matrix:
-  fast_finish: true
-  include:
-  - python: 2.6
-    dist: trusty   # required for Python 2.6
-  - python: 2.7
-    dist: trusty   # required for packages like gamin
-    name: 2.7 (trusty)
-  - python: 2.7
-    name: 2.7 (xenial)
-  - python: pypy
-    dist: trusty
-  - python: 3.3
-    dist: trusty
-  - python:  3.4
-  - python:  3.5
-  - python:  3.6
-  - python:  3.7
-  - python:  3.8-dev
-  - python:  pypy3.5
+python:
+  - 2.6
+  - 2.7
+  - pypy
+  # disabled until coverage module fixes up compatibility issue
+  # - 3.2
+  - 3.3
+  - 3.4
+  # disabled since setuptools dropped support for Python 3.0 - 3.2
+  # - pypy3
+  - pypy3.3-5.2-alpha1
 before_install:
   - echo "running under $TRAVIS_PYTHON_VERSION"
-  - if [[ $TRAVIS_PYTHON_VERSION == 2* || $TRAVIS_PYTHON_VERSION == pypy* && $TRAVIS_PYTHON_VERSION != pypy3* ]]; then export F2B_PY=2; fi
-  - if [[ $TRAVIS_PYTHON_VERSION == 3* || $TRAVIS_PYTHON_VERSION == pypy3* ]]; then export F2B_PY=3; fi
-  - echo "Set F2B_PY=$F2B_PY"
+  - if [[ $TRAVIS_PYTHON_VERSION == 2* || $TRAVIS_PYTHON_VERSION == pypy* && $TRAVIS_PYTHON_VERSION != pypy3* ]]; then export F2B_PY_2=true && echo "Set F2B_PY_2"; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 3* || $TRAVIS_PYTHON_VERSION == pypy3* ]]; then export F2B_PY_3=true && echo "Set F2B_PY_3"; fi
   - travis_retry sudo apt-get update -qq
   # Set this so sudo executes the correct python binary
   #   Anything not using sudo will already have the correct environment
@@ -40,43 +25,32 @@ install:
   # Install Python packages / dependencies
   #   coverage
   - travis_retry pip install coverage
-  #   coveralls (note coveralls doesn't support 2.6 now):
-  - if [[ $TRAVIS_PYTHON_VERSION != 2.6* ]]; then F2B_COV=1; else F2B_COV=0; fi
-  - if [[ "$F2B_COV" = 1 ]]; then travis_retry pip install coveralls; fi
-  #   codecov:
-  - travis_retry pip install codecov
+  #   coveralls
+  - travis_retry pip install coveralls codecov
   #   dnspython or dnspython3
-  - if [[ "$F2B_PY" = 2 ]]; then travis_retry pip install dnspython || echo 'not installed'; fi
-  - if [[ "$F2B_PY" = 3 ]]; then travis_retry pip install dnspython3 || echo 'not installed'; fi
-  #   python systemd bindings:
-  - if [[ "$F2B_PY" = 2 ]]; then travis_retry sudo apt-get install -qq python-systemd || echo 'not installed'; fi
-  - if [[ "$F2B_PY" = 3 ]]; then travis_retry sudo apt-get install -qq python3-systemd || echo 'not installed'; fi
+  - if [[ "$F2B_PY_2" ]]; then travis_retry pip install dnspython; fi
+  - if [[ "$F2B_PY_3" ]]; then travis_retry pip install dnspython3; fi
   #   gamin - install manually (not in PyPI) - travis-ci system Python is 2.7
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then (travis_retry sudo apt-get install -qq python-gamin && cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/) || echo 'not installed'; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then travis_retry sudo apt-get install -qq python-gamin && cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/; fi
   #   pyinotify
-  - travis_retry pip install pyinotify || echo 'not installed'
-  # Install helper tools
-  - sudo apt-get install shellcheck
+  - travis_retry pip install pyinotify
 before_script:
   # Manually execute 2to3 for now
-  - if [[ "$F2B_PY" = 3 ]]; then ./fail2ban-2to3; fi
-  # (debug) output current preferred encoding:
-  - python -c 'import locale, sys; from fail2ban.helpers import PREFER_ENC; print(PREFER_ENC, locale.getpreferredencoding(), (sys.stdout and sys.stdout.encoding))'
+  - if [[ "$F2B_PY_3" ]]; then ./fail2ban-2to3; fi
 script:
   # Keep the legacy setup.py test approach of checking coverage for python2
-  - if [[ "$F2B_PY" = 2 ]]; then coverage run setup.py test; fi
-  # Coverage doesn't pick up setup.py test with python3, so run it directly (with same verbosity as from setup)
-  - if [[ "$F2B_PY" = 3 ]]; then coverage run bin/fail2ban-testcases --verbosity=2; fi
+  - if [[ "$F2B_PY_2" ]]; then coverage run setup.py test; fi
+  # Coverage doesn't pick up setup.py test with python3, so run it directly
+  - if [[ "$F2B_PY_3" ]]; then coverage run bin/fail2ban-testcases; fi
   # Use $VENV_BIN (not python) or else sudo will always run the system's python (2.7)
   - sudo $VENV_BIN/pip install .
-  # Doc files should get installed on Travis under Linux (python >= 3.8 seem to use another path segment)
-  - if [[ $TRAVIS_PYTHON_VERSION < 3.8 ]]; then test -e /usr/share/doc/fail2ban/FILTERS; fi
-  # Test initd script
-  - shellcheck -s bash -e SC1090,SC1091 files/debian-initd
+  # Doc files should get installed on Travis under Linux
+  - test -e /usr/share/doc/fail2ban/FILTERS
 after_success:
-  - if [[ "$F2B_COV" = 1 ]]; then coveralls; fi
+  - coveralls
   - codecov
-
+matrix:
+  fast_finish: true
 # Might be worth looking into
 #notifications:
 #  email: true

ChangeLog

@@ -6,699 +6,6 @@
 Fail2Ban: Changelog
 ===================
 
-ver. 0.11.1 (2020/01/11) - this-is-the-way
------------
-
-### Compatibility:
-* to v.0.10:
-  - 0.11 is totally compatible to 0.10 (configuration- and API-related stuff), but the database
-    got some new tables and fields (auto-converted during the first start), so once updated to 0.11, you
-    have to remove the database /var/lib/fail2ban/fail2ban.sqlite3 (or its different to 0.10 schema)
-    if you would need to downgrade to 0.10 for some reason.
-* to v.0.9:
-  - Filter (or `failregex`) internal capture-groups:
-
-    * If you've your own `failregex` or custom filters using conditional match `(?P=host)`, you should
-      rewrite the regex like in example below resp. using `(?:(?P=ip4)|(?P=ip6)` instead of `(?P=host)`
-      (or `(?:(?P=ip4)|(?P=ip6)|(?P=dns))` corresponding your `usedns` and `raw` settings).
-
-      Of course you can always define your own capture-group (like below `_cond_ip_`) to do this.
-      ```
-      testln="1500000000 failure from 192.0.2.1: bad host 192.0.2.1"
-      fail2ban-regex "$testln" "^\s*failure from (?P<_cond_ip_><HOST>): bad host (?P=_cond_ip_)$"
-      ```
-    * New internal groups (currently reserved for internal usage):
-      `ip4`, `ip6`, `dns`, `fid`, `fport`, additionally `user` and another captures in lower case if
-      mapping from tag `<F-*>` used in failregex (e. g. `user` by `<F-USER>`).
-
-  - v.0.10 and 0.11 use more precise date template handling, that can be theoretically incompatible to some
-    user configurations resp. `datepattern`.
-
-  - Since v0.10 fail2ban supports the matching of IPv6 addresses, but not all ban actions are
-    IPv6-capable now.
-
-### Fixes
-* purge database will be executed now (within observer).
-* restoring currently banned ip after service restart fixed 
-  (now < timeofban + bantime), ignore old log failures (already banned)
-* upgrade database: update new created table `bips` with entries from table `bans` (allows restore
-  current bans after upgrade from version <= 0.10)
-
-### New Features
-* Increment ban time (+ observer) functionality introduced.
-* Database functionality extended with bad ips.
-* New tags (usable in actions):
-  - `<bancount>` - ban count of this offender if known as bad (started by 1 for unknown)
-  - `<bantime>` - current ban-time of the ticket (prolongation can be retarded up to 10 sec.)
-* Introduced new action command `actionprolong` to prolong ban-time (e. g. set new timeout if expected);
-  Several actions (like ipset, etc.) rewritten using net logic with `actionprolong`.
-  Note: because ban-time is dynamic, it was removed from jail.conf as timeout argument (check jail.local).
-
-### Enhancements
-* algorithm of restore current bans after restart changed: update the restored ban-time (and therefore 
-  end of ban) of the ticket with ban-time of jail (as maximum), for all tickets with ban-time greater
-  (or persistent); not affected if ban-time of the jail is unchanged between stop/start.
-* added new setup-option `--without-tests` to skip building and installing of tests files (gh-2287).
-* added new command `fail2ban-client get <JAIL> banip ?sep-char|--with-time?` to get the banned ip addresses (gh-1916).
-
-
-ver. 0.10.5 (2020/01/10) - deserve-more-respect-a-jedis-weapon-must
------------
-
-Yes, Hrrrm...
-
-### Fixes
-* [compatibility] systemd backend: default flags changed to SYSTEM_ONLY(4), fixed in gh-2444 in order to ignore
-  user session files per default, so could prevent "Too many open files" errors on a lot of user sessions (see gh-2392)
-* [grave] fixed parsing of multi-line filters (`maxlines` > 1) together with systemd backend,
-  now systemd-filter replaces newlines in message from systemd journal with `\n` (otherwise 
-  multi-line parsing may be broken, because removal of matched string from multi-line buffer window
-  is confused by such extra new-lines, so they are retained and got matched on every followed 
-  message, see gh-2431)
-* [stability] prevent race condition - no unban if the bans occur continuously (gh-2410);
-  now an unban-check will happen not later than 10 tickets get banned regardless there are
-  still active bans available (precedence of ban over unban-check is 10 now)
-* fixed read of included config-files (`.local` overwrites options of `.conf` for config-files 
-  included with before/after)
-* `action.d/abuseipdb.conf`: switched to use AbuseIPDB API v2 (gh-2302)
-* `action.d/badips.py`: fixed start of banaction on demand (which may be IP-family related), gh-2390
-* `action.d/helpers-common.conf`: rewritten grep arguments, now options `-wF` used to match only
-  whole words and fixed string (not as pattern), gh-2298
-* `filter.d/apache-auth.conf`:
-  - ignore errors from mod_evasive in `normal` mode (mode-controlled now) (gh-2548);
-  - extended with option `mode` - `normal` (default) and `aggressive`
-* `filter.d/sshd.conf`:
-  - matches `Bad protocol version identification` in `ddos` and `aggressive` modes (gh-2404).
-  - captures `Disconnecting ...: Change of username or service not allowed` (gh-2239, gh-2279)
-  - captures `Disconnected from ... [preauth]`, preauth phase only, different handling by `extra`
-    (with supplied user only) and `ddos`/`aggressive` mode (gh-2115, gh-2239, gh-2279)
-* `filter.d/mysqld-auth.conf`: 
-  - MYSQL 8.0.13 compatibility (log-error-verbosity = 3), log-format contains few additional words
-    enclosed in brackets after "[Note]" (gh-2314)
-* `filter.d/sendmail-reject.conf`:
-  - `mode=extra` now captures port IDs of `TLSMTA` and `MSA` (defaults for ports 465 and 587 on some distros)
-* `files/fail2ban.service.in`: fixed systemd-unit template - missing nftables dependency (gh-2313)
-* several `action.d/mail*`: fixed usage with multiple log files (ultimate fix for gh-976, gh-2341)
-* `filter.d/sendmail-reject.conf`: fixed journal usage for some systems (e. g. CentOS): if only identifier 
-  set to `sm-mta` (no unit `sendmail`) for some messages (gh-2385)
-* `filter.d/asterisk.conf`: asterisk can log additional timestamp if logs into systemd-journal
-  (regex extended with optional part matching this, gh-2383)
-* `filter.d/postfix.conf`:
-    - regexp's accept variable suffix code in status of postfix for precise messages (gh-2442)
-    - extended with new postfix filter mode `errors` to match "too many errors" (gh-2439),
-      also included within modes `normal`, `more` (`extra` and `aggressive`), since postfix
-      parameter `smtpd_hard_error_limit` is default 20 (additionally consider `maxretry`)
-* `filter.d/named-refused.conf`:
-    - support BIND 9.11.0 log format (includes an additional field @0xXXX..., gh-2406);
-    - `prefregex` extended, more selective now (denied/NOTAUTH suffix moved from failregex, so no catch-all there anymore)
-* `filter.d/sendmail-auth.conf`, `filter.d/sendmail-reject.conf` :
-  - ID in prefix can be longer as 14 characters (gh-2563);
-* all filters would accept square brackets around IPv4 addresses also (e. g. monit-filter, gh-2494)
-* avoids unhandled exception during flush (gh-2588)
-* fixes pass2allow-ftp jail - due to inverted handling, action should prohibit access per default for any IP,
-  therefore reset start on demand parameter for this action (it will be started immediately by repair);
-* auto-detection of IPv6 subsystem availability (important for not on-demand actions or jails, like pass2allow);
-
-### New Features
-* new replacement tags for failregex to match subnets in form of IP-addresses with CIDR mask (gh-2559):
-  - `<CIDR>` - helper regex to match CIDR (simple integer form of net-mask);
-  - `<SUBNET>` - regex to match sub-net adresses (in form of IP/CIDR, also single IP is matched, so part /CIDR is optional);
-* grouped tags (`<ADDR>`, `<HOST>`, `<SUBNET>`) recognize IP addresses enclosed in square brackets
-* new failregex-flag tag `<F-MLFGAINED>` for failregex, signaled that the access to service was gained
-  (ATM used similar to tag `<F-NOFAIL>`, but it does not add the log-line to matches, gh-2279)
-* filters: introduced new configuration parameter `logtype` (default `file` for file-backends, and 
-  `journal` for journal-backends, gh-2387); can be also set to `rfc5424` to force filters (which include common.conf)
-  to use RFC 5424 conform prefix-line per default (gh-2467);
-* for better performance and safety the option `logtype` can be also used to
-  select short prefix-line for file-backends too for all filters using `__prefix_line` (`common.conf`),
-  if message logged only with `hostname svc[nnnn]` prefix (often the case on several systems):
-```ini
-[jail]
-backend = auto
-filter = flt[logtype=short]
-```
-* `filter.d/common.conf`: differentiate `__prefix_line` for file/journal logtype's (speedup and fix parsing
-  of systemd-journal);
-* `filter.d/traefik-auth.conf`: used to ban hosts, that were failed through traefik
-* `filter.d/znc-adminlog.conf`: new filter for ZNC (IRC bouncer); requires the adminlog module to be loaded
-
-### Enhancements
-* introduced new options: `dbmaxmatches` (fail2ban.conf) and `maxmatches` (jail.conf) to contol
-  how many matches per ticket fail2ban can hold in memory and store in database (gh-2402, gh-2118);
-* fail2ban.conf: introduced new section `[Thread]` and option `stacksize` to configure default size
-  of the stack for threads running in fail2ban (gh-2356), it could be set in `fail2ban.local` to
-  avoid runtime error "can't start new thread" (see gh-969);
-* jail-reader extended (amend to gh-1622): actions support multi-line options now (interpolations
-  containing new-line);
-* fail2ban-client: extended to ban/unban multiple tickets (see gh-2351, gh-2349);
-  Syntax:
-  - `fail2ban-client set <jain> banip <ip1> ... <ipN>`
-  - `fail2ban-client set <jain> unbanip [--report-absent] <ip1> ... <ipN>`
-* fail2ban-client: extended with new feature which allows to inform fail2ban about single or multiple
-  attempts (failure) for IP (resp. failure-ID), see gh-2351;
-  Syntax:
-  - `fail2ban-client set <jail> attempt <ip> [<failure-message1> ... <failure-messageN>]`
-* `action.d/nftables.conf`:
-  - isolate fail2ban rules into a dedicated table and chain (gh-2254)
-  - `nftables-allports` supports multiple protocols in single rule now
-  - combined nftables actions to single action `nftables`:
-    * `nftables-common` is removed (replaced with single action `nftables` now)
-    * `nftables-allports` is obsolete, superseded by `nftables[type=allports]`
-    * `nftables-multiport` is obsolete, superseded by `nftables[type=multiport]`
-  - allowed multiple protocols in `nftables[type=multiport]` action (single set with multiple rules
-    in chain), following configuration in jail would replace 3 separate actions, see
-    https://github.com/fail2ban/fail2ban/pull/2254#issuecomment-534684675
-* `action.d/badips.py`: option `loglevel` extended with level of summary message,
-  following example configuration logging summary with NOTICE and rest with DEBUG log-levels:
-  `action = badips.py[loglevel="debug, notice"]`
-* samplestestcase.py (testSampleRegexsFactory) extended:
-  - allow coverage of journal logtype;
-  - new option `fileOptions` to set common filter/test options for whole test-file;
-* large enhancement: auto-reban, improved invariant check and conditional operations (gh-2588):
-  - improves invariant check and repair (avoid unhandled exception, consider family on conditional operations, etc),
-    prepared for bulk re-ban in repair case (if bulk-ban becomes implemented);
-  - automatic reban (repeat banning action) after repair/restore sane environment, if already logged ticket causes
-    new failures (via new action operation `actionreban` or `actionban` if still not defined in action);
-  * introduces banning epoch for actions and tickets (to distinguish or recognize removed set of the tickets);
-  * invariant check avoids repair by unban/stop (unless parameter `actionrepair_on_unban` set to `true`);
-  * better handling for all conditional operations (distinguish families for certain operations like 
-    repair/flush/stop, prepared for other families, e. g. if different handling for subnets expected, etc);
-  * partially implements gh-980 (more breakdown safe handling);
-  * closes gh-1680 (better as large-scale banning implementation with on-demand reban by failure, 
-    at least unless a bulk-ban gets implemented);
-* fail2ban-regex - several enhancements and fixes:
-  - improved usage output (don't put a long help if an error occurs);
-  - new option `--no-check-all` to avoid check of all regex's (first matched only);
-  - new option `-o`, `--out` to set token only provided in output (disables check-all and outputs only expected data).
-
-
-ver. 0.10.4 (2018/10/04) - ten-four-on-due-date-ten-four
------------
-
-### Fixes
-* `filter.d/dovecot.conf`: 
-  - failregex enhancement to catch sql password mismatch errors (gh-2153);
-  - disconnected with "proxy dest auth failed" (gh-2184);
-* `filter.d/freeswitch.conf`:
-  - provide compatibility for log-format from gh-2193:
-    * extended with new default date-pattern `^(?:%%Y-)?%%m-%%d[ T]%%H:%%M:%%S(?:\.%%f)?` to cover
-      `YYYY-mm-dd HH:MM::SS.ms` as well as `mm-dd HH:MM::SS.ms` (so year is optional);
-    * more optional arguments in log-line (so accept [WARN] as well as [WARNING] and optional [SOFIA] hereafter);
-  - extended with mode parameter, allows to avoid matching of messages like `auth challenge (REGISTER)`
-    (see gh-2163) (currently `extra` as default to be backwards-compatible), see comments in filter
-    how to set it to mode `normal`.
-* `filter.d/domino-smtp.conf`:
-  - recognizes failures logged using another format (something like session-id, IP enclosed in square brackets);
-  - failregex extended to catch connections rejected for policy reasons (gh-2228);
-* `action.d/hostsdeny.conf`: fix parameter in config (dynamic parameters stating with '_' are protected 
-  and don't allowed in command-actions), see gh-2114;
-* decoding stability fix by wrong encoded characters like utf-8 surrogate pairs, etc (gh-2171):
-  - fail2ban running in the preferred encoding now (as default encoding also within python 2.x), mostly
-    `UTF-8` in opposite to `ascii` previously, so minimizes influence of implicit conversions errors;
-  - actions: avoid possible conversion errors on wrong-chars by replace tags;
-  - database: improve adapter/converter handlers working on invalid characters in sense of json and/or sqlite-database;
-    additionally both are exception-safe now, so avoid possible locking of database (closes gh-2137);
-  - logging in fail2ban is process-wide exception-safe now.
-* repaired start-time of initial seek to time (as well as other log-parsing related data), 
-  if parameter `logpath` specified before `findtime`, `backend`, `datepattern`, etc (gh-2173)
-* systemd: fixed type error on option `journalflags`: an integer is required (gh-2125);
-
-### New Features
-* new option `ignorecache` to improve performance of ignore failure check (using caching of `ignoreip`, 
-  `ignoreself` and `ignorecommand`), see `man jail.conf` for syntax-example;
-* `ignorecommand` extended to use actions-similar replacement (capable to interpolate 
-  all possible tags like `<ip-host>`, `<family>`, `<fid>`, `F-USER` etc.)
-
-### Enhancements
-* `filter.d/dovecot.conf`: extended with tags F-USER (and alternatives) to collect user-logins (gh-2168)
-* since v.0.10.4, fail2ban-client, fail2ban-server and fail2ban-regex will return version without logo info,
-  additionally option `-V` can be used to get version in normalized machine-readable short format.
-
-
-ver. 0.10.3 (2018/04/04) - the-time-is-always-right-to-do-what-is-right
------------
-
-### ver. 0.10.3.1:
-* fixed JSON serialization for the set-object within dump into database (gh-2103).
-
-### Fixes
-* `filter.d/asterisk.conf`: fixed failregex prefix by log over remote syslog server (gh-2060);
-* `filter.d/exim.conf`: failregex extended - SMTP call dropped: too many syntax or protocol errors (gh-2048);
-* `filter.d/recidive.conf`: fixed if logging into systemd-journal (SYSLOG) with daemon name in prefix, gh-2069;
-* `filter.d/sendmail-auth.conf`, `filter.d/sendmail-reject.conf` :
-  - fixed failregex, sendmail uses prefix 'IPv6:' logging of IPv6 addresses (gh-2064);
-* `filter.d/sshd.conf`:
-  - failregex got an optional space in order to match new log-format (see gh-2061);
-  - fixed ddos-mode regex to match refactored message (some versions can contain port now, see gh-2062);
-  - fixed root login refused regex (optional port before preauth, gh-2080);
-  - avoid banning of legitimate users when pam_unix used in combination with other password method, so
-    bypass pam_unix failures if accepted available for this user gh-2070;
-  - amend to gh-1263 with better handling of multiple attempts (failures for different user-names recognized immediatelly);
-  - mode `ddos` (and `aggressive`) extended to catch `Connection closed by ... [preauth]`, so in DDOS mode
-    it counts failure on closing connection within preauth-stage (gh-2085);
-* `action.d/abuseipdb.conf`: fixed curl cypher errors and comment quote-issue (gh-2044, gh-2101);
-* `action.d/badips.py`: implicit convert IPAddr to str, solves an issue "expected string, IPAddr found" (gh-2059);
-* `action.d/hostsdeny.conf`: fixed IPv6 syntax (enclosed in square brackets, gh-2066);
-* (Free)BSD ipfw actionban fixed to allow same rule added several times (gh-2054);
-
-### New Features
-* several stability and performance optimizations, more effective filter parsing, etc;
-* stable runnable within python versions 3.6 (as well as within 3.7-dev);
-
-### Enhancements
-* `filter.d/apache-auth.conf`: detection of Apache SNI errors resp. misredirect attempts (gh-2017, gh-2097);
-* `filter.d/apache-noscript.conf`: extend failregex to match "Primary script unknown", e. g. from php-fpm (gh-2073);
-* date-detector extended with long epoch (`LEPOCH`) to parse milliseconds/microseconds posix-dates (gh-2029);
-* possibility to specify own regex-pattern to match epoch date-time, e. g. `^\[{EPOCH}\]` or `^\[{LEPOCH}\]` (gh-2038);
-  the epoch-pattern similar to `{DATE}` patterns does the capture and cuts out the match of whole pattern from the log-line,
-  e. g. date-pattern `^\[{LEPOCH}\]\s+:` will match and cut out `[1516469849551000] :` from begin of the log-line.
-* badips.py now uses https instead of plain http when requesting badips.com (gh-2057);
-* add support for "any" badips.py bancategory, to be able to retrieve IPs from all categories with a desired score (gh-2056);
-* Introduced new parameter `padding` for logging within fail2ban-server (default on, excepting SYSLOG):
-  Usage `logtarget = target[padding=on|off]`
-
-
-ver. 0.10.2 (2018/01/18) - nothing-burns-like-the-cold
------------
-
-### Incompatibility list:
-* The configuration for jails using banaction `pf` can be incompatible after upgrade, because pf-action uses
-  anchors now (see `action.d/pf.conf` for more information). If you want use obsolete handling without anchors,
-  just rewrite it in the `jail.local` by overwrite of `pfctl` parameter, e. g. like `banaction = pf[pfctl="pfctl"]`.
-
-### Fixes
-* Fixed logging to systemd-journal: new logtarget value SYSOUT can be used instead of STDOUT, to avoid 
-  write of the time-stamp, if logging to systemd-journal from foreground mode (gh-1876)
-* Fixed recognition of the new date-format on mysqld-auth filter (gh-1639)
-* jail.conf: port `imap3` replaced with `imap` everywhere, since imap3 is not a standard port and old rarely 
-  (if ever) used and can missing on some systems (e. g. debian stretch), see gh-1942.
-* config/paths-common.conf: added missing initial values (and small normalization in config/paths-*.conf)
-  in order to avoid errors while interpolating (e. g. starting with systemd-backend), see gh-1955.
-* `action.d/pf.conf`: 
-  - fixed syntax error in achnor definition (documentation, see gh-1919);
-  - enclose ports in braces for multiport jails (see gh-1925);
-* `action.d/firewallcmd-ipset.conf`: fixed create of set for ipv6 (missing `family inet6`, gh-1990)
-* `filter.d/sshd.conf`:
-  - extended failregex for modes "extra"/"aggressive": now finds all possible (also future)
-    forms of "no matching (cipher|mac|MAC|compression method|key exchange method|host key type) found", 
-    see "ssherr.c" for all possible SSH_ERR_..._ALG_MATCH errors (gh-1943, gh-1944);
-  - fixed failregex in order to avoid banning of legitimate users with multiple public keys (gh-2014, gh-1263);
-
-### New Features
-* datedetector: extended default date-patterns (allows extra space between the date and time stamps);
-  introduces 2 new format directives (with corresponding %Ex prefix for more precise parsing):
-  - %k - one- or two-digit number giving the hour of the day (0-23) on a 24-hour clock,
-    (corresponds %H, but allows space if not zero-padded).
-  - %l - one- or two-digit number giving the hour of the day (12-11) on a 12-hour clock,
-    (corresponds %I, but allows space if not zero-padded).
-* `filter.d/exim.conf`: added mode `aggressive` to ban flood resp. DDOS-similar failures (gh-1983);
-* New Actions:
-  - `action.d/nginx-block-map.conf` - in order to ban not IP-related tickets via nginx (session blacklisting in
-    nginx-location with map-file);
-
-### Enhancements
-* jail.conf: extended with new parameter `mode` for the filters supporting it (gh-1988);
-* action.d/pf.conf: extended with bulk-unban, command `actionflush` in order to flush all bans at once.
-* Introduced new parameters for logging within fail2ban-server (gh-1980).
-  Usage `logtarget = target[facility=..., datetime=on|off, format="..."]`:
-  - `facility` - specify syslog facility (default `daemon`, see https://docs.python.org/2/library/logging.handlers.html#sysloghandler
-     for the list of facilities);
-  - `datetime` - add date-time to the message (default on, ignored if `format` specified);
-  - `format` - specify own format how it will be logged, for example for short-log into STDOUT:
-      `fail2ban-server -f --logtarget 'stdout[format="%(relativeCreated)5d | %(message)s"]' start`;
-* Automatically recover or recreate corrupt persistent database (e. g. if failed to open with 
-  'database disk image is malformed'). Fail2ban will create a backup, try to repair the database,
-  if repair fails - recreate new database (gh-1465, gh-2004).
-
-
-ver. 0.10.1 (2017/10/12) - succeeded-before-friday-the-13th
------------
-
-### Fixes
-* fix Gentoo init script's shebang to use openrc-run instead of runscript (gh-1891)
-* jail "pass2allow-ftp" supply blocktype and returntype parameters to the action (gh-1884)
-* avoid using "ANSI_X3.4-1968" as preferred encoding (if missing environment variables 
-  'LANGUAGE', 'LC_ALL', 'LC_CTYPE', and 'LANG', see gh-1587).
-* action.d/pf.conf: several fixes for pf-action like anchoring, etc. (see gh-1866, gh-1867);
-* fixed ignoreself issue "Retrieving own IPs of localhost failed: inet_pton() argument 2 must be string, not int" (see gh-1865);
-* fixed tags `<fq-hostname>` and `<sh-hostname>`, could be used without ticket (a. g. in `actionstart` etc., gh-1859).
-
-* setup.py: fixed several setup facilities (gh-1874):
-  - don't check return code by dry-run: returns 256 on some python/setuptool versions;
-  - `files/fail2ban.service` renamed as template to `files/fail2ban.service.in`;
-  - setup process generates `build/fail2ban.service` from `files/fail2ban.service.in` using distribution related bin-path;
-  - bug-fixing by running setup with option `--dry-run`;
-
-### New Features
-* introduced new command-line options `--dp`, `--dump-pretty` to dump the configuration using more
-  human readable representation (opposite to `-d`);
-
-### Enhancements
-* nftables actions are IPv6-capable now (gh-1893)
-* filter.d/dovecot.conf: introduced mode `aggressive` for cases like "disconnected before auth was ready" (gh-1880)
-
-
-ver. 0.10.0 (2017/08/09) - long-awaited 0.10th version
------------
-
-TODO: implementing of options resp. other tasks from PR #1346
-      documentation should be extended (new options, etc)
-      
-### Fixes
-* `filter.d/apache-auth.conf`:
-  - better failure recognition using short form of regex (url/referer are foreign inputs, see gh-1645)
-* `filter.d/apache-common.conf` (`filter.d/apache-*.conf`):
-  - support of apache log-format if logging into syslog/systemd (gh-1695), using parameter `logging`,
-    parameter usage for jail:
-      filter = apache-auth[logging=syslog]
-    parameter usage for `apache-common.local`:
-      logging = syslog
-* `filter.d/pam-generic.conf`:
-  - [grave] injection on user name to host fixed
-* `filter.d/sshd.conf`:
-  - rewritten using `prefregex` and used MLFID-related multi-line parsing
-    (by using tag `<F-MLFID>` instead of buffering with `maxlines`);
-  - optional parameter `mode` rewritten: normal (default), ddos, extra or aggressive (combines all),
-    see sshd for regex details)
-* `filter.d/sendmail-reject.conf`:
-  - rewritten using `prefregex` and used MLFID-related multi-line parsing;
-  - optional parameter `mode` introduced: normal (default), extra or aggressive
-* `filter.d/haproxy-http-auth`: do not mistake client port for part of an IPv6 address (gh-1745)
-* `filter.d/postfix.conf`:
-    - updated to latest postfix formats
-    - joined several postfix filter together (normalized and optimized version, gh-1825)
-    - introduced new parameter `mode` (see gh-1825): more (default, combines normal and rbl), auth, normal,
-      rbl, ddos, extra or aggressive (combines all)
-    - postfix postscreen (resp. other RBL's compatibility fix, gh-1764, gh-1825)
-* `filter.d/postfix-rbl.conf`: removed (replaced with `postfix[mode=rbl]`)
-* `filter.d/postfix-sasl.conf`: removed (replaced with `postfix[mode=auth]`)
-* `filter.d/roundcube-auth.conf`:
-    - fixed regex when `X-Real-IP` or/and `X-Forwarded-For` are present after host (gh-1303);
-    - fixed regex when logging authentication errors to journal instead to a local file (gh-1159);
-    - additionally fixed more complex injections on username (e. g. using dot after fake host).
-* `filter.d/ejabberd-auth.conf`: fixed failregex - accept new log-format (gh-993)
-* `action.d/complain.conf`
-  - fixed using new tag `<ip-rev>` (sh/dash compliant now)
-* `action.d/sendmail-geoip-lines.conf`
-  - fixed using new tag `<ip-host>` (without external command execution)
-* fail2ban-regex: fixed matched output by multi-line (buffered) parsing
-* fail2ban-regex: support for multi-line debuggex URL implemented (gh-422)
-* fixed ipv6-action errors on systems not supporting ipv6 and vice versa (gh-1741)
-* fixed directory-based log-rotate for pyinotify-backend (gh-1778)
-
-### New Features
-* New Actions:
-
-* New Filters:
-
-### Enhancements
-* Introduced new filter option `prefregex` for pre-filtering using single regular expression (gh-1698);
-* Many times faster and fewer CPU-hungry because of parsing with `maxlines=1`, so without 
-  line buffering (scrolling of the buffer-window).
-  Combination of tags `<F-MLFID>` and `<F-NOFAIL>` can be used now to process multi-line logs
-  using single-line expressions:
-  - tag `<F-MLFID>`: used to identify resp. store failure info for groups of log-lines with the same
-    identifier (e. g. combined failure-info for the same conn-id by `<F-MLFID>(?:conn-id)</F-MLFID>`,
-    see sshd.conf for example);
-  - tag `<F-MLFFORGET>`: can be used as mark to forget current multi-line MLFID (e. g. by connection 
-    closed, reset or disconnect etc);
-  - tag `<F-NOFAIL>`: used as mark for no-failure (helper to accumulate common failure-info, 
-    e. g. from lines that contain IP-address);
-  Opposite to obsolete multi-line parsing (using buffering with `maxlines`) it is more precise and 
-  can recognize multiple failure attempts within the same connection (MLFID).
-* Several filters optimized with pre-filtering using new option `prefregex`, and multiline filter 
-  using `<F-MLFID>` + `<F-NOFAIL>` combination;
-* Exposes filter group captures in actions (non-recursive interpolation of tags `<F-...>`, 
-  see gh-1698, gh-1110)
-* Some filters extended with user name (can be used in gh-1243 to distinguish IP and user,
-  resp. to remove after success login the user-related failures only);
-* Safer, more stable and faster replaceTag interpolation (switched from cycle over all tags
-  to re.sub with callable)
-* substituteRecursiveTags optimization + moved in helpers facilities (because currently used 
-  commonly in server and in client)
-* New tags (usable in actions):
-  - `<fid>` - failure identifier (if raw resp. failures without IP address)
-  - `<ip-rev>` - PTR reversed representation of IP address
-  - `<ip-host>` - host name of the IP address
-  - `<bancount>` - ban count of this offender if known as bad (started by 1 for unknown)
-  - `<bantime>` - current ban-time of the ticket (prolongation can be retarded up to 10 sec.)
-  - `<F-...>` - interpolates to the corresponding filter group capture `...`
-  - `<fq-hostname>` - fully-qualified name of host (the same as `$(hostname -f)`)
-  - `<sh-hostname>` - short hostname (the same as `$(uname -n)`)
-* Introduced new action command `actionprolong` to prolong ban-time (e. g. set new timeout if expected);
-  Several actions (like ipset, etc.) rewritten using net logic with `actionprolong`.
-  Note: because ban-time is dynamic, it was removed from jail.conf as timeout argument (check jail.local).
-* Allow to use filter options by `fail2ban-regex`, example:
-  fail2ban-regex text.log "sshd[mode=aggressive]"
-* Samples test case factory extended with filter options - dict in JSON to control 
-  filter options (e. g. mode, etc.):
-  # filterOptions: {"mode": "aggressive"}
-* Introduced new jail option "ignoreself", specifies whether the local resp. own IP addresses 
-  should be ignored (default is true). Fail2ban will not ban a host which matches such addresses.
-  Option "ignoreip" affects additionally to "ignoreself" and don't need to include the DNS 
-  resp. IPs of the host self.
-* Regex will be compiled as MULTILINE only if needed (buffering with `maxlines` > 1), that enables:
-  - to improve performance by the single line parsing (see gh-1733);
-  - make regex more precise (because distinguish between anchors `^`/`$` for the begin/end of string
-    and the new-line character '\n', e. g. if coming from filters (like systemd journal) that allow
-    the parsing of log-entries contain new-line chars (as single entry);
-  - if multiline regex however expected (by single-line parsing without buffering) - prefix `(?m)` 
-    could be used in regex to enable it;
-* Implemented execution of `actionstart` on demand (conditional), if action depends on `family` (gh-1742):
-  - new action parameter `actionstart_on_demand` (bool) can be set to prevent/allow starting action
-    on demand (default retrieved automatically, if some conditional parameter `param?family=...` 
-    presents in action properties), see `action.d/pf.conf` for example;
-  - additionally `actionstop` will be executed only for families previously executing `actionstart`
-    (starting on demand only)
-* Introduced new command `actionflush`: executed in order to flush all bans at once 
-  e. g. by unban all, reload with removing action, stop, shutdown the system (gh-1743),
-  the actions having `actionflush` do not execute `actionunban` for each single ticket
-* Add new command `actionflush` default for several iptables/iptables-ipset actions (and common include);
-* Add new jail option `logtimezone` to force the timezone on log lines that don't have an explicit one (gh-1773)
-* Implemented zone abbreviations (like CET, CEST, etc.) and abbr+-offset functionality (accept zones
-  like 'CET+0100'), for the list of abbreviations see strptime.TZ_STR;
-* Introduced new option `--timezone` (resp. `--TZ`) for `fail2ban-regex`.
-* Tokens `%z` and `%Z` are changed (more precise now);
-* Introduced new tokens `%Exz` and `%ExZ` that fully support zone abbreviations and/or offset-based
-  zones (implemented as enhancement using custom `datepattern`, because may be too dangerous for default
-  patterns and tokens like `%z`);
-  Note: the extended tokens supported zone abbreviations, but it can parse 1 or 3-5 char(s) in lowercase.
-        Don't use them in default date-patterns (if not anchored, few precise resp. optional).
-        Because python currently does not support mixing of case-sensitive with case-insensitive matching,
-	the TZ (in uppercase) cannot be combined with `%a`/`%b` etc (that are currently case-insensitive),
-	to avoid invalid date-time recognition in strings like '11-Aug-2013 03:36:11.372 error ...' with
-	wrong TZ "error".
-        Hence `%z` currently match literal Z|UTC|GMT only (and offset-based), and `%Exz` - all zone 
-	abbreviations.
-* `filter.d/courier-auth.conf`: support failed logins with method only
-* Config reader's: introduced new syntax `%(section/option)s`, in opposite to extended interpolation of
-  python 3 `${section:option}` work with all supported python version in fail2ban and this syntax is 
-  like our another features like `%(known/option)s`, etc. (gh-1750)
-* Variable `default_backend` switched to `%(default/backend)s`, so totally backwards compatible now,
-  but now the setting of parameter `backend` in default section of `jail.local` can overwrite default
-  backend also (see gh-1750). In the future versions parameter `default_backend` can be removed (incompatibility, 
-  possibly some distributions affected).
-
-
-ver. 0.10.0-alpha-1 (2016/07/14) - ipv6-support-etc
------------
-
-### Fixes
-* [Grave] memory leak's fixed (gh-1277, gh-1234)
-* [Grave] Misleading date patterns defined more precisely (using extended syntax
-  `%Ex[mdHMS]` for exact two-digit match or e. g. `%ExY` as more precise year 
-  pattern, within same century of last year and the next 3 years)
-* [Grave] extends date detector template with distance (position of match in 
-  log-line), to prevent grave collision using (re)ordered template list (e.g.
-  find-spot of wrong date-match inside foreign input, misleading date patterns
-  by ambiguous formats, etc.)
-* Distance collision check always prefers template with shortest distance
-  (left for right) if date pattern is not anchored
-* Tricky bug fix: last position of log file will be never retrieved (gh-795),
-  because of CASCADE all log entries will be deleted from logs table together with jail, 
-  if used "INSERT OR REPLACE" statement
-* Asyncserver (asyncore) code fixed and test cases repaired (again gh-161)
-* testSocket: sporadical bug repaired - wait for server thread starts a socket (listener)
-* testExecuteTimeoutWithNastyChildren: sporadical bug repaired - wait for pid file inside bash,
-  kill tree in any case (gh-1155)
-* purge database will be executed now (within observer).
-* restoring currently banned ip after service restart fixed 
-  (now < timeofban + bantime), ignore old log failures (already banned)
-* Fixed high-load of pyinotify-backend,
-  see https://github.com/fail2ban/fail2ban/issues/885#issuecomment-248964591
-* Database: stability fix - repack cursor iterator as long as locked
-* File filter backends: stability fix for sporadically errors - always close file
-  handle, otherwise may be locked (prevent log-rotate, etc.)
-* Pyinotify-backend: stability fix for sporadically errors in multi-threaded
-  environment (without lock)
-* Fixed sporadically error in testCymruInfoNxdomain, because of unsorted values
-* Misleading errors logged from ignorecommand in success case on retcode 1 (gh-1194)
-* fail2ban.service - systemd service updated (gh-1618):
-  - starting service in normal mode (without forking)
-  - does not restart if service exited normally (exit-code 0, e.g. stopped via fail2ban-client)
-  - does not restart if service can not start (exit-code 255, e.g. wrong configuration, etc.)
-  - service can be additionally started/stopped with commands (fail2ban-client, fail2ban-server)
-  - automatically creates `/var/run/fail2ban` directory before start fail2ban 
-    (systems with virtual resp. memory-based FS for `/var/run`), see gh-1531
-  - if fail2ban running as systemd-service, for logging to the systemd-journal, 
-    the `logtarget` could be set to STDOUT
-  - value `logtarget` for system targets allowed also in lowercase (stdout, stderr, syslog, etc.)
-* Fixed UTC/GMT named time zone, using `%Z` and `%z` patterns 
-  (special case with 0 zone offset, see gh-1575)
-* `filter.d/freeswitch.conf`
-    - Optional prefixes (server, daemon, dual time) if systemd daemon logs used (gh-1548)
-    - User part rewritten to accept IPv6 resp. domain after "@" (gh-1548)
-
-### New Features
-* IPv6 support:
-    - IP addresses are now handled as objects rather than strings capable for 
-      handling both address types IPv4 and IPv6
-    - iptables related actions have been amended to support IPv6 specific actions
-      additionally
-    - hostsdeny and route actions have been tested to be aware of v4 and v6 already
-    - pf action for *BSD systems has been improved and supports now also v4 and v6
-    - name resolution is now working for either address type
-    - new conditional section functionality used in config resp. includes:
-      - [Init?family=inet4] - IPv4 qualified hosts only
-      - [Init?family=inet6] - IPv6 qualified hosts only
-* Increment ban time (+ observer) functionality introduced.
-  Thanks Serg G. Brester (sebres)
-* Database functionality extended with bad ips.
-* New reload functionality (now totally without restart, unbanning/rebanning, etc.),
-  see gh-1557
-* Several commands extended and new commands introduced:
-  - `restart [--unban] [--if-exists] <JAIL>` - restarts the jail \<JAIL\>
-    (alias for `reload --restart ... <JAIL>`)
-  - `reload [--restart] [--unban] [--all]` - reloads the configuration without restarting
-    of the server, the option `--restart` activates completely restarting of affected jails,
-    thereby can unban IP addresses (if option `--unban` specified)
-  - `reload [--restart] [--unban] [--if-exists] <JAIL>` - reloads the jail \<JAIL\>,
-    or restarts it (if option `--restart` specified), at the same time unbans all IP addresses
-    banned in this jail, if option `--unban` specified
-  - `unban --all` - unbans all IP addresses (in all jails and database)
-  - `unban <IP> ... <IP>` - unbans \<IP\> (in all jails and database) (see gh-1388)
-  - introduced new option `-t` or `--test` to test configuration resp. start server only 
-    if configuration is clean (fails by wrong configured jails if option `-t` specified)
-* New command action parameter `actionrepair` - command executed in order to restore
-  sane environment in error case of `actioncheck`.
-* Reporting via abuseipdb.com:
-  - Bans can now be reported to abuseipdb
-  - Catagories must be set in the config
-  - Relevant log lines included in report
-
-### Enhancements
-* Huge increasing of fail2ban performance and especially test-cases performance (see gh-1109)
-* Datedetector: in-place reordering using hits and last used time: 
-  matchTime, template list etc. rewritten because of performance degradation
-* Prevent out of memory situation if many IP's makes extremely many failures (maxEntries)
-* Introduced string to seconds (str2seconds) for configuration entries with time,
-  use `1h` instead of `3600`, `1d` instead of `86400`, etc
-* seekToTime - prevent completely read of big files first time (after start of service), 
-  initial seek to start time using half-interval search algorithm (see issue gh-795)
-* Ticket and some other modules prepared to easy merge with newest version of 'ban-time-incr'
-* Cache dnsToIp, ipToName to prevent long wait during retrieving of ip/name,
-  especially for wrong dns or lazy dns-system
-* FailManager memory-optimization: increases performance, 
-  prevents memory leakage, because don't copy failures list on some operations
-* fail2ban-testcases - new options introduced:
-    - `-f`, `--fast` to decrease wait intervals, avoid passive waiting, and skip
-      few very slow test cases (implied memory database, see `-m` and no gamin tests `-g`)
-    - `-g`, `--no-gamin` to prevent running of tests that require the gamin (slow)
-    - `-m`, `--memory-db` - run database tests using memory instead of file
-    - `-i`, `--ignore` - negate [regexps] filter to ignore tests matched specified regexps
-* Background servicing: prevents memory leak on some platforms/python versions, using forced GC
-  in periodic intervals (latency and threshold)
-* executeCmd partially moved from action to new module utils
-* Several functionality of class `DNSUtils` moved to new class `IPAddr`, 
-  both classes moved to new module `ipdns`
-* Pseudo-conditional section introduced, for conditional substitution resp. 
-  evaluation of parameters for different family qualified hosts, 
-  syntax `[Section?family=inet6]` (currently use for IPv6-support only).
-* All the backends were rewritten to get reload-possibility, performance increased,
-  so fewer greedy regarding cpu- resp. system-load now
-* Numeric log-level allowed now in server (resp. fail2ban.conf);
-* Implemented better error handling in some multi-threaded routines; shutdown of jails
-  rewritten (faster and safer, does not breaks shutdown process if some error occurred)
-* Possibility for overwriting some configuration options (read with config-readers)
-  with command line option, e. g.:
-```bash
-## start server with DEBUG log-level (ignore level read from fail2ban.conf):
-fail2ban-client --loglevel DEBUG start
-## or
-fail2ban-server -c /cfg/path --loglevel DEBUG start
-## keep server log-level by reload (without restart it)
-fail2ban-client --loglevel DEBUG reload
-## switch log-level back to INFO:
-fail2ban-client set loglevel INFO
-```
-* Optimized BanManager: increase performance, fewer system load, try to prevent
-  memory leakage:
-  - better ban/unban handling within actions (e.g. used dict instead of list)
-  - don't copy bans resp. its list on some operations;
-  - added new unbantime handling to relieve unBanList (prevent permanent
-    searching for tickets to unban)
-  - prefer failure-ID as identifier of the ticket to its IP (most of the time
-    the same, but it can be something else e.g. user name in some complex jails,
-    as introduced in 0.10)
-* Regexp enhancements:
-  - build replacement of `<HOST>` substitution corresponding parameter
-    `usedns` - dns-part will be added only if `usedns` is not `no`,
-    also using fail2ban-regex
-  - new replacement for `<ADDR>` in opposition to `<HOST>`, for separate
-    usage of 2 address groups only (regardless of `usedns`), `ip4` and `ip6`
-    together, without host (dns)
-* Misconfigured jails don't prevent fail2ban from starting, server starts 
-  nevertheless, as long as one jail was successful configured (gh-1619)
-  Message about wrong jail configuration logged in client log (stdout, systemd
-  journal etc.) and in server log with error level
-* More precise date template handling (WARNING: theoretically possible incompatibilities):
-  - datedetector rewritten more strict as earlier;
-  - default templates can be specified exacter using prefix/suffix syntax (via `datepattern`);
-  - more as one date pattern can be specified using option `datepattern` now 
-    (new-line separated);
-  - some default options like `datepattern` can be specified directly in 
-    section `[Definition]`, that avoids contrary usage of unnecessarily `[Init]`
-    section, because of performance (each extra section costs time);
-  - option `datepattern` can be specified in jail also (e. g. jails without filters 
-    or custom log-format, new-line separated for multiple patterns);
-  - if first unnamed group specified in pattern, only this will be cut out from
-    search log-line (e. g.: `^date:[({DATE})]` will cut out only datetime match 
-    pattern, and leaves `date:[] ...` for searching in filter);
-  - faster match and fewer searching of appropriate templates
-    (DateDetector.matchTime calls rarer DateTemplate.matchDate now);
-  - several standard filters extended with exact prefixed or anchored date templates;
-* Added possibility to recognize restored state of the tickets (see gh-1669).
-  New option `norestored` introduced, to ignore restored tickets (after restart).
-  To avoid execution of ban/unban for the restored tickets, `norestored = true`
-  could be added in definition section of action.
-  For conditional usage in the shell-based actions an interpolation `<restored>` 
-  could be used also. E. g. it is enough to add following script-piece at begin
-  of `actionban` (or `actionunban`) to prevent execution:
-  `if [ '<restored>' = '1' ]; then exit 0; fi;`
-  Several actions extended now using `norestored` option:
-  - complain.conf
-  - dshield.conf
-  - mail-buffered.conf
-  - mail-whois-lines.conf
-  - mail-whois.conf
-  - mail.conf
-  - sendmail-buffered.conf
-  - sendmail-geoip-lines.conf
-  - sendmail-whois-ipjailmatches.conf
-  - sendmail-whois-ipmatches.conf
-  - sendmail-whois-lines.conf
-  - sendmail-whois-matches.conf
-  - sendmail-whois.conf
-  - sendmail.conf
-  - smtp.py
-  - xarf-login-attack.conf
-* fail2ban-testcases:
-  - `assertLogged` extended with parameter wait (to wait up to specified timeout,
-    before we throw assert exception) + test cases rewritten using that
-  - added `assertDictEqual` for compatibility to early python versions (< 2.7);
-  - new `with_foreground_server_thread` decorator to test several client/server commands
-
-
 ver. 0.9.8 (2016/XX/XXX) - wanna-be-released
 -----------
 

DEVELOP

@@ -262,16 +262,12 @@ FileContainer
     Keeps the position pointer
 
 
-ipdns.py
-~~~~~~~~
+dnsutils.py
+~~~~~~~~~~~
 
 DNSUtils
 
-  Utility class for DNS handling
-
-IPAddr
-
-  Object-class for IP address handling
+  Utility class for DNS and IP handling
 
 
 filter*.py

MANIFEST

@@ -3,7 +3,6 @@ bin/fail2ban-regex
 bin/fail2ban-server
 bin/fail2ban-testcases
 ChangeLog
-config/action.d/abuseipdb.conf
 config/action.d/apf.conf
 config/action.d/badips.conf
 config/action.d/badips.py
@@ -14,13 +13,11 @@ config/action.d/complain.conf
 config/action.d/dshield.conf
 config/action.d/dummy.conf
 config/action.d/firewallcmd-allports.conf
-config/action.d/firewallcmd-common.conf
 config/action.d/firewallcmd-ipset.conf
 config/action.d/firewallcmd-multiport.conf
 config/action.d/firewallcmd-new.conf
 config/action.d/firewallcmd-rich-logging.conf
 config/action.d/firewallcmd-rich-rules.conf
-config/action.d/helpers-common.conf
 config/action.d/hostsdeny.conf
 config/action.d/ipfilter.conf
 config/action.d/ipfw.conf
@@ -42,9 +39,8 @@ config/action.d/mail-whois-lines.conf
 config/action.d/mynetwatchman.conf
 config/action.d/netscaler.conf
 config/action.d/nftables-allports.conf
-config/action.d/nftables.conf
+config/action.d/nftables-common.conf
 config/action.d/nftables-multiport.conf
-config/action.d/nginx-block-map.conf
 config/action.d/npf.conf
 config/action.d/nsupdate.conf
 config/action.d/osx-afctl.conf
@@ -81,9 +77,7 @@ config/filter.d/apache-pass.conf
 config/filter.d/apache-shellshock.conf
 config/filter.d/assp.conf
 config/filter.d/asterisk.conf
-config/filter.d/bitwarden.conf
 config/filter.d/botsearch-common.conf
-config/filter.d/centreon.conf
 config/filter.d/common.conf
 config/filter.d/counter-strike.conf
 config/filter.d/courier-auth.conf
@@ -105,6 +99,7 @@ config/filter.d/gssftpd.conf
 config/filter.d/guacamole.conf
 config/filter.d/haproxy-http-auth.conf
 config/filter.d/horde.conf
+config/filter.d/ignorecommands
 config/filter.d/ignorecommands/apache-fakegooglebot
 config/filter.d/kerio.conf
 config/filter.d/lighttpd-auth.conf
@@ -123,10 +118,11 @@ config/filter.d/openwebmail.conf
 config/filter.d/oracleims.conf
 config/filter.d/pam-generic.conf
 config/filter.d/perdition.conf
-config/filter.d/phpmyadmin-syslog.conf
 config/filter.d/php-url-fopen.conf
 config/filter.d/portsentry.conf
 config/filter.d/postfix.conf
+config/filter.d/postfix-rbl.conf
+config/filter.d/postfix-sasl.conf
 config/filter.d/proftpd.conf
 config/filter.d/pure-ftpd.conf
 config/filter.d/qmail.conf
@@ -137,26 +133,25 @@ config/filter.d/selinux-common.conf
 config/filter.d/selinux-ssh.conf
 config/filter.d/sendmail-auth.conf
 config/filter.d/sendmail-reject.conf
+config/filter.d/sendmail-spam.conf
 config/filter.d/sieve.conf
 config/filter.d/slapd.conf
 config/filter.d/sogo-auth.conf
 config/filter.d/solid-pop3d.conf
 config/filter.d/squid.conf
 config/filter.d/squirrelmail.conf
+config/filter.d/sshd-aggressive.conf
 config/filter.d/sshd.conf
+config/filter.d/sshd-ddos.conf
 config/filter.d/stunnel.conf
 config/filter.d/suhosin.conf
 config/filter.d/tine20.conf
-config/filter.d/traefik-auth.conf
 config/filter.d/uwimap-auth.conf
 config/filter.d/vsftpd.conf
 config/filter.d/webmin-auth.conf
 config/filter.d/wuftpd.conf
 config/filter.d/xinetd-fail.conf
-config/filter.d/znc-adminlog.conf
-config/filter.d/zoneminder.conf
 config/jail.conf
-config/paths-arch.conf
 config/paths-common.conf
 config/paths-debian.conf
 config/paths-fedora.conf
@@ -167,6 +162,7 @@ CONTRIBUTING.md
 COPYING
 .coveragerc
 DEVELOP
+doc/run-rootless.txt
 fail2ban-2to3
 fail2ban/client/actionreader.py
 fail2ban/client/beautifier.py
@@ -174,11 +170,8 @@ fail2ban/client/configparserinc.py
 fail2ban/client/configreader.py
 fail2ban/client/configurator.py
 fail2ban/client/csocket.py
-fail2ban/client/fail2banclient.py
-fail2ban/client/fail2bancmdline.py
 fail2ban/client/fail2banreader.py
 fail2ban/client/fail2banregex.py
-fail2ban/client/fail2banserver.py
 fail2ban/client/filterreader.py
 fail2ban/client/__init__.py
 fail2ban/client/jailreader.py
@@ -194,6 +187,7 @@ fail2ban/server/banmanager.py
 fail2ban/server/database.py
 fail2ban/server/datedetector.py
 fail2ban/server/datetemplate.py
+fail2ban/server/faildata.py
 fail2ban/server/failmanager.py
 fail2ban/server/failregex.py
 fail2ban/server/filtergamin.py
@@ -202,17 +196,15 @@ fail2ban/server/filter.py
 fail2ban/server/filterpyinotify.py
 fail2ban/server/filtersystemd.py
 fail2ban/server/__init__.py
-fail2ban/server/ipdns.py
+fail2ban/server/iso8601.py
 fail2ban/server/jail.py
 fail2ban/server/jails.py
 fail2ban/server/jailthread.py
 fail2ban/server/mytime.py
-fail2ban/server/observer.py
 fail2ban/server/server.py
 fail2ban/server/strptime.py
 fail2ban/server/ticket.py
 fail2ban/server/transmitter.py
-fail2ban/server/utils.py
 fail2ban/setup.py
 fail2ban-testcases-all
 fail2ban-testcases-all-python3
@@ -222,21 +214,22 @@ fail2ban/tests/action_d/test_smtp.py
 fail2ban/tests/actionstestcase.py
 fail2ban/tests/actiontestcase.py
 fail2ban/tests/banmanagertestcase.py
-fail2ban/tests/clientbeautifiertestcase.py
 fail2ban/tests/clientreadertestcase.py
-fail2ban/tests/config/action.d/action.conf
 fail2ban/tests/config/action.d/brokenaction.conf
 fail2ban/tests/config/fail2ban.conf
+fail2ban/tests/config/filter.d/common.conf
 fail2ban/tests/config/filter.d/simple.conf
 fail2ban/tests/config/filter.d/test.conf
 fail2ban/tests/config/filter.d/test.local
 fail2ban/tests/config/filter.d/zzz-generic-example.conf
-fail2ban/tests/config/filter.d/zzz-sshd-obsolete-multiline.conf
 fail2ban/tests/config/jail.conf
+fail2ban/tests/config/paths-common.conf
+fail2ban/tests/config/paths-debian.conf
+fail2ban/tests/config/paths-freebsd.conf
+fail2ban/tests/config/paths-osx.conf
 fail2ban/tests/databasetestcase.py
 fail2ban/tests/datedetectortestcase.py
 fail2ban/tests/dummyjail.py
-fail2ban/tests/fail2banclienttestcase.py
 fail2ban/tests/fail2banregextestcase.py
 fail2ban/tests/failmanagertestcase.py
 fail2ban/tests/files/action.d/action_checkainfo.py
@@ -262,7 +255,6 @@ fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd
 fail2ban/tests/files/config/apache-auth/noentry/.htaccess
 fail2ban/tests/files/config/apache-auth/README
 fail2ban/tests/files/database_v1.db
-fail2ban/tests/files/database_v2.db
 fail2ban/tests/files/filter.d/substition.conf
 fail2ban/tests/files/filter.d/testcase01.conf
 fail2ban/tests/files/filter.d/testcase-common.conf
@@ -270,6 +262,7 @@ fail2ban/tests/files/ignorecommand.py
 fail2ban/tests/files/logs/3proxy
 fail2ban/tests/files/logs/apache-auth
 fail2ban/tests/files/logs/apache-badbots
+fail2ban/tests/files/logs/apache-botscripts
 fail2ban/tests/files/logs/apache-botsearch
 fail2ban/tests/files/logs/apache-fakegooglebot
 fail2ban/tests/files/logs/apache-modsecurity
@@ -280,11 +273,9 @@ fail2ban/tests/files/logs/apache-pass
 fail2ban/tests/files/logs/apache-shellshock
 fail2ban/tests/files/logs/assp
 fail2ban/tests/files/logs/asterisk
-fail2ban/tests/files/logs/bitwarden
 fail2ban/tests/files/logs/bsd/syslog-plain.txt
 fail2ban/tests/files/logs/bsd/syslog-v.txt
 fail2ban/tests/files/logs/bsd/syslog-vv.txt
-fail2ban/tests/files/logs/centreon
 fail2ban/tests/files/logs/counter-strike
 fail2ban/tests/files/logs/courier-auth
 fail2ban/tests/files/logs/courier-smtp
@@ -321,10 +312,11 @@ fail2ban/tests/files/logs/openwebmail
 fail2ban/tests/files/logs/oracleims
 fail2ban/tests/files/logs/pam-generic
 fail2ban/tests/files/logs/perdition
-fail2ban/tests/files/logs/phpmyadmin-syslog
 fail2ban/tests/files/logs/php-url-fopen
 fail2ban/tests/files/logs/portsentry
 fail2ban/tests/files/logs/postfix
+fail2ban/tests/files/logs/postfix-rbl
+fail2ban/tests/files/logs/postfix-sasl
 fail2ban/tests/files/logs/proftpd
 fail2ban/tests/files/logs/pure-ftpd
 fail2ban/tests/files/logs/qmail
@@ -334,6 +326,7 @@ fail2ban/tests/files/logs/screensharingd
 fail2ban/tests/files/logs/selinux-ssh
 fail2ban/tests/files/logs/sendmail-auth
 fail2ban/tests/files/logs/sendmail-reject
+fail2ban/tests/files/logs/sendmail-spam
 fail2ban/tests/files/logs/sieve
 fail2ban/tests/files/logs/slapd
 fail2ban/tests/files/logs/sogo-auth
@@ -341,21 +334,17 @@ fail2ban/tests/files/logs/solid-pop3d
 fail2ban/tests/files/logs/squid
 fail2ban/tests/files/logs/squirrelmail
 fail2ban/tests/files/logs/sshd
-fail2ban/tests/files/logs/sshd-journal
+fail2ban/tests/files/logs/sshd-aggressive
+fail2ban/tests/files/logs/sshd-ddos
 fail2ban/tests/files/logs/stunnel
 fail2ban/tests/files/logs/suhosin
 fail2ban/tests/files/logs/tine20
-fail2ban/tests/files/logs/traefik-auth
 fail2ban/tests/files/logs/uwimap-auth
 fail2ban/tests/files/logs/vsftpd
 fail2ban/tests/files/logs/webmin-auth
 fail2ban/tests/files/logs/wuftpd
 fail2ban/tests/files/logs/xinetd-fail
-fail2ban/tests/files/logs/znc-adminlog
-fail2ban/tests/files/logs/zoneminder
 fail2ban/tests/files/logs/zzz-generic-example
-fail2ban/tests/files/logs/zzz-sshd-obsolete-multiline
-fail2ban/tests/files/testcase01a.log
 fail2ban/tests/files/testcase01.log
 fail2ban/tests/files/testcase02.log
 fail2ban/tests/files/testcase03.log
@@ -364,15 +353,12 @@ fail2ban/tests/files/testcase-journal.log
 fail2ban/tests/files/testcase-multiline.log
 fail2ban/tests/files/testcase-usedns.log
 fail2ban/tests/files/testcase-wrong-char.log
-fail2ban/tests/files/zzz-sshd-obsolete-multiline.log
 fail2ban/tests/filtertestcase.py
 fail2ban/tests/__init__.py
 fail2ban/tests/misctestcase.py
-fail2ban/tests/observertestcase.py
 fail2ban/tests/samplestestcase.py
 fail2ban/tests/servertestcase.py
 fail2ban/tests/sockettestcase.py
-fail2ban/tests/tickettestcase.py
 fail2ban/tests/utils.py
 fail2ban/version.py
 files/bash-completion
@@ -381,7 +367,7 @@ files/cacti/fail2ban_stats.sh
 files/cacti/README
 files/debian-initd
 files/fail2ban-logrotate
-files/fail2ban.service.in
+files/fail2ban.service
 files/fail2ban-tmpfiles.conf
 files/fail2ban.upstart
 files/gen_badbots
@@ -404,8 +390,6 @@ kill-server
 man/fail2ban.1
 man/fail2ban-client.1
 man/fail2ban-client.h2m
-man/fail2ban-python.1
-man/fail2ban-python.h2m
 man/fail2ban-regex.1
 man/fail2ban-regex.h2m
 man/fail2ban-server.1

README.md

@@ -2,7 +2,7 @@
                         / _|__ _(_) |_  ) |__  __ _ _ _  
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
-                       v0.11.0.dev1            20??/??/??
+                       v0.9.7.dev0             2017/??/??
 
 ## Fail2Ban: ban hosts that cause multiple authentication errors
 
@@ -17,14 +17,9 @@ Though Fail2Ban is able to reduce the rate of incorrect authentication
 attempts, it cannot eliminate the risk presented by weak authentication.
 Set up services to use only two factor, or public/private authentication
 mechanisms if you really want to protect services.
-     
-<img src="http://www.worldipv6launch.org/wp-content/themes/ipv6/downloads/World_IPv6_launch_logo.svg" height="52pt"/> | Since v0.10 fail2ban supports the matching of IPv6 addresses.
-------|------
 
 This README is a quick introduction to Fail2Ban. More documentation, FAQ, and HOWTOs
-to be found on fail2ban(1) manpage, [Wiki](https://github.com/fail2ban/fail2ban/wiki),
-[Developers documentation](https://fail2ban.readthedocs.io/)
-and the website: https://www.fail2ban.org
+to be found on fail2ban(1) manpage and the website: https://www.fail2ban.org
 
 Installation:
 -------------
@@ -46,16 +41,10 @@ Optional:
 
 To install:
 
-    tar xvfj fail2ban-0.11.0.tar.bz2
-    cd fail2ban-0.11.0
-    sudo python setup.py install
-   
-Alternatively, you can clone the source from GitHub to a directory of Your choice, and do the install from there. Pick the correct branch, for example, 0.11
+    tar xvfj fail2ban-0.9.7.tar.bz2
+    cd fail2ban-0.9.7
+    python setup.py install
 
-    git clone https://github.com/fail2ban/fail2ban.git
-    cd fail2ban
-    sudo python setup.py install 
-    
 This will install Fail2Ban into the python library directory. The executable
 scripts are placed into `/usr/bin`, and configuration in `/etc/fail2ban`.
 
@@ -65,9 +54,6 @@ Fail2Ban should be correctly installed now. Just type:
 
 to see if everything is alright. You should always use fail2ban-client and
 never call fail2ban-server directly.
-You can verify that you have the correct version installed with 
-
-    fail2ban-client version
 
 Please note that the system init/service script is not automatically installed.
 To enable fail2ban as an automatic service, simply copy the script for your
@@ -89,11 +75,11 @@ fail2ban(1) and jail.conf(5)  manpages for further references.
 Code status:
 ------------
 
-* travis-ci.org: [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=0.11)](https://travis-ci.org/fail2ban/fail2ban?branch=0.11) (0.11 branch) / [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=0.10)](https://travis-ci.org/fail2ban/fail2ban?branch=0.10) (0.10 branch) 
+* [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.png?branch=master)](https://travis-ci.org/fail2ban/fail2ban) travis-ci.org (master branch)
 
-* coveralls.io: [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=0.11)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.11) (0.11 branch) / [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=0.10)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.10) / (0.10 branch)
+* [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.png?branch=master)](https://coveralls.io/r/fail2ban/fail2ban)
 
-* codecov.io: [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.11)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.11) (0.11 branch) / [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.10)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.10) (0.10 branch)
+* [![codecov.io](https://codecov.io/github/fail2ban/fail2ban/coverage.svg?branch=master)](https://codecov.io/github/fail2ban/fail2ban?branch=master)
 
 Contact:
 --------
@@ -102,7 +88,7 @@ Contact:
 See [CONTRIBUTING.md](https://github.com/fail2ban/fail2ban/blob/master/CONTRIBUTING.md)
 
 ### You just appreciate this program:
-Send kudos to the original author ([Cyril Jaquier](mailto:cyril.jaquier@fail2ban.org))
+Send kudos to the original author ([Cyril Jaquier](mailto: Cyril Jaquier <cyril.jaquier@fail2ban.org>))
 or *better* to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
 since Fail2Ban is "community-driven" for years now.
 

RELEASE

@@ -53,7 +53,7 @@ Preparation
 
   or an alternative for comparison with previous release
 
-     git diff 0.10.0 | grep -B2 'index 0000000..' | grep -B1 'new file mode' | sed -n -e '/^diff /s,.* b/,,gp' >> MANIFEST
+     git diff 0.9.7 | grep -B2 'index 0000000..' | grep -B1 'new file mode' | sed -n -e '/^diff /s,.* b/,,gp' >> MANIFEST
      sort MANIFEST | uniq | sponge MANIFEST
 
 * Run::
@@ -66,24 +66,24 @@ Preparation
 
   * Which indicates that testcases/files/logs/mysqld.log has been moved or is a directory::
 
-      tar -C /tmp -jxf dist/fail2ban-0.9.6.tar.bz2
+      tar -C /tmp -jxf dist/fail2ban-0.9.7.tar.bz2
 
 * clean up current directory::
 
-    diff -rul --exclude \*.pyc . /tmp/fail2ban-0.10.0/
+    diff -rul --exclude \*.pyc . /tmp/fail2ban-0.9.7/
 
   * Only differences should be files that you don't want distributed.
 
 
 * Ensure the tests work from the tarball::
 
-    cd /tmp/fail2ban-0.9.6/ && bin/fail2ban-testcases
+    cd /tmp/fail2ban-0.9.7/ && bin/fail2ban-testcases
 
 * Add/finalize the corresponding entry in the ChangeLog
 
   * To generate a list of committers use e.g.::
 
-      git shortlog -sn 0.10.0.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
+      git shortlog -sn 0.9.7.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
 
   * Ensure the top of the ChangeLog has the right version and current date.
   * Ensure the top entry of the ChangeLog has the right version and current date.
@@ -106,7 +106,7 @@ Preparation
 * Tag the release by using a signed (and annotated) tag.  Cut/paste
   release ChangeLog entry as tag annotation::
 
-    git tag -s 0.10.0
+    git tag -s 0.9.8
 
 Pre Release
 ===========
@@ -190,7 +190,7 @@ Post Release
 
 Add the following to the top of the ChangeLog::
 
-  ver. 0.10.0 (2016/XX/XXX) - wanna-be-released
+  ver. 0.9.9 (2016/XX/XXX) - wanna-be-released
   -----------
   
   ### Fixes

THANKS

@@ -12,11 +12,9 @@ Adrien Clerc
 ache
 ag4ve (Shawn)
 Alasdair D. Campbell
-Alexander Koeppe (IPv6 support)
 Alexandre Perrin (kAworu)
 Amir Caspi
 Amy
-Andrew James Collett (ajcollett)
 Andrew St. Jean
 Andrey G. Grozin
 Andy Fragen
@@ -61,7 +59,6 @@ John Thoe
 Jacques Lav!gnotte
 Johannes Weberhofer
 Jason H Martin
-Jeaye Wilkerson
 Jisoo Park
 Joel M Snyder
 Jonathan Kamens
@@ -111,9 +108,7 @@ Russell Odom
 SATO Kentaro
 Sean DuBois
 Sebastian Arcus
-Serg G. Brester (sebres)
-Sergey Safarov
-Shaun C.
+Serg G. Brester
 Sireyessire
 silviogarbes
 Stefan Tatschner

bin/fail2ban-client

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
 # vi: set ft=python sts=4 ts=4 sw=4 noet :
 
@@ -18,20 +18,458 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-"""
-Fail2Ban reads log file that contains password failure report
-and bans the corresponding IP addresses using firewall rules.
-
-This tools starts/stops fail2ban server or does client/server communication,
-to change/read parameters of the server or jails.
-
-"""
-
-__author__ = "Fail2Ban Developers"
-__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko, 2014-2016 Serg G. Brester"
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from fail2ban.client.fail2banclient import exec_command_line, sys
+import getopt
+import logging
+import os
+import pickle
+import re
+import shlex
+import signal
+import socket
+import string
+import sys
+import time
 
-if __name__ == "__main__":
-	exec_command_line(sys.argv)
+from fail2ban.version import version
+from fail2ban.protocol import printFormatted
+from fail2ban.client.csocket import CSocket
+from fail2ban.client.configurator import Configurator
+from fail2ban.client.beautifier import Beautifier
+from fail2ban.helpers import getLogger
+
+# Gets the instance of the logger.
+logSys = getLogger("fail2ban")
+
+##
+#
+# @todo This class needs cleanup.
+
+class Fail2banClient:
+
+	SERVER = "fail2ban-server"
+	PROMPT = "fail2ban> "
+
+	def __init__(self):
+		self.__argv = None
+		self.__stream = None
+		self.__configurator = Configurator()
+		self.__conf = dict()
+		self.__conf["conf"] = "/etc/fail2ban"
+		self.__conf["dump"] = False
+		self.__conf["force"] = False
+		self.__conf["background"] = True
+		self.__conf["verbose"] = 1
+		self.__conf["interactive"] = False
+		self.__conf["socket"] = None
+		self.__conf["pidfile"] = None
+
+	def dispVersion(self):
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+
+	def dispUsage(self):
+		""" Prints Fail2Ban command line options and exits
+		"""
+		print "Usage: "+self.__argv[0]+" [OPTIONS] <COMMAND>"
+		print
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+		print "Options:"
+		print "    -c <DIR>                configuration directory"
+		print "    -s <FILE>               socket path"
+		print "    -p <FILE>               pidfile path"
+		print "    -d                      dump configuration. For debugging"
+		print "    -i                      interactive mode"
+		print "    -v                      increase verbosity"
+		print "    -q                      decrease verbosity"
+		print "    -x                      force execution of the server (remove socket file)"
+		print "    -b                      start server in background (default)"
+		print "    -f                      start server in foreground (note that the client forks once itself)"
+		print "    -h, --help              display this help message"
+		print "    -V, --version           print the version"
+		print
+		print "Command:"
+
+		# Prints the protocol
+		printFormatted()
+
+		print
+		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
+
+	def dispInteractive(self):
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+
+	def __sigTERMhandler(self, signum, frame):
+		# Print a new line because we probably come from wait
+		print
+		logSys.warning("Caught signal %d. Exiting" % signum)
+		sys.exit(-1)
+
+	def __getCmdLineOptions(self, optList):
+		""" Gets the command line options
+		"""
+		for opt in optList:
+			if opt[0] == "-c":
+				self.__conf["conf"] = opt[1]
+			elif opt[0] == "-s":
+				self.__conf["socket"] = opt[1]
+			elif opt[0] == "-p":
+				self.__conf["pidfile"] = opt[1]
+			elif opt[0] == "-d":
+				self.__conf["dump"] = True
+			elif opt[0] == "-v":
+				self.__conf["verbose"] = self.__conf["verbose"] + 1
+			elif opt[0] == "-q":
+				self.__conf["verbose"] = self.__conf["verbose"] - 1
+			elif opt[0] == "-x":
+				self.__conf["force"] = True
+			elif opt[0] == "-i":
+				self.__conf["interactive"] = True
+			elif opt[0] == "-b":
+				self.__conf["background"] = True
+			elif opt[0] == "-f":
+				self.__conf["background"] = False
+			elif opt[0] in ["-h", "--help"]:
+				self.dispUsage()
+				sys.exit(0)
+			elif opt[0] in ["-V", "--version"]:
+				self.dispVersion()
+				sys.exit(0)
+
+	def __ping(self):
+		return self.__processCmd([["ping"]], False)
+
+	def __processCmd(self, cmd, showRet = True):
+		client = None
+		try:
+			beautifier = Beautifier()
+			streamRet = True
+			for c in cmd:
+				beautifier.setInputCmd(c)
+				try:
+					if not client:
+						client = CSocket(self.__conf["socket"])
+					ret = client.send(c)
+					if ret[0] == 0:
+						logSys.debug("OK : " + `ret[1]`)
+						if showRet:
+							print beautifier.beautify(ret[1])
+					else:
+						logSys.error("NOK: " + `ret[1].args`)
+						if showRet:
+							print beautifier.beautifyError(ret[1])
+						streamRet = False
+				except socket.error:
+					if showRet:
+						self.__logSocketError()
+					return False
+				except Exception as e:
+					if showRet:
+						logSys.error(e)
+					return False
+		finally:
+			if client:
+				client.close()
+		return streamRet
+
+	def __logSocketError(self):
+		try:
+			if os.access(self.__conf["socket"], os.F_OK):
+				# This doesn't check if path is a socket,
+				#  but socket.error should be raised
+				if os.access(self.__conf["socket"], os.W_OK):
+					# Permissions look good, but socket.error was raised
+					logSys.error("Unable to contact server. Is it running?")
+				else:
+					logSys.error("Permission denied to socket: %s,"
+								 " (you must be root)", self.__conf["socket"])
+			else:
+				logSys.error("Failed to access socket path: %s."
+							 " Is fail2ban running?",
+							 self.__conf["socket"])
+		except Exception as e:
+			logSys.error("Exception while checking socket access: %s",
+						 self.__conf["socket"])
+			logSys.error(e)
+
+	##
+	# Process a command line.
+	#
+	# Process one command line and exit.
+	# @param cmd the command line
+
+	def __processCommand(self, cmd):
+		if len(cmd) == 1 and cmd[0] == "start":
+			if self.__ping():
+				logSys.error("Server already running")
+				return False
+			else:
+				# Read the config
+				ret = self.__readConfig()
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
+				# verify that directory for the socket file exists
+				socket_dir = os.path.dirname(self.__conf["socket"])
+				if not os.path.exists(socket_dir):
+					logSys.error(
+						"There is no directory %s to contain the socket file %s."
+						% (socket_dir, self.__conf["socket"]))
+					return False
+				if not os.access(socket_dir, os.W_OK | os.X_OK):
+					logSys.error(
+						"Directory %s exists but not accessible for writing"
+						% (socket_dir,))
+					return False
+				# Start the server
+				self.__startServerAsync(self.__conf["socket"],
+										self.__conf["pidfile"],
+										self.__conf["force"],
+										self.__conf["background"])
+				try:
+					# Wait for the server to start
+					self.__waitOnServer()
+					# Configure the server
+					self.__processCmd(self.__stream, False)
+					return True
+				except ServerExecutionException:
+					logSys.error("Could not start server. Maybe an old "
+								 "socket file is still present. Try to "
+								 "remove " + self.__conf["socket"] + ". If "
+								 "you used fail2ban-client to start the "
+								 "server, adding the -x option will do it")
+					return False
+		elif len(cmd) == 1 and cmd[0] == "reload":
+			if self.__ping():
+				ret = self.__readConfig()
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
+				self.__processCmd([['stop', 'all']], False)
+				# Configure the server
+				return self.__processCmd(self.__stream, False)
+			else:
+				logSys.error("Could not find server")
+				return False
+		elif len(cmd) == 2 and cmd[0] == "reload":
+			if self.__ping():
+				jail = cmd[1]
+				ret = self.__readConfig(jail)
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
+				self.__processCmd([['stop', jail]], False)
+				# Configure the server
+				return self.__processCmd(self.__stream, False)
+			else:
+				logSys.error("Could not find server")
+				return False
+		else:
+			return self.__processCmd([cmd])
+
+
+	##
+	# Start Fail2Ban server.
+	#
+	# Start the Fail2ban server in daemon mode.
+
+	def __startServerAsync(self, socket, pidfile, force = False, background = True):
+		# Forks the current process.
+		pid = os.fork()
+		if pid == 0:
+			args = list()
+			args.append(self.SERVER)
+			# Set the socket path.
+			args.append("-s")
+			args.append(socket)
+			# Set the pidfile
+			args.append("-p")
+			args.append(pidfile)
+			# Force the execution if needed.
+			if force:
+				args.append("-x")
+			# Start in foreground mode if requested.
+			if background:
+				args.append("-b")
+			else:
+				args.append("-f")
+			
+			try:
+				# Use the current directory.
+				exe = os.path.abspath(os.path.join(sys.path[0], self.SERVER))
+				logSys.debug("Starting %r with args %r" % (exe, args))
+				os.execv(exe, args)
+			except OSError:
+				try:
+					# Use the PATH env.
+					logSys.warning("Initial start attempt failed.  Starting %r with the same args" % (self.SERVER,))
+					os.execvp(self.SERVER, args)
+				except OSError:
+					logSys.error("Could not start %s" % self.SERVER)
+					os.exit(-1)
+
+	def __waitOnServer(self):
+		# Wait for the server to start
+		cnt = 0
+		if self.__conf["verbose"] > 1:
+			pos = 0
+			delta = 1
+			mask = "[          ]"
+		while not self.__ping():
+			# Wonderful visual :)
+			if self.__conf["verbose"] > 1:
+				pos += delta
+				sys.stdout.write("\rINFO   " + mask[:pos] + '#' + mask[pos+1:] +
+								 " Waiting on the server...")
+				sys.stdout.flush()
+				if pos > len(mask)-3:
+					delta = -1
+				elif pos < 2:
+					delta = 1
+			# The server has 30 seconds to start.
+			if cnt >= 300:
+				if self.__conf["verbose"] > 1:
+					sys.stdout.write('\n')
+				raise ServerExecutionException("Failed to start server")
+			time.sleep(0.1)
+			cnt += 1
+		if self.__conf["verbose"] > 1:
+			sys.stdout.write('\n')
+
+
+	def start(self, argv):
+		# Command line options
+		self.__argv = argv
+
+		# Install signal handlers
+		signal.signal(signal.SIGTERM, self.__sigTERMhandler)
+		signal.signal(signal.SIGINT, self.__sigTERMhandler)
+
+		# Reads the command line options.
+		try:
+			cmdOpts = 'hc:s:p:xfbdviqV'
+			cmdLongOpts = ['help', 'version']
+			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
+		except getopt.GetoptError:
+			self.dispUsage()
+			return False
+
+		self.__getCmdLineOptions(optList)
+
+		verbose = self.__conf["verbose"]
+		if verbose <= 0:
+			logSys.setLevel(logging.ERROR)
+		elif verbose == 1:
+			logSys.setLevel(logging.WARNING)
+		elif verbose == 2:
+			logSys.setLevel(logging.INFO)
+		elif verbose == 3:
+			logSys.setLevel(logging.DEBUG)
+		else:
+			logSys.setLevel(logging.HEAVYDEBUG)
+		# Add the default logging handler to dump to stderr
+		logout = logging.StreamHandler(sys.stderr)
+		# set a format which is simpler for console use
+		formatter = logging.Formatter('%(levelname)-6s %(message)s')
+		# tell the handler to use this format
+		logout.setFormatter(formatter)
+		logSys.addHandler(logout)
+
+		# Set the configuration path
+		self.__configurator.setBaseDir(self.__conf["conf"])
+
+		# Set socket path
+		self.__configurator.readEarly()
+		conf = self.__configurator.getEarlyOptions()
+		if self.__conf["socket"] is None:
+			self.__conf["socket"] = conf["socket"]
+		if self.__conf["pidfile"] is None:
+			self.__conf["pidfile"] = conf["pidfile"]
+		logSys.info("Using socket file " + self.__conf["socket"])
+
+		if self.__conf["dump"]:
+			ret = self.__readConfig()
+			self.dumpConfig(self.__stream)
+			return ret
+
+		# Interactive mode
+		if self.__conf["interactive"]:
+			try:
+				import readline
+			except ImportError:
+				logSys.error("Readline not available")
+				return False
+			try:
+				ret = True
+				if len(args) > 0:
+					ret = self.__processCommand(args)
+				if ret:
+					readline.parse_and_bind("tab: complete")
+					self.dispInteractive()
+					while True:
+						cmd = raw_input(self.PROMPT)
+						if cmd == "exit" or cmd == "quit":
+							# Exit
+							return True
+						if cmd == "help":
+							self.dispUsage()
+						elif not cmd == "":
+							try:
+								self.__processCommand(shlex.split(cmd))
+							except Exception as e:
+								logSys.error(e)
+			except (EOFError, KeyboardInterrupt):
+				print
+				return True
+		# Single command mode
+		else:
+			if len(args) < 1:
+				self.dispUsage()
+				return False
+			return self.__processCommand(args)
+
+	def __readConfig(self, jail=None):
+		# Read the configuration
+		# TODO: get away from stew of return codes and exception
+		# handling -- handle via exceptions
+		try:
+			self.__configurator.Reload()
+			self.__configurator.readAll()
+			ret = self.__configurator.getOptions(jail)
+			self.__configurator.convertToProtocol()
+			self.__stream = self.__configurator.getConfigStream()
+		except Exception as e:
+			logSys.error("Failed during configuration: %s" % e)
+			ret = False
+		return ret
+
+	@staticmethod
+	def dumpConfig(cmd):
+		for c in cmd:
+			print c
+		return True
+
+
+class ServerExecutionException(Exception):
+	pass
+
+if __name__ == "__main__": # pragma: no cover - can't test main
+	client = Fail2banClient()
+	# Exit with correct return value
+	if client.start(sys.argv):
+		sys.exit(0)
+	else:
+		sys.exit(-1)

bin/fail2ban-regex

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
 # vi: set ft=python sts=4 ts=4 sw=4 noet :
 #

bin/fail2ban-server

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
 # vi: set ft=python sts=4 ts=4 sw=4 noet :
 
@@ -18,20 +18,123 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-"""
-Fail2Ban reads log file that contains password failure report
-and bans the corresponding IP addresses using firewall rules.
-
-This tool starts/stops fail2ban server or does client/server communication
-to change/read parameters of the server or jails.
-
-"""
-
-__author__ = "Fail2Ban Developers"
-__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko, 2014-2016 Serg G. Brester"
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from fail2ban.client.fail2banserver import exec_command_line, sys
+import getopt
+import os
+import sys
+
+from fail2ban.version import version
+from fail2ban.server.server import Server
+from fail2ban.helpers import getLogger
+
+# Gets the instance of the logger.
+logSys = getLogger("fail2ban")
+
+##
+# \mainpage Fail2Ban
+#
+# \section Introduction
+#
+# Fail2ban is designed to protect your server against brute force attacks.
+# Its first goal was to protect a SSH server.
+
+class Fail2banServer:
+
+	def __init__(self):
+		self.__server = None
+		self.__argv = None
+		self.__conf = dict()
+		self.__conf["background"] = True
+		self.__conf["force"] = False
+		self.__conf["socket"] = "/var/run/fail2ban/fail2ban.sock"
+		self.__conf["pidfile"] = "/var/run/fail2ban/fail2ban.pid"
+
+	def dispVersion(self):
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+
+	def dispUsage(self):
+		""" Prints Fail2Ban command line options and exits
+		"""
+		print "Usage: "+self.__argv[0]+" [OPTIONS]"
+		print
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+		print "Only use this command for debugging purpose. Start the server with"
+		print "fail2ban-client instead. The default behaviour is to start the server"
+		print "in background."
+		print
+		print "Options:"
+		print "    -b                   start in background"
+		print "    -f                   start in foreground"
+		print "    -s <FILE>            socket path"
+		print "    -p <FILE>            pidfile path"
+		print "    -x                   force execution of the server (remove socket file)"
+		print "    -h, --help           display this help message"
+		print "    -V, --version        print the version"
+		print
+		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
+
+	def __getCmdLineOptions(self, optList):
+		""" Gets the command line options
+		"""
+		for opt in optList:
+			if opt[0] == "-b":
+				self.__conf["background"] = True
+			if opt[0] == "-f":
+				self.__conf["background"] = False
+			if opt[0] == "-s":
+				self.__conf["socket"] = opt[1]
+			if opt[0] == "-p":
+				self.__conf["pidfile"] = opt[1]
+			if opt[0] == "-x":
+				self.__conf["force"] = True
+			if opt[0] in ["-h", "--help"]:
+				self.dispUsage()
+				sys.exit(0)
+			if opt[0] in ["-V", "--version"]:
+				self.dispVersion()
+				sys.exit(0)
+
+	def start(self, argv):
+		# Command line options
+		self.__argv = argv
+
+		# Reads the command line options.
+		try:
+			cmdOpts = 'bfs:p:xhV'
+			cmdLongOpts = ['help', 'version']
+			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
+		except getopt.GetoptError:
+			self.dispUsage()
+			sys.exit(-1)
+
+		self.__getCmdLineOptions(optList)
+
+		try:
+			self.__server = Server(self.__conf["background"])
+			self.__server.start(self.__conf["socket"],
+								self.__conf["pidfile"],
+								self.__conf["force"])
+			return True
+		except Exception as e:
+			logSys.exception(e)
+			self.__server.quit()
+			return False
 
 if __name__ == "__main__":
-	exec_command_line(sys.argv)
+	server = Fail2banServer()
+	if server.start(sys.argv):
+		sys.exit(0)
+	else:
+		sys.exit(-1)

bin/fail2ban-testcases

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
 # vi: set ft=python sts=4 ts=4 sw=4 noet :
 """Script to run Fail2Ban tests battery
@@ -30,15 +30,19 @@ import sys
 import time
 import unittest
 
-# Check if local fail2ban module exists, and use if it exists by
-# modifying the path. This is done so that tests can be used in dev
+# Check if local fail2ban module exists, and use if it exists by 
+# modifying the path. This is such that tests can be used in dev
 # environment.
 if os.path.exists("fail2ban/__init__.py"):
 	sys.path.insert(0, ".")
 from fail2ban.version import version
 
-from fail2ban.tests.utils import getOptParser, initProcess, gatherTests
+from fail2ban.tests.utils import gatherTests
+from fail2ban.helpers import FormatterWithTraceBack, getLogger
 from fail2ban.setup import updatePyExec
+from fail2ban.server.mytime import MyTime
+
+from optparse import OptionParser, Option
 
 # Update fail2ban-python env to current python version (where f2b-modules located/installed)
 bindir = os.path.dirname(
@@ -47,19 +51,84 @@ bindir = os.path.dirname(
 )
 updatePyExec(bindir)
 
-(opts, regexps) = getOptParser(__doc__).parse_args()
+def get_opt_parser():
+	# use module docstring for help output
+	p = OptionParser(
+				usage="%s [OPTIONS] [regexps]\n" % sys.argv[0] + __doc__,
+				version="%prog " + version)
+
+	p.add_options([
+		Option('-l', "--log-level", type="choice",
+			   dest="log_level",
+			   choices=('heavydebug', 'debug', 'info', 'notice', 'warning', 'error', 'critical'),
+			   default=None,
+			   help="Log level for the logger to use during running tests"),
+		Option('-n', "--no-network", action="store_true",
+			   dest="no_network",
+			   help="Do not run tests that require the network"),
+		Option("-t", "--log-traceback", action='store_true',
+			   help="Enrich log-messages with compressed tracebacks"),
+		Option("--full-traceback", action='store_true',
+			   help="Either to make the tracebacks full, not compressed (as by default)"),
+
+		])
+
+	return p
+
+parser = get_opt_parser()
+(opts, regexps) = parser.parse_args()
 
 #
-# Process initialization corresponding options (logging, default options, etc.)
+# Logging
 #
-opts = initProcess(opts)
-verbosity = opts.verbosity
+logSys = getLogger("fail2ban")
+
+# Numerical level of verbosity corresponding to a log "level"
+verbosity = {'heavydebug': 4,
+			 'debug': 3,
+			 'info': 2,
+			 'notice': 2,
+			 'warning': 1,
+			 'error': 1,
+			 'critical': 0,
+			 None: 1}[opts.log_level]
+
+if opts.log_level is not None: # pragma: no cover
+	# so we had explicit settings
+	logSys.setLevel(getattr(logging, opts.log_level.upper()))
+else: # pragma: no cover
+	# suppress the logging but it would leave unittests' progress dots
+	# ticking, unless like with '-l critical' which would be silent
+	# unless error occurs
+	logSys.setLevel(getattr(logging, 'CRITICAL'))
+
+# Add the default logging handler
+stdout = logging.StreamHandler(sys.stdout)
+
+fmt = ' %(message)s'
+
+if opts.log_traceback:
+	Formatter = FormatterWithTraceBack
+	fmt = (opts.full_traceback and ' %(tb)s' or ' %(tbc)s') + fmt
+else:
+	Formatter = logging.Formatter
+
+# Custom log format for the verbose tests runs
+if verbosity > 1: # pragma: no cover
+	stdout.setFormatter(Formatter(' %(asctime)-15s %(thread)s' + fmt))
+else: # pragma: no cover
+	# just prefix with the space
+	stdout.setFormatter(Formatter(fmt))
+logSys.addHandler(stdout)
 
 #
-# Gather tests (and filter corresponding options)
+# Let know the version
 #
-tests = gatherTests(regexps, opts)
+if not opts.log_level or opts.log_level != 'critical': # pragma: no cover
+	print("Fail2ban %s test suite. Python %s. Please wait..." \
+	    % (version, str(sys.version).replace('\n', '')))
 
+tests = gatherTests(regexps, opts.no_network)
 #
 # Run the tests
 #

config/action.d/abuseipdb.conf

@@ -1,105 +0,0 @@
-# Fail2ban configuration file
-#
-# Action to report IP address to abuseipdb.com
-# You must sign up to obtain an API key from abuseipdb.com.
-#
-# NOTE: These reports may include sensitive Info.
-# If you want cleaner reports that ensure no user data see the helper script at the below website.
-#
-# IMPORTANT:
-#
-# Reporting an IP of abuse is a serious complaint. Make sure that it is
-# serious. Fail2ban developers and network owners recommend you only use this
-# action for:
-#   * The recidive where the IP has been banned multiple times
-#   * Where maxretry has been set quite high, beyond the normal user typing
-#     password incorrectly.
-#   * For filters that have a low likelihood of receiving human errors
-#
-# This action relies on a api_key being added to the above action conf,
-# and the appropriate categories set.
-#
-# Example, for ssh bruteforce (in section [sshd] of `jail.local`): 
-#   action = %(known/action)s
-#            %(action_abuseipdb)s[abuseipdb_apikey="my-api-key", abuseipdb_category="18,22"]
-#
-# See below for catagories.
-#
-# Original Ref: https://wiki.shaunc.com/wikka.php?wakka=ReportingToAbuseIPDBWithFail2Ban
-# Added to fail2ban by Andrew James Collett (ajcollett)
-
-## abuseIPDB Catagories, `the abuseipdb_category` MUST be set in the jail.conf action call.
-# Example, for ssh bruteforce: action = %(action_abuseipdb)s[abuseipdb_category="18,22"]
-# ID	Title	Description
-# 3	  Fraud Orders
-# 4	  DDoS Attack
-# 9	  Open Proxy
-# 10	Web Spam
-# 11	Email Spam
-# 14	Port Scan
-# 18	Brute-Force
-# 19	Bad Web Bot
-# 20	Exploited Host
-# 21	Web App Attack
-# 22	SSH	Secure Shell (SSH) abuse. Use this category in combination with more specific categories.
-# 23	IoT Targeted
-# See https://abuseipdb.com/categories for more descriptions
-
-[Definition]
-
-# bypass action for restored tickets
-norestored = 1
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-#
-#          ** IMPORTANT! **
-#
-#          By default, this posts directly to AbuseIPDB's API, unfortunately
-#          this results in a lot of backslashes/escapes appearing in the
-#          reports. This also may include info like your hostname.
-#          If you have your own web server with PHP available, you can
-#          use my (Shaun's) helper PHP script by commenting out the first #actionban
-#          line below, uncommenting the second one, and pointing the URL at
-#          wherever you install the helper script. For the PHP helper script, see
-#          <https://wiki.shaunc.com/wikka.php?wakka=ReportingToAbuseIPDBWithFail2Ban>
-#
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = lgm=$(printf '%%.1000s\n...' "<matches>"); curl -sSf "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: <abuseipdb_apikey>" --data-urlencode "comment=$lgm" --data-urlencode "ip=<ip>" --data "categories=<abuseipdb_category>"
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
-[Init]
-# Option:  abuseipdb_apikey
-# Notes    Your API key from abuseipdb.com
-# Values:  STRING  Default: None
-# Register for abuseipdb [https://www.abuseipdb.com], get api key and set below.
-# You will need to set the category in the action call.
-abuseipdb_apikey =

config/action.d/badips.py

@@ -18,25 +18,23 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 import sys
-if sys.version_info < (2, 7): # pragma: no cover
+if sys.version_info < (2, 7):
 	raise ImportError("badips.py action requires Python >= 2.7")
 import json
 import threading
 import logging
-if sys.version_info >= (3, ): # pragma: 2.x no cover
+if sys.version_info >= (3, ):
 	from urllib.request import Request, urlopen
 	from urllib.parse import urlencode
 	from urllib.error import HTTPError
-else: # pragma: 3.x no cover
+else:
 	from urllib2 import Request, urlopen, HTTPError
 	from urllib import urlencode
 
-from fail2ban.server.actions import Actions, ActionBase, BanTicket
-from fail2ban.helpers import splitwords, str2LogLevel
+from fail2ban.server.actions import ActionBase
 
 
-
-class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable
+class BadIPsAction(ActionBase):
 	"""Fail2Ban action which reports bans to badips.com, and also
 	blacklist bad IPs listed on badips.com by using another action's
 	ban method.
@@ -54,6 +52,9 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable
 	age : str, optional
 		Age of last report for bad IPs, per badips.com syntax.
 		Default "24h" (24 hours)
+	key : str, optional
+		Key issued by badips.com to report bans, for later retrieval
+		of personalised content.
 	banaction : str, optional
 		Name of banaction to use for blacklisting bad IPs. If `None`,
 		no blacklist of IPs will take place.
@@ -64,17 +65,11 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable
 		"postfix", but want to use whole "mail" category for blacklist.
 		Default `category`.
 	bankey : str, optional
-		Key issued by badips.com to retrieve personal list
-		of blacklist IPs.
+		Key issued by badips.com to blacklist IPs reported with the
+		associated key.
 	updateperiod : int, optional
 		Time in seconds between updating bad IPs blacklist.
 		Default 900 (15 minutes)
-	loglevel : int/str, optional
-		Log level of the message when an IP is (un)banned.
-		Default `DEBUG`.
-		Can be also supplied as two-value list (comma- or space separated) to
-		provide level of the summary message when a group of IPs is (un)banned.
-		Example `DEBUG,INFO`.
 	agent : str, optional
 		User agent transmitted to server.
 		Default `Fail2Ban/ver.`
@@ -86,13 +81,13 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable
 	"""
 
 	TIMEOUT = 10
-	_badips = "https://www.badips.com"
+	_badips = "http://www.badips.com"
 	def _Request(self, url, **argv):
 		return Request(url, headers={'User-Agent': self.agent}, **argv)
 
-	def __init__(self, jail, name, category, score=3, age="24h",
-		banaction=None, bancategory=None, bankey=None, updateperiod=900, 
-		loglevel='DEBUG', agent="Fail2Ban", timeout=TIMEOUT):
+	def __init__(self, jail, name, category, score=3, age="24h", key=None,
+		banaction=None, bancategory=None, bankey=None, updateperiod=900, agent="Fail2Ban", 
+		timeout=TIMEOUT):
 		super(BadIPsAction, self).__init__(jail, name)
 
 		self.timeout = timeout
@@ -100,37 +95,16 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable
 		self.category = category
 		self.score = score
 		self.age = age
+		self.key = key
 		self.banaction = banaction
 		self.bancategory = bancategory or category
 		self.bankey = bankey
-		loglevel = splitwords(loglevel)
-		self.sumloglevel = str2LogLevel(loglevel[-1])
-		self.loglevel = str2LogLevel(loglevel[0])
 		self.updateperiod = updateperiod
 
 		self._bannedips = set()
 		# Used later for threading.Timer for updating badips
 		self._timer = None
 
-	@staticmethod
-	def isAvailable(timeout=1):
-		try:
-			response = urlopen(Request("/".join([BadIPsAction._badips]),
-					headers={'User-Agent': "Fail2Ban"}), timeout=timeout)
-			return True, ''
-		except Exception as e: # pragma: no cover
-			return False, e
-
-	def logError(self, response, what=''): # pragma: no cover - sporadical (502: Bad Gateway, etc)
-		messages = {}
-		try:
-			messages = json.loads(response.read().decode('utf-8'))
-		except:
-			pass
-		self._logSys.error(
-			"%s. badips.com response: '%s'", what,
-				messages.get('err', 'Unknown'))
-
 	def getCategories(self, incParents=False):
 		"""Get badips.com categories.
 
@@ -149,8 +123,11 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable
 		try:
 			response = urlopen(
 				self._Request("/".join([self._badips, "get", "categories"])), timeout=self.timeout)
-		except HTTPError as response: # pragma: no cover
-			self.logError(response, "Failed to fetch categories")
+		except HTTPError as response:
+			messages = json.loads(response.read().decode('utf-8'))
+			self._logSys.error(
+				"Failed to fetch categories. badips.com response: '%s'",
+				messages['err'])
 			raise
 		else:
 			response_json = json.loads(response.read().decode('utf-8'))
@@ -199,10 +176,12 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable
 				urlencode({'age': age})])
 			if key:
 				url = "&".join([url, urlencode({'key': key})])
-			self._logSys.debug('badips.com: get list, url: %r', url)
 			response = urlopen(self._Request(url), timeout=self.timeout)
-		except HTTPError as response: # pragma: no cover
-			self.logError(response, "Failed to fetch bad IP list")
+		except HTTPError as response:
+			messages = json.loads(response.read().decode('utf-8'))
+			self._logSys.error(
+				"Failed to fetch bad IP list. badips.com response: '%s'",
+				messages['err'])
 			raise
 		else:
 			return set(response.read().decode('utf-8').split())
@@ -230,7 +209,7 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable
 
 	@bancategory.setter
 	def bancategory(self, bancategory):
-		if bancategory != "any" and bancategory not in self.getCategories(incParents=True):
+		if bancategory not in self.getCategories(incParents=True):
 			self._logSys.error("Category name '%s' not valid. "
 				"see badips.com for list of valid categories",
 				bancategory)
@@ -282,8 +261,13 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable
 	def _banIPs(self, ips):
 		for ip in ips:
 			try:
-				ai = Actions.ActionInfo(BanTicket(ip), self._jail)
-				self._jail.actions[self.banaction].ban(ai)
+				self._jail.actions[self.banaction].ban({
+					'ip': ip,
+					'failures': 0,
+					'matches': "",
+					'ipmatches': "",
+					'ipjailmatches': "",
+				})
 			except Exception as e:
 				self._logSys.error(
 					"Error banning IP %s for jail '%s' with action '%s': %s",
@@ -291,22 +275,27 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable
 					exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG)
 			else:
 				self._bannedips.add(ip)
-				self._logSys.log(self.loglevel,
+				self._logSys.info(
 					"Banned IP %s for jail '%s' with action '%s'",
 					ip, self._jail.name, self.banaction)
 
 	def _unbanIPs(self, ips):
 		for ip in ips:
 			try:
-				ai = Actions.ActionInfo(BanTicket(ip), self._jail)
-				self._jail.actions[self.banaction].unban(ai)
+				self._jail.actions[self.banaction].unban({
+					'ip': ip,
+					'failures': 0,
+					'matches': "",
+					'ipmatches': "",
+					'ipjailmatches': "",
+				})
 			except Exception as e:
-				self._logSys.error(
+				self._logSys.info(
 					"Error unbanning IP %s for jail '%s' with action '%s': %s",
 					ip, self._jail.name, self.banaction, e,
 					exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG)
 			else:
-				self._logSys.log(self.loglevel,
+				self._logSys.info(
 					"Unbanned IP %s for jail '%s' with action '%s'",
 					ip, self._jail.name, self.banaction)
 			finally:
@@ -334,19 +323,12 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable
 				ips = self.getList(
 					self.bancategory, self.score, self.age, self.bankey)
 				# Remove old IPs no longer listed
-				s = self._bannedips - ips
-				m = len(s)
-				self._unbanIPs(s)
+				self._unbanIPs(self._bannedips - ips)
 				# Add new IPs which are now listed
-				s = ips - self._bannedips
-				p = len(s)
-				self._banIPs(s)
-				if m != 0 or p != 0:
-					self._logSys.log(self.sumloglevel,
-						"Updated IPs for jail '%s' (-%d/+%d)",
-						self._jail.name, m, p)
-				self._logSys.debug(
-					"Next update for jail '%' in %i seconds",
+				self._banIPs(ips - self._bannedips)
+
+				self._logSys.info(
+					"Updated IPs for jail '%s'. Update again in %i seconds",
 					self._jail.name, self.updateperiod)
 			finally:
 				self._timer = threading.Timer(self.updateperiod, self.update)
@@ -376,15 +358,19 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable
 			Any issues with badips.com request.
 		"""
 		try:
-			url = "/".join([self._badips, "add", self.category, str(aInfo['ip'])])
-			self._logSys.debug('badips.com: ban, url: %r', url)
+			url = "/".join([self._badips, "add", self.category, aInfo['ip']])
+			if self.key:
+				url = "?".join([url, urlencode({'key': self.key})])
 			response = urlopen(self._Request(url), timeout=self.timeout)
-		except HTTPError as response: # pragma: no cover
-			self.logError(response, "Failed to ban")
+		except HTTPError as response:
+			messages = json.loads(response.read().decode('utf-8'))
+			self._logSys.error(
+				"Response from badips.com report: '%s'",
+				messages['err'])
 			raise
 		else:
 			messages = json.loads(response.read().decode('utf-8'))
-			self._logSys.debug(
+			self._logSys.info(
 				"Response from badips.com report: '%s'",
 				messages['suc'])
 

config/action.d/blocklist_de.conf

@@ -31,13 +31,13 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =
@@ -54,7 +54,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = curl --fail --data-urlencode "server=<email>" --data "apikey=<apikey>" --data "service=<service>" --data "ip=<ip>" --data-urlencode "logs=<matches><br>" --data 'format=text' --user-agent "<agent>" "https://www.blocklist.de/en/httpreports.html"
+actionban = curl --fail --data-urlencode 'server=<email>' --data 'apikey=<apikey>' --data 'service=<service>' --data 'ip=<ip>' --data-urlencode 'logs=<matches>' --data 'format=text' --user-agent "<agent>" "https://www.blocklist.de/en/httpreports.html"
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -64,6 +64,8 @@ actionban = curl --fail --data-urlencode "server=<email>" --data "apikey=<apikey
 #
 actionunban =
 
+[Init]
+
 # Option:  email
 # Notes    server email address, as per blocklist.de account
 # Values:  STRING  Default: None

config/action.d/bsd-ipfw.conf

@@ -11,14 +11,14 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = ipfw show | fgrep -c -m 1 -s 'table(<table>)' > /dev/null 2>&1 || ( ipfw show | awk 'BEGIN { b = <lowest_rule_num> } { if ($1 < b) {} else if ($1 == b) { b = $1 + 1 } else { e = b } } END { if (e) exit e <br> else exit b }'; num=$?; ipfw -q add $num <blocktype> <block> from table\(<table>\) to me <port>; echo $num > "<startstatefile>" )
 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =  [ ! -f <startstatefile> ] || ( read num < "<startstatefile>" <br> ipfw -q delete $num <br> rm "<startstatefile>" )
@@ -38,7 +38,7 @@ actioncheck =
 # Values:  CMD
 #
 # requires an ipfw rule like "deny ip from table(1) to me"
-actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || echo "$e" | grep -q "record already exists" || { echo "$e" 1>&2; exit $x; }
+actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || { echo "$e" 1>&2; exit $x; }
 
 
 # Option:  actionunban
@@ -47,7 +47,7 @@ actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ip
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = e=`ipfw table <table> delete <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || echo "$e" | grep -q "record not found" || { echo "$e" 1>&2; exit $x; }
+actionunban = e=`ipfw table <table> delete <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || { echo "$e" 1>&2; exit $x; }
 
 [Init]
 # Option:  table

config/action.d/cloudflare.conf

@@ -15,13 +15,13 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =

config/action.d/complain.conf

@@ -28,26 +28,16 @@
 #
 
 
-[INCLUDES]
-
-before = helpers-common.conf
-
 [Definition]
 
-# Used in test cases for coverage internal transformations
-debug = 0
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =
@@ -64,18 +54,10 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = oifs=${IFS};
-            RESOLVER_ADDR="%(addr_resolver)s"
-            if [ "<debug>" -gt 0 ]; then echo "try to resolve $RESOLVER_ADDR"; fi
-            ADDRESSES=$(dig +short -t txt -q $RESOLVER_ADDR | tr -d '"')
-            IFS=,; ADDRESSES=$(echo $ADDRESSES)
-            IFS=${oifs}
-            IP=<ip>
+actionban = oifs=${IFS}; IFS=.;SEP_IP=( <ip> ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs}
+	    IP=<ip>
             if [ ! -z "$ADDRESSES" ]; then
-                ( printf %%b "<message>\n"; date '+Note: Local timezone is %%z (%%Z)'; 
-                  printf %%b "\nLines containing failures of <ip> (max <grepmax>)\n";
-                  %(_grep_logs)s;
-                ) | <mailcmd> "Abuse from <ip>" <mailargs> $ADDRESSES
+                (printf %%b "<message>\n"; date '+Note: Local timezone is %%z (%%Z)'; grep -E '(^|[^0-9])<ip>([^0-9]|$)' <logpath>) | <mailcmd> "Abuse from <ip>" <mailargs> ${ADDRESSES//,/\" \"}
             fi
 
 # Option:  actionunban
@@ -86,12 +68,7 @@ actionban = oifs=${IFS};
 #
 actionunban =
 
-# Server as resolver used in dig command
-#
-addr_resolver = <ip-rev>abuse-contacts.abusix.org
-
-# Default message used for abuse content
-#
+[Init]
 message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to a abusix.com is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process.)\n\n This mail was generated by Fail2Ban.\nThe recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here: https://abusix.com/global-reporting/abuse-contact-db\nabusix.com is neither responsible nor liable for the content or accuracy of this message.\n
 
 # Path to the log files which contain relevant lines for the abuser IP
@@ -102,7 +79,7 @@ logpath = /dev/null
 # Notes.:  Your system mail command. Is passed 2 args: subject and recipient
 # Values:  CMD
 #
-mailcmd = mail -s
+mailcmd = mail -E 'set escape' -s
 
 # Option:  mailargs
 # Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
@@ -115,7 +92,3 @@ mailcmd = mail -s
 #
 mailargs =
 
-# Number of log lines to include in the email
-#
-#grepmax = 1000
-#grepopts = -m <grepmax>

config/action.d/dshield.conf

@@ -28,17 +28,14 @@
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile>.buffer ]; then
@@ -179,7 +176,7 @@ tcpflags =
 # Notes.:  Your system mail command. Is passed 2 args: subject and recipient
 # Values:  CMD
 #
-mailcmd = mail -s
+mailcmd = mail -E 'set escape' -s
 
 # Option:  mailargs
 # Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:

config/action.d/dummy.conf

@@ -7,26 +7,17 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = if [ ! -z '<target>' ]; then touch <target>; fi;
-              printf %%b "<init>\n" <to_target>
-              echo "%(debug)s started"
-
-# Option:  actionflush
-# Notes.:  command executed once to flush (clear) all IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = printf %%b "-*\n" <to_target>
-              echo "%(debug)s clear all"
+actionstart = touch /var/run/fail2ban/fail2ban.dummy
+              printf %%b "<init>\n" >> /var/run/fail2ban/fail2ban.dummy
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = if [ ! -z '<target>' ]; then rm -f <target>; fi;
-             echo "%(debug)s stopped"
+actionstop = rm -f /var/run/fail2ban/fail2ban.dummy
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -40,8 +31,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "+<ip>\n" <to_target>
-            echo "%(debug)s banned <ip> (family: <family>)"
+actionban = printf %%b "+<ip>\n" >> /var/run/fail2ban/fail2ban.dummy
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -49,15 +39,9 @@ actionban = printf %%b "+<ip>\n" <to_target>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = printf %%b "-<ip>\n" <to_target>
-              echo "%(debug)s unbanned <ip> (family: <family>)"
-
-
-debug = [<name>] <actname> <target> --
+actionunban = printf %%b "-<ip>\n" >> /var/run/fail2ban/fail2ban.dummy
 
 [Init]
 
 init = 123
 
-target = /var/run/fail2ban/fail2ban.dummy
-to_target = >> <target>

config/action.d/firewallcmd-allports.conf

@@ -6,26 +6,34 @@
 
 [INCLUDES]
 
-before = firewallcmd-common.conf
+before = iptables-common.conf
 
 [Definition]
 
-actionstart = firewall-cmd --direct --add-chain <family> filter f2b-<name>
-              firewall-cmd --direct --add-rule <family> filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 -j f2b-<name>
+actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
+              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -j f2b-<name>
 
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 -j f2b-<name>
-             firewall-cmd --direct --remove-rules <family> filter f2b-<name>
-             firewall-cmd --direct --remove-chain <family> filter f2b-<name>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -j f2b-<name>
+             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
+             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
 
 
 # Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-recidive$'
 
-actioncheck = firewall-cmd --direct --get-chains <family> filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
+actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
 
-actionban = firewall-cmd --direct --add-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
 
-actionunban = firewall-cmd --direct --remove-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+
+[Init]
+
+# Default name of the chain
+#
+name = default
+
+chain = INPUT_direct
 
 # DEV NOTES:
 #

config/action.d/firewallcmd-common.conf

@@ -1,76 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt
-#
-
-[Init]
-
-# Option:  name
-# Notes    Default name of the chain
-# Values:  STRING
-name = default
-
-# Option   port
-# Notes    Can also use port numbers separated by a comma and in rich-rules comma and/or space.
-# Value    STRING Default: 1:65535
-port = 1:65535
-
-# Option:  protocol
-# Notes    [ tcp | udp | icmp | all ]
-# Values:  STRING Default: tcp
-protocol = tcp
-
-# Option:  family(ipv4)
-# Notes    specifies the socket address family type
-# Values:  STRING  
-family = ipv4
-
-# Option:  chain
-# Notes    specifies the firewalld chain to which the Fail2Ban rules should be
-#          added
-# Values:  STRING  Default: INPUT_direct
-chain = INPUT_direct
-
-# Option:  zone
-# Notes    use command firewall-cmd --get-active-zones to see a list of all active zones. See firewalld man pages for more information on zones
-# Values:  STRING  Default: public
-zone = public
-
-# Option:  service
-# Notes    use command firewall-cmd --get-services to see a list of services available
-#          Examples services: amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps 
-#          freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos 
-#          kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s 
-#          postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy 
-#          telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
-# Values:  STRING Default: ssh 
-service = ssh
-
-# Option:  rejecttype (ipv4)
-# Notes    See iptables/firewalld man pages for ipv4 reject types. 
-# Values:  STRING
-rejecttype = icmp-port-unreachable
-
-# Option:  blocktype (ipv4/ipv6)
-# Notes    See iptables/firewalld man pages for jump targets. Common values are REJECT, 
-#          REJECT --reject-with icmp-port-unreachable, DROP
-# Values:  STRING
-blocktype = REJECT --reject-with <rejecttype>
-
-# Option:  rich-blocktype (ipv4/ipv6)
-# Notes    See firewalld man pages for jump targets. Common values are reject, 
-#          reject type="icmp-port-unreachable", drop
-# Values:  STRING
-rich-blocktype = reject type='<rejecttype>'
-
-[Init?family=inet6]
-
-# Option:  family(ipv6)
-# Notes    specifies the socket address family type
-# Values:  STRING  
-family = ipv6
-
-# Option:  rejecttype (ipv6)
-# Note:    See iptables/firewalld man pages for ipv6 reject types. 
-# Values:  STRING
-rejecttype = icmp6-port-unreachable

config/action.d/firewallcmd-ipset.conf

@@ -14,24 +14,20 @@
 
 [INCLUDES]
 
-before = firewallcmd-common.conf
+before = iptables-common.conf
 
 [Definition]
 
-actionstart = ipset create <ipmset> hash:ip timeout <default-timeout><familyopt>
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
+actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 <actiontype> -m set --match-set fail2ban-<name> src -j <blocktype>
 
-actionflush = ipset flush <ipmset>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 <actiontype> -m set --match-set fail2ban-<name> src -j <blocktype>
+             ipset flush fail2ban-<name>
+             ipset destroy fail2ban-<name>
 
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
-             <actionflush>
-             ipset destroy <ipmset>
+actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist
 
-actionban = ipset add <ipmset> <ip> timeout <bantime> -exist
-
-actionprolong = %(actionban)s
-
-actionunban = ipset del <ipmset> <ip> -exist
+actionunban = ipset del fail2ban-<name> <ip> -exist
 
 [Init]
 
@@ -42,11 +38,11 @@ actionunban = ipset del <ipmset> <ip> -exist
 #
 chain = INPUT_direct
 
-# Option: default-timeout
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
+# Option: bantime
+# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
 # Values:  [ NUM ]  Default: 600
 
-default-timeout = 600
+bantime = 600
 
 # Option: actiontype
 # Notes.: defines additions to the blocking rule
@@ -65,14 +61,6 @@ allports = -p <protocol>
 # Usage.: use in jail config:  banaction = firewallcmd-ipset[actiontype=<multiport>]
 multiport = -p <protocol> -m multiport --dports <port>
 
-ipmset = f2b-<name>
-familyopt =
-
-[Init?family=inet6]
-
-ipmset = f2b-<name>6
-familyopt = <sp>family inet6
-
 
 # DEV NOTES:
 #

config/action.d/firewallcmd-multiport.conf

@@ -5,22 +5,59 @@
 
 [INCLUDES]
 
-before = firewallcmd-common.conf
+before = iptables-common.conf
 
 [Definition]
 
-actionstart = firewall-cmd --direct --add-chain <family> filter f2b-<name>
-              firewall-cmd --direct --add-rule <family> filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
+              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
 
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             firewall-cmd --direct --remove-rules <family> filter f2b-<name>
-             firewall-cmd --direct --remove-chain <family> filter f2b-<name>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
+             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
 
 # Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$'
 
-actioncheck = firewall-cmd --direct --get-chains <family> filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
+actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
 
-actionban = firewall-cmd --direct --add-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+
+actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+
+[Init]
+
+# Default name of the chain
+name = default
+
+chain = INPUT_direct
+
+# Could also use port numbers separated by a comma. 
+port = 1:65535
+
+
+# Option:  protocol
+# Values:  [ tcp | udp | icmp | all ]
+
+protocol = tcp
+
+
+
+# DEV NOTES:
+#
+# Author: Donald Yandt 
+# Uses "FirewallD" instead of the "iptables daemon".
+#
+#
+# Output:
+# actionstart:
+# $ firewall-cmd --direct --add-chain ipv4 filter f2b-apache-modsecurity
+# success
+# $ firewall-cmd --direct --add-rule ipv4 filter f2b-apache-modsecurity 1000 -j RETURN
+# success
+# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 80,443 -j f2b-apache-modsecurity
+# success
+# actioncheck:
+# $ firewall-cmd --direct --get-chains ipv4 filter f2b-apache-modsecurity | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$'
+# f2b-apache-modsecurity
 
-actionunban = firewall-cmd --direct --remove-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>

config/action.d/firewallcmd-new.conf

@@ -4,23 +4,32 @@
 
 [INCLUDES]
 
-before = firewallcmd-common.conf
+before = iptables-common.conf
 
 [Definition]
 
-actionstart = firewall-cmd --direct --add-chain <family> filter f2b-<name>
-              firewall-cmd --direct --add-rule <family> filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
+              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
 
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             firewall-cmd --direct --remove-rules <family> filter f2b-<name>
-             firewall-cmd --direct --remove-chain <family> filter f2b-<name>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
+             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
 
-actioncheck = firewall-cmd --direct --get-chains <family> filter | sed -e 's, ,\n,g' | grep -q 'f2b-<name>$'
+actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q 'f2b-<name>$'
 
-actionban = firewall-cmd --direct --add-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
 
-actionunban = firewall-cmd --direct --remove-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+
+[Init]
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  [ STRING ]
+#
+chain = INPUT_direct
 
 # DEV NOTES:
 #

config/action.d/firewallcmd-rich-logging.conf

@@ -15,10 +15,6 @@
 # firewall-cmd [--zone=<zone>] --list-all
 # firewall-cmd [--zone=zone] --query-rich-rule='rule'
 
-[INCLUDES]
-
-before = firewallcmd-common.conf
-
 [Definition]
 
 actionstart = 
@@ -30,22 +26,40 @@ actioncheck =
 # you can also use zones and/or service names. 
 #
 # zone example: 
-# firewall-cmd --zone=<zone> --add-rich-rule="rule family='<family>' source address='<ip>' port port='<port>' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <rich-blocktype>"
-#
+# 	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' port port='<port>' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"
 # service name example:
-# firewall-cmd --zone=<zone> --add-rich-rule="rule family='<family>' source address='<ip>' service name='<service>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <rich-blocktype>"
-#
+#	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' service name='<service>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"
 # Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges separated by a comma or space for an example: http, https, 22-60, 18 smtp 
 
-actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='<family>' source address='<ip>' port port='$p' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <rich-blocktype>"; done
+actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"; done
 	   
-actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='<family>' source address='<ip>' port port='$p' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <rich-blocktype>"; done
+actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"; done
 
 [Init]
 
+name = default
+
 # log levels are "emerg", "alert", "crit", "error", "warning", "notice", "info" or "debug"
 level = info
 
 # log rate per minute
 rate = 1
 
+zone = public
+
+# use command firewall-cmd --get-services to see a list of services available
+#
+# Examples:
+#
+# amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps 
+# freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos 
+# kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s 
+# postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy 
+# telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
+
+service = ssh
+
+# reject types: 'icmp-net-unreachable', 'icmp-host-unreachable', 'icmp-port-unreachable', 'icmp-proto-unreachable', 
+# 'icmp-net-prohibited', 'icmp-host-prohibited', 'icmp-admin-prohibited' or 'tcp-reset'
+
+blocktype = reject type='icmp-port-unreachable'

config/action.d/firewallcmd-rich-rules.conf

@@ -13,10 +13,6 @@
 # firewall-cmd [--zone=<zone>] --list-all
 # firewall-cmd [--zone=zone] --query-rich-rule='rule'
 
-[INCLUDES]
-
-before = firewallcmd-common.conf
-
 [Definition]
 
 actionstart = 
@@ -28,15 +24,34 @@ actioncheck =
 #you can also use zones and/or service names. 
 #
 # zone example: 
-# firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' port port='<port>' protocol='<protocol>' <rich-blocktype>"
-#
+# 	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' port port='<port>' protocol='<protocol>' <blocktype>"
 # service name example:
-# firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' service name='<service>' <rich-blocktype>"
-#
+#	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' service name='<service>' <blocktype>"
 # Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges separated by a comma or space for an example: http, https, 22-60, 18 smtp 
 
-actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='<family>' source address='<ip>' port port='$p' protocol='<protocol>' <rich-blocktype>"; done
+actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' <blocktype>"; done
 	   
-actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='<family>' source address='<ip>' port port='$p' protocol='<protocol>' <rich-blocktype>"; done
+actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' <blocktype>"; done
 
+[Init]
 
+name = default
+
+zone = public
+
+# use command firewall-cmd --get-services to see a list of services available
+#
+# Examples:
+#
+# amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps 
+# freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos 
+# kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s 
+# postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy 
+# telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
+
+service = ssh
+
+# reject types: 'icmp-net-unreachable', 'icmp-host-unreachable', 'icmp-port-unreachable', 'icmp-proto-unreachable', 
+# 'icmp-net-prohibited', 'icmp-host-prohibited', 'icmp-admin-prohibited' or 'tcp-reset'
+
+blocktype = reject type='icmp-port-unreachable'

config/action.d/helpers-common.conf

@@ -1,17 +0,0 @@
-[DEFAULT]
-
-# Usage:
-#   _grep_logs_args = 'test'
-#   (printf %%b "Log-excerpt contains 'test':\n"; %(_grep_logs)s; printf %%b "Log-excerpt contains 'test':\n") | mail ...
-#
-_grep_logs = logpath="<logpath>"; grep <grepopts> %(_grep_logs_args)s $logpath | <greplimit>
-# options `-wF` used to match only whole words and fixed string (not as pattern)
-_grep_logs_args = -wF "<ip>"
-
-# Used for actions, that should not by executed if ticket was restored:
-_bypass_if_restored = if [ '<restored>' = '1' ]; then exit 0; fi;
-
-[Init]
-greplimit = tail -n <grepmax>
-grepmax = 1000
-grepopts = -m <grepmax>

config/action.d/hostsdeny.conf

@@ -8,13 +8,13 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = 
@@ -31,7 +31,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "<daemon_list>: <ip_value>\n" >> <file>
+actionban = IP=<ip> && printf %%b "<daemon_list>: $IP\n" >> <file>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -39,7 +39,7 @@ actionban = printf %%b "<daemon_list>: <ip_value>\n" >> <file>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = IP=$(echo "<ip_value>" | sed 's/[][\.]/\\\0/g') && sed -i "/^<daemon_list>: $IP$/d" <file>
+actionunban = IP=$(echo <ip> | sed 's/\./\\./g') && sed -i "/^<daemon_list>: $IP$/d" <file>
 
 [Init]
 
@@ -54,9 +54,3 @@ file = /etc/hosts.deny
 #          for hosts.deny/hosts_access. Default is all services.
 # Values:  STR  Default: ALL
 daemon_list = ALL
-
-# internal variable IP (to differentiate the IPv4 and IPv6 syntax, where it is enclosed in brackets):
-ip_value = <ip>
-
-[Init?family=inet6]
-ip_value = [<ip>]

config/action.d/ipfilter.conf

@@ -9,7 +9,7 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 # enable IPF if not already enabled
@@ -17,7 +17,7 @@ actionstart = /sbin/ipf -E
 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 # don't disable IPF with "/sbin/ipf -D", there may be other filters in use

config/action.d/ipfw.conf

@@ -8,14 +8,14 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 
 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = 

config/action.d/iptables-allports.conf

@@ -14,7 +14,7 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = <iptables> -N f2b-<name>
@@ -22,11 +22,11 @@ actionstart = <iptables> -N f2b-<name>
               <iptables> -I <chain> -p <protocol> -j f2b-<name>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = <iptables> -D <chain> -p <protocol> -j f2b-<name>
-             <actionflush>
+             <iptables> -F f2b-<name>
              <iptables> -X f2b-<name>
 
 # Option:  actioncheck

config/action.d/iptables-common.conf

@@ -6,9 +6,6 @@
 # used in all iptables based actions by default.
 #
 # The user can override the defaults in iptables-common.local
-#
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable (see new section Init?family=inet6)
 
 [INCLUDES]
 
@@ -16,15 +13,6 @@ after = iptables-blocktype.local
         iptables-common.local
 # iptables-blocktype.local is obsolete
 
-[Definition]
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = <iptables> -F f2b-<name>
-
-
 [Init]
 
 # Option:  chain
@@ -74,19 +62,3 @@ lockingopt = -w
 # Notes.:  Actual command to be executed, including common to all calls options
 # Values:  STRING
 iptables = iptables <lockingopt>
-
-
-[Init?family=inet6]
-
-# Option:  blocktype (ipv6)
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp6-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp6-port-unreachable
-
-# Option:  iptables (ipv6)
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-iptables = ip6tables <lockingopt>
-

config/action.d/iptables-ipset-proto4.conf

@@ -24,25 +24,18 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = ipset --create f2b-<name> iphash
               <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
 
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = ipset --flush f2b-<name>
-
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
-             <actionflush>
+             ipset --flush f2b-<name>
              ipset --destroy f2b-<name>
 
 # Option:  actionban

config/action.d/iptables-ipset-proto6-allports.conf

@@ -12,9 +12,6 @@
 #
 # If you are running on an older kernel you make need to patch in external
 # modules which probably won't be protocol version 6.
-#
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable (see new section Init?family=inet6)
 
 [INCLUDES]
 
@@ -23,25 +20,19 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipset create <ipmset> hash:ip timeout <default-timeout><familyopt>
-              <iptables> -I <chain> -m set --match-set <ipmset> src -j <blocktype>
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = ipset flush <ipmset>
+actionstart = ipset create f2b-<name> hash:ip timeout <bantime>
+              <iptables> -I <chain> -m set --match-set f2b-<name> src -j <blocktype>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -m set --match-set <ipmset> src -j <blocktype>
-             <actionflush>
-             ipset destroy <ipmset>
+actionstop = <iptables> -D <chain> -m set --match-set f2b-<name> src -j <blocktype>
+             ipset flush f2b-<name>
+             ipset destroy f2b-<name>
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -49,9 +40,7 @@ actionstop = <iptables> -D <chain> -m set --match-set <ipmset> src -j <blocktype
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add <ipmset> <ip> timeout <bantime> -exist
-
-actionprolong = %(actionban)s
+actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -59,21 +48,12 @@ actionprolong = %(actionban)s
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipset del <ipmset> <ip> -exist
+actionunban = ipset del f2b-<name> <ip> -exist
 
 [Init]
 
-# Option: default-timeout
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
+# Option: bantime
+# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
 # Values:  [ NUM ]  Default: 600
-
-default-timeout = 600
-
-ipmset = f2b-<name>
-familyopt =
-
-
-[Init?family=inet6]
-
-ipmset = f2b-<name>6
-familyopt = <sp>family inet6
+#
+bantime = 600

config/action.d/iptables-ipset-proto6.conf

@@ -12,9 +12,6 @@
 #
 # If you are running on an older kernel you make need to patch in external
 # modules.
-#
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable (see new section Init?family=inet6)
 
 [INCLUDES]
 
@@ -23,25 +20,19 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipset create <ipmset> hash:ip timeout <default-timeout><familyopt>
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = ipset flush <ipmset>
+actionstart = ipset create f2b-<name> hash:ip timeout <bantime>
+              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>
-             <actionflush>
-             ipset destroy <ipmset>
+actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
+             ipset flush f2b-<name>
+             ipset destroy f2b-<name>
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -49,9 +40,7 @@ actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add <ipmset> <ip> timeout <bantime> -exist
-
-actionprolong = %(actionban)s
+actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -59,21 +48,12 @@ actionprolong = %(actionban)s
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipset del <ipmset> <ip> -exist
+actionunban = ipset del f2b-<name> <ip> -exist
 
 [Init]
 
-# Option: default-timeout
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
+# Option: bantime
+# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
 # Values:  [ NUM ]  Default: 600
-
-default-timeout = 600
-
-ipmset = f2b-<name>
-familyopt =
-
-
-[Init?family=inet6]
-
-ipmset = f2b-<name>6
-familyopt = <sp>family inet6
+#
+bantime = 600

config/action.d/iptables-multiport-log.conf

@@ -16,7 +16,7 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = <iptables> -N f2b-<name>
@@ -26,19 +26,13 @@ actionstart = <iptables> -N f2b-<name>
               <iptables> -I f2b-<name>-log -j LOG --log-prefix "$(expr f2b-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
               <iptables> -A f2b-<name>-log -j <blocktype>
 
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = <iptables> -F f2b-<name>
-              <iptables> -F f2b-<name>-log
-
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             <actionflush>
+             <iptables> -F f2b-<name>
+             <iptables> -F f2b-<name>-log
              <iptables> -X f2b-<name>
              <iptables> -X f2b-<name>-log
 

config/action.d/iptables-multiport.conf

@@ -11,7 +11,7 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = <iptables> -N f2b-<name>
@@ -19,11 +19,11 @@ actionstart = <iptables> -N f2b-<name>
               <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             <actionflush>
+             <iptables> -F f2b-<name>
              <iptables> -X f2b-<name>
 
 # Option:  actioncheck

config/action.d/iptables-new.conf

@@ -13,7 +13,7 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = <iptables> -N f2b-<name>
@@ -21,11 +21,11 @@ actionstart = <iptables> -N f2b-<name>
               <iptables> -I <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = <iptables> -D <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
-             <actionflush>
+             <iptables> -F f2b-<name>
              <iptables> -X f2b-<name>
 
 # Option:  actioncheck

config/action.d/iptables-xt_recent-echo.conf

@@ -2,8 +2,7 @@
 #
 # Author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
 #
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable
+#
 
 [INCLUDES]
 
@@ -12,7 +11,7 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 # Changing iptables rules requires root privileges. If fail2ban is
@@ -23,36 +22,30 @@ before = iptables-common.conf
 # iptables-persistent package).
 # 
 # Explanation of the rule below:
-#    Check if any packets coming from an IP on the <iptname>
+#    Check if any packets coming from an IP on the f2b-<name>
 #    list have been seen in the last 3600 seconds. If yes, update the
 #    timestamp for this IP and drop the packet. If not, let the packet
 #    through.
 #
-#    Fail2ban inserts blacklisted hosts into the <iptname> list
+#    Fail2ban inserts blacklisted hosts into the f2b-<name> list
 #    and removes them from the list after some time, according to its
 #    own rules. The 3600 second timeout is independent and acts as a
 #    safeguard in case the fail2ban process dies unexpectedly. The
 #    shorter of the two timeouts actually matters.
-actionstart = if [ `id -u` -eq 0 ];then <iptables> -I <chain> -m recent --update --seconds 3600 --name <iptname> -j <blocktype>;fi
-
-# Option:  actionflush
-#
-# [TODO] Flushing is currently not implemented for xt_recent
-#
-actionflush = 
+actionstart = if [ `id -u` -eq 0 ];then <iptables> -I <chain> -m recent --update --seconds 3600 --name f2b-<name> -j <blocktype>;fi
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = echo / > /proc/net/xt_recent/<iptname>
-             if [ `id -u` -eq 0 ];then <iptables> -D <chain> -m recent --update --seconds 3600 --name <iptname> -j <blocktype>;fi
+actionstop = echo / > /proc/net/xt_recent/f2b-<name>
+             if [ `id -u` -eq 0 ];then <iptables> -D <chain> -m recent --update --seconds 3600 --name f2b-<name> -j <blocktype>;fi
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = test -e /proc/net/xt_recent/<iptname>
+actioncheck = test -e /proc/net/xt_recent/f2b-<name>
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -60,7 +53,7 @@ actioncheck = test -e /proc/net/xt_recent/<iptname>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = echo +<ip> > /proc/net/xt_recent/<iptname>
+actionban = echo +<ip> > /proc/net/xt_recent/f2b-<name>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -68,12 +61,7 @@ actionban = echo +<ip> > /proc/net/xt_recent/<iptname>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = echo -<ip> > /proc/net/xt_recent/<iptname>
+actionunban = echo -<ip> > /proc/net/xt_recent/f2b-<name>
 
 [Init]
 
-iptname              = f2b-<name>
-
-[Init?family=inet6]
-
-iptname = f2b-<name>6

config/action.d/iptables.conf

@@ -11,7 +11,7 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = <iptables> -N f2b-<name>
@@ -19,11 +19,11 @@ actionstart = <iptables> -N f2b-<name>
               <iptables> -I <chain> -p <protocol> --dport <port> -j f2b-<name>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = <iptables> -D <chain> -p <protocol> --dport <port> -j f2b-<name>
-             <actionflush>
+             <iptables> -F f2b-<name>
              <iptables> -X f2b-<name>
 
 # Option:  actioncheck

config/action.d/mail-buffered.conf

@@ -6,21 +6,18 @@
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = printf %%b "Hi,\n
               The jail <name> has been started successfully.\n
               Output will be buffered until <lines> lines are available.\n
               Regards,\n
-              Fail2Ban"|mail -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
+              Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started on `uname -n`" <dest>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile> ]; then
@@ -28,13 +25,13 @@ actionstop = if [ -f <tmpfile> ]; then
                  These hosts have been banned by Fail2Ban.\n
                  `cat <tmpfile>`
                  Regards,\n
-                 Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary from <fq-hostname>" <dest>
+                 Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: Summary from `uname -n`" <dest>
                  rm <tmpfile>
              fi
              printf %%b "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
+             Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -55,7 +52,7 @@ actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
                 These hosts have been banned by Fail2Ban.\n
                 `cat <tmpfile>`
                 \nRegards,\n
-                Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest>
+                Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: Summary" <dest>
                 rm <tmpfile>
             fi
 

config/action.d/mail-whois-common.conf

@@ -17,7 +17,7 @@ _whois = whois <ip> || echo "missing whois program"
 # character set before sending it to a mail program
 # make sure you have 'file' and 'iconv' commands installed when opting for that
 _whois_target_charset = UTF-8
-_whois_convert_charset = (%(_whois)s) |
+_whois_convert_charset = whois <ip> |
                          { WHOIS_OUTPUT=$(cat) ; WHOIS_CHARSET=$(printf %%b "$WHOIS_OUTPUT" | file -b --mime-encoding -) ; printf %%b "$WHOIS_OUTPUT" | iconv -f $WHOIS_CHARSET -t %(_whois_target_charset)s//TRANSLIT - ; }
 
 # choose between _whois and _whois_convert_charset in mail-whois-common.local

config/action.d/mail-whois-lines.conf

@@ -7,30 +7,26 @@
 [INCLUDES]
 
 before = mail-whois-common.conf
-         helpers-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = printf %%b "Hi,\n
               The jail <name> has been started successfully.\n
               Regards,\n
-              Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
+              Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: started on `uname -n`" <dest>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = printf %%b "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
+             Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: stopped on `uname -n`" <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -44,19 +40,15 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-
-_ban_mail_content = ( printf %%b "Hi,\n
+actionban = printf %%b "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n"
-            %(_whois_command)s;
-            printf %%b "\nLines containing failures of <ip> (max <grepmax>)\n";
-            %(_grep_logs)s;
-            printf %%b "\n
+            Here is more information about <ip> :\n
+            `%(_whois_command)s`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `grep -E <grepopts> '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
             Regards,\n
-            Fail2Ban" )
-
-actionban = %(_ban_mail_content)s | <mailcmd> "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
+            Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: banned <ip> from  `uname -n`" <dest>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -72,7 +64,7 @@ actionunban =
 # Notes.:  Your system mail command. Is passed 2 args: subject and recipient
 # Values:  CMD
 #
-mailcmd = mail -s
+mailcmd = mail -E 'set escape' -s
 
 # Default name of the chain
 #
@@ -88,5 +80,4 @@ logpath = /dev/null
 
 # Number of log lines to include in the email
 #
-#grepmax = 1000
-#grepopts = -m <grepmax>
+grepopts = -m 1000

config/action.d/mail-whois.conf

@@ -10,26 +10,23 @@ before = mail-whois-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = printf %%b "Hi,\n
               The jail <name> has been started successfully.\n
               Regards,\n
-              Fail2Ban"|mail -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
+              Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started on `uname -n`" <dest>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = printf %%b "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
+             Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -49,7 +46,7 @@ actionban = printf %%b "Hi,\n
             Here is more information about <ip> :\n
             `%(_whois_command)s`\n
             Regards,\n
-            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
+            Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the

config/action.d/mail.conf

@@ -6,26 +6,23 @@
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = printf %%b "Hi,\n
               The jail <name> has been started successfully.\n
               Regards,\n
-              Fail2Ban"|mail -s "[Fail2Ban] <name>: started  on <fq-hostname>" <dest>
+              Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started  on `uname -n`" <dest>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = printf %%b "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
+             Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -43,7 +40,7 @@ actionban = printf %%b "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n
             Regards,\n
-            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
+            Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the

config/action.d/mynetwatchman.conf

@@ -28,13 +28,13 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =

config/action.d/nftables-allports.conf

@@ -6,12 +6,17 @@
 # Modified: Alexander Belykh <albel727@ngs.ru>
 #                       adapted for nftables
 #
-# Obsolete: superseded by nftables[type=allports]
 
 [INCLUDES]
 
-before = nftables.conf
+before = nftables-common.conf
 
 [Definition]
 
-type = allports
+# Option:  nftables_mode
+# Notes.:  additional expressions for nftables filter rule
+# Values:  nftables expressions
+#
+nftables_mode = ip protocol <protocol>
+
+[Init]

config/action.d/nftables-common.conf

@@ -0,0 +1,119 @@
+# Fail2Ban configuration file
+#
+# Author: Daniel Black
+# Author: Cyril Jaquier
+# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
+# 			made active on all ports from original iptables.conf
+# Modified: Alexander Belykh <albel727@ngs.ru>
+#                       adapted for nftables
+#
+# This is a included configuration file and includes the definitions for the nftables
+# used in all nftables based actions by default.
+#
+# The user can override the defaults in nftables-common.local
+
+[INCLUDES]
+
+after = nftables-common.local
+
+[Definition]
+
+# Option:  nftables_mode
+# Notes.:  additional expressions for nftables filter rule
+# Values:  nftables expressions
+#
+nftables_mode = <protocol> dport \{ <port> \}
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = <nftables> add set <nftables_family> <nftables_table> f2b-<name> \{ type <nftables_type>\; \}
+              <nftables> insert rule <nftables_family> <nftables_table> <chain> %(nftables_mode)s ip saddr @f2b-<name> <blocktype>
+
+_nft_list = <nftables> --handle --numeric list chain <nftables_family> <nftables_table> <chain>
+_nft_get_handle_id = grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep -oe ' handle [0-9]*'
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = HANDLE_ID=$(%(_nft_list)s | %(_nft_get_handle_id)s)
+             <nftables> delete rule <nftables_family> <nftables_table> <chain> $HANDLE_ID
+             <nftables> delete set <nftables_family> <nftables_table> f2b-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = <nftables> list chain <nftables_family> <nftables_table> <chain> | grep -q '@f2b-<name>[ \t]'
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = <nftables> add element <nftables_family> <nftables_table> f2b-<name> \{ <ip> \}
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = <nftables> delete element <nftables_family> <nftables_table> f2b-<name> \{ <ip> \}
+
+[Init]
+
+# Option:  nftables_type
+# Notes.:  address type to work with
+# Values:  [ipv4_addr | ipv6_addr]  Default: ipv4_addr
+#
+nftables_type = ipv4_addr
+
+# Option:  nftables_family
+# Notes.:  address family to work in
+# Values:  [ip | ip6 | inet]  Default: inet
+#
+nftables_family = inet
+
+# Option:  nftables_table
+# Notes.:  table in the address family to work in
+# Values:  STRING  Default: filter
+#
+nftables_table = filter
+
+# Option:  chain
+# Notes    specifies the nftables chain to which the Fail2Ban rules should be
+#          added
+# Values:  STRING  Default: input
+chain = input
+
+# Default name of the filtering set
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp ] Default: tcp
+#
+protocol = tcp
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the nftables man page (section 8). Common values are drop
+#          reject, reject with icmp type host-unreachable
+# Values:  STRING
+blocktype = reject
+
+# Option:  nftables
+# Notes.:  Actual command to be executed, including common to all calls options
+# Values:  STRING
+nftables = nft

config/action.d/nftables-multiport.conf

@@ -6,12 +6,17 @@
 # Modified: Alexander Belykh <albel727@ngs.ru>
 #                       adapted for nftables
 #
-# Obsolete: superseded by nftables[type=multiport]
 
 [INCLUDES]
 
-before = nftables.conf
+before = nftables-common.conf
 
 [Definition]
 
-type = multiport
+# Option:  nftables_mode
+# Notes.:  additional expressions for nftables filter rule
+# Values:  nftables expressions
+#
+nftables_mode = <protocol> dport \{ <port> \}
+
+[Init]

config/action.d/nftables.conf

@@ -1,203 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Daniel Black
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-# This is a included configuration file and includes the definitions for the nftables
-# used in all nftables based actions by default.
-#
-# The user can override the defaults in nftables-common.local
-# Example: redirect flow to honeypot
-#
-# [Init]
-# table_family = ip
-# chain_type = nat
-# chain_hook = prerouting
-# chain_priority = -50
-# blocktype = counter redirect to 2222
-
-[INCLUDES]
-
-after = nftables-common.local
-
-[Definition]
-
-# Option:  type
-# Notes.:  type of the action.
-# Values:  [ multiport | allports ]  Default: multiport
-#
-type = multiport
-
-rule_match-custom =
-rule_match-allports = meta l4proto \{ <protocol> \}
-rule_match-multiport = $proto dport \{ <port> \}
-match = <rule_match-<type>>
-
-# Option:  rule_stat
-# Notes.:  statement for nftables filter rule.
-#          leaving it empty will block all (include udp and icmp)
-# Values:  nftables statement
-#
-rule_stat = %(match)s <addr_family> saddr @<addr_set> <blocktype>
-
-# optional interator over protocol's:
-_nft_for_proto-custom-iter =
-_nft_for_proto-custom-done =
-_nft_for_proto-allports-iter =
-_nft_for_proto-allports-done =
-_nft_for_proto-multiport-iter = for proto in $(echo '<protocol>' | sed 's/,/ /g'); do
-_nft_for_proto-multiport-done = done
-
-_nft_list = <nftables> -a list chain <table_family> <table> <chain>
-_nft_get_handle_id = grep -oP '@<addr_set>\s+.*\s+\Khandle\s+(\d+)$'
-
-_nft_add_set = <nftables> add set <table_family> <table> <addr_set> \{ type <addr_type>\; \}
-              <_nft_for_proto-<type>-iter>
-              <nftables> add rule <table_family> <table> <chain> %(rule_stat)s
-              <_nft_for_proto-<type>-done>
-_nft_del_set = { %(_nft_list)s | %(_nft_get_handle_id)s; } | while read -r hdl; do
-               <nftables> delete rule <table_family> <table> <chain> $hdl; done
-              <nftables> delete set <table_family> <table> <addr_set>
-
-# Option:  _nft_shutdown_table
-# Notes.:  command executed after the stop in order to delete table (it checks that no sets are available):
-# Values:  CMD
-#
-_nft_shutdown_table = { <nftables> list table <table_family> <table> | grep -qP '^\s+set\s+'; } || {
-                        <nftables> delete table <table_family> <table>
-                      }
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = <nftables> add table <table_family> <table>
-              <nftables> -- add chain <table_family> <table> <chain> \{ type <chain_type> hook <chain_hook> priority <chain_priority> \; \}
-              %(_nft_add_set)s
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action);
-#          uses `nft flush set ...` and as fallback (e. g. unsupported) recreates the set (with references)
-# Values:  CMD
-#
-actionflush = { <nftables> flush set <table_family> <table> <addr_set> 2> /dev/null; } || {
-              %(_nft_del_set)s
-              %(_nft_add_set)s
-              }
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = %(_nft_del_set)s
-             <_nft_shutdown_table>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <nftables> list chain <table_family> <table> <chain> | grep -q '@<addr_set>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <nftables> add element <table_family> <table> <addr_set> \{ <ip> \}
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <nftables> delete element <table_family> <table> <addr_set> \{ <ip> \}
-
-[Init]
-
-# Option:  table
-# Notes.:  main table to store chain and sets (automatically created on demand)
-# Values:  STRING  Default: f2b-table
-table = f2b-table
-
-# Option:  table_family
-# Notes.:  address family to work in
-# Values:  [ip | ip6 | inet]  Default: inet
-table_family = inet
-
-# Option:  chain
-# Notes.:  main chain to store rules
-# Values:  STRING  Default: f2b-chain
-chain = f2b-chain
-
-# Option:  chain_type
-# Notes.:  refers to the kind of chain to be created
-# Values:  [filter | route | nat]  Default: filter
-#
-chain_type = filter
-
-# Option:  chain_hook
-# Notes.:  refers to the kind of chain to be created
-# Values:  [ prerouting | input | forward | output | postrouting ]  Default: input
-#
-chain_hook = input
-
-# Option:  chain_priority
-# Notes.:  priority in the chain.
-# Values:  NUMBER  Default: -1
-#
-chain_priority = -1
-
-# Option:  addr_type
-# Notes.:  address type to work with
-# Values:  [ipv4_addr | ipv6_addr]  Default: ipv4_addr
-#
-addr_type = ipv4_addr
-
-# Default name of the filtering set
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp ] Default: tcp
-#
-protocol = tcp
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the nftables man page (section 8). Common values are drop,
-#          reject, reject with icmpx type host-unreachable, redirect to 2222
-# Values:  STRING
-blocktype = reject
-
-# Option:  nftables
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-nftables = nft
-
-# Option: addr_set
-# Notes.: The name of the nft set used to store banned addresses
-# Values: STRING
-addr_set = addr-set-<name>
-
-# Option: addr_family
-# Notes.: The family of the banned addresses
-# Values: [ ip | ip6 ]
-addr_family = ip
-
-[Init?family=inet6]
-addr_family = ip6
-addr_type = ipv6_addr
-addr_set = addr6-set-<name>

config/action.d/nginx-block-map.conf

@@ -1,108 +0,0 @@
-# Fail2Ban configuration file for black-listing via nginx
-#
-# Author: Serg G. Brester (aka sebres)
-#
-# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration,
-# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban).
-#
-# Example (argument "token_id" resp. cookie "session_id" used here as unique identifier for user):
-#
-#   http {
-#     ...
-#     # maps to check user is blacklisted (banned in f2b):
-#     #map $arg_token_id      $blck_lst_tok { include blacklisted-tokens.map; }
-#     map  $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; }
-#     ...
-#     # special log-format to notify fail2ban about failures:
-#     log_format f2b_session_errors '$msec failure "$cookie_session_id" - $remote_addr - $remote_user '
-#      ;#                  '"$request" $status $bytes_sent '
-#       #                  '"$http_referer" "$http_user_agent"';
-#
-#     # location checking blacklisted values:
-#     location ... {
-#       # check banned sessionid:
-#       if ($blck_lst_ses != "") {
-#         try_files "" @f2b-banned;
-#       }
-#       ...
-#       # notify fail2ban about a failure inside nginx:
-#       error_page 401 = @notify-f2b;
-#       ...
-#     }
-#     ...
-#     # location for return with "403 Forbidden" if banned:
-#     location @f2b-banned {
-#       default_type text/html;
-#       return 403 "<br/><center>
-#         <b style=\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\">
-#         You are banned!</b></center>";
-#     }
-#     ...
-#     # location to notify fail2ban about a failure inside nginx:
-#     location @notify-f2b {
-#       access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;
-#     }
-#   }
-#   ...
-#
-# Note that quote-character (and possibly other special characters) are not allowed currently as session-id.
-# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service), 
-# like in example below:
-#
-#   location ... {
-#     if ($cookie_session_id !~ "^[\w\-]+$") {
-#       return  403 "Wrong session-id"
-#     }
-#     ...
-#   }
-#
-# The parameters for jail corresponding log-format (f2b_session_errors):
-#
-#   [nginx-blck-lst]
-#   filter =
-#   datepattern = ^Epoch
-#   failregex = ^ failure "<F-ID>[^"]+</F-ID>" - <ADDR>
-#   usedns = no
-#
-# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs):
-#
-#   [nginx-blck-ip]
-#   maxretry = 100
-#   filter =
-#   datepattern = ^Epoch
-#   failregex = ^ failure "[^"]+" - <ADDR>
-#   usedns = no
-#
-
-[Definition]
-
-# path to configuration of nginx (used to target nginx-instance in multi-instance system,
-# and as path for the blacklisted map):
-srv_cfg_path = /etc/nginx/
-
-# cmd-line arguments to supply to test/reload nginx:
-#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf
-srv_cmd = nginx
-
-# first test configuration is correct, hereafter send reload signal:
-blck_lst_reload = %(srv_cmd)s -qt; if [ $? -eq 0 ]; then
-                    %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;
-                  fi;
-
-# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file="/path/file.map"]`:
-blck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.map
-
-# Action definition:
-
-actionstart_on_demand = false
-actionstart = touch '%(blck_lst_file)s'
-
-actionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s
-
-actionstop = %(actionflush)s
-
-actioncheck = 
-
-actionban = echo "\\\\<fid> 1;" >> '%(blck_lst_file)s'; %(blck_lst_reload)s
-
-actionunban = id=$(echo "<fid>" | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/^\\\\$id 1;$/d" %(blck_lst_file)s; %(blck_lst_reload)s

config/action.d/npf.conf

@@ -9,7 +9,7 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 # we don't enable NPF automatically, as it will be enabled elsewhere
@@ -17,7 +17,7 @@ actionstart =
 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 # we don't disable NPF automatically either

config/action.d/nsupdate.conf

@@ -42,14 +42,14 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =
 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =

config/action.d/osx-afctl.conf

@@ -12,5 +12,5 @@ actioncheck =
 actionban = /usr/libexec/afctl -a <ip> -t <bantime>
 actionunban = /usr/libexec/afctl -r <ip>
 
-actionprolong = %(actionunban)s && %(actionban)s
-
+[Init]
+bantime = 2880

config/action.d/osx-ipfw.conf

@@ -9,14 +9,14 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 
 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = 

config/action.d/pf.conf

@@ -3,59 +3,32 @@
 # OpenBSD pf ban/unban
 #
 # Author: Nick Hilliard <nick@foobar.org>
-# Modified by: Alexander Koeppe making PF work seamless and with IPv4 and IPv6
 #
 #
 
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-# we don't enable PF automatically; to enable run pfctl -e 
-# or add `pf_enable="YES"` to /etc/rc.conf (tested on FreeBSD)
-# also, these rulesets are loaded into (nested) anchors
-# to enable them, add as wildcard:
-#     anchor "f2b/*"
-# or using jail names:
-#     anchor f2b {
-#        anchor name1
-#        anchor name2
-#        ...
-#     }
-# to your main pf ruleset, where "namei" are the names of the jails
-# which invoke this action
-actionstart = echo "table <<tablename>-<name>> persist counters" | <pfctl> -f-
-              port="<port>"; if [ "$port" != "" ] && case "$port" in \{*) false;; esac; then port="{$port}"; fi
-              echo "<block> proto <protocol> from <<tablename>-<name>> to <actiontype>" | <pfctl> -f-
+# we don't enable PF automatically, as it will be enabled elsewhere
+actionstart = 
 
-# Option:  start_on_demand - to start action on demand
-# Example: `action=pf[actionstart_on_demand=true]`
-actionstart_on_demand = false
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-# we only disable PF rules we've installed prior
-actionstop = <pfctl> -sr 2>/dev/null | grep -v <tablename>-<name> | <pfctl> -f-
-             %(actionflush)s
-             <pfctl> -t <tablename>-<name> -T kill
-
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = <pfctl> -t <tablename>-<name> -T flush
+# we don't disable PF automatically either
+actionstop = 
 
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <pfctl> -sr | grep -q <tablename>-<name>
+actioncheck = 
 
 
 # Option:  actionban
@@ -66,7 +39,7 @@ actioncheck = <pfctl> -sr | grep -q <tablename>-<name>
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = <pfctl> -t <tablename>-<name> -T add <ip>
+actionban = /sbin/pfctl -t <tablename> -T add <ip>/32
 
 
 # Option:  actionunban
@@ -78,47 +51,12 @@ actionban = <pfctl> -t <tablename>-<name> -T add <ip>
 # Values:  CMD
 #
 # note -r option used to remove matching rule
-actionunban = <pfctl> -t <tablename>-<name> -T delete <ip>
-
-# Option: pfctl
-#
-# Use anchor as jailname to manipulate affected rulesets only.
-# If more parameter expected it can be extended with `pf[pfctl="<known/pfctl> ..."]`
-# 
-pfctl = pfctl -a f2b/<name>
+actionunban = /sbin/pfctl -t <tablename> -T delete <ip>/32
 
 [Init]
 # Option:  tablename
 # Notes.:  The pf table name.
 # Values:  [ STRING ]
 #
-tablename = f2b
-
-# Option: block
-#
-# The action you want pf to take.
-# Probably, you want "block quick", but adjust as needed.
-block = block quick
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | ipv6-icmp ] Default: tcp
-#
-protocol = tcp
-
-# Option: actiontype
-# Notes.: defines additions to the blocking rule
-# Values: leave empty to block all attempts from the host
-# Default: Value of the multiport
-actiontype = <multiport>
-
-# Option: allports
-# Notes.: default addition to block all ports
-# Usage.: use in jail config: "banaction = pf[actiontype=<allports>]"
-allports = any
-
-# Option: multiport
-# Notes.: addition to block access only to specific ports
-# Usage.: use in jail config: "banaction = pf[actiontype=<multiport>]"
-multiport = any port $port
+tablename = fail2ban
 

config/action.d/sendmail-buffered.conf

@@ -10,44 +10,41 @@ before = sendmail-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on <fq-hostname>
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
               From: <sendername> <<sender>>
               To: <dest>\n
               Hi,\n
               The jail <name> has been started successfully.\n
               Output will be buffered until <lines> lines are available.\n
               Regards,\n
-              Fail2Ban" | <mailcmd>
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile> ]; then
-                 printf %%b "Subject: [Fail2Ban] <name>: summary from <fq-hostname>
+                 printf %%b "Subject: [Fail2Ban] <name>: summary from `uname -n`
                  From: <sendername> <<sender>>
                  To: <dest>\n
                  Hi,\n
                  These hosts have been banned by Fail2Ban.\n
                  `cat <tmpfile>`
                  Regards,\n
-                 Fail2Ban" | <mailcmd>
+                 Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
                  rm <tmpfile>
              fi
-             printf %%b "Subject: [Fail2Ban] <name>: stopped  on <fq-hostname>
+             printf %%b "Subject: [Fail2Ban] <name>: stopped  on `uname -n`
              From: Fail2Ban <<sender>>
              To: <dest>\n
              Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban" | <mailcmd>
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -64,14 +61,14 @@ actioncheck =
 actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
             LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
             if [ $LINE -ge <lines> ]; then
-                printf %%b "Subject: [Fail2Ban] <name>: summary from <fq-hostname>
+                printf %%b "Subject: [Fail2Ban] <name>: summary from `uname -n`
                 From: <sendername> <<sender>>
                 To: <dest>\n
                 Hi,\n
                 These hosts have been banned by Fail2Ban.\n
                 `cat <tmpfile>`
                 Regards,\n
-                Fail2Ban" | <mailcmd>
+                Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
                 rm <tmpfile>
             fi
 

config/action.d/sendmail-common.conf

@@ -11,30 +11,30 @@ after = sendmail-common.local
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on <fq-hostname>
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
               Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
               From: <sendername> <<sender>>
               To: <dest>\n
               Hi,\n
               The jail <name> has been started successfully.\n
               Regards,\n
-              Fail2Ban" | <mailcmd>
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on <fq-hostname>
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
              Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
              From: <sendername> <<sender>>
              To: <dest>\n
              Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban" | <mailcmd>
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -60,10 +60,6 @@ actionunban =
 
 [Init]
 
-# Your system mail command
-#
-mailcmd = /usr/sbin/sendmail -f "<sender>" "<dest>"
-
 # Recipient mail address
 #
 dest = root

config/action.d/sendmail-geoip-lines.conf

@@ -7,13 +7,9 @@
 [INCLUDES]
 
 before = sendmail-common.conf
-         helpers-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  Command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -23,7 +19,7 @@ norestored = 1
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
@@ -36,12 +32,11 @@ actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostn
             http://whois.domaintools.com/<ip>\n\n
             Country:`geoiplookup -f /usr/share/GeoIP/GeoIP.dat "<ip>" | cut -d':' -f2-`
             AS:`geoiplookup -f /usr/share/GeoIP/GeoIPASNum.dat "<ip>" | cut -d':' -f2-`
-            hostname: <ip-host>\n\n
-            Lines containing failures of <ip> (max <grepmax>)\n";
-            %(_grep_logs)s;
-            printf %%b "\n
+            hostname: `host -t A <ip> 2>&1`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `grep -E <grepopts> '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
             Regards,\n
-            Fail2Ban" ) | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 
@@ -55,5 +50,4 @@ logpath = /dev/null
 
 # Number of log lines to include in the email
 #
-#grepmax = 1000
-#grepopts = -m <grepmax>
+grepopts = -m 1000

config/action.d/sendmail-whois-ipjailmatches.conf

@@ -7,20 +7,16 @@
 [INCLUDES]
 
 before = sendmail-common.conf
-         mail-whois-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
@@ -28,11 +24,11 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostnam
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
             Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
+            `/usr/bin/whois <ip>`\n\n
             Matches for <name> with <ipjailfailures> failures IP:<ip>\n
             <ipjailmatches>\n\n
             Regards,\n
-            Fail2Ban" | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 

config/action.d/sendmail-whois-ipmatches.conf

@@ -7,20 +7,16 @@
 [INCLUDES]
 
 before = sendmail-common.conf
-         mail-whois-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
@@ -28,11 +24,11 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostnam
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
             Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
+            `/usr/bin/whois <ip>`\n\n
             Matches with <ipfailures> failures IP:<ip>\n
             <ipmatches>\n\n
             Regards,\n
-            Fail2Ban" | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 

config/action.d/sendmail-whois-lines.conf

@@ -7,34 +7,28 @@
 [INCLUDES]
 
 before = sendmail-common.conf
-         mail-whois-common.conf
-         helpers-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n"
-            %(_whois_command)s;
-            printf %%b "\nLines containing failures of <ip> (max <grepmax>)\n";
-            %(_grep_logs)s;
-            printf %%b "\n
+            Here is more information about <ip> :\n
+            `/usr/bin/whois <ip> || echo missing whois program`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `grep -E <grepopts> '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
             Regards,\n
-            Fail2Ban" ) | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 
@@ -48,5 +42,4 @@ logpath = /dev/null
 
 # Number of log lines to include in the email
 #
-#grepmax = 1000
-#grepopts = -m <grepmax>
+grepopts = -m 1000

config/action.d/sendmail-whois-matches.conf

@@ -7,20 +7,16 @@
 [INCLUDES]
 
 before = sendmail-common.conf
-         mail-whois-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
@@ -28,11 +24,11 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostnam
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
             Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
+            `/usr/bin/whois <ip>`\n\n
             Matches:\n
             <matches>\n\n
             Regards,\n
-            Fail2Ban" | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 

config/action.d/sendmail-whois.conf

@@ -7,20 +7,16 @@
 [INCLUDES]
 
 before = sendmail-common.conf
-         mail-whois-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
@@ -28,9 +24,9 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostnam
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
             Here is more information about <ip> :\n
-            `%(_whois_command)s`\n
+            `/usr/bin/whois <ip> || echo missing whois program`\n
             Regards,\n
-            Fail2Ban" | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 

config/action.d/sendmail.conf

@@ -10,16 +10,13 @@ before = sendmail-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
@@ -27,7 +24,7 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostnam
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n
             Regards,\n
-            Fail2Ban" | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 

config/action.d/shorewall-ipset-proto6.conf

@@ -47,15 +47,15 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = if ! ipset -quiet -name list f2b-<name> >/dev/null;
-              then ipset -quiet -exist create f2b-<name> hash:ip timeout <default-timeout>;
+              then ipset -quiet -exist create f2b-<name> hash:ip timeout <bantime>;
               fi
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = ipset flush f2b-<name>
@@ -68,8 +68,6 @@ actionstop = ipset flush f2b-<name>
 #
 actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
 
-actionprolong = %(actionban)s
-
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -78,8 +76,10 @@ actionprolong = %(actionban)s
 #
 actionunban = ipset del f2b-<name> <ip> -exist
 
-# Option: default-timeout
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
-# Values:  [ NUM ]  Default: 600
+[Init]
 
-default-timeout = 600
+# Option: bantime
+# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
+# Values:  [ NUM ]  Default: 600
+#
+bantime = 600

config/action.d/shorewall.conf

@@ -17,13 +17,13 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = 
@@ -40,7 +40,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = shorewall<family> <blocktype> <ip>
+actionban = shorewall <blocktype> <ip>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -48,26 +48,12 @@ actionban = shorewall<family> <blocktype> <ip>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = shorewall<family> allow <ip>
-
+actionunban = shorewall allow <ip>
 
 [Init]
 
-# Option:  family
-# Note:    Control which version of command is executed
-# Values:  Empty or 6 in case of IPv6
-family = 
-
 # Option:  blocktype
 # Note:    This is what the action does with rules.
 #          See man page of shorewall for options that include drop, logdrop, reject, or logreject
 # Values:  STRING
 blocktype = reject
-
-[Init?family=inet6]
-
-# Option:  family
-# Note:    Control which version of command is executed
-# Values:  Empty or 6 in case of IPv6
-family = 6
-

config/action.d/smtp.py

@@ -123,12 +123,9 @@ class SMTPAction(ActionBase):
 		self.message_values = CallingMap(
 			jailname = self._jail.name,
 			hostname = socket.gethostname,
-			bantime = lambda: self._jail.actions.getBanTime(),
+			bantime = self._jail.actions.getBanTime,
 			)
 
-		# bypass ban/unban for restored tickets
-		self.norestored = 1
-
 	def _sendMessage(self, subject, text):
 		"""Sends message based on arguments and instance's properties.
 
@@ -159,25 +156,25 @@ class SMTPAction(ActionBase):
 		try:
 			self._logSys.debug("Connected to SMTP '%s', response: %i: %s",
 				self.host, *smtp.connect(self.host))
-			if self.user and self.password: # pragma: no cover (ATM no tests covering that)
+			if self.user and self.password:
 				smtp.login(self.user, self.password)
 			failed_recipients = smtp.sendmail(
 				self.fromaddr, self.toaddr.split(", "), msg.as_string())
-		except smtplib.SMTPConnectError: # pragma: no cover
+		except smtplib.SMTPConnectError:
 			self._logSys.error("Error connecting to host '%s'", self.host)
 			raise
-		except smtplib.SMTPAuthenticationError: # pragma: no cover
+		except smtplib.SMTPAuthenticationError:
 			self._logSys.error(
 				"Failed to authenticate with host '%s' user '%s'",
 				self.host, self.user)
 			raise
-		except smtplib.SMTPException: # pragma: no cover
+		except smtplib.SMTPException:
 			self._logSys.error(
 				"Error sending mail to host '%s' from '%s' to '%s'",
 				self.host, self.fromaddr, self.toaddr)
 			raise
 		else:
-			if failed_recipients: # pragma: no cover
+			if failed_recipients:
 				self._logSys.warning(
 					"Email to '%s' failed to following recipients: %r",
 					self.toaddr, failed_recipients)
@@ -186,7 +183,7 @@ class SMTPAction(ActionBase):
 			try:
 				self._logSys.debug("Disconnected from '%s', response %i: %s",
 					self.host, *smtp.quit())
-			except smtplib.SMTPServerDisconnected: # pragma: no cover
+			except smtplib.SMTPServerDisconnected:
 				pass # Not connected
 
 	def start(self):
@@ -214,8 +211,6 @@ class SMTPAction(ActionBase):
 			Dictionary which includes information in relation to
 			the ban.
 		"""
-		if aInfo.get('restored'):
-			return
 		aInfo.update(self.message_values)
 		message = "".join([
 			messages['ban']['head'],

config/action.d/symbiosis-blacklist-allports.conf

@@ -10,13 +10,13 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =

config/action.d/xarf-login-attack.conf

@@ -22,7 +22,7 @@
 # Login-Attack, Malware-Attack, Fraud (Phishing, etc.), Info DNSBL
 #
 # For details see:
-# https://github.com/xarf/xarf-specification
+# https://github.com/abusix/xarf-specification
 # http://www.x-arf.org/schemata.html
 #
 # Author: Daniel Black
@@ -32,61 +32,42 @@
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 actionstart =
 
 actionstop =
 
 actioncheck =
 
-actionban = oifs=${IFS};
-            RESOLVER_ADDR="%(addr_resolver)s"
-            if [ "<debug>" -gt 0 ]; then echo "try to resolve $RESOLVER_ADDR"; fi
-            ADDRESSES=$(dig +short -t txt -q $RESOLVER_ADDR | tr -d '"')
-            IFS=,; ADDRESSES=$(echo $ADDRESSES)
-            IFS=${oifs}
+actionban = oifs=${IFS}; IFS=.;SEP_IP=( <ip> ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs}
             IP=<ip>
             FROM=<sender>
             SERVICE=<service>
             FAILURES=<failures>
-            REPORTID=<time>@<fq-hostname>
+            REPORTID=<time>@`uname -n`
             TLP=<tlp>
             PORT=<port>
             DATE=`LC_ALL=C date --date=@<time> +"%%a, %%d %%h %%Y %%T %%z"`
             if [ ! -z "$ADDRESSES" ]; then
-                oifs=${IFS}; IFS=,; ADDRESSES=$(echo $ADDRESSES)
-                IFS=${oifs}
                 (printf -- %%b "<header>\n<message>\n<report>\n\n";
                  date '+Note: Local timezone is %%z (%%Z)';
-                 printf -- %%b "\n<ipmatches>\n\n<footer>") | <mailcmd> <mailargs> $ADDRESSES
+                 printf -- %%b "\n<ipmatches>\n\n<footer>") | <mailcmd> <mailargs> ${ADDRESSES//,/\" \"}
             fi
 
 actionunban =
 
-# Server as resolver used in dig command
-#
-addr_resolver = <ip-rev>abuse-contacts.abusix.org
-
-# Option: boundary
-# Notes:  This can be overwritten to be safe for possible predictions
-boundary = bfbb0f920793ac03cb8634bde14d8a1e
-
-_boundary = Abuse<time>-<boundary>
-
+[Init]
 # Option: header
 # Notes:  This is really a fixed value
-header  = Subject: abuse report about $IP - $DATE\nAuto-Submitted: auto-generated\nX-XARF: PLAIN\nContent-Transfer-Encoding: 7bit\nContent-Type: multipart/mixed; charset=utf8;\n  boundary=%(_boundary)s;\n\n--%(_boundary)s\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8;\n
+header  = Subject: abuse report about $IP - $DATE\nAuto-Submitted: auto-generated\nX-XARF: PLAIN\nContent-Transfer-Encoding: 7bit\nContent-Type: multipart/mixed; charset=utf8;\n  boundary=Abuse-bfbb0f920793ac03cb8634bde14d8a1e;\n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8;\n
 
 # Option: footer
 # Notes:  This is really a fixed value and needs to match the report and header
 #         mime delimiters
-footer = \n\n--%(_boundary)s--
+footer = \n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e--
 
 # Option: report
 # Notes:  Intended to be fixed
-report =  --%(_boundary)s\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8; name=\"report.txt\";\n\n---\nReported-From: $FROM\nCategory: abuse\nReport-ID: $REPORTID\nReport-Type: login-attack\nService: $SERVICE\nVersion: 0.2\nUser-Agent: Fail2ban v0.9\nDate: $DATE\nSource-Type: ip-address\nSource: $IP\nPort: $PORT\nSchema-URL: http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json\nAttachment: text/plain\nOccurances: $FAILURES\nTLP: $TLP\n\n\n--%(_boundary)s\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf8; name=\"logfile.log\";
+report =  --Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8; name=\"report.txt\";\n\n---\nReported-From: $FROM\nCategory: abuse\nReport-ID: $REPORTID\nReport-Type: login-attack\nService: $SERVICE\nVersion: 0.2\nUser-Agent: Fail2ban v0.9\nDate: $DATE\nSource-Type: ip-address\nSource: $IP\nPort: $PORT\nSchema-URL: http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json\nAttachment: text/plain\nOccurances: $FAILURES\nTLP: $TLP\n\n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf8; name=\"logfile.log\";
 
 # Option: Message
 # Notes:  This can be modified by the users
@@ -135,7 +116,7 @@ logpath = /dev/null
 
 # Option:  sender
 # Notes.:  This is the sender that is included in the XARF report
-sender = fail2ban@<fq-hostname>
+sender = fail2ban@`uname -n`
 
 # Option:  port
 # Notes.:  This is the port number that received the login-attack

config/fail2ban.conf

@@ -5,11 +5,11 @@
 # Changes:  in most of the cases you should not modify this
 #           file, but provide customizations in fail2ban.local file, e.g.:
 #
-# [DEFAULT]
+# [Definition]
 # loglevel = DEBUG
 #
 
-[DEFAULT]
+[Definition]
 
 # Option: loglevel
 # Notes.: Set the log level output.
@@ -30,7 +30,7 @@ loglevel = INFO
 #         using logrotate -- also adjust or disable rotation in the
 #         corresponding configuration file
 #         (e.g. /etc/logrotate.d/fail2ban on Debian systems)
-# Values: [ STDOUT | STDERR | SYSLOG | SYSOUT | FILE ]  Default: STDERR
+# Values: [ STDOUT | STDERR | SYSLOG | FILE ]  Default: STDERR
 #
 logtarget = /var/log/fail2ban.log
 
@@ -66,21 +66,4 @@ dbfile = /var/lib/fail2ban/fail2ban.sqlite3
 # Options: dbpurgeage
 # Notes.: Sets age at which bans should be purged from the database
 # Values: [ SECONDS ] Default: 86400 (24hours)
-dbpurgeage = 1d
-
-# Options: dbmaxmatches
-# Notes.: Number of matches stored in database per ticket (resolvable via 
-#         tags <ipmatches>/<ipjailmatches> in actions)
-# Values: [ INT ] Default: 10
-dbmaxmatches = 10
-
-[Definition]
-
-
-[Thread]
-
-# Options: stacksize
-# Notes.: Specifies the stack size (in KiB) to be used for subsequently created threads,
-#         and must be 0 or a positive integer value of at least 32.
-# Values: [ SIZE ] Default: 0 (use platform or configured default)
-#stacksize = 0
+dbpurgeage = 86400

config/filter.d/3proxy.conf

@@ -9,8 +9,6 @@ failregex = ^\s[+-]\d{4} \S+ \d{3}0[1-9] \S+ <HOST>:\d+ [\d.]+:\d+ \d+ \d+ \d+\s
 
 ignoreregex = 
 
-datepattern = {^LN-BEG}
-
 # DEV Notes:
 # http://www.3proxy.ru/howtoe.asp#ERRORS indicates that 01-09 are
 # all authentication problems (%E field)

config/filter.d/apache-auth.conf

@@ -9,32 +9,20 @@ before = apache-common.conf
 
 [Definition]
 
-# Mode for filter: normal (default) and aggressive (allows DDoS & brute force detection of mod_evasive)
-mode = normal
 
-# ignore messages of mod_evasive module:
-apache-pref-ign-normal = (?!evasive)
-# allow "denied by server configuration" from all modules:
-apache-pref-ign-aggressive =
-# mode related ignore prefix for common _apache_error_client substitution:
-apache-pref-ignore = <apache-pref-ign-<mode>>
-
-prefregex = ^%(_apache_error_client)s (?:AH\d+: )?<F-CONTENT>.+</F-CONTENT>$
-
-# auth_type = ((?:Digest|Basic): )?
-auth_type = ([A-Z]\w+: )?
-
-failregex = ^client (?:denied by server configuration|used wrong authentication scheme)\b
-            ^user (?!`)<F-USER>(?:\S*|.*?)</F-USER> (?:auth(?:oriz|entic)ation failure|not found|denied by provider)\b
-            ^Authorization of user <F-USER>(?:\S*|.*?)</F-USER> to access .*? failed\b
-            ^%(auth_type)suser <F-USER>(?:\S*|.*?)</F-USER>: password mismatch\b
-            ^%(auth_type)suser `<F-USER>(?:[^']*|.*?)</F-USER>' in realm `.+' (auth(?:oriz|entic)ation failure|not found|denied by provider)\b
-            ^%(auth_type)sinvalid nonce .* received - length is not\b
-            ^%(auth_type)srealm mismatch - got `(?:[^']*|.*?)' but expected\b
-            ^%(auth_type)sunknown algorithm `(?:[^']*|.*?)' received\b
-            ^invalid qop `(?:[^']*|.*?)' received\b
-            ^%(auth_type)sinvalid nonce .*? received - user attempted time travel\b
-            ^(?:No h|H)ostname \S+ provided via SNI(?:, but no hostname provided| and hostname \S+ provided| for a name based virtual host)\b
+failregex = ^%(_apache_error_client)s (AH(01797|01630): )?client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01617: )?user .*? authentication failure for "\S*": Password Mismatch(, referer: \S+)?$
+            ^%(_apache_error_client)s (AH01618: )?user .*? not found(: )?\S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme: \S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH\d+: )?Authorization of user \S+ to access \S* failed, reason: .*$
+            ^%(_apache_error_client)s (AH0179[24]: )?(Digest: )?user .*?: password mismatch: \S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH0179[01]: |Digest: )user `.*?' in realm `.+' (not found|denied by provider): \S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01631: )?user .*?: authorization failure for "\S*":(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01775: )?(Digest: )?invalid nonce .* received - length is not \S+(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01788: )?(Digest: )?realm mismatch - got `.*?' but expected `.+'(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01789: )?(Digest: )?unknown algorithm `.*?' received: \S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01793: )?invalid qop `.*?' received: \S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01777: )?(Digest: )?invalid nonce .*? received - user attempted time travel(, referer: \S+)?\s*$
 
 ignoreregex = 
 
@@ -55,17 +43,14 @@ ignoreregex =
 # all of these expressions. Lots of submodules like mod_authz_* return back to mod_authz_core
 # to return the actual failure.
 #
-# Note that URI can contain spaces.
-#
 # See also: http://wiki.apache.org/httpd/ListOfErrors
 # Expressions that don't have tests and aren't common.
 # more be added with  https://issues.apache.org/bugzilla/show_bug.cgi?id=55284 
-#     ^user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
-#     ^user .*: one-time-nonce mismatch - sending new nonce\s*$
-#     ^realm mismatch - got `(?:[^']*|.*?)' but no realm specified\s*$
+#     ^%(_apache_error_client)s (AH01778: )?user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
+#     ^%(_apache_error_client)s (AH01779: )?user .*: one-time-nonce mismatch - sending new nonce\s*$
+#     ^%(_apache_error_client)s (AH02486: )?realm mismatch - got `.*' but no realm specified\s*$
 #
-# Because url/referer are foreign input, short form of regex used if long enough to idetify failure.
+# referer is always in error log messages if it exists added as per the log_error_core function in server/log.c
 # 
 # Author: Cyril Jaquier
-# Major edits by Daniel Black and Ben Rubson.
-# Rewritten for v.0.10 by Sergey Brester (sebres).
+# Major edits by Daniel Black

config/filter.d/apache-badbots.conf

@@ -14,9 +14,6 @@ failregex = ^<HOST> -.*"(GET|POST|HEAD).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s
 
 ignoreregex =
 
-datepattern = ^[^\[]*\[({DATE})
-              {^LN-BEG}
-
 # DEV Notes:
 # List of bad bots fetched from http://www.user-agents.org
 # Generated on Thu Nov  7 14:23:35 PST 2013 by files/gen_badbots.

config/filter.d/apache-botsearch.conf

@@ -23,13 +23,14 @@ before = apache-common.conf
 
 [Definition]
 
-prefregex = ^%(_apache_error_client)s (?:AH\d+: )?<F-CONTENT>.+</F-CONTENT>$
-
-failregex = ^(?:File does not exist|script not found or unable to stat): <webroot><block>(, referer: \S+)?\s*$
-            ^script '<webroot><block>' not found or unable to stat(, referer: \S+)?\s*$
+failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): <webroot><block>(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s script '<webroot><block>' not found or unable to stat(, referer: \S+)?\s*$
 
 ignoreregex = 
 
+
+[Init]
+
 # Webroot represents the webroot on which all other files are based
 webroot = /var/www/
 

config/filter.d/apache-common.conf

@@ -3,35 +3,12 @@
 
 [INCLUDES]
 
-before = common.conf
 # Load customizations if any available
 after = apache-common.local
 
 [DEFAULT]
 
-# Apache logging mode:
-#   all - universal prefix (logfile, syslog)
-#   logfile - logfile only
-#   syslog - syslog only
-# Use `filter = apache-auth[logging=syslog]` to get more precise regex if apache logs into syslog (ErrorLog syslog).
-# Use `filter = apache-auth[logging=all]` to get universal regex matches both logging variants.
-logging = logfile
-
-# Apache logging prefixes (date-pattern prefix, server, process etc.):
-apache-prefix-syslog = %(__prefix_line)s
-apache-prefix-logfile = \[\]\s
-apache-prefix-all = (?:%(apache-prefix-logfile)s|%(apache-prefix-syslog)s)?
-
-# Setting for __prefix_line (only `logging=syslog`):
-_daemon = (?:apache\d*|httpd(?:/\w+)?)
-
-apache-prefix = <apache-prefix-<logging>>
-
-apache-pref-ignore =
-
-_apache_error_client = <apache-prefix>\[(:?error|<apache-pref-ignore>\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]
-
-datepattern = {^LN-BEG}
+_apache_error_client = \[\] \[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]
 
 # Common prefix for [error] apache messages which also would include <HOST>
 # Depending on the version it could be

config/filter.d/apache-fakegooglebot.conf

@@ -6,8 +6,6 @@ failregex = ^<HOST> .*Googlebot.*$
 
 ignoreregex =
 
-datepattern = ^[^\[]*\[({DATE})
-              {^LN-BEG}
 
 # DEV Notes:
 #

config/filter.d/apache-modsecurity.conf

@@ -10,10 +10,10 @@ before = apache-common.conf
 [Definition]
 
 
-failregex = ^%(_apache_error_client)s(?: \[client [^\]]+\])? ModSecurity:\s+(?:\[(?:\w+ \"[^\"]*\"|[^\]]*)\]\s*)*Access denied with code [45]\d\d
+failregex = ^%(_apache_error_client)s ModSecurity:\s+(?:\[(?:\w+ \"[^\"]*\"|[^\]]*)\]\s*)*Access denied with code [45]\d\d
 
 ignoreregex = 
 
 # https://github.com/SpiderLabs/ModSecurity/wiki/ModSecurity-2-Data-Formats
 # Author: Daniel Black
-#         Sergey G. Brester aka sebres (review, optimization)
+#         Sergey G. Brester aka sebres (review, optimization)

config/filter.d/apache-noscript.conf

@@ -17,13 +17,8 @@ before = apache-common.conf
 
 [Definition]
 
-script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl)
-
-prefregex = ^%(_apache_error_client)s (?:AH0(?:01(?:28|30)|1(?:264|071)): )?(?:(?:[Ff]ile|script|[Gg]ot) )<F-CONTENT>.+</F-CONTENT>$
-
-failregex = ^(?:does not exist|not found or unable to stat): <script>\b
-            ^'<script>\S*' not found or unable to stat
-            ^error '[Pp]rimary script unknown(?:\\n)?'
+failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s script '/\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)\S*' not found or unable to stat(, referer: \S+)?\s*$
 
 ignoreregex = 
 

config/filter.d/apache-pass.conf

@@ -3,15 +3,16 @@
 #
 # The knocking request must have a referer.
 
+[INCLUDES]
+
+before = apache-common.conf
+
 [Definition]
 
 failregex = ^<HOST> - \w+ \[\] "GET <knocking_url> HTTP/1\.[01]" 200 \d+ ".*" "[^-].*"$
 
 ignoreregex =
 
-datepattern = ^[^\[]*\[({DATE})
-              {^LN-BEG}
-
 [Init]
 
 knocking_url = /knocking/

config/filter.d/apache-shellshock.conf

@@ -9,10 +9,8 @@ before = apache-common.conf
 
 [Definition]
 
-prefregex = ^%(_apache_error_client)s (AH01215: )?/bin/([bd]a)?sh: <F-CONTENT>.+</F-CONTENT>$
-
-failregex = ^warning: HTTP_[^:]+: ignoring function definition attempt(, referer: \S+)?\s*$
-            ^error importing function definition for `HTTP_[^']+'(, referer: \S+)?\s*$
+failregex = ^%(_apache_error_client)s (AH01215: )?/bin/(ba)?sh: warning: HTTP_.*?: ignoring function definition attempt(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01215: )?/bin/(ba)?sh: error importing function definition for `HTTP_.*?'(, referer: \S+)?\s*$
 
 ignoreregex = 
 

config/filter.d/assp.conf

@@ -20,9 +20,6 @@ failregex = ^(:? \[SSL-out\])? <HOST> max sender authentication errors \(\d{,3}\
 
 ignoreregex = 
 
-datepattern = {^LN-BEG}%%b-%%d-%%Exy %%H:%%M:%%S
-              {^LN-BEG}
-
 # DEV Notes:
 # V1 Examples matches:
 #   Apr-27-13 02:33:09 Blocking 217.194.197.97 - too much AUTH errors (41);

config/filter.d/asterisk.conf

@@ -16,25 +16,22 @@ __pid_re = (?:\s*\[\d+\])
 iso8601 = \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+[+-]\d{4}
 
 # All Asterisk log messages begin like this:
-log_prefix= (?:NOTICE|SECURITY|WARNING)%(__pid_re)s:?(?:\[C-[\da-f]*\])?:? [^:]+:\d*(?:(?: in)? [^:]+:)?
+log_prefix= (?:NOTICE|SECURITY|WARNING)%(__pid_re)s:?(?:\[C-[\da-f]*\])? [^:]+:\d*(?:(?: in)? \w+:)?
 
-prefregex = ^%(__prefix_line)s%(log_prefix)s <F-CONTENT>.+</F-CONTENT>$
-
-failregex = ^Registration from '[^']*' failed for '<HOST>(:\d+)?' - (?:Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$
-            ^Call from '[^']*' \(<HOST>:\d+\) to extension '[^']*' rejected because extension not found in context
-            ^(?:Host )?<HOST> (?:failed (?:to authenticate\b|MD5 authentication\b)|tried to authenticate with nonexistent user\b)
-            ^No registration for peer '[^']*' \(from <HOST>\)$
-            ^hacking attempt detected '<HOST>'$
-            ^SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)"(?:(?:,(?!RemoteAddress=)\w+="[^"]*")*|.*?),RemoteAddress="IPV[46]/[^/"]+/<HOST>/\d+"(?:,(?!RemoteAddress=)\w+="[^"]*")*$
-            ^"Rejecting unknown SIP connection from <HOST>(?::\d+)?"$
-            ^Request (?:'[^']*' )?from '(?:[^']*|.*?)' failed for '<HOST>(?::\d+)?'\s\(callid: [^\)]*\) - (?:No matching endpoint found|Not match Endpoint(?: Contact)? ACL|(?:Failed|Error) to authenticate)\s*$
+failregex = ^%(__prefix_line)s%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - (?:Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$
+            ^%(__prefix_line)s%(log_prefix)s Call from '[^']*' \(<HOST>:\d+\) to extension '[^']*' rejected because extension not found in context
+            ^%(__prefix_line)s%(log_prefix)s (?:Host )?<HOST> (?:failed (?:to authenticate\b|MD5 authentication\b)|tried to authenticate with nonexistent user\b)
+            ^%(__prefix_line)s%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)$
+            ^%(__prefix_line)s%(log_prefix)s hacking attempt detected '<HOST>'$
+            ^%(__prefix_line)s%(log_prefix)s SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)"(?:(?:,(?!RemoteAddress=)\w+="[^"]*")*|.*?),RemoteAddress="IPV[46]/(UDP|TCP|WS)/<HOST>/\d+"(?:,(?!RemoteAddress=)\w+="[^"]*")*$
+            ^%(__prefix_line)s%(log_prefix)s "Rejecting unknown SIP connection from <HOST>(?::\d+)?"$
+            ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '(?:[^']*|.*?)' failed for '<HOST>(?::\d+)?'\s\(callid: [^\)]*\) - (?:No matching endpoint found|Not match Endpoint(?: Contact)? ACL|(?:Failed|Error) to authenticate)\s*$
 
 # FreePBX (todo: make optional in v.0.10):
 #            ^(%(__prefix_line)s|\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])? )[^:]+: Friendly Scanner from <HOST>$
 
 ignoreregex =
 
-datepattern = {^LN-BEG}
 
 # Author: Xavier Devlamynck / Daniel Black
 #
@@ -44,12 +41,3 @@ datepattern = {^LN-BEG}
 # First regex: channels/chan_sip.c
 #
 # main/logger.c:ast_log_vsyslog - "in {functionname}:" only occurs in syslog
-
-journalmatch = _SYSTEMD_UNIT=asterisk.service
-
-
-[lt_journal]
-
-# asterisk can log timestamp if logs into systemd-journal (optional part matching this timestamp, gh-2383):
-__extra_timestamp = (?:\[[^\]]+\]\s+)?
-__prefix_line = %(known/__prefix_line)s%(__extra_timestamp)s

config/filter.d/bitwarden.conf

@@ -1,6 +0,0 @@
-# Fail2Ban filter for Bitwarden
-# Detecting failed login attempts
-# Logged in bwdata/logs/identity/Identity/log.txt
-
-[Definition]
-failregex = ^\s*\[WRN\]\s+Failed login attempt(?:, 2FA invalid)?\. <HOST>$

config/filter.d/botsearch-common.conf

@@ -5,7 +5,7 @@
 # Block is the actual non-found directories to block
 block = \/?(<webmail>|<phpmyadmin>|<wordpress>|cgi-bin|mysqladmin)[^,]*
 
-# These are just convenient definitions that assist the blocking of stuff that 
+# These are just convient definitions that assist the blocking of stuff that 
 # isn't installed
 webmail = roundcube|(ext)?mail|horde|(v-?)?webmail
 

config/filter.d/centreon.conf

@@ -1,9 +0,0 @@
-# Fail2Ban filter for Centreon Web
-# Detecting unauthorized access to the Centreon Web portal
-# typically logged in /var/log/centreon/login.log
-
-[Init]
-datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S
-
-[Definition]
-failregex = ^(?:\|-?\d+){3}\|\[[^\]]*\] \[<HOST>\] Authentication failed for '<F-USER>[^']+</F-USER>'

config/filter.d/common.conf

@@ -10,9 +10,6 @@ after = common.local
 
 [DEFAULT]
 
-# Type of log-file resp. log-format (file, short, journal, rfc542):
-logtype = file
-
 # Daemon definition is to be specialized (if needed) in .conf file
 _daemon = \S*
 
@@ -37,7 +34,7 @@ __daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_r
 
 # Some messages have a kernel prefix with a timestamp
 # EXAMPLES: kernel: [769570.846956]
-__kernel_prefix = kernel:\s?\[ *\d+\.\d+\]:?
+__kernel_prefix = kernel: \[ *\d+\.\d+\]
 
 __hostname = \S+
 
@@ -58,32 +55,10 @@ __date_ambit = (?:\[\])
 #      [bsdverbose]? [hostname] [vserver tag] daemon_id spaces
 #
 # This can be optional (for instance if we match named native log files)
-__prefix_line = <lt_<logtype>/__prefix_line>
+__prefix_line = %(__date_ambit)s?\s*(?:%(__bsd_syslog_verbose)s\s+)?(?:%(__hostname)s\s+)?(?:%(__kernel_prefix)s\s+)?(?:%(__vserver)s\s+)?(?:%(__daemon_combs_re)s\s+)?(?:%(__daemon_extra_re)s\s+)?
 
 # PAM authentication mechanism check for failures, e.g.: pam_unix, pam_sss,
 # pam_ldap
 __pam_auth = pam_unix
 
-# standardly all formats using prefix have line-begin anchored date:
-datepattern = <lt_<logtype>/datepattern>
-
-[lt_file]
-# Common line prefixes for logtype "file":
-__prefix_line = %(__date_ambit)s?\s*(?:%(__bsd_syslog_verbose)s\s+)?(?:%(__hostname)s\s+)?(?:%(__kernel_prefix)s\s+)?(?:%(__vserver)s\s+)?(?:%(__daemon_combs_re)s\s+)?(?:%(__daemon_extra_re)s\s+)?
-datepattern = {^LN-BEG}
-
-[lt_short]
-# Common (short) line prefix for logtype "journal" (corresponds output of formatJournalEntry):
-__prefix_line = \s*(?:%(__hostname)s\s+)?(?:%(_daemon)s%(__pid_re)s?:?\s+)?(?:%(__kernel_prefix)s\s+)?
-datepattern = %(lt_file/datepattern)s
-[lt_journal]
-__prefix_line = %(lt_short/__prefix_line)s
-datepattern = %(lt_short/datepattern)s
-
-[lt_rfc5424]
-# RFC 5424 log-format, see gh-2309:
-#__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ \S+\s+
-__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ (?:[^\[\]\s]+|(?:\[(?:[^\]"]*|"[^"]*")*\])+)\s+
-datepattern = ^<\d+>\d+\s+{DATE}
-
-# Author: Yaroslav Halchenko, Sergey G. Brester (aka sebres)
+# Author: Yaroslav Halchenko

config/filter.d/counter-strike.conf

@@ -8,6 +8,8 @@ failregex = ^: Bad Rcon: "rcon \d+ "\S+"  sv_contact ".*?"" from "<HOST>:\d+"$
 
 ignoreregex =
 
+[Init]
+
 datepattern = ^L %%d/%%m/%%Y - %%H:%%M:%%S
 
 

config/filter.d/courier-auth.conf

@@ -11,11 +11,9 @@ before = common.conf
 
 _daemon = (?:courier)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)?
 
-failregex = ^%(__prefix_line)sLOGIN FAILED, (?:user|method)=.*, ip=\[<HOST>\]$
+failregex = ^%(__prefix_line)sLOGIN FAILED, user=.*, ip=\[<HOST>\]$
 
 ignoreregex = 
 
-datepattern = {^LN-BEG}
-
 # Author: Christoph Haas
 # Modified by: Cyril Jaquier

config/filter.d/courier-smtp.conf

@@ -12,10 +12,8 @@ before = common.conf
 
 _daemon = courieresmtpd
 
-prefregex = ^%(__prefix_line)serror,relay=<HOST>,<F-CONTENT>.+</F-CONTENT>$
-
-failregex = ^[^:]*: 550 User (<.*> )?unknown\.?$
-            ^msg="535 Authentication failed\.",cmd:( AUTH \S+)?( [0-9a-zA-Z\+/=]+)?(?: \S+)$
+failregex = ^%(__prefix_line)serror,relay=<HOST>,.*: 550 User (<.*> )?unknown\.?$
+            ^%(__prefix_line)serror,relay=<HOST>,msg="535 Authentication failed\.",cmd:( AUTH \S+)?( [0-9a-zA-Z\+/=]+)?(?: \S+)$
 
 ignoreregex = 
 

config/filter.d/directadmin.conf

@@ -13,6 +13,7 @@ failregex = ^: \'<HOST>\' \d{1,3} failed login attempt(s)?. \s*
 
 ignoreregex = 
 
+[Init]
 datepattern = ^%%Y:%%m:%%d-%%H:%%M:%%S
 
 #

config/filter.d/domino-smtp.conf

@@ -35,12 +35,9 @@
 # 08-09-2014 06:14:27   smtp: postmaster [1.2.3.4] authentication failure using internet password
 # 08-09-2014 06:14:27   SMTP Server: Authentication failed for user postmaster ; connecting host 1.2.3.4
 
-__prefix = (?:\[[^\]]+\])?\s*
-__opt_data = (?::|\s+\[[^\]]+\])
-failregex = ^%(__prefix)sSMTP Server%(__opt_data)s Authentication failed for user .*? \; connecting host \[?<HOST>\]?$
-            ^%(__prefix)ssmtp: (?:[^\[]+ )*\[?<HOST>\]? authentication failure using internet password\s*$
-            ^%(__prefix)sSMTP Server%(__opt_data)s Connection from \[?<HOST>\]? rejected for policy reasons\.
-
+__prefix = (?:\[[^\]]+\])?\s+
+failregex = ^%(__prefix)sSMTP Server: Authentication failed for user .*? \; connecting host <HOST>$
+            ^%(__prefix)ssmtp: (?:[^\[]+ )*\[<HOST>\] authentication failure using internet password\s*$
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT

config/filter.d/dovecot.conf

@@ -10,36 +10,24 @@ before = common.conf
 _auth_worker = (?:dovecot: )?auth(?:-worker)?
 _daemon = (?:dovecot(?:-auth)?|auth)
 
-prefregex = ^%(__prefix_line)s(?:%(_auth_worker)s(?:\([^\)]+\))?: )?(?:%(__pam_auth)s(?:\(dovecot:auth\))?: |(?:pop3|imap)-login: )?(?:Info: )?<F-CONTENT>.+</F-CONTENT>$
+__prefregex = ^%(__prefix_line)s(?:%(_auth_worker)s(?:\([^\)]+\))?: )?(?:%(__pam_auth)s(?:\(dovecot:auth\))?: |(?:pop3|imap)-login: )?(?:Info: )?
 
-failregex = ^authentication failure; logname=<F-ALT_USER1>\S*</F-ALT_USER1> uid=\S* euid=\S* tty=dovecot ruser=<F-USER>\S*</F-USER> rhost=<HOST>(?:\s+user=<F-ALT_USER>\S*</F-ALT_USER>)?\s*$
-            ^(?:Aborted login|Disconnected)(?::(?: [^ \(]+)+)? \((?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)\):(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
-            ^pam\(\S+,<HOST>(?:,\S*)?\): pam_authenticate\(\) failed: (?:User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\)|Permission denied)\s*$
-            ^[a-z\-]{3,15}\(\S*,<HOST>(?:,\S*)?\): (?:unknown user|invalid credentials|Password mismatch)\s*$
-            <mdre-<mode>>
-
-mdre-aggressive = ^(?:Aborted login|Disconnected)(?::(?: [^ \(]+)+)? \((?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,)(?: (?:in|waited) \d+ secs)?\):(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
-
-mdre-normal = 
-
-# Parameter `mode` - `normal` or `aggressive`.
-# Aggressive mode can be used to match log-entries like:
-#   'no auth attempts', 'disconnected before auth was ready', 'client didn't finish SASL auth'.
-# Note it may produce lots of false positives on misconfigured MTAs.
-# Ex.:
-# filter = dovecot[mode=aggressive]
-mode = normal
+failregex = ^%(__prefregex)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(?:\s+user=\S*)?\s*$
+            ^%(__prefregex)s(?:Aborted login|Disconnected)(?::(?: [^ \(]+)+)? \((?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth)\):(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
+            ^%(__prefregex)spam\(\S+,<HOST>(?:,\S*)?\): pam_authenticate\(\) failed: (?:User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\)|Permission denied)\s*$
+            ^%(__prefregex)s[a-z\-]{3,15}\(\S*,<HOST>(?:,\S*)?\): (?:unknown user|invalid credentials)\s*$
 
 ignoreregex = 
 
-journalmatch = _SYSTEMD_UNIT=dovecot.service
+[Init]
 
-datepattern = {^LN-BEG}TAI64N
-              {^LN-BEG}
+journalmatch = _SYSTEMD_UNIT=dovecot.service
 
 # DEV Notes:
 # * the first regex is essentially a copy of pam-generic.conf
 # * Probably doesn't do dovecot sql/ldap backends properly (resolved in edit 21/03/2016)
+# * Removed the 'no auth attempts' log lines from the matches because produces
+#    lots of false positives on misconfigured MTAs making regexp unusable
 #
 # Author: Martin Waschbuesch
 #         Daniel Black (rewrote with begin and end anchors)

config/filter.d/dropbear.conf

@@ -23,11 +23,9 @@ before = common.conf
 
 _daemon = dropbear
 
-prefregex = ^%(__prefix_line)s<F-CONTENT>(?:[Ll]ogin|[Bb]ad|[Ee]xit).+</F-CONTENT>$
-
-failregex = ^[Ll]ogin attempt for nonexistent user ('.*' )?from <HOST>:\d+$
-            ^[Bb]ad (PAM )?password attempt for .+ from <HOST>(:\d+)?$
-            ^[Ee]xit before auth \(user '.+', \d+ fails\): Max auth tries reached - user '.+' from <HOST>:\d+\s*$
+failregex = ^%(__prefix_line)s[Ll]ogin attempt for nonexistent user ('.*' )?from <HOST>:\d+$
+            ^%(__prefix_line)s[Bb]ad (PAM )?password attempt for .+ from <HOST>(:\d+)?$
+            ^%(__prefix_line)s[Ee]xit before auth \(user '.+', \d+ fails\): Max auth tries reached - user '.+' from <HOST>:\d+\s*$
 
 ignoreregex = 
 

config/filter.d/ejabberd-auth.conf

@@ -16,8 +16,8 @@
 #          searched for other failures. This tag can be used multiple times.
 # Values:  TEXT
 #
-failregex = ^=INFO REPORT====  ===\nI\(<0\.\d+\.0>:ejabberd_c2s:\d+\) : \([^)]+\) Failed authentication for \S+ from (?:IP )?<HOST>(?: \({{(?:\d+,){3}\d+},\d+}\))?$
-            ^(?:\.\d+)? \[info\] <0\.\d+\.\d>@ejabberd_c2s:\w+:\d+ \([^\)]+\) Failed (?:c2s \w+ )?authentication for \S+ from (?:IP )?(?:::FFFF:)?<HOST>(?:: |$)
+failregex = ^=INFO REPORT====  ===\nI\(<0\.\d+\.0>:ejabberd_c2s:\d+\) : \([^)]+\) Failed authentication for .+ from IP <HOST> \({{(?:\d+,){3}\d+},\d+}\)$
+            ^(?:\.\d+)? \[info\] <0\.\d+\.\d>@ejabberd_c2s:wait_for_feature_request:\d+ \([^\)]+\) Failed authentication for \S+ from IP <HOST>$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
@@ -25,6 +25,8 @@ failregex = ^=INFO REPORT====  ===\nI\(<0\.\d+\.0>:ejabberd_c2s:\d+\) : \([^)]+\
 #
 ignoreregex = 
 
+[Init]
+
 # "maxlines" is number of log lines to buffer for multi-line regex searches
 maxlines = 2
 
@@ -33,8 +35,3 @@ maxlines = 2
 # Values:  TEXT
 #
 journalmatch = 
-
-#datepattern = ^(?:=[^=]+={3,} )?({DATE})
-# explicit time format using prefix =...==== and no date in second string begins with I(...)... 
-datepattern = ^(?:=[^=]+={3,} )?(%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?)
-              ^I\(()**

config/filter.d/exim.conf

@@ -13,32 +13,14 @@ before = exim-common.conf
 
 [Definition]
 
-# Fre-filter via "prefregex" is currently inactive because of too different failure syntax in exim-log (testing needed):
-#prefregex = ^%(pid)s <F-CONTENT>\b(?:\w+ authenticator failed|([\w\-]+ )?SMTP (?:(?:call|connection) from|protocol(?: synchronization)? error)|no MAIL in|(?:%(host_info_pre)s\[[^\]]+\]%(host_info_suf)s(?:sender verify fail|rejected RCPT|dropped|AUTH command))).+</F-CONTENT>$
-
 failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
             ^%(pid)s \w+ authenticator failed for (?:[^\[\( ]* )?(?:\(\S*\) )?\[<HOST>\](?::\d+)?(?: I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
             ^%(pid)s %(host_info)srejected RCPT [^@]+@\S+: (?:relay not permitted|Sender verify failed|Unknown user|Unrouteable address)\s*$
             ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (?:connection from|"\S+") %(host_info)s(?:next )?input=".*"\s*$
-            ^%(pid)s SMTP call from (?:[^\[\( ]* )?%(host_info)sdropped: too many (?:nonmail commands|syntax or protocol errors) \(last (?:command )?was "[^"]*"\)\s*$
+            ^%(pid)s SMTP call from \S+ %(host_info)sdropped: too many nonmail commands \(last was "\S+"\)\s*$
             ^%(pid)s SMTP protocol error in "[^"]+(?:"+[^"]*(?="))*?" %(host_info)sAUTH command used when not advertised\s*$
             ^%(pid)s no MAIL in SMTP connection from (?:[^\[\( ]* )?(?:\(\S*\) )?%(host_info)sD=\d\S*s(?: C=\S*)?\s*$
             ^%(pid)s (?:[\w\-]+ )?SMTP connection from (?:[^\[\( ]* )?(?:\(\S*\) )?%(host_info)sclosed by DROP in ACL\s*$
-            <mdre-<mode>>
-
-mdre-aggressive = ^%(pid)s no host name found for IP address <HOST>$
-                  ^%(pid)s no IP address found for host \S+ \(during SMTP connection from \[<HOST>\]\)$
-
-mdre-normal = 
-
-# Parameter `mode` - `normal` or `aggressive`.
-# Aggressive mode can be used to match flood and ddos-similar log-entries like:
-#   'no host found for IP', 'no IP found for host'.
-# Note this is not an authentication failures, so it may produce lots of false 
-# positives on misconfigured MTAs.
-# Ex.:
-#   filter = exim[mode=aggressive]
-mode = normal
 
 ignoreregex = 
 

config/filter.d/freeswitch.conf

@@ -8,49 +8,14 @@
 # IP addresses on your LAN.
 #
 
-[INCLUDES]
-
-# Read common prefixes. If any customizations available -- read them from
-# common.local
-before = common.conf
-
 [Definition]
 
-_daemon = freeswitch
-
-# Parameter "mode": normal, ddos or extra (default, combines all)
-# Usage example (for jail.local):
-#   [freeswitch]
-#   mode = normal
-#   # or with rewrite filter parameters of jail:
-#   [freeswitch-ddos]
-#   filter = freeswitch[mode=ddos]
-#
-mode = extra
-              
-# Prefix contains common prefix line (server, daemon, etc.) and 2 datetimes if used systemd backend
-_pref_line = ^%(__prefix_line)s(?:(?:\d+-)?\d+-\d+ \d+:\d+:\d+\.\d+)?
-
-prefregex = ^%(_pref_line)s \[WARN(?:ING)?\](?: \[SOFIA\])? \[?sofia_reg\.c:\d+\]? <F-CONTENT>.+</F-CONTENT>$
-
-cmnfailre = ^Can't find user \[[^@]+@[^\]]+\] from <HOST>$
-
-mdre-normal = %(cmnfailre)s
-              ^SIP auth failure \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[[^\]]*\] from ip <HOST>$
-
-mdre-ddos   = ^SIP auth (?:failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[[^\]]*\] from ip <HOST>$
-
-mdre-extra  = %(cmnfailre)s
-              <mdre-ddos>
-
-failregex = <mdre-<mode>>
+failregex = ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ SIP auth (failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[.*\] from ip <HOST>$
+            ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from <HOST>$
 
 ignoreregex =
 
-datepattern = ^(?:%%Y-)?%%m-%%d[ T]%%H:%%M:%%S(?:\.%%f)?
-              {^LN-BEG}
-
-# Author: Rupa SChomaker, soapee01, Daniel Black, Sergey Brester aka sebres
+# Author: Rupa SChomaker, soapee01, Daniel Black
 # https://freeswitch.org/confluence/display/FREESWITCH/Fail2Ban
 # Thanks to Jim on mailing list of samples and guidance
 #

config/filter.d/froxlor-auth.conf

@@ -25,11 +25,8 @@ _daemon = Froxlor
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-
-prefregex = ^%(__prefix_line)s\[Login Action <HOST>\] <F-CONTENT>.+</F-CONTENT>$
-
-failregex = ^Unknown user \S* tried to login.$
-            ^User \S* tried to login with wrong password.$
+failregex = ^%(__prefix_line)s\[Login Action <HOST>\] Unknown user \S* tried to login.$
+            ^%(__prefix_line)s\[Login Action <HOST>\] User \S* tried to login with wrong password.$
 
 
 # Option:  ignoreregex