changelog for debian packager.

This allows me to build in a VM on a Mac.

.gitignore

@@ -1,3 +1,4 @@
+.pc/*
 *~
 build
 dist
@@ -6,3 +7,6 @@ htmlcov
 .coverage
 *.orig
 *.rej
+*.bak
+__pycache__
+.vagrant/

.travis.yml

@@ -4,14 +4,19 @@ language: python
 python:
   - "2.6"
   - "2.7"
+  - "3.2"
+  - "3.3"
+  - "3.4"
+  - "pypy"
 before_install:
-  - sudo apt-get update -qq
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get update -qq; fi
 install:
   - pip install pyinotify
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get install -qq python-gamin; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get install -qq python-gamin; cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/; fi
   - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then cd ..; pip install -q coveralls; cd -; fi
 script:
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then export PYTHONPATH="$PYTHONPATH:/usr/share/pyshared:/usr/lib/pyshared/python2.7"; fi
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coverage run --rcfile=.travis_coveragerc fail2ban-testcases; else python ./fail2ban-testcases; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coverage run --rcfile=.travis_coveragerc setup.py test; else python setup.py test; fi
 after_success:
+# Coverage config file must be .coveragerc for coveralls
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then cp -v .travis_coveragerc .coveragerc; fi
   - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coveralls; fi

.travis_coveragerc

@@ -4,3 +4,4 @@ branch = True
 omit =
     /usr/*
     /home/travis/virtualenv/*
+    fail2ban/server/filtersystemd.py

3rdparty/logwatch/fail2ban

@@ -0,0 +1,181 @@
+#!/usr/bin/perl
+##########################################################################
+# $Id: fail2ban 150 2013-06-18 22:19:38Z mtremaine $
+##########################################################################
+# $Log: fail2ban,v $
+# Revision 1.5  2008/08/18 16:07:46  mike
+# Patches from Paul Gear <paul at libertysys.com> -mgt
+#
+# Revision 1.4  2008/06/30 23:07:51  kirk
+# fixed copyright holders for files where I know who they should be
+#
+# Revision 1.3  2008/03/24 23:31:26  kirk
+# added copyright/license notice to each script
+#
+# Revision 1.2  2006/12/15 04:53:59  bjorn
+# Additional filtering, by Willi Mann.
+#
+# Revision 1.1  2006/05/30 19:04:26  bjorn
+# Added fail2ban service, written by Yaroslav Halchenko.
+#
+# Written by Yaroslav Halchenko <debian@onerussian.com> for fail2ban
+#
+##########################################################################
+
+########################################################
+## Copyright (c) 2008  Yaroslav Halchenko
+## Covered under the included MIT/X-Consortium License:
+##    http://www.opensource.org/licenses/mit-license.php
+## All modifications and contributions by other persons to
+## this script are assumed to have been donated to the
+## Logwatch project and thus assume the above copyright
+## and licensing terms.  If you want to make contributions
+## under your own copyright or a different license this
+## must be explicitly stated in the contribution an the
+## Logwatch project reserves the right to not accept such
+## contributions.  If you have made significant
+## contributions to this script and want to claim
+## copyright please contact logwatch-devel@lists.sourceforge.net.
+#########################################################
+
+use strict;
+use Logwatch ':all';
+
+my $Debug = $ENV{'LOGWATCH_DEBUG'} || 0;
+my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
+my $IgnoreHost = $ENV{'sshd_ignore_host'} || "";
+my $DebugCounter = 0;
+my $ReInitializations = 0;
+my @IptablesErrors = ();
+my @ActionErrors = ();
+my $NotValidIP = 0;		# reported invalid IPs number
+my @OtherList = ();
+
+my %ServicesBans = ();
+
+if ( $Debug >= 5 ) {
+	print STDERR "\n\nDEBUG: Inside Fail2Ban Filter \n\n";
+	$DebugCounter = 1;
+}
+
+while (defined(my $ThisLine = <STDIN>)) {
+    if ( $Debug >= 5 ) {
+	print STDERR "DEBUG($DebugCounter): $ThisLine";
+	$DebugCounter++;
+    }
+    chomp($ThisLine);
+    if ( ($ThisLine =~ /..,... DEBUG: /) or
+	 ($ThisLine =~ /..,... \S*\s*: DEBUG /) or # syntax of 0.7.? fail2ban
+	 ($ThisLine =~ /..,... INFO: (Fail2Ban v.* is running|Exiting|Enabled sections:)/) or
+	 ($ThisLine =~ /INFO\s+Log rotation detected for/) or
+	 ($ThisLine =~ /INFO\s+Jail.+(?:stopped|started|uses poller)/) or
+	 ($ThisLine =~ /INFO\s+Changed logging target to/) or
+	 ($ThisLine =~ /INFO\s+Creating new jail/) or
+	 ($ThisLine =~ /..,... \S+\s*: INFO\s+(Set |Socket|Exiting|Gamin|Created|Added|Using)/) or # syntax of 0.7.? fail2ban
+	 ($ThisLine =~ /..,... WARNING: Verbose level is /) or
+	 ($ThisLine =~ /..,... WARNING: Restoring firewall rules/)
+       )
+    {
+	if ( $Debug >= 6 ) {
+	    print STDERR "DEBUG($DebugCounter): line ignored\n";
+	}
+    } elsif ( my ($Service,$Action,$Host) = ($ThisLine =~ m/WARNING:?\s\[?(.*?)[]:]?\s(Ban|Unban)[^\.]* (\S+)/)) {
+	if ( $Debug >= 6 ) {
+	    print STDERR "DEBUG($DebugCounter): Found $Action for $Service from $Host\n";
+	}
+	$ServicesBans{$Service}{$Host}{$Action}++;
+	$ServicesBans{$Service}{"(all)"}{$Action}++;
+    } elsif ( my ($Service,$Host,$NumFailures) = ($ThisLine =~ m/INFO: (\S+): (.+) has (\d+) login failure\(s\). Banned./)) {
+	if ($Debug >= 4) {
+	    print STDERR "DEBUG: Found host $Host trying to access $Service - failed $NumFailures times\n";
+	}
+	push @{$ServicesBans{$Service}{$Host}{'Failures'}}, $NumFailures;
+    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ ERROR:\s(.*):\s(\S+)\salready in ban list/)) {
+   	 $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
+    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/WARNING\s*\[(.*)\]\s*(\S+)\s*already banned/)) {
+       $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
+    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ WARNING:\s(.*):\sReBan (\S+)/)) {
+	    $ServicesBans{$Service}{$Host}{'ReBan'}++;
+    } elsif ($ThisLine =~ / ERROR:?\s*(Execution of command )?\'?iptables/) {
+	    push @IptablesErrors, "$ThisLine\n";
+    } elsif ($ThisLine =~ /ERROR.*returned \d+$/) {
+       push @ActionErrors, "$ThisLine\n";
+    } elsif (($ThisLine =~ /..,... WARNING: \#\S+ reinitialization of firewalls/) or
+	    ($ThisLine =~ / ERROR\s*Invariant check failed. Trying to restore a sane environment/)) {
+	    $ReInitializations++;
+    } elsif ($ThisLine =~ /..,... WARNING:  is not a valid IP address/) {
+	# just ignore - this will be fixed within fail2ban and is harmless warning
+    }
+    else
+    {
+	# Report any unmatched entries...
+	push @OtherList, "$ThisLine\n";
+    }
+}
+
+###########################################################
+
+
+if (keys %ServicesBans) {
+    printf("\nBanned services with Fail2Ban:				 Bans:Unbans\n");
+    foreach my $service (sort {$a cmp $b} keys %ServicesBans) {
+	printf("   %-55s [%3d:%-3d]\n", "$service:",
+	       $ServicesBans{$service}{'(all)'}{'Ban'},
+	       $ServicesBans{$service}{'(all)'}{'Unban'});
+	delete $ServicesBans{$service}{'(all)'};
+	my $totalSort = TotalCountOrder(%{$ServicesBans{$service}}, \&SortIP);
+	if ($Detail >= 5) {
+	    foreach my $ip (sort $totalSort keys %{$ServicesBans{$service}}) {
+		   my $name = LookupIP($ip);
+		   printf("      %-53s %3d:%-3d\n",
+		       $name,
+		       $ServicesBans{$service}{$ip}{'Ban'},
+		       $ServicesBans{$service}{$ip}{'Unban'});
+		   if (($Detail >= 10) and ($ServicesBans{$service}{$ip}{'Failures'}>0)) {
+		      print "	   Failed ";
+		      foreach my $fails (@{$ServicesBans{$service}{$ip}{'Failures'}}) {
+			      print " $fails";
+		      }
+		    print " times";
+		    printf("\n	   %d Duplicate Ban attempts", $ServicesBans{$service}{$ip}{'AlreadyInTheList'}) ;
+		    printf("\n	   %d ReBans due to rules reinitilizations", $ServicesBans{$service}{$ip}{'ReBan'}) ;
+		    print "\n";
+		   }
+	    }
+	   }
+    }
+}
+
+
+if ($Detail>0) {
+    if ($#IptablesErrors > 0) {
+	   printf("\n%d faulty iptables invocation(s)", $#IptablesErrors);
+	   if ($Detail > 5) {
+	    print ":\n";
+	    print @IptablesErrors ;
+	   }
+    }
+    if ($#ActionErrors > 0) {
+       printf("\n%d error(s) returned from actions", $#ActionErrors);
+       if ($Detail > 5) {
+           print ":\n";
+           print @ActionErrors ;
+       }
+    }
+    if ($ReInitializations > 0) {
+	   printf("\n%d fail2ban rules reinitialization(s)", $ReInitializations);
+    }
+    if ($#OtherList >= 0) {
+	   print "\n**Unmatched Entries**\n";
+	   print @OtherList;
+    }
+}
+
+exit(0);
+
+# vi: shiftwidth=3 tabstop=3 syntax=perl et
+# Local Variables:
+# mode: perl
+# perl-indent-level: 3
+# indent-tabs-mode: nil
+# End:

CONTRIBUTING.md

@@ -0,0 +1,17 @@
+Guidelines on Fail2Ban contributions
+====================================
+
+### You found a severe security vulnerability in Fail2Ban?
+email details to fail2ban-vulnerabilities at lists dot sourceforge dot net .
+
+### You need some new features, you found bugs?
+visit [Issues](https://github.com/fail2ban/fail2ban/issues)
+and if your issue is not yet known -- file a bug report. See
+[Fail2Ban wiki](http://www.fail2ban.org/wiki/index.php/HOWTO_Seek_Help)
+on further instructions.
+
+### You would like to troubleshoot or discuss?
+join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
+
+### You would like to contribute (new filters/actions/code/documentation)?
+send a [pull request](https://github.com/fail2ban/fail2ban/pulls)

ChangeLog

@@ -4,9 +4,167 @@
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 ================================================================================
-Fail2Ban (version 0.8.13)                                             2014/03/15
+Fail2Ban (version 0.9.0.dev)                                          2014/xx/xx
 ================================================================================
 
+ver. 0.9.1 (2014/xx/xx) - better, faster, stronger
+----------
+
+- Refactoring (IMPORTANT -- Please review your setup and configuration):
+   * iptables-common.conf replaced iptables-blocktype.conf
+     (iptables-blocktype.local should still be read) and now also
+     provides defaults for the chain, port, protocol and name tags
+
+- Fixes:
+   * UTF-8 fixes in pure-ftp thanks to Johannes Weberhofer. Closes gh-806.
+   * systemd backend error on bad utf-8 in python3
+   * badips.py action error when logging HTTP error raised with badips request
+   * fail2ban-regex failed to work in python3 due to space/tab mix
+   * recidive regex samples incorrect log level
+   * journalmatch for recidive incorrect PRIORITY
+   * loglevel couldn't be changed in fail2ban.conf
+   * Handle case when no sqlite library is available for persistent database
+   * Only reban once per IP from database on fail2ban restart
+   * Nginx filter to support missing server_name. Closes gh-676
+   * fail2ban-regex assertion error caused by miscount missed lines with
+     multiline regex
+   * Fix actions failing to execute for Python 3.4.0. Workaround for
+     http://bugs.python.org/issue21207
+   * Database now returns persistent bans on restart (bantime < 0)
+   * Recursive action tags now fully processed. Fixes issue with bsd-ipfw
+     action
+   * Fixed TypeError with "ipfailures" and "ipjailfailures" action tags.
+     Thanks Serg G. Brester
+   * Correct times for non-timezone date times formats during DST
+   * Pass a copy of, not original, aInfo into actions to avoid side-effects
+   * Per-distribution paths to the exim's main log
+   * Ignored IPs are no longer banned when being restored from persistent
+     database
+   * Manually unbanned IPs are now removed from persistent database, such they
+     wont be banned again when Fail2Ban is restarted
+   * Pass "bantime" parameter to the actions in default jail's action
+     definition(s)
+   * filters.d/sieve.conf - fixed typo in _daemon.  Thanks Jisoo Park
+   * cyrus-imap -- also catch also failed logins via secured (imaps/pop3s).
+     Regression was introduced while strengthening failregex in 0.8.11 (bd175f)
+     Debian bug #755173
+   * postfix-sasl -- added journalmatch.  Thanks Luc Maisonobe
+
+- New features:
+   - New filters:
+     - monit  Thanks Jason H Martin
+     - directadmin  Thanks niorg
+   - New actions:
+     - symbiosis-blacklist-allports  for Bytemark symbiosis firewall
+   - fail2ban-client can fetch the running server version
+   - Added Cloudflare API action
+
+- Enhancements
+   * Fail2ban-regex - add print-all-matched option. Closes gh-652
+   * Suppress fail2ban-client warnings for non-critical config options
+   * Match non "Bye Bye" disconnect messages for sshd locked account regex
+   * courier-smtp filter:
+     - match lines with user names
+     - match lines containing "535 Authentication failed" attempts
+   * Add <chain> tag to iptables-ipsets
+   * Realign fail2ban log output with white space to improve readability. Does
+     not affect SYSLOG output
+   * Log unhandled exceptions
+   * cyrus-imap: catch "user not found" attempts
+
+ver. 0.9.0 (2014/03/14) - beta
+----------
+
+Carries all fixes, features and enhancements from 0.8.13 (unreleased) with
+major changes.
+
+The minimum supported python version is now 2.6. If you have python-2.4 or 2.5
+you can use the 0.8.12 version of fail2ban.
+
+Please take note of release notes:
+https://github.com/fail2ban/fail2ban/releases/tag/0.9.0
+
+Please test your configuration before relying on it.
+
+Nearly all development is thanks to Steven Hiscocks (THANKS!), merging,
+testcases and timezone support from Daniel Black, and code-review and minor
+additions from Yaroslav Halchenko.
+
+- Refactoring (IMPORTANT -- Please review your setup and configuration):
+   * [..bddbf1e] jail.conf was heavily refactored and now is similar
+     to how it looked on Debian systems:
+     - default action could be configured once for all jails
+     - jails definitions only provide customizations (port, logpath)
+     - no need to specify 'filter' if name matches jail name
+   * [..5aef036] Core functionality moved into fail2ban/ module.
+     Closes gh-26
+     - tests included in module to aid testing and debugging
+   * Added fail2ban persistent database
+     - default location at /var/lib/fail2ban/fail2ban.sqlite3
+     - allows active bans to be reinstated on restart
+     - log files read from last position after restart
+   * Added systemd journal backend
+     - Dependency on python-systemd
+     - New "journalmatch" option added to filter configs files
+     - New "systemd-journal" option added to fail2ban-regex
+   * Added python3 support
+   * Support %z (Timezone offset) and %f (sub-seconds) support for
+     datedetector. Enhanced existing date/time have been updated patterns to
+     support these. ISO8601 now defaults to localtime unless specified otherwise.
+     Some filters have been change as required to capture these elements in the
+     right timezone correctly.
+   * Log levels are now set by Syslog style strings e.g. DEBUG, ERROR.
+     - Log level INFO is now more verbose
+   * Optionally can read log files starting from "head" or "tail".
+     - See "logpath" option in jail.conf(5) man page.
+   * Can now set log encoding for files per jail.
+     - Default uses systemd locale.
+
+- New features:
+   * [..c7ae460] Multiline failregex. Close gh-54
+   * [8af32ed] Guacamole filter and support for Apache Tomcat date
+     format
+   * [..b6059f4] 'timeout' option for actions Close gh-60 and Debian bug
+     #410077.  Also it would now capture and include stdout and stderr
+     into logging messages in case of error or at DEBUG loglevel.
+   * Added action xarf-login-attack to report formatted attack messages
+     according to the XARF standard (v0.2). Close gh-105
+   * Support PyPy
+   * Add filter for apache-botsearch
+   * Add filter for kerio. Thanks Tony Lawrence for blog of regexs and
+     providing samples. Close gh-120
+   * Filter for stunnel
+   * Filter for Counter Strike 1.6. Thanks to onorua for logs.
+     Close gh-347
+   * Filter for squirrelmail. Close gh-261
+   * Filter for tine20. Close gh-583
+   * Custom date formats (strptime) can now be set in filters and jail.conf
+   * Python based actions can now be created.
+     - SMTP action for sending emails on jail start, stop and ban.
+   * Added action to use badips.com reporting and blacklist
+     - Requires Python 2.7+
+
+- Enhancements
+   * Fail2ban-regex - don't accumulate lines if not printing them.
+     add options to suppress output of missed/ignored lines. Close gh-644
+   * Asterisk now supports syslog format
+   * Jail names increased to 26 characters and iptables prefix reduced
+     from fail2ban- to f2b- as suggested by buanzo in gh-462.
+   * Multiline filter for sendmail-spam. Close gh-418
+   * Multiline regex for Disconnecting: Too many authentication failures for
+     root [preauth]\nConnection closed by 6X.XXX.XXX.XXX [preauth]
+   * Multiline regex for Disconnecting: Connection from 61.XX.XX.XX port
+     51353\nToo many authentication failures for root [preauth]. Thanks
+     Helmut Grohne. Close gh-457
+   * Replacing use of deprecated API (.warning, .assertEqual, etc)
+   * [..a648cc2] Filters can have options now too which are substituted into
+     failregex / ignoreregex
+   * [..e019ab7] Multiple instances of the same action are allowed in the
+     same jail -- use actname option to disambiguate.
+   * Add honeypot email address to exim-spam filter as argument
+   * Properties and methods of actions accessible from fail2ban-client
+     - Use of properties replaces command actions "cinfo" interface
+
 ver. 0.8.13 (2014/03/15) - maintenance-only-from-now-on
 -----------
 
@@ -27,7 +185,7 @@ ver. 0.8.13 (2014/03/15) - maintenance-only-from-now-on
     Thanks Noel Butler.
 
 ver. 0.8.12 (2014/01/22) - things-can-only-get-better
------------
+----------
 
 - IMPORTANT incompatible changes:
   - Rename firewall-cmd-direct-new to firewallcmd-new to fit within jail name
@@ -39,7 +197,7 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better
   - allow for ",milliseconds" in the custom date format of proftpd.log
   - allow for ", referer ..." in apache-* filter for apache error logs.
   - allow for spaces at the beginning of kernel messages. Closes gh-448
-  - recidive jail to block all protocols. Closes gh-440. Thanksg Ioan Indreias
+  - recidive jail to block all protocols. Closes gh-440. Thanks Ioan Indreias
   - smtps not a IANA standard and has been removed from Arch. Replaced with
     465. Thanks Stefan. Closes gh-447
   - add 'flushlogs' command to allow logrotation without clobbering logtarget
@@ -52,7 +210,7 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better
   - Asynchat changed to use push method which verifys whether all data was
     send. This ensures that all data is sent before closing the connection.
   - Removed unnecessary reference to as yet undeclared $jail_name when checking
-    a specific jail.
+    a specific jail in nagios script.
   - Filter dovecot reordered session and TLS items in regex with wider scope
     for session characters. Thanks Ivo Truxa. Closes gh-586
   - A single bad failregex or command syntax in configuration files won't stop
@@ -68,8 +226,11 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better
     Thanks dani. Closes gh-503
   - exim-spam filter to match spamassassin log entry for option SAdevnull.
     Thanks Ivo Truxa. Closes gh-533
+  - filter.d/nsd.conf -- also amended Unix date template to match nsd format
   - Added to sshd filter expression for "Received disconnect from <HOST>: 3:
     ...: Auth fail". Thanks Marcel Dopita. Closes gh-289
+  - loglines now also report "[PID]" after the name portion
+  - Added filter.d/ejabberd-auth
   - Improved ACL-handling for Asterisk
   - loglines now also report "[PID]" after the name portion
   - Added improper command pipelining to postfix filter.
@@ -79,10 +240,12 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better
   - filter.d/solid-pop3d -- added thanks to Jacques Lav!gnotte on mailinglist.
   - Add filter for apache-modsecurity.
   - filter.d/nsd.conf -- also amended Unix date template to match nsd format
-  - Added filter.d/openwebmail filter thanks Ivo Truxa. Closes gh-543
-  - Added filter.d/horde.
+  - Added openwebmail filter thanks Ivo Truxa. Closes gh-543
   - Added filter for freeswitch. Thanks Jim and editors and authors of 
-    http://wiki.freeswitch.org/wiki/Fail2ban.
+    http://wiki.freeswitch.org/wiki/Fail2ban
+  - Added groupoffice filter thanks to logs from Merijn Schering.
+    Closes gh-566
+  - Added filter for horde
   - Added filter for squid. Thanks Roman Gelfand.
   - Added filter for ejabberd-auth.
   - Added filter.d/openwebmail filter thanks Ivo Truxa. Closes gh-543
@@ -95,7 +258,7 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better
 
 
 ver. 0.8.11 (2013/11/13) - loves-unittests-and-tight-DoS-free-filter-regexes
------------
+----------
 
 In light of CVE-2013-2178 that triggered our last release we have put
 a significant effort into tightening all of the regexs of our filters
@@ -154,15 +317,15 @@ and bug requests.
   Daniel Black & Sebastian Arcus
    * filter.d/asterisk -- more regexes
   Daniel Black
-   * action.d/hostsdeny -- NOTE: new dependancy 'ed'. Switched to use 'ed' across
+   * action.d/hostsdeny -- NOTE: new dependency 'ed'. Switched to use 'ed' across
      all platforms to ensure permissions are the same before and after a ban.
      Closes gh-266. hostsdeny supports daemon_list now too.
-   * action.d/bsd-ipfw - action option unsed. Change blocktype to port unreach
+   * action.d/bsd-ipfw - action option unused. Change blocktype to port unreach
      instead of deny for consistancy.
    * filter.d/dovecot - added to support different dovecot failure
      "..disallowed plaintext auth". Closes Debian bug #709324
    * filter.d/roundcube-auth - timezone offset can be positive or negative
-   * action.d/bsd-ipfw - action option unsed. Fixed to blocktype for
+   * action.d/bsd-ipfw - action option unused. Fixed to blocktype for
      consistency. default to port unreach instead of deny
    * filter.d/dropbear - fix regexs to match standard dropbear and the patched
      http://www.unchartedbackwaters.co.uk/files/dropbear/dropbear-0.52.patch

DEVELOP

@@ -1,4 +1,4 @@
-                         __      _ _ ___ _
+..                       __      _ _ ___ _
                         / _|__ _(_) |_  ) |__  __ _ _ _
                        |  _/ _` | | |/ /| '_ \/ _` | ' \
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
@@ -25,6 +25,7 @@ Pull Requests
 =============
 
 When submitting pull requests on GitHub we ask you to:
+
 * Clearly describe the problem you're solving;
 * Don't introduce regressions that will make it hard for systems administrators
   to update;
@@ -39,9 +40,9 @@ If you are developing filters see the FILTERS file for documentation.
 Code Testing
 ============
 
-Existing tests can be run by executing `fail2ban-testcases`. This has options
-like --log-level that will probably be useful. `fail2ban-testcases --help` for
-full options.
+Existing tests can be run by executing `bin/fail2ban-testcases`. It has
+options like --log-level that will probably be useful.  Run
+`bin/fail2ban-testcases --help` for the full list of options.
 
 Test cases should cover all usual cases, all exception cases and all inside
 / outside boundary conditions.
@@ -52,32 +53,32 @@ for more details.
 
 Install the package python-coverage to visualise your test coverage. Run the
 following (note: on Debian-based systems, the script is called
-`python-coverage`):
+`python-coverage`)::
 
-coverage run fail2ban-testcases
-coverage html
+  coverage run bin/fail2ban-testcases
+  coverage html
 
 Then look at htmlcov/index.html and see how much coverage your test cases
 exert over the code base. Full coverage is a good thing however it may not be
 complete. Try to ensure tests cover as many independent paths through the
 code.
 
-Manual Execution. To run in a development environment do:
+Manual Execution. To run in a development environment do::
 
-./fail2ban-client -c config/ -s /tmp/f2b.sock -i start
+  ./fail2ban-client -c config/ -s /tmp/f2b.sock -i start
 
-some quick commands:
+some quick commands::
 
-status
-add test pyinotify
-status test
-set test addaction iptables
-set test actionban iptables echo <ip> <cidr> >> /tmp/ban
-set test actionunban iptables echo <ip> <cidr> >> /tmp/unban
-get test actionban iptables
-get test actionunban iptables
-set test banip 192.168.2.2
-status test
+  status
+  add test pyinotify
+  status test
+  set test addaction iptables
+  set test actionban iptables echo <ip> <cidr> >> /tmp/ban
+  set test actionunban iptables echo <ip> <cidr> >> /tmp/unban
+  get test actionban iptables
+  get test actionunban iptables
+  set test banip 192.168.2.2
+  status test
 
 
 
@@ -104,6 +105,15 @@ older versions on python. For all other uses of "pragma: no cover" or
 "pragma: no branch" document the reason why its not covered. "I haven't written
 a test case" isn't a sufficient reason.
 
+pyflakes
+--------
+
+pyflakes can be used to find unused imports, and unused, undefined and
+redefined variables. pyflakes should be run in any python code, including
+python based actions::
+
+  pyflakes bin/ config/ fail2ban/
+
 Documentation
 -------------
 
@@ -121,10 +131,10 @@ Git
 
 Use the following tags in your commit messages:
 
-'BF:' for bug fixes
-'DOC:' for documentation fixes
-'ENH:' for enhancements
-'TST:' for commits concerning tests only (thus not touching the main code-base)
+* 'BF:' for bug fixes
+* 'DOC:' for documentation fixes
+* 'ENH:' for enhancements
+* 'TST:' for commits concerning tests only (thus not touching the main code-base)
 
 Multiple tags could be joined with +, e.g. "BF+TST:".
 
@@ -268,159 +278,3 @@ action.py
 
 Takes care about executing start/check/ban/unban/stop commands
 
-
-Releasing
-=========
-
-# Check distribution patches and see if they can be included
-
-  * https://apps.fedoraproject.org/packages/fail2ban/sources
-  * http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/
-  * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/
-  * https://build.opensuse.org/package/show?package=fail2ban&project=openSUSE%3AFactory
-  * http://sophie.zarb.org/sources/fail2ban (Mageia)
-  * https://trac.macports.org/browser/trunk/dports/security/fail2ban
-
-# Check distribution outstanding bugs
-
-  * https://github.com/fail2ban/fail2ban/issues?sort=updated&state=open
-  * http://bugs.debian.org/cgi-bin/pkgreport.cgi?dist=unstable;package=fail2ban
-  * https://bugs.launchpad.net/ubuntu/+source/fail2ban
-  * http://bugs.sabayon.org/buglist.cgi?quicksearch=net-analyzer%2Ffail2ban
-  * https://bugs.archlinux.org/?project=5&cat%5B%5D=33&string=fail2ban
-  * https://bugs.gentoo.org/buglist.cgi?query_format=advanced&short_desc=fail2ban&bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=IN_PROGRESS&short_desc_type=allwords
-  * https://bugzilla.redhat.com/buglist.cgi?query_format=advanced&bug_status=NEW&bug_status=ASSIGNED&component=fail2ban&classification=Red%20Hat&classification=Fedora
-  * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
-  * https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
-  * https://build.opensuse.org/package/requests/openSUSE:Factory/fail2ban
-
-# Make sure the tests pass
-
-  ./fail2ban-testcases-all
-
-# Ensure the version is correct
-
-  in:
-  * ./common/version.py
-  * top of ChangeLog
-  * README.md
-
-# Ensure the MANIFEST is complete
-
-Run:
-
-  python setup.py sdist
-
-Look for errors like:
- 'testcases/files/logs/mysqld.log' not a regular file -- skipping
-
-Which indicates that testcases/files/logs/mysqld.log has been moved or is a directory
-
-  tar -C /tmp -jxf dist/fail2ban-0.8.14.tar.bz2
-
-# clean up current direcory
-
-  diff -rul --exclude \*.pyc . /tmp/fail2ban-0.8.14/
-
-  # Only differences should be files that you don't want distributed.
-
-# Ensure the tests work from the tarball
-
-  cd /tmp/fail2ban-0.8.14/ && ./fail2ban-testcases-all
-
-# Add/finalize the corresponding entry in the ChangeLog
-
-  To generate a list of committers use e.g.
-
-  git shortlog -sn 0.8.13.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
-
-  Ensure the top of the ChangeLog has the right version and current date.
-
-  Ensure the top entry of the ChangeLog has the right version and current date.
-
-# Update man pages
-
-  (cd man ; ./generate-man )
-  git commit -m 'DOC/ENH: update man pages for release' man/*
-
-# Prepare source and rpm binary distributions
-
-  python setup.py sdist
-  python setup.py bdist_rpm
-  python setup.py upload
-
-# Provide a release sample to distributors
-
-  * Arch Linux:
-            https://www.archlinux.org/packages/community/any/fail2ban/
-  * Debian: Yaroslav Halchenko <debian@onerussian.com>
-            http://packages.qa.debian.org/f/fail2ban.html
-  * FreeBSD: Christoph Theis theis@gmx.at>, Nick Hilliard <nick@foobar.org>
-            http://svnweb.freebsd.org/ports/head/security/py-fail2ban/Makefile?view=markup
-            http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
-  * Fedora: Axel Thimm <Axel.Thimm@atrpms.net>
-            https://apps.fedoraproject.org/packages/fail2ban
-            http://pkgs.fedoraproject.org/cgit/fail2ban.git
-            https://admin.fedoraproject.org/pkgdb/acls/bugs/fail2ban
-  * Gentoo: netmon@gentoo.org
-            http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/metadata.xml?view=markup
-            https://bugs.gentoo.org/buglist.cgi?quicksearch=fail2ban
-  * openSUSE: Stephan Kulow <coolo@suse.com>
-            https://build.opensuse.org/package/show/openSUSE:Factory/fail2ban
-  * Mac Ports: @Malbrouck on github (gh-49)
-            https://trac.macports.org/browser/trunk/dports/security/fail2ban/Portfile
-  * Mageia:
-            https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
-  An potentially to the fail2ban-users directory.
-
-# Wait for feedback from distributors
-
-# Prepare a release notice https://github.com/fail2ban/fail2ban/releases/new
-
-  Upload the source/binaries from the dist directory and tag the release using the URL
-
-# Upload source/binaries to sourceforge http://sourceforge.net/projects/fail2ban/
-
-# Run the following and update the wiki with output:
-  python -c 'import common.protocol; common.protocol.printWiki()'
-
-  page: http://www.fail2ban.org/wiki/index.php/Commands
-
-* Update:
-  http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_Versions&action=edit
-
-  http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_News&action=edit
-  move old bits to:
-  http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_OldNews&action=edit
-
-  http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_Versions&action=edit
-  http://www.fail2ban.org/wiki/index.php/ChangeLog
-  http://www.fail2ban.org/wiki/index.php/Requirements (Check requirement)
-  http://www.fail2ban.org/wiki/index.php/Features
-
-* See if any filters are upgraded:
-  http://www.fail2ban.org/wiki/index.php/Special:AllPages
-
-# Email users and development list of release
-
-# notify distributors
-
-Post Release
-============
-
-Add the following to the top of the ChangeLog
-
-ver. 0.8.13 (2014/XX/XXX) - wanna-be-released
------------
-
-- Fixes:
-
-- New Features:
-
-- Enhancements:
-
-Alter the git shortlog command in the previous section to refer to the just
-released version.
-
-and adjust common/version.py to carry .dev suffix to signal
-a version under development.

FILTERS

@@ -1,4 +1,4 @@
-                         __      _ _ ___ _
+..                       __      _ _ ___ _
                         / _|__ _(_) |_  ) |__  __ _ _ _
                        |  _/ _` | | |/ /| '_ \/ _` | ' \
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
@@ -7,10 +7,8 @@
 Developing Filters
 ================================================================================
 
-Filters
-=======
-
 Filters are tricky. They need to:
+
 * work with a variety of the versions of the software that generates the logs;
 * work with the range of logging configuration options available in the
   software;
@@ -31,10 +29,11 @@ what you have done, what is the hurdle, and we'll attempt to help (PR
 will be automagically updated with future commits you would push to
 complete it).
 
-Filter test cases
------------------
+Filter Test Cases
+=================
 
-Purpose:
+Purpose
+-------
 
 Start by finding the log messages that the application generates related to
 some form of authentication failure. If you are adding to an existing filter
@@ -49,7 +48,8 @@ and exim-spam at log messages related to spam.
 Even if it is a new filter you may consider separating the log messages into
 different filters based on purpose.
 
-Cause:
+Cause
+-----
 
 Are some of the log lines a result of the same action? For example, is a PAM
 failure log message, followed by an application specific failure message the
@@ -65,7 +65,8 @@ the log message be occurring due to the first step towards the application
 asking for authentication? Could the log messages occur often? If some of
 these are true make a note of this in the jail.conf example that you provide.
 
-Samples:
+Samples
+-------
 
 It is important to include log file samples so any future change in the regular
 expression will still work with the log lines you have identified.
@@ -93,21 +94,22 @@ If the mechanism to create the log message isn't obvious provide a
 configuration and/or sample scripts testcases/files/config/{filtername} and
 reference these in the comments above the log line.
 
-FailJSON metadata:
+FailJSON metadata
+-----------------
 
 A failJSON metadata is a comment immediately above the log message. It will
-look like:
+look like::
 
-# failJSON: { "time": "2013-06-10T10:10:59", "match": true , "host": "93.184.216.119" }
+  # failJSON: { "time": "2013-06-10T10:10:59", "match": true , "host": "93.184.216.119" }
 
 Time should match the time of the log message. It is in a specific format of
 Year-Month-Day'T'Hour:minute:Second.  If your log message does not include a
 year, like the example below, the year should be listed as 2005, if before Sun
 Aug 14 10am UTC, and 2004 if afterwards.  Here is an example failJSON
-line preceding a sample log line:
+line preceding a sample log line::
 
-# failJSON: { "time": "2005-03-24T15:25:51", "match": true , "host": "198.51.100.87" }
-Mar 24 15:25:51 buffalo1 dropbear[4092]: bad password attempt for 'root' from 198.51.100.87:5543
+  # failJSON: { "time": "2005-03-24T15:25:51", "match": true , "host": "198.51.100.87" }
+  Mar 24 15:25:51 buffalo1 dropbear[4092]: bad password attempt for 'root' from 198.51.100.87:5543
 
 The "host" in failJSON should contain the IP or domain that should be blocked.
 
@@ -116,27 +118,28 @@ attacks) and any log lines to be excluded (see "Cause" section above), set
 "match": false in the failJSON and describe the reason in the comment above.
 
 After developing regexes, the following command will test all failJSON metadata
-against the log lines in all sample log files
+against the log lines in all sample log files::
 
-./fail2ban-testcases testSampleRegex
+  ./fail2ban-testcases testSampleRegex
 
 Developing Filter Regular Expressions
--------------------------------------
+=====================================
 
-Date/Time:
+Date/Time
+---------
 
 At the moment, Fail2Ban depends on log lines to have time stamps.  That is why
 before starting to develop failregex, check if your log line format known to
 Fail2Ban.  Copy the time component from the log line and append an IP address to
-test with following command:
+test with following command::
 
-./fail2ban-regex "2013-09-19 02:46:12 1.2.3.4" "<HOST>"
+  ./fail2ban-regex "2013-09-19 02:46:12 1.2.3.4" "<HOST>"
 
-Output of such command should contain something like:
+Output of such command should contain something like::
 
-Date template hits:
-|- [# of hits] date format
-|  [1] Year-Month-Day Hour:Minute:Second
+  Date template hits:
+  |- [# of hits] date format
+  |  [1] Year-Month-Day Hour:Minute:Second
 
 Ensure that the template description matches time/date elements in your log line
 time stamp.  If there is no matched format then date template needs to be added
@@ -144,29 +147,31 @@ to server/datedetector.py.  Ensure that a new template is added in the order
 that more specific matches occur first and that there is no confusion between a
 Day and a Month.
 
-Filter file:
+Filter file
+-----------
 
 The filter is specified in a config/filter.d/{filtername}.conf file. Filter file
-can have sections INCLUDES (optional) and Definition as follows:
+can have sections INCLUDES (optional) and Definition as follows::
 
-[INCLUDES]
-
-before = common.conf
-
-after = filtername.local
-
-[Definition]
-
-failregex = ....
-
-ignoreregex = ....
+  [INCLUDES]
+  
+  before = common.conf
+  
+  after = filtername.local
+  
+  [Definition]
+  
+  failregex = ....
+  
+  ignoreregex = ....
 
 This is also documented in the man page jail.conf (section 5). Other definitions
 can be added to make failregex's more readable and maintainable to be used
 through string Interpolations (see http://docs.python.org/2.7/library/configparser.html)
 
 
-General rules:
+General rules
+-------------
 
 Use "before" if you need to include a common set of rules, like syslog or if
 there is a common set of regexes for multiple filters.
@@ -178,33 +183,35 @@ Try to avoid using ignoreregex mainly for performance reasons. The case when you
 would use it is if in trying to avoid using it, you end up with an unreadable
 failregex.
 
-Syslog:
+Syslog
+------
 
 If your application logs to syslog you can take advantage of log line prefix
-definitions present in common.conf.  So as a base use:
+definitions present in common.conf.  So as a base use::
 
-[INCLUDES]
-
-before = common.conf
-
-[Definition]
-
-_daemon = app
-
-failregex = ^%(__prefix_line)s
+  [INCLUDES]
+  
+  before = common.conf
+  
+  [Definition]
+  
+  _daemon = app
+  
+  failregex = ^%(__prefix_line)s
 
 In this example common.conf defines __prefix_line which also contains the
 _daemon name (in syslog terms the service) you have just specified. _daemon
 can also be a regex.
 
-For example, to capture following line _daemon should be set to "dovecot"
+For example, to capture following line _daemon should be set to "dovecot"::
 
-Dec 12 11:19:11 dunnart dovecot: pop3-login: Aborted login (tried to use disabled plaintext auth): rip=190.210.136.21, lip=113.212.99.193
+  Dec 12 11:19:11 dunnart dovecot: pop3-login: Aborted login (tried to use disabled plaintext auth): rip=190.210.136.21, lip=113.212.99.193
 
-and then ^%(__prefix_line)s would match "Dec 12 11:19:11 dunnart dovecot:
+and then ``^%(__prefix_line)s`` would match "Dec 12 11:19:11 dunnart dovecot:
 ". Note it matches the trailing space(s) as well.
 
-Substitutions (AKA string interpolations):
+Substitutions (AKA string interpolations)
+-----------------------------------------
 
 We have used string interpolations in above examples.  They are useful for
 making the regexes more readable, reuse generic patterns in multiple failregex
@@ -213,7 +220,8 @@ to the user.  General principle is that value of a _name variable replaces
 occurrences of %(_name)s within the same section or anywhere in the config file
 if defined in [DEFAULT] section.
 
-Regular Expressions:
+Regular Expressions
+-------------------
 
 Regular expressions (failregex, ignoreregex) assume that the date/time has been
 removed from the log line (this is just how fail2ban works internally ATM).
@@ -236,29 +244,33 @@ If you have only a basic knowledge of regular repressions we advise to read
 http://docs.python.org/2/library/re.html first.  It doesn't take long and would
 remind you e.g. which characters you need to escape and which you don't.
 
-Developing/testing a regex:
+Developing/testing a regex
+--------------------------
 
 You can develop a regex in a file or using command line depending on your
 preference. You can also use samples you have already created in the test cases
 or test them one at a time.
 
 The general tool for testing Fail2Ban regexes is fail2ban-regex. To see how to
-use it run:
+use it run::
 
-./fail2ban-regex --help
+  ./fail2ban-regex --help
 
 Take note of  -l heavydebug  / -l debug  and -v as they might be very useful.
 
-TIP: Take a look at the source code of the application you are developing
+.. TIP::
+     Take a look at the source code of the application you are developing
      failregex for. You may see optional or extra log messages, or parts there
      of, that need to form part of your regex.  It may also reveal how some
      parts are constrained and different formats depending on configuration or
      less common usages.
 
-TIP: For looking through source code - http://sourcecodebrowser.com/ . It has
+.. TIP::
+     For looking through source code - http://sourcecodebrowser.com/ . It has
      call graphs and can browse different versions.
 
-TIP: Some applications log spaces at the end. If you are not sure add \s*$ as
+.. TIP::
+     Some applications log spaces at the end. If you are not sure add \s*$ as
      the end part of the regex.
 
 If your regex is not matching, http://www.debuggex.com/?flavor=python can help
@@ -277,13 +289,15 @@ When you have fixed the regex put it back into your filter file.
 Please spread the good word about Debuggex - Serge Toarca is kindly continuing
 its free availability to Open Source developers.
 
-Finishing up:
+Finishing up
+------------
 
 If you've added a new filter, add a new entry in config/jail.conf. The theory
 here is that a user will create a jail.local with [filtername]\nenable=true to
 enable your jail.
 
 So more specifically in the [filter] section in jail.conf:
+
 * ensure that you have "enabled = false" (users will enable as needed);
 * use "filter =" set to your filter name;
 * use a typical action to disable ports associated with the application;
@@ -295,7 +309,7 @@ Submit github pull request (See "Pull Requests" above) for
 github.com/fail2ban/fail2ban containing your great work.
 
 Filter Security
----------------
+===============
 
 Poor filter regular expressions are susceptible to DoS attacks.
 
@@ -321,33 +335,33 @@ Examples of poor filters
 
 1. Too restrictive
 
-We find a log message:
+We find a log message::
 
     Apr-07-13 07:08:36 Invalid command fial2ban from 1.2.3.4
 
-We make a failregex
+We make a failregex::
 
     ^Invalid command \S+ from <HOST>
 
 Now think evil. The user does the command 'blah from 1.2.3.44'
 
-The program diligently logs:
+The program diligently logs::
 
     Apr-07-13 07:08:36 Invalid command blah from 1.2.3.44 from 1.2.3.4
 
 And fail2ban matches 1.2.3.44 as the IP that it ban. A DoS attack was successful.
 
-The fix here is that the command can be anything so .* is appropriate.
+The fix here is that the command can be anything so .* is appropriate::
 
     ^Invalid command .* from <HOST>
 
 Here the .* will match until the end of the string. Then realise it has more to
 match, i.e. "from <HOST>" and go back until it find this. Then it will ban
-1.2.3.4 correctly. Since the <HOST> is always at the end, end the regex with a $.
+1.2.3.4 correctly. Since the <HOST> is always at the end, end the regex with a $::
 
     ^Invalid command .* from <HOST>$
 
-Note if we'd just had the expression:
+Note if we'd just had the expression::
 
     ^Invalid command \S+ from <HOST>$
 
@@ -359,16 +373,16 @@ banned.
 From the Apache vulnerability CVE-2013-2178
 ( original ref: https://vndh.net/note:fail2ban-089-denial-service ).
 
-An example bad regex for Apache:
+An example bad regex for Apache::
 
     failregex = [[]client <HOST>[]] user .* not found
 
-Since the user can do a get request on:
+Since the user can do a get request on::
 
     GET /[client%20192.168.0.1]%20user%20root%20not%20found HTTP/1.0
-Host: remote.site
+    Host: remote.site
 
-Now the log line will be:
+Now the log line will be::
 
     [Sat Jun 01 02:17:42 2013] [error] [client 192.168.33.1] File does not exist: /srv/http/site/[client 192.168.0.1] user root not found
 
@@ -379,27 +393,27 @@ regex and blocks 192.168.33.1 as a denial of service from the HTTP requester.
 
 From: https://github.com/fail2ban/fail2ban/pull/426
 
-An example ssh log (simplified)
+An example ssh log (simplified)::
 
     Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser remoteuser
 
 As we assume username can include anything including spaces its prudent to put
-.* here. The remote user can also exist as anything so lets not make assumptions again.
+.* here. The remote user can also exist as anything so lets not make assumptions again::
 
     failregex = ^%(__prefix_line)sFailed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
 
 So this works. The problem is if the .* after remote user is injected by the
-user to be 'from 1.2.3.4'. The resultant log line is.
+user to be 'from 1.2.3.4'. The resultant log line is::
 
     Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4
 
-Testing with:
+Testing with::
 
     fail2ban-regex -v 'Sep 29 17:15:02 Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4' '^ Failed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$'
 
-TIP: I've removed the bit that matches __prefix_line from the regex and log.
+.. TIP:: I've removed the bit that matches __prefix_line from the regex and log.
 
-Shows:
+Shows::
 
     1) [1] ^ Failed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
        1.2.3.4  Sun Sep 29 17:15:02 2013
@@ -412,14 +426,14 @@ The result was that 1.2.3.4 was matched, injected by the user, and the wrong IP
 was banned.
 
 The solution here is to make the first .* non-greedy with .*?. Here it matches
-as little as required and the fail2ban-regex tool shows the output:
+as little as required and the fail2ban-regex tool shows the output::
 
     fail2ban-regex -v 'Sep 29 17:15:02 Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4' '^ Failed \S+ for .*? from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$'
 
     1) [1] ^ Failed \S+ for .*? from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
        127.0.0.1  Sun Sep 29 17:15:02 2013
 
-So the general case here is a log line that contains:
+So the general case here is a log line that contains::
 
     (fixed_data_1)<HOST>(fixed_data_2)(user_injectable_data)
 
@@ -427,20 +441,21 @@ Where the regex that matches fixed_data_1 is gready and matches the entire
 string, before moving backwards and user_injectable_data can match the entire
 string.
 
-Another case:
+Another case
+------------
 
 ref: https://www.debuggex.com/r/CtAbeKMa2sDBEfA2/0
 
-A webserver logs the following without URL escaping:
+A webserver logs the following without URL escaping::
 
     [error] 2865#0: *66647 user "xyz" was not found in "/file", client: 1.2.3.1, server: www.host.com, request: "GET ", client: 3.2.1.1, server: fake.com, request: "GET exploited HTTP/3.3", host: "injected.host", host: "www.myhost.com"
 
-regex:
+regex::
 
     failregex = ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (?:password mismatch|was not found in ".*"), client: <HOST>, server: \S+, request: "\S+ .+ HTTP/\d+\.\d+", host: "\S+"
 
 The .* matches to the end of the string. Finds that it can't continue to match
-", client ... so it moves from the back and find that the user injected web URL:
+", client ... so it moves from the back and find that the user injected web URL::
 
     ", client: 3.2.1.1, server: fake.com, request: "GET exploited HTTP/3.3", host: "injected.host
 
@@ -453,14 +468,14 @@ beyond <HOST>.
 4. Application generates two identical log messages with different meanings
 
 If the application generates the following two messages under different
-circumstances:
+circumstances::
 
     client <IP>: authentication failed
     client <USER>: authentication failed
 
 
-Then it's obvious that a regex of "^client <HOST>: authentication
-failed$" will still cause problems if the user can trigger the second
+Then it's obvious that a regex of ``^client <HOST>: authentication
+failed$`` will still cause problems if the user can trigger the second
 log message with a <USER> of 123.1.1.1.
 
 Here there's nothing to do except request/change the application so it logs

MANIFEST

@@ -6,169 +6,204 @@ THANKS
 COPYING
 DEVELOP
 FILTERS
-fail2ban-client
-fail2ban-server
-fail2ban-testcases
-fail2ban-regex
+fail2ban-2to3
 fail2ban-testcases-all
+fail2ban-testcases-all-python3
+bin/fail2ban-client
+bin/fail2ban-server
+bin/fail2ban-testcases
+bin/fail2ban-regex
+doc/run-rootless.txt
+fail2ban/client/configreader.py
+fail2ban/client/configparserinc.py
+fail2ban/client/jailreader.py
+fail2ban/client/fail2banreader.py
+fail2ban/client/jailsreader.py
+fail2ban/client/beautifier.py
+fail2ban/client/filterreader.py
+fail2ban/client/actionreader.py
+fail2ban/client/__init__.py
+fail2ban/client/configurator.py
+fail2ban/client/csocket.py
+fail2ban/server/asyncserver.py
+fail2ban/server/database.py
+fail2ban/server/filter.py
+fail2ban/server/filterpyinotify.py
+fail2ban/server/filtergamin.py
+fail2ban/server/filterpoll.py
+fail2ban/server/filtersystemd.py
+fail2ban/server/iso8601.py
+fail2ban/server/server.py
+fail2ban/server/actions.py
+fail2ban/server/faildata.py
+fail2ban/server/failmanager.py
+fail2ban/server/datedetector.py
+fail2ban/server/jailthread.py
+fail2ban/server/transmitter.py
+fail2ban/server/action.py
+fail2ban/server/ticket.py
+fail2ban/server/jail.py
+fail2ban/server/jails.py
+fail2ban/server/__init__.py
+fail2ban/server/banmanager.py
+fail2ban/server/datetemplate.py
+fail2ban/server/mytime.py
+fail2ban/server/failregex.py
+fail2ban/server/database.py
+fail2ban/tests/banmanagertestcase.py
+fail2ban/tests/failmanagertestcase.py
+fail2ban/tests/clientreadertestcase.py
+fail2ban/tests/filtertestcase.py
+fail2ban/tests/__init__.py
+fail2ban/tests/dummyjail.py
+fail2ban/tests/samplestestcase.py
+fail2ban/tests/datedetectortestcase.py
+fail2ban/tests/actiontestcase.py
+fail2ban/tests/servertestcase.py
+fail2ban/tests/sockettestcase.py
+fail2ban/tests/utils.py
+fail2ban/tests/misctestcase.py
+fail2ban/tests/databasetestcase.py
+fail2ban/tests/config/jail.conf
+fail2ban/tests/config/fail2ban.conf
+fail2ban/tests/config/paths-common.conf
+fail2ban/tests/config/paths-freebsd.conf
+fail2ban/tests/config/paths-osx.conf
+fail2ban/tests/config/paths-debian.conf
+fail2ban/tests/config/filter.d/simple.conf
+fail2ban/tests/config/action.d/brokenaction.conf
+fail2ban/tests/files/config/apache-auth/digest/.htaccess
+fail2ban/tests/files/config/apache-auth/digest/.htpasswd
+fail2ban/tests/files/config/apache-auth/digest_time/.htaccess
+fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd
+fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htaccess
+fail2ban/tests/files/config/apache-auth/basic/authz_owner/cant_get_me.html
+fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htpasswd
+fail2ban/tests/files/config/apache-auth/basic/file/.htaccess
+fail2ban/tests/files/config/apache-auth/basic/file/.htpasswd
+fail2ban/tests/files/config/apache-auth/digest.py
+fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess
+fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd
+fail2ban/tests/files/config/apache-auth/digest_anon/.htaccess
+fail2ban/tests/files/config/apache-auth/digest_anon/.htpasswd
+fail2ban/tests/files/config/apache-auth/README
+fail2ban/tests/files/config/apache-auth/noentry/.htaccess
+fail2ban/tests/files/database_v1.db
+fail2ban/tests/files/ignorecommand.py
+fail2ban/tests/files/filter.d/substition.conf
+fail2ban/tests/files/filter.d/testcase-common.conf
+fail2ban/tests/files/filter.d/testcase01.conf
+fail2ban/tests/files/testcase01.log
+fail2ban/tests/files/testcase02.log
+fail2ban/tests/files/testcase03.log
+fail2ban/tests/files/testcase04.log
+fail2ban/tests/files/testcase-usedns.log
+fail2ban/tests/files/testcase-journal.log
+fail2ban/tests/files/testcase-multiline.log
+fail2ban/tests/files/logs/bsd/syslog-plain.txt
+fail2ban/tests/files/logs/bsd/syslog-v.txt
+fail2ban/tests/files/logs/bsd/syslog-vv.txt
+fail2ban/tests/files/logs/3proxy
+fail2ban/tests/files/logs/apache-auth
+fail2ban/tests/files/logs/apache-badbots
+fail2ban/tests/files/logs/apache-botscripts
+fail2ban/tests/files/logs/apache-modsecurity
+fail2ban/tests/files/logs/apache-nohome
+fail2ban/tests/files/logs/apache-noscript
+fail2ban/tests/files/logs/apache-overflows
+fail2ban/tests/files/logs/assp
+fail2ban/tests/files/logs/asterisk
+fail2ban/tests/files/logs/counter-strike
+fail2ban/tests/files/logs/courier-auth
+fail2ban/tests/files/logs/courier-smtp
+fail2ban/tests/files/logs/cyrus-imap
+fail2ban/tests/files/logs/dovecot
+fail2ban/tests/files/logs/dropbear
+fail2ban/tests/files/logs/ejabberd-auth
+fail2ban/tests/files/logs/exim
+fail2ban/tests/files/logs/exim-spam
+fail2ban/tests/files/logs/freeswitch
+fail2ban/tests/files/logs/groupoffice
+fail2ban/tests/files/logs/gssftpd
+fail2ban/tests/files/logs/guacamole
+fail2ban/tests/files/logs/kerio
+fail2ban/tests/files/logs/lighttpd-auth
+fail2ban/tests/files/logs/mysqld-auth
+fail2ban/tests/files/logs/nagios
+fail2ban/tests/files/logs/nsd
+fail2ban/tests/files/logs/perdition
+fail2ban/tests/files/logs/php-url-fopen
+fail2ban/tests/files/logs/postfix-sasl
+fail2ban/tests/files/logs/named-refused
+fail2ban/tests/files/logs/nginx-http-auth
+fail2ban/tests/files/logs/pam-generic
+fail2ban/tests/files/logs/postfix
+fail2ban/tests/files/logs/proftpd
+fail2ban/tests/files/logs/pure-ftpd
+fail2ban/tests/files/logs/qmail
+fail2ban/tests/files/logs/recidive
+fail2ban/tests/files/logs/roundcube-auth
+fail2ban/tests/files/logs/selinux-ssh
+fail2ban/tests/files/logs/sendmail-spam
+fail2ban/tests/files/logs/sieve
+fail2ban/tests/files/logs/squid
+fail2ban/tests/files/logs/stunnel
+fail2ban/tests/files/logs/suhosin
+fail2ban/tests/files/logs/sogo-auth
+fail2ban/tests/files/logs/solid-pop3d
+fail2ban/tests/files/logs/sshd
+fail2ban/tests/files/logs/sshd-ddos
+fail2ban/tests/files/logs/vsftpd
+fail2ban/tests/files/logs/webmin-auth
+fail2ban/tests/files/logs/wuftpd
+fail2ban/tests/files/logs/uwimap-auth
+fail2ban/tests/files/logs/xinetd-fail
+fail2ban/tests/config/jail.conf
+fail2ban/tests/config/fail2ban.conf
+fail2ban/tests/config/filter.d/simple.conf
+fail2ban/tests/config/action.d/brokenaction.conf
+setup.py
+setup.cfg
+fail2ban/__init__.py
+fail2ban/exceptions.py
+fail2ban/helpers.py
+fail2ban/version.py
+fail2ban/protocol.py
 setup.py
 setup.cfg
 kill-server
-client/configreader.py
-client/configparserinc.py
-client/jailreader.py
-client/fail2banreader.py
-client/jailsreader.py
-client/beautifier.py
-client/filterreader.py
-client/actionreader.py
-client/__init__.py
-client/configurator.py
-client/csocket.py
-server/asyncserver.py
-server/filter.py
-server/filterpyinotify.py
-server/filtergamin.py
-server/filterpoll.py
-server/iso8601.py
-server/server.py
-server/actions.py
-server/faildata.py
-server/failmanager.py
-server/datedetector.py
-server/jailthread.py
-server/transmitter.py
-server/action.py
-server/ticket.py
-server/jail.py
-server/jails.py
-server/__init__.py
-server/banmanager.py
-server/datetemplate.py
-server/mytime.py
-server/failregex.py
-testcases/actionstestcase.py
-testcases/dummyjail.py
-testcases/files/ignorecommand.py
-testcases/files/testcase-usedns.log
-testcases/files/logs/bsd/syslog-plain.txt
-testcases/files/logs/bsd/syslog-v.txt
-testcases/files/logs/bsd/syslog-vv.txt
-testcases/files/logs/apache-overflows
-testcases/files/logs/apache-modsecurity
-testcases/files/logs/assp
-testcases/files/logs/asterisk
-testcases/files/logs/dovecot
-testcases/files/logs/ejabberd-auth
-testcases/files/logs/exim
-testcases/files/logs/freeswitch
-testcases/files/logs/groupoffice
-testcases/files/logs/horde
-testcases/files/logs/suhosin
-testcases/files/logs/mysqld-auth
-testcases/files/logs/named-refused
-testcases/files/logs/nagios
-testcases/files/logs/nginx-http-auth
-testcases/files/logs/nsd
-testcases/files/logs/openwebmail
-testcases/files/logs/pam-generic
-testcases/files/logs/postfix
-testcases/files/logs/proftpd
-testcases/files/logs/pure-ftpd
-testcases/files/logs/roundcube-auth
-testcases/files/logs/postfix-sasl
-testcases/files/logs/sogo-auth
-testcases/files/logs/solid-pop3d
-testcases/files/logs/squid
-testcases/files/logs/sshd
-testcases/files/logs/sshd-ddos
-testcases/files/logs/vsftpd
-testcases/files/logs/webmin-auth
-testcases/files/logs/wuftpd
-testcases/files/logs/3proxy
-testcases/files/logs/apache-auth
-testcases/files/logs/apache-badbots
-testcases/files/logs/apache-nohome
-testcases/files/logs/apache-noscript
-testcases/files/logs/courierlogin
-testcases/files/logs/couriersmtp
-testcases/files/logs/cyrus-imap
-testcases/files/logs/dropbear
-testcases/files/logs/exim-spam
-testcases/files/logs/gssftpd
-testcases/files/logs/lighttpd-auth
-testcases/files/logs/mysqld-auth
-testcases/files/logs/perdition
-testcases/files/logs/php-url-fopen
-testcases/files/logs/qmail
-testcases/files/logs/recidive
-testcases/files/logs/sieve
-testcases/files/logs/selinux-ssh
-testcases/files/logs/sendmail-auth
-testcases/files/logs/sendmail-reject
-testcases/files/logs/suhosin
-testcases/files/logs/uwimap-auth
-testcases/files/logs/wuftpd
-testcases/files/logs/xinetd-fail
-testcases/files/config/apache-auth/digest/.htaccess
-testcases/files/config/apache-auth/digest/.htpasswd
-testcases/files/config/apache-auth/digest_time/.htaccess
-testcases/files/config/apache-auth/digest_time/.htpasswd
-testcases/files/config/apache-auth/basic/authz_owner/.htaccess
-testcases/files/config/apache-auth/basic/authz_owner/cant_get_me.html
-testcases/files/config/apache-auth/basic/authz_owner/.htpasswd
-testcases/files/config/apache-auth/basic/file/.htaccess
-testcases/files/config/apache-auth/basic/file/.htpasswd
-testcases/files/config/apache-auth/digest.py
-testcases/files/config/apache-auth/digest_wrongrelm/.htaccess
-testcases/files/config/apache-auth/digest_wrongrelm/.htpasswd
-testcases/files/config/apache-auth/digest_anon/.htaccess
-testcases/files/config/apache-auth/digest_anon/.htpasswd
-testcases/files/config/apache-auth/README
-testcases/files/config/apache-auth/noentry/.htaccess
-testcases/samplestestcase.py
-testcases/banmanagertestcase.py
-testcases/failmanagertestcase.py
-testcases/clientreadertestcase.py
-testcases/filtertestcase.py
-testcases/__init__.py
-testcases/datedetectortestcase.py
-testcases/actiontestcase.py
-testcases/servertestcase.py
-testcases/sockettestcase.py
-testcases/files/testcase01.log
-testcases/files/testcase02.log
-testcases/files/testcase03.log
-testcases/files/testcase04.log
-testcases/misctestcase.py
-testcases/utils.py
-common/__init__.py
-common/exceptions.py
-common/helpers.py
-common/version.py
-common/protocol.py
 config/jail.conf
+config/fail2ban.conf
 config/filter.d/common.conf
 config/filter.d/apache-auth.conf
 config/filter.d/apache-badbots.conf
+config/filter.d/apache-botsearch.conf
 config/filter.d/apache-modsecurity.conf
 config/filter.d/apache-nohome.conf
 config/filter.d/apache-noscript.conf
 config/filter.d/apache-overflows.conf
 config/filter.d/nginx-http-auth.conf
-config/filter.d/courierlogin.conf
-config/filter.d/couriersmtp.conf
+config/filter.d/counter-strike.conf
+config/filter.d/courier-auth.conf
+config/filter.d/courier-smtp.conf
 config/filter.d/cyrus-imap.conf
 config/filter.d/ejabberd-auth.conf
 config/filter.d/exim.conf
 config/filter.d/freeswitch.conf
 config/filter.d/gssftpd.conf
+config/filter.d/kerio.conf
 config/filter.d/horde.conf
 config/filter.d/suhosin.conf
 config/filter.d/nagios.conf
 config/filter.d/named-refused.conf
 config/filter.d/nsd.conf
 config/filter.d/openwebmail.conf
+config/filter.d/pam-generic.conf
+config/filter.d/php-url-fopen.conf
+config/filter.d/postfix-sasl.conf
+config/filter.d/pam-generic.conf
+config/filter.d/php-url-fopen.conf
+config/filter.d/postfix-sasl.conf
 config/filter.d/postfix.conf
 config/filter.d/proftpd.conf
 config/filter.d/pure-ftpd.conf
@@ -183,6 +218,7 @@ config/filter.d/solid-pop3d.conf
 config/filter.d/squid.conf
 config/filter.d/sshd.conf
 config/filter.d/sshd-ddos.conf
+config/filter.d/stunnel.conf
 config/filter.d/vsftpd.conf
 config/filter.d/webmin-auth.conf
 config/filter.d/wuftpd.conf
@@ -202,9 +238,15 @@ config/filter.d/3proxy.conf
 config/filter.d/apache-common.conf
 config/filter.d/exim-common.conf
 config/filter.d/exim-spam.conf
+config/filter.d/freeswitch.conf
 config/filter.d/groupoffice.conf
 config/filter.d/perdition.conf
 config/filter.d/uwimap-auth.conf
+config/filter.d/courier-auth.conf
+config/filter.d/courier-smtp.conf
+config/filter.d/ejabberd-auth.conf
+config/filter.d/guacamole.conf
+config/filter.d/sendmail-spam.conf
 config/action.d/apf.conf
 config/action.d/blocklist_de.conf
 config/action.d/osx-afctl.conf
@@ -216,7 +258,7 @@ config/action.d/dummy.conf
 config/action.d/firewallcmd-new.conf
 config/action.d/firewallcmd-ipset.conf
 config/action.d/iptables-ipset-proto6-allports.conf
-config/action.d/iptables-blocktype.conf
+config/action.d/iptables-common.conf
 config/action.d/iptables-ipset-proto4.conf
 config/action.d/iptables-ipset-proto6.conf
 config/action.d/iptables-xt_recent-echo.conf
@@ -239,9 +281,11 @@ config/action.d/mynetwatchman.conf
 config/action.d/pf.conf
 config/action.d/sendmail.conf
 config/action.d/sendmail-buffered.conf
+config/action.d/sendmail-whois-ipmatches.conf
 config/action.d/sendmail-whois.conf
 config/action.d/sendmail-whois-lines.conf
 config/action.d/shorewall.conf
+config/action.d/xarf-login-attack.conf
 config/action.d/ufw.conf
 config/fail2ban.conf
 doc/run-rootless.txt
@@ -272,7 +316,3 @@ files/fail2ban-tmpfiles.conf
 files/fail2ban.service
 files/ipmasq-ZZZzzz_fail2ban.rul
 files/gen_badbots
-testcases/config/jail.conf
-testcases/config/fail2ban.conf
-testcases/config/filter.d/simple.conf
-testcases/config/action.d/brokenaction.conf

MANIFEST.in

@@ -0,0 +1,4 @@
+include ChangeLog COPYING DEVELOP FILTERS README.* THANKS TODO
+graft doc
+graft files
+recursive-include config *.conf *.py

README.Solaris

@@ -6,20 +6,20 @@ By Roy Sigurd Karlsbakk <roy@karlsbakk.net>
 
 ABOUT
 
-This readme is meant for those wanting to install fail2ban on Solaris 10,
+This README is meant for those wanting to install fail2ban on Solaris 10,
 OpenSolaris, OpenIndiana etc. To some degree it may as well be useful for
 users of older Solaris versions and Nexenta, but don't rely on it.
 
 READ ME FIRST
 
 If I use the term Solaris, I am talking about any Solaris dialect, that is, the
-official Sun/Oracle ones or derivates. If I describe an OS as
+official Sun/Oracle ones or derivatives. If I describe an OS as
 "OpenSolaris-based", it means it's either OpenSolaris, OpenIndiana or one of the
 other, but /not/ the Nexenta family, since this only uses the OpenSolaris/
 IllumOS kernel and not the userland. If I say Solaris 10, I mean Solaris 10 and
 perhaps, if you're lucky and have some good gods on your side, it may also apply
 to Solaris 9 or even 8 and hopefully in the new Solaris 11 whenever that may be
-released. Quoted lines of code, settings et cetera are indented with two spaces.
+released. Quoted lines of code, settings etc. are indented with two spaces.
 This does _not_ mean you should use that indentation, especially in config files
 where they can be harmful. Optional settings are prefixed with OPT: while
 required settings are prefixed with REQ:. If no prefix is found, regard it as a
@@ -111,7 +111,7 @@ GOTCHAS AND FIXMES
     svcadm enable fail2ban
 
 * If svcs -xv says that fail2ban failed to start or svcs says it's in maintenance mode
-  check /var/svc/log/network-fail2ban:default.log for clues. 
+  check /var/svc/log/network-fail2ban:default.log for clues.
   Check permissions on /var/adm, /var/adm/auth.log /var/adm/fail2ban.log and /var/run/fail2ban
   You may need to:
 

README.md

@@ -2,7 +2,7 @@
                         / _|__ _(_) |_  ) |__  __ _ _ _  
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
-                       v0.8.12                 2014/01/22
+                       v0.9.0                  2014/03/14
 
 ## Fail2Ban: ban hosts that cause multiple authentication errors
 
@@ -11,6 +11,11 @@ password failures. It updates firewall rules to reject the IP address. These
 rules can be defined by the user. Fail2Ban can read multiple log files such as
 sshd or Apache web server ones.
 
+Fail2Ban is able to reduce the rate of incorrect authentications attempts
+however it cannot eliminate the risk that weak authentication presents.
+Configure services to use only two factor or public/private authentication
+mechanisms if you really want to protect services.
+
 This README is a quick introduction to Fail2ban. More documentation, FAQ, HOWTOs
 are available in fail2ban(1) manpage and on the website http://www.fail2ban.org
 
@@ -21,21 +26,22 @@ Installation:
 this case, you should use it instead.**
 
 Required:
-- [Python >= 2.4](http://www.python.org)
+- [Python2 >= 2.6 or Python >= 3.2](http://www.python.org) or [PyPy](http://pypy.org)
 
 Optional:
 - [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify)
   - Linux >= 2.6.13
 - [gamin >= 0.0.21](http://www.gnome.org/~veillard/gamin)
+- [systemd >= 204](http://www.freedesktop.org/wiki/Software/systemd)
 
 To install, just do:
 
-    tar xvfj fail2ban-0.8.12.tar.bz2
-    cd fail2ban-0.8.12
+    tar xvfj fail2ban-0.9.0.tar.bz2
+    cd fail2ban-0.9.0
     python setup.py install
 
-This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
-placed into /usr/bin, and configuration under /etc/fail2ban.
+This will install Fail2Ban into the python library directory. The executable
+scripts are placed into /usr/bin, and configuration under /etc/fail2ban.
 
 Fail2Ban should be correctly installed now. Just type:
 
@@ -50,8 +56,7 @@ Configuration:
 You can configure Fail2Ban using the files in /etc/fail2ban. It is possible to
 configure the server using commands sent to it by fail2ban-client. The
 available commands are described in the fail2ban-client(1) manpage.  Also see
-fail2ban(1) manpage for further references and find even more documentation on
-the website: http://www.fail2ban.org
+fail2ban(1) and jail.conf(5)  manpages for further references.
 
 Code status:
 ------------
@@ -63,24 +68,12 @@ Code status:
 Contact:
 --------
 
-### You found a severe security vulnerability in Fail2Ban?
-email details to fail2ban-vulnerabilities at lists dot sourceforge dot net .
-
-### You need some new features, you found bugs?
-visit [Issues](https://github.com/fail2ban/fail2ban/issues)
-and if your issue is not yet known -- file a bug report. See
-[Fail2Ban wiki](http://www.fail2ban.org/wiki/index.php/HOWTO_Seek_Help)
-on further instructions.
-
-### You would like to troubleshoot or discuss?
-join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
-
-### You would like to contribute (new filters/actions/code/documentation)?
-send a pull request
+### Bugs, feature requests, discussions?
+See [CONTRIBUTING.md](https://github.com/fail2ban/fail2ban/blob/master/CONTRIBUTING.md)
 
 ### You just appreciate this program:
-send kudos to the original author ([Cyril Jaquier](mailto: Cyril Jaquier <cyril.jaquier@fail2ban.org>)
-or better to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
+send kudos to the original author ([Cyril Jaquier](mailto: Cyril Jaquier <cyril.jaquier@fail2ban.org>))
+or *better* to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
 since Fail2Ban is "community-driven" for years now.
 
 Thanks:

RELEASE

@@ -0,0 +1,197 @@
+..                       __      _ _ ___ _
+                        / _|__ _(_) |_  ) |__  __ _ _ _
+                       |  _/ _` | | |/ /| '_ \/ _` | ' \
+                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+================================================================================
+How to do a release for Fail2Ban
+================================================================================
+
+Preparation
+===========
+
+* Check distribution patches and see if they can be included
+
+  * https://apps.fedoraproject.org/packages/fail2ban/sources
+  * http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/
+  * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/
+  * https://build.opensuse.org/package/show?package=fail2ban&project=openSUSE%3AFactory
+  * http://sophie.zarb.org/sources/fail2ban (Mageia)
+  * https://trac.macports.org/browser/trunk/dports/security/fail2ban
+
+
+* Check distribution outstanding bugs
+
+  * https://github.com/fail2ban/fail2ban/issues?sort=updated&state=open
+  * http://bugs.debian.org/cgi-bin/pkgreport.cgi?dist=unstable;package=fail2ban
+  * https://bugs.launchpad.net/ubuntu/+source/fail2ban
+  * http://bugs.sabayon.org/buglist.cgi?quicksearch=net-analyzer%2Ffail2ban
+  * https://bugs.archlinux.org/?project=5&cat%5B%5D=33&string=fail2ban
+  * https://bugs.gentoo.org/buglist.cgi?query_format=advanced&short_desc=fail2ban&bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=IN_PROGRESS&short_desc_type=allwords
+  * https://bugzilla.redhat.com/buglist.cgi?query_format=advanced&bug_status=NEW&bug_status=ASSIGNED&component=fail2ban&classification=Red%20Hat&classification=Fedora
+  * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
+  * https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
+  * https://build.opensuse.org/package/requests/openSUSE:Factory/fail2ban
+
+
+* Make sure the tests pass::
+
+  ./fail2ban-testcases-all
+
+* Ensure the version is correct in:
+
+  * ./fail2ban/version.py
+  * top of ChangeLog
+  * README.md
+
+
+* Ensure the MANIFEST is complete
+
+* Run::
+
+  python setup.py sdist
+
+* Look for errors like::
+
+   'testcases/files/logs/mysqld.log' not a regular file -- skipping
+
+  * Which indicates that testcases/files/logs/mysqld.log has been moved or is a directory::
+
+      tar -C /tmp -jxf dist/fail2ban-0.9.0.tar.bz2
+
+* clean up current direcory::
+
+    diff -rul --exclude \*.pyc . /tmp/fail2ban-0.9.0/
+
+  * Only differences should be files that you don't want distributed.
+
+
+* Ensure the tests work from the tarball::
+
+    cd /tmp/fail2ban-0.9.0/ && export PYTHONPATH=`pwd` && bin/fail2ban-testcases
+
+* Add/finalize the corresponding entry in the ChangeLog
+
+  * To generate a list of committers use e.g.::
+
+      git shortlog -sn 0.8.12.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
+
+  * Ensure the top of the ChangeLog has the right version and current date.
+  * Ensure the top entry of the ChangeLog has the right version and current date.
+
+* Update man pages::
+
+    (cd man ; ./generate-man )
+    git commit -m 'DOC/ENH: update man pages for release' man/*
+
+* Cleanout TODO file with the finished stuff
+
+* Prepare source and rpm binary distributions::
+
+    python setup.py sdist
+
+  * Broken for now:  python setup.py bdist_rpm
+  * Broken for now:  python setup.py upload
+
+
+* Tag the release by using a signed (and annotated) tag.  Cut/paste
+  release ChangeLog entry as tag annotation::
+
+    git tag -s 0.9.1
+
+Pre Release
+===========
+
+* Provide a release sample to distributors
+
+  * Arch Linux:
+
+    * https://www.archlinux.org/packages/community/any/fail2ban/
+
+  * Debian: Yaroslav Halchenko <debian@onerussian.com>
+
+    * http://packages.qa.debian.org/f/fail2ban.html
+
+  * FreeBSD: Christoph Theis theis@gmx.at>, Nick Hilliard <nick@foobar.org>
+
+    * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/Makefile?view=markup
+    * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
+
+  * Fedora: Axel Thimm <Axel.Thimm@atrpms.net>
+
+    * https://apps.fedoraproject.org/packages/fail2ban
+    * http://pkgs.fedoraproject.org/cgit/fail2ban.git
+    * https://admin.fedoraproject.org/pkgdb/acls/bugs/fail2ban
+
+  * Gentoo: netmon@gentoo.org
+
+    * http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/metadata.xml?view=markup
+    * https://bugs.gentoo.org/buglist.cgi?quicksearch=fail2ban
+
+  * openSUSE: Stephan Kulow <coolo@suse.com>
+
+    * https://build.opensuse.org/package/show/openSUSE:Factory/fail2ban
+
+  * Mac Ports: @Malbrouck on github (gh-49)
+
+    * https://trac.macports.org/browser/trunk/dports/security/fail2ban/Portfile
+
+  * Mageia:
+
+    * https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
+
+  * An potentially to the fail2ban-users email list.
+
+
+* Wait for feedback from distributors
+
+* Prepare a release notice https://github.com/fail2ban/fail2ban/releases/new
+
+* Upload the source/binaries from the dist directory and tag the release using the URL
+
+* Upload source/binaries to sourceforge http://sourceforge.net/projects/fail2ban/
+
+* Run the following and update the wiki with output::
+
+    python -c 'import fail2ban.protocol; fail2ban.protocol.printWiki()'
+
+  * page: http://www.fail2ban.org/wiki/index.php/Commands
+
+
+* Update:
+
+  * http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_Versions&action=edit
+
+  * http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_News&action=edit
+    * move old bits to http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_OldNews&action=edit
+
+  * http://www.fail2ban.org/wiki/index.php/ChangeLog
+  * http://www.fail2ban.org/wiki/index.php/Requirements (Check requirement)
+  * http://www.fail2ban.org/wiki/index.php/Features
+
+* See if any filters are upgraded:
+  http://www.fail2ban.org/wiki/index.php/Special:AllPages
+
+* Email users and development list of release
+
+* notify distributors
+
+Post Release
+============
+
+Add the following to the top of the ChangeLog::
+
+  ver. 0.9.1 (2014/XX/XXX) - wanna-be-released
+  -----------
+  
+  - Fixes:
+  
+  - New Features:
+  
+  - Enhancements:
+
+Alter the git shortlog command in the previous section to refer to the just
+released version.
+
+and adjust fail2ban/version.py to carry .dev suffix to signal
+a version under development.

THANKS

@@ -40,11 +40,18 @@ Frédéric
 Georgiy Mernov
 Guilhem Lettron
 Guillaume Delvit
+Hank Leininger
 Hanno 'Rince' Wagner
+Helmut Grohne
 Iain Lea
-Ivo Truxa
-Jacques Lav!gnotte
 Ioan Indreias
+Ivo Truxa
+John Thoe
+Jacques Lav!gnotte
+Johannes Weberhofer
+Jason H Martin
+Jisoo Park
+Joel M Snyder
 Jonathan Kamens
 Jonathan Lanning
 Jonathan Underwood
@@ -55,7 +62,9 @@ Justin Shore
 Kévin Drapel
 kjohnsonecl
 kojiro
+Lars Kneschke
 Lee Clemens
+leftyfb (Mike Rushton)
 Manuel Arostegui Ramirez
 Marcel Dopita
 Mark Edgington
@@ -68,9 +77,13 @@ mEDI
 Merijn Schering
 Michael C. Haller
 Michael Hanselmann
+Mika (mkl)
 Nick Munger
+onorua
+Paul Marrapese
 Noel Butler
 Patrick Börjesson
+Pressy
 Raphaël Marichez
 RealRancor
 René Berber
@@ -78,22 +91,28 @@ Robert Edeker
 Rolf Fokkens
 Roman Gelfand
 Russell Odom
+SATO Kentaro
+Sean DuBois
 Sebastian Arcus
+Serg G. Brester
 Sireyessire
 silviogarbes
 Stefan Tatschner
 Stephen Gildea
 Steven Hiscocks
+TESTOVIK
 Tom Pike
 Tomas Pihl
+Tony Lawrence
 Tomasz Ciolek
 Tyler
 Vaclav Misek
 Vincent Deffontaines
 Yaroslav Halchenko
 Winston Smith
-ykimon
 Yehuda Katz
+ykimon
+Yung-Chin Oei
 Zbigniew Jędrzejewski-Szmek
 zugeschmiert
 Zurd

TODO

@@ -13,20 +13,6 @@ Legend:
 # partially done
 * done
 
-- more detailed explaination in DEVELOP for new developers (eg. howto build this HEX numbers in ChangeLog)
-
-- Run tests though all filters/examples files - (see sshd example file) as unit
-  test
-
-* Removed relative imports
-
-* Cleanup fail2ban-client and fail2ban-server. Move code to server/ and client/
-
-- Add timeout to external commands (signal alarm, watchdog thread, etc)
-
-- Uniformize filters and actions name. Use the software name (openssh, postfix,
-  proftp) and possible qualifier (e.g. auth) after a '-'
-
 - Added <USER> tag for failregex. Add features using this information. Maybe add
   more tags
 
@@ -37,23 +23,10 @@ Legend:
 - Auto-enable function (search for log files), check modification date to see if
   service is still in use
 
-- Improve parsing of the action parameters in jailreader.py
-
 - Better handling of the protocol in transmitter.py
 
 - Add gettext support (I18N)
 
-- Multiline log reading
-
-- Improve execution of action. Why does subprocess.call deadlock with
-  multi-jails?
-
-# see Feature Request Tracking System at SourceForge.net
-
 # improve documentation and website for user
 
 # better return values in function
-
-# refactoring in server.py, actions.py, filter.py
-
-* New backend: pyinotify

Vagrantfile

@@ -0,0 +1,35 @@
+Vagrant.configure("2") do |config|
+
+  config.vm.define "builder" do |builder|
+    builder.vm.box = "vm144"
+    builder.vm.provision "shell", path: "provision.sh"
+  end
+
+    config.vm.define "secure" do |secure|
+        secure.vm.box = "ubuntu/trusty64"
+        secure.vm.hostname = "secure.dev.fail2ban.org"
+        secure.vm.network "private_network", ip: "192.168.200.100"
+
+#        secure.vm.synced_folder 'salt/roots', '/srv/salt'
+
+#        secure.vm.provision :salt do |salt|
+#            salt.minion_config = 'salt/minion'
+#            salt.run_highstate = true
+#            salt.verbose = true
+#        end
+    end
+
+    config.vm.define "attacker" do |attacker|
+        attacker.vm.box = "ubuntu/trusty64"
+        attacker.vm.hostname = "attacker.dev.fail2ban.org"
+        attacker.vm.network "private_network", ip: "192.168.200.150"
+
+#        attacker.vm.synced_folder 'salt/roots', '/srv/salt'
+
+#        attacker.vm.provision :salt do |salt|
+#            salt.minion_config = 'salt/minion'
+#            salt.run_highstate = true
+#            salt.verbose = true
+#        end
+    end
+end

bin/fail2ban-client

@@ -25,22 +25,15 @@ __license__ = "GPL"
 import sys, string, os, pickle, re, logging, signal
 import getopt, time, shlex, socket
 
-# Inserts our own modules path first in the list
-# fix for bug #343821
-try:
-	from common.version import version
-except ImportError, e:
-	sys.path.insert(1, "/usr/share/fail2ban")
-	from common.version import version
-
-# Now we can import the rest of modules
-from common.protocol import printFormatted
-from client.csocket import CSocket
-from client.configurator import Configurator
-from client.beautifier import Beautifier
+from fail2ban.version import version
+from fail2ban.protocol import printFormatted
+from fail2ban.client.csocket import CSocket
+from fail2ban.client.configurator import Configurator
+from fail2ban.client.beautifier import Beautifier
+from fail2ban.helpers import getLogger
 
 # Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.client")
+logSys = getLogger("fail2ban")
 
 ##
 #
@@ -59,58 +52,61 @@ class Fail2banClient:
 		self.__conf["conf"] = "/etc/fail2ban"
 		self.__conf["dump"] = False
 		self.__conf["force"] = False
+		self.__conf["background"] = True
 		self.__conf["verbose"] = 1
 		self.__conf["interactive"] = False
 		self.__conf["socket"] = None
 		self.__conf["pidfile"] = None
 
 	def dispVersion(self):
-		print "Fail2Ban v" + version
-		print
-		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
-		print "Copyright of modifications held by their respective authors."
-		print "Licensed under the GNU General Public License v2 (GPL)."
-		print
-		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
-		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+		print("Fail2Ban v" + version)
+		print()
+		print("Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors")
+		print("Copyright of modifications held by their respective authors.")
+		print("Licensed under the GNU General Public License v2 (GPL).")
+		print()
+		print("Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.")
+		print("Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.")
 
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
-		print "Usage: "+self.__argv[0]+" [OPTIONS] <COMMAND>"
-		print
-		print "Fail2Ban v" + version + " reads log file that contains password failure report"
-		print "and bans the corresponding IP addresses using firewall rules."
-		print
-		print "Options:"
-		print "    -c <DIR>                configuration directory"
-		print "    -s <FILE>               socket path"
-		print "    -p <FILE>               pidfile path"
-		print "    -d                      dump configuration. For debugging"
-		print "    -i                      interactive mode"
-		print "    -v                      increase verbosity"
-		print "    -q                      decrease verbosity"
-		print "    -x                      force execution of the server (remove socket file)"
-		print "    -h, --help              display this help message"
-		print "    -V, --version           print the version"
-		print
-		print "Command:"
+		print("Usage: "+self.__argv[0]+" [OPTIONS] <COMMAND>")
+		print()
+		print("Fail2Ban v" + version + " reads log file that contains password failure report")
+		print("and bans the corresponding IP addresses using firewall rules.")
+		print()
+		print("Options:")
+		print("    -c <DIR>                configuration directory")
+		print("    -s <FILE>               socket path")
+		print("    -p <FILE>               pidfile path")
+		print("    -d                      dump configuration. For debugging")
+		print("    -i                      interactive mode")
+		print("    -v                      increase verbosity")
+		print("    -q                      decrease verbosity")
+		print("    -x                      force execution of the server (remove socket file)")
+		print("    -b                      start server in background (default)")
+		print("    -f                      start server in foreground (note that the client forks once itself)")
+		print("    -h, --help              display this help message")
+		print("    -V, --version           print the version")
+		print()
+		print("Command:")
 
 		# Prints the protocol
 		printFormatted()
 
-		print
-		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
+		print()
+		print("Report bugs to https://github.com/fail2ban/fail2ban/issues")
 
 	def dispInteractive(self):
-		print "Fail2Ban v" + version + " reads log file that contains password failure report"
-		print "and bans the corresponding IP addresses using firewall rules."
-		print
+		print("Fail2Ban v" + version + " reads log file that contains password failure report")
+		print("and bans the corresponding IP addresses using firewall rules.")
+		print()
 
 	def __sigTERMhandler(self, signum, frame):
 		# Print a new line because we probably come from wait
-		print
-		logSys.warn("Caught signal %d. Exiting" % signum)
+		print()
+		logSys.warning("Caught signal %d. Exiting" % signum)
 		sys.exit(-1)
 
 	def __getCmdLineOptions(self, optList):
@@ -133,6 +129,10 @@ class Fail2banClient:
 				self.__conf["force"] = True
 			elif opt[0] == "-i":
 				self.__conf["interactive"] = True
+			elif opt[0] == "-b":
+				self.__conf["background"] = True
+			elif opt[0] == "-f":
+				self.__conf["background"] = False
 			elif opt[0] in ["-h", "--help"]:
 				self.dispUsage()
 				sys.exit(0)
@@ -152,19 +152,19 @@ class Fail2banClient:
 				client = CSocket(self.__conf["socket"])
 				ret = client.send(c)
 				if ret[0] == 0:
-					logSys.debug("OK : " + `ret[1]`)
+					logSys.debug("OK : " + repr(ret[1]))
 					if showRet:
-						print beautifier.beautify(ret[1])
+						print(beautifier.beautify(ret[1]))
 				else:
-					logSys.error("NOK: " + `ret[1].args`)
+					logSys.error("NOK: " + repr(ret[1].args))
 					if showRet:
-						print beautifier.beautifyError(ret[1])
+						print(beautifier.beautifyError(ret[1]))
 					streamRet = False
 			except socket.error:
 				if showRet:
 					logSys.error("Unable to contact server. Is it running?")
 				return False
-			except Exception, e:
+			except Exception as e:
 				if showRet:
 					logSys.error(e)
 				return False
@@ -202,7 +202,8 @@ class Fail2banClient:
 				# Start the server
 				self.__startServerAsync(self.__conf["socket"],
 										self.__conf["pidfile"],
-										self.__conf["force"])
+										self.__conf["force"],
+										self.__conf["background"])
 				try:
 					# Wait for the server to start
 					self.__waitOnServer()
@@ -250,14 +251,12 @@ class Fail2banClient:
 	#
 	# Start the Fail2ban server in daemon mode.
 
-	def __startServerAsync(self, socket, pidfile, force = False):
+	def __startServerAsync(self, socket, pidfile, force = False, background = True):
 		# Forks the current process.
 		pid = os.fork()
 		if pid == 0:
 			args = list()
 			args.append(self.SERVER)
-			# Start in background mode.
-			args.append("-b")
 			# Set the socket path.
 			args.append("-s")
 			args.append(socket)
@@ -267,6 +266,12 @@ class Fail2banClient:
 			# Force the execution if needed.
 			if force:
 				args.append("-x")
+			# Start in foreground mode if requested.
+			if background:
+				args.append("-b")
+			else:
+				args.append("-f")
+			
 			try:
 				# Use the current directory.
 				exe = os.path.abspath(os.path.join(sys.path[0], self.SERVER))
@@ -320,7 +325,7 @@ class Fail2banClient:
 
 		# Reads the command line options.
 		try:
-			cmdOpts = 'hc:s:p:xdviqV'
+			cmdOpts = 'hc:s:p:xfbdviqV'
 			cmdLongOpts = ['help', 'version']
 			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
@@ -333,7 +338,7 @@ class Fail2banClient:
 		if verbose <= 0:
 			logSys.setLevel(logging.ERROR)
 		elif verbose == 1:
-			logSys.setLevel(logging.WARN)
+			logSys.setLevel(logging.WARNING)
 		elif verbose == 2:
 			logSys.setLevel(logging.INFO)
 		else:
@@ -378,7 +383,7 @@ class Fail2banClient:
 					readline.parse_and_bind("tab: complete")
 					self.dispInteractive()
 					while True:
-						cmd = raw_input(self.PROMPT)
+						cmd = input(self.PROMPT)
 						if cmd == "exit" or cmd == "quit":
 							# Exit
 							return True
@@ -387,10 +392,10 @@ class Fail2banClient:
 						elif not cmd == "":
 							try:
 								self.__processCommand(shlex.split(cmd))
-							except Exception, e:
+							except Exception as e:
 								logSys.error(e)
 			except (EOFError, KeyboardInterrupt):
-				print
+				print()
 				return True
 		# Single command mode
 		else:
@@ -408,7 +413,7 @@ class Fail2banClient:
 			ret = self.__configurator.getOptions(jail)
 			self.__configurator.convertToProtocol()
 			self.__stream = self.__configurator.getConfigStream()
-		except Exception, e:
+		except Exception as e:
 			logSys.error("Failed during configuration: %s" % e)
 			ret = False
 		return ret
@@ -416,7 +421,7 @@ class Fail2banClient:
 	#@staticmethod
 	def dumpConfig(cmd):
 		for c in cmd:
-			print c
+			print(c)
 		return True
 	dumpConfig = staticmethod(dumpConfig)
 

bin/fail2ban-regex

@@ -25,33 +25,32 @@ This tools can test regular expressions for "fail2ban".
 
 """
 
-__author__ = "Cyril Jaquier, Yaroslav Halchenko"
-__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2013 Yaroslav Halchenko"
+__author__ = "Fail2Ban Developers"
+__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko"
 __license__ = "GPL"
 
-import getopt, sys, time, logging, os, urllib
-
-# Inserts our own modules path first in the list
-# fix for bug #343821
-try:
-	from common.version import version
-except ImportError, e:
-	sys.path.insert(1, "/usr/share/fail2ban")
-	from common.version import version
-
+import getopt, sys, time, logging, os, locale, shlex, time, urllib.request, urllib.parse, urllib.error
 from optparse import OptionParser, Option
 
-from client.configparserinc import SafeConfigParserWithIncludes
-from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
-from server.filter import Filter
-from server.failregex import RegexException
+from configparser import NoOptionError, NoSectionError, MissingSectionHeaderError
 
-from testcases.utils import FormatterWithTraceBack
+try:
+	from systemd import journal
+	from fail2ban.server.filtersystemd import FilterSystemd
+except ImportError:
+	journal = None
+
+from fail2ban.version import version
+from fail2ban.client.filterreader import FilterReader
+from fail2ban.server.filter import Filter
+from fail2ban.server.failregex import RegexException
+
+from fail2ban.helpers import FormatterWithTraceBack, getLogger
 # Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban")
+logSys = getLogger("fail2ban")
 
 def debuggexURL(sample, regex):
-	q = urllib.urlencode({ 're': regex.replace('<HOST>', '(?&.ipv4)'),
+	q = urllib.parse.urlencode({ 're': regex.replace('<HOST>', '(?&.ipv4)'),
 							'str': sample,
 							'flavor': 'python' })
 	return 'http://www.debuggex.com/?' + q
@@ -70,8 +69,26 @@ def pprint_list(l, header=None):
 		s = "|- %s\n" % header
 	else:
 		s = ''
-	print s + "|  " + "\n|  ".join(l) + '\n`-'
+	print(s + "|  " + "\n|  ".join(l) + '\n`-')
 
+def file_lines_gen(hdlr):
+	for line in hdlr:
+		try:
+			line = line.decode(fail2banRegex.encoding, 'strict')
+		except UnicodeDecodeError:
+			if sys.version_info >= (3,): # Python 3 must be decoded
+				line = line.decode(fail2banRegex.encoding, 'ignore')
+		yield line
+
+def journal_lines_gen(myjournal):
+	while True:
+		try:
+			entry = myjournal.get_next()
+		except OSError:
+			continue
+		if not entry:
+			break
+		yield FilterSystemd.formatJournalEntry(entry)
 
 def get_opt_parser():
 	# use module docstring for help output
@@ -81,6 +98,7 @@ def get_opt_parser():
 LOG:
     string                  a string representing a log line
     filename                path to a log file (/var/log/auth.log)
+    "systemd-journal"       search systemd journal (systemd-python required)
 
 REGEX:
     string                  a string representing a 'failregex'
@@ -102,9 +120,18 @@ Report bugs to https://github.com/fail2ban/fail2ban/issues
 				version="%prog " + version)
 
 	p.add_options([
+		Option("-d", "--datepattern",
+			   help="set custom pattern used to match date/times"),
+		Option("-e", "--encoding",
+			   help="File encoding. Default: system locale"),
+		Option("-L", "--maxlines", type=int, default=0,
+			   help="maxlines for multi-line regex"),
+		Option("-m", "--journalmatch",
+			   help="journalctl style matches overriding filter file. "
+			   "\"systemd-journal\" only"),
 		Option('-l', "--log-level", type="choice",
 			   dest="log_level",
-			   choices=('heavydebug', 'debug', 'info', 'warning', 'error', 'fatal'),
+			   choices=('heavydebug', 'debug', 'info', 'notice', 'warning', 'error', 'critical'),
 			   default=None,
 			   help="Log level for the Fail2Ban logger to use"),
 		Option("-v", "--verbose", action='store_true',
@@ -115,6 +142,8 @@ Report bugs to https://github.com/fail2ban/fail2ban/issues
 			   help="Do not print any missed lines"),
 		Option("--print-no-ignored", action='store_true',
 			   help="Do not print any ignored lines"),
+		Option("--print-all-matched", action='store_true',
+			   help="Print all matched lines"),
 		Option("--print-all-missed", action='store_true',
 			   help="Print all missed lines, no matter how many"),
 		Option("--print-all-ignored", action='store_true',
@@ -160,6 +189,7 @@ class LineStats(object):
 	"""
 	def __init__(self):
 		self.tested = self.matched = 0
+		self.matched_lines = []
 		self.missed = 0
 		self.missed_lines = []
 		self.missed_lines_timeextracted = []
@@ -177,47 +207,91 @@ class LineStats(object):
 
 class Fail2banRegex(object):
 
-	CONFIG_DEFAULTS = {'configpath' : "/etc/fail2ban/"}
-
 	def __init__(self, opts):
 		self._verbose = opts.verbose
 		self._debuggex = opts.debuggex
 		self._maxlines = 20
 		self._print_no_missed = opts.print_no_missed
 		self._print_no_ignored = opts.print_no_ignored
+		self._print_all_matched = opts.print_all_matched
 		self._print_all_missed = opts.print_all_missed
 		self._print_all_ignored = opts.print_all_ignored
+		self._maxlines_set = False		  # so we allow to override maxlines in cmdline
+		self._datepattern_set = False
+		self._journalmatch = None
 
 		self._filter = Filter(None)
 		self._ignoreregex = list()
 		self._failregex = list()
+		self._time_elapsed = None
 		self._line_stats = LineStats()
 
+		if opts.maxlines:
+			self.setMaxLines(opts.maxlines)
+		if opts.journalmatch is not None:
+			self.setJournalMatch(opts.journalmatch.split())
+		if opts.datepattern:
+			self.setDatePattern(opts.datepattern)
+		if opts.encoding:
+			self.encoding = opts.encoding
+		else:
+			self.encoding = locale.getpreferredencoding()
+
+
+
+	def setDatePattern(self, pattern):
+		if not self._datepattern_set:
+			self._filter.setDatePattern(pattern)
+			self._datepattern_set = True
+			if pattern is not None:
+				print("Use      datepattern : %s" % (
+					self._filter.getDatePattern()[1], ))
+
+	def setMaxLines(self, v):
+		if not self._maxlines_set:
+			self._filter.setMaxLines(int(v))
+			self._maxlines_set = True
+			print("Use         maxlines : %d" % self._filter.getMaxLines())
+
+	def setJournalMatch(self, v):
+		if self._journalmatch is None:
+			self._journalmatch = v
 
 	def readRegex(self, value, regextype):
 		assert(regextype in ('fail', 'ignore'))
 		regex = regextype + 'regex'
 		if os.path.isfile(value):
-			reader = SafeConfigParserWithIncludes(defaults=self.CONFIG_DEFAULTS)
-			try:
-				reader.read(value)
-				print "Use %11s file : %s" % (regex, value)
-				# TODO: reuse functionality in client
+			print("Use %11s file : %s" % (regex, value))
+			reader = FilterReader(value, 'fail2ban-regex-jail', {})
+			reader.setBaseDir(None)
+
+			if reader.readexplicit():
+				reader.getOptions(None)
+				readercommands = reader.convert()
 				regex_values = [
-					RegexStat(m)
-					for m in reader.get("Definition", regex).split('\n')
-					if m != ""]
-			except NoSectionError:
-				print "No [Definition] section in %s" % value
-				return False
-			except NoOptionError:
-				print "No %s option in %s" % (regex, value)
-				return False
-			except MissingSectionHeaderError:
-				print "No section headers in %s" % value
+					RegexStat(m[3])
+					for m in [x for x in readercommands if x[0] == 'set' and x[2] == "add%sregex" % regextype]]
+				# Read out and set possible value of maxlines
+				for command in readercommands:
+					if command[2] == "maxlines":
+						maxlines = int(command[3])
+						try:
+							self.setMaxLines(maxlines)
+						except ValueError:
+							print("ERROR: Invalid value for maxlines (%(maxlines)r) " \
+								  "read from %(value)s" % locals())
+							return False
+					elif command[2] == 'addjournalmatch':
+						journalmatch = command[3]
+						self.setJournalMatch(shlex.split(journalmatch))
+					elif command[2] == 'datepattern':
+						datepattern = command[3]
+						self.setDatePattern(datepattern)
+			else:
+				print("ERROR: failed to read %s" % value)
 				return False
 		else:
-			print "Use %11s line : %s" % (regex, shortstr(value))
+			print("Use %11s line : %s" % (regex, shortstr(value)))
 			regex_values = [RegexStat(value)]
 
 		setattr(self, "_" + regex, regex_values)
@@ -230,18 +304,20 @@ class Fail2banRegex(object):
 	def testIgnoreRegex(self, line):
 		found = False
 		try:
-			ret = self._filter.ignoreLine(line)
+			ret = self._filter.ignoreLine([(line, "", "")])
 			if ret is not None:
 				found = True
 				regex = self._ignoreregex[ret].inc()
-		except RegexException, e:
-			print e
+		except RegexException as e:
+			print(e)
 			return False
 		return found
 
-	def testRegex(self, line):
+	def testRegex(self, line, date=None):
+		orgLineBuffer = self._filter._Filter__lineBuffer
+		fullBuffer = len(orgLineBuffer) >= self._filter.getMaxLines()
 		try:
-			line, ret = self._filter.processLine(line, checkAllRegex=True)
+			line, ret = self._filter.processLine(line, date, checkAllRegex=True)
 			for match in ret:
 				# Append True/False flag depending if line was matched by
 				# more than one regex
@@ -249,23 +325,41 @@ class Fail2banRegex(object):
 				regex = self._failregex[match[0]]
 				regex.inc()
 				regex.appendIP(match)
-		except RegexException, e:
-			print e
+		except RegexException as e:
+			print(e)
 			return False
 		except IndexError:
-			print "Sorry, but no <HOST> found in regex"
+			print("Sorry, but no <HOST> found in regex")
 			return False
+		for bufLine in orgLineBuffer[int(fullBuffer):]:
+			if bufLine not in self._filter._Filter__lineBuffer:
+				try:
+					self._line_stats.missed_lines.pop(
+						self._line_stats.missed_lines.index("".join(bufLine)))
+					self._line_stats.missed_lines_timeextracted.pop(
+						self._line_stats.missed_lines_timeextracted.index(
+							"".join(bufLine[::2])))
+				except ValueError:
+					pass
+				else:
+					self._line_stats.matched += 1
+					self._line_stats.missed -= 1
 		return line, ret
 
-
 	def process(self, test_lines):
-
+		t0 = time.time()
 		for line_no, line in enumerate(test_lines):
-			if line.startswith('#') or not line.strip():
-				# skip comment and empty lines
-				continue
-			is_ignored = fail2banRegex.testIgnoreRegex(line)
-			line_datetimestripped, ret = fail2banRegex.testRegex(line)
+			if isinstance(line, tuple):
+				line_datetimestripped, ret = fail2banRegex.testRegex(
+					line[0], line[1])
+				line = "".join(line[0])
+			else:
+				line = line.rstrip('\r\n')
+				if line.startswith('#') or not line:
+					# skip comment and empty lines
+					continue
+				line_datetimestripped, ret = fail2banRegex.testRegex(line)
+			is_ignored = fail2banRegex.testIgnoreRegex(line_datetimestripped)
 
 			if is_ignored:
 				self._line_stats.ignored += 1
@@ -276,6 +370,8 @@ class Fail2banRegex(object):
 			if len(ret) > 0:
 				assert(not is_ignored)
 				self._line_stats.matched += 1
+				if self._print_all_matched:
+					self._line_stats.matched_lines.append(line)
 			else:
 				if not is_ignored:
 					self._line_stats.missed += 1
@@ -284,8 +380,9 @@ class Fail2banRegex(object):
 						self._line_stats.missed_lines_timeextracted.append(line_datetimestripped)
 			self._line_stats.tested += 1
 
-			if line_no % 10 == 0:
+			if line_no % 10 == 0 and self._filter.dateDetector is not None:
 				self._filter.dateDetector.sortTemplate()
+		self._time_elapsed = time.time() - t0
 
 
 
@@ -297,7 +394,7 @@ class Fail2banRegex(object):
 		if lines:
 			header = "%s line(s):" % (ltype.capitalize(),)
 			if self._debuggex:
-				if ltype == 'missed':
+				if ltype == 'missed' or ltype == 'matched':
 					regexlist = self._failregex
 				else:
 					regexlist = self._ignoreregex
@@ -305,22 +402,22 @@ class Fail2banRegex(object):
 				if lines < self._maxlines or getattr(self, '_print_all_' + ltype):
 					ans = [[]]
 					for arg in [l, regexlist]:
-					    ans = [ x + [y] for x in ans for y in arg ]
-					b = map(lambda a: a[0] +  ' | ' + a[1].getFailRegex() + ' |  ' + debuggexURL(a[0], a[1].getFailRegex()), ans)
+						ans = [ x + [y] for x in ans for y in arg ]
+					b = [a[0] +  ' | ' + a[1].getFailRegex() + ' |  ' + debuggexURL(a[0], a[1].getFailRegex()) for a in ans]
 					pprint_list([x.rstrip() for x in b], header)
 				else:
-					print "%s too many to print.  Use --print-all-%s " \
-						  "to print all %d lines" % (header, ltype, lines)
+					print("%s too many to print.  Use --print-all-%s " \
+						  "to print all %d lines" % (header, ltype, lines))
 			elif lines < self._maxlines or getattr(self, '_print_all_' + ltype):
 				pprint_list([x.rstrip() for x in l], header)
 			else:
-				print "%s too many to print.  Use --print-all-%s " \
-					  "to print all %d lines" % (header, ltype, lines)
+				print("%s too many to print.  Use --print-all-%s " \
+					  "to print all %d lines" % (header, ltype, lines))
 
 	def printStats(self):
-		print
-		print "Results"
-		print "======="
+		print()
+		print("Results")
+		print("=======")
 
 		def print_failregexes(title, failregexes):
 			# Print title
@@ -339,9 +436,9 @@ class Fail2banRegex(object):
 							"    %s  %s%s" % (
 								ip[1],
 								timeString,
-								ip[3] and " (multiple regex matched)" or ""))
+								ip[-1] and " (multiple regex matched)" or ""))
 
-			print "\n%s: %d total" % (title, total)
+			print("\n%s: %d total" % (title, total))
 			pprint_list(out, " #) [# of hits] regular expression")
 			return total
 
@@ -350,15 +447,22 @@ class Fail2banRegex(object):
 		_ = print_failregexes("Ignoreregex", self._ignoreregex)
 
 
-		print "\nDate template hits:"
-		out = []
-		for template in self._filter.dateDetector.getTemplates():
-			if self._verbose or template.getHits():
-				out.append("[%d] %s" % (template.getHits(), template.getName()))
-		pprint_list(out, "[# of hits] date format")
+		if self._filter.dateDetector is not None:
+			print("\nDate template hits:")
+			out = []
+			for template in self._filter.dateDetector.templates:
+				if self._verbose or template.hits:
+					out.append("[%d] %s" % (
+						template.hits, template.name))
+			pprint_list(out, "[# of hits] date format")
 
-		print "\nLines: %s" % self._line_stats
+		print("\nLines: %s" % self._line_stats, end=' ')
+		if self._time_elapsed is not None:
+			print("[processed in %.2f sec]" % self._time_elapsed, end=' ')
+		print()
 
+		if self._print_all_matched:
+			self.printLines('matched')
 		if not self._print_no_ignored:
 			self.printLines('ignored')
 		if not self._print_no_missed:
@@ -374,11 +478,16 @@ if __name__ == "__main__":
 	if opts.print_no_missed and opts.print_all_missed:
 		sys.stderr.write("ERROR: --print-no-missed and --print-all-missed are mutually exclusive.\n\n")
 		parser.print_help()
-	        sys.exit(-1)
+		sys.exit(-1)
 	if opts.print_no_ignored and opts.print_all_ignored:
 		sys.stderr.write("ERROR: --print-no-ignored and --print-all-ignored are mutually exclusive.\n\n")
 		parser.print_help()
-	        sys.exit(-1)
+		sys.exit(-1)
+
+	print()
+	print("Running tests")
+	print("=============")
+	print()
 
 	fail2banRegex = Fail2banRegex(opts)
 
@@ -394,9 +503,9 @@ if __name__ == "__main__":
 		logSys.setLevel(getattr(logging, opts.log_level.upper()))
 	else: # pragma: no cover
 		# suppress the logging but it would leave unittests' progress dots
-		# ticking, unless like with '-l fatal' which would be silent
+		# ticking, unless like with '-l critical' which would be silent
 		# unless error occurs
-		logSys.setLevel(getattr(logging, 'FATAL'))
+		logSys.setLevel(getattr(logging, 'CRITICAL'))
 
 	# Add the default logging handler
 	stdout = logging.StreamHandler(sys.stdout)
@@ -410,37 +519,52 @@ if __name__ == "__main__":
 		Formatter = logging.Formatter
 
 	# Custom log format for the verbose tests runs
-	if opts.verbose > 1: # pragma: no cover
+	if opts.verbose: # pragma: no cover
 		stdout.setFormatter(Formatter(' %(asctime)-15s %(thread)s' + fmt))
 	else: # pragma: no cover
 		# just prefix with the space
 		stdout.setFormatter(Formatter(fmt))
 	logSys.addHandler(stdout)
 
-	print
-	print "Running tests"
-	print "============="
-	print
-
 	cmd_log, cmd_regex = args[:2]
 
+	fail2banRegex.readRegex(cmd_regex, 'fail') or sys.exit(-1)
+
 	if len(args) == 3:
 		fail2banRegex.readRegex(args[2], 'ignore') or sys.exit(-1)
 
-	fail2banRegex.readRegex(cmd_regex, 'fail') or sys.exit(-1)
-
 	if os.path.isfile(cmd_log):
 		try:
-			hdlr = open(cmd_log)
-			print "Use         log file : %s" % cmd_log
-			test_lines = hdlr # Iterable
-		except IOError, e:
-			print e
+			hdlr = open(cmd_log, 'rb')
+			print("Use         log file : %s" % cmd_log)
+			print("Use         encoding : %s" % fail2banRegex.encoding)
+			test_lines = file_lines_gen(hdlr)
+		except IOError as e:
+			print(e)
 			sys.exit(-1)
+	elif cmd_log == "systemd-journal":
+		if not journal:
+			print("Error: systemd library not found. Exiting...")
+			sys.exit(-1)
+		myjournal = journal.Reader(converters={'__CURSOR': lambda x: x})
+		journalmatch = fail2banRegex._journalmatch
+		fail2banRegex.setDatePattern(None)
+		if journalmatch:
+			try:
+				for element in journalmatch:
+					if element == "+":
+						myjournal.add_disjunction()
+					else:
+						myjournal.add_match(element)
+			except ValueError:
+				print("Error: Invalid journalmatch: %s" % shortstr(" ".join(journalmatch)))
+				sys.exit(-1)
+		print("Use    journal match : %s" % " ".join(journalmatch))
+		test_lines = journal_lines_gen(myjournal)
 	else:
-		print "Use      single line : %s" % shortstr(cmd_log)
+		print("Use      single line : %s" % shortstr(cmd_log))
 		test_lines = [ cmd_log ]
-	print
+	print()
 
 	fail2banRegex.process(test_lines)
 

bin/fail2ban-server

@@ -22,20 +22,14 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import getopt, sys, logging, os
+import getopt, sys, os
 
-# Inserts our own modules path first in the list
-# fix for bug #343821
-try:
-	from common.version import version
-except ImportError, e:
-	sys.path.insert(1, "/usr/share/fail2ban")
-	from common.version import version
-
-from server.server import Server
+from fail2ban.version import version
+from fail2ban.server.server import Server
+from fail2ban.helpers import getLogger
 
 # Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban")
+logSys = getLogger("fail2ban")
 
 ##
 # \mainpage Fail2Ban
@@ -57,37 +51,37 @@ class Fail2banServer:
 		self.__conf["pidfile"] = "/var/run/fail2ban/fail2ban.pid"
 
 	def dispVersion(self):
-		print "Fail2Ban v" + version
-		print
-		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
-		print "Copyright of modifications held by their respective authors."
-		print "Licensed under the GNU General Public License v2 (GPL)."
-		print
-		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
-		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+		print("Fail2Ban v" + version)
+		print()
+		print("Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors")
+		print("Copyright of modifications held by their respective authors.")
+		print("Licensed under the GNU General Public License v2 (GPL).")
+		print()
+		print("Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.")
+		print("Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.")
 
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
-		print "Usage: "+self.__argv[0]+" [OPTIONS]"
-		print
-		print "Fail2Ban v" + version + " reads log file that contains password failure report"
-		print "and bans the corresponding IP addresses using firewall rules."
-		print
-		print "Only use this command for debugging purpose. Start the server with"
-		print "fail2ban-client instead. The default behaviour is to start the server"
-		print "in background."
-		print
-		print "Options:"
-		print "    -b                   start in background"
-		print "    -f                   start in foreground"
-		print "    -s <FILE>            socket path"
-		print "    -p <FILE>            pidfile path"
-		print "    -x                   force execution of the server (remove socket file)"
-		print "    -h, --help           display this help message"
-		print "    -V, --version        print the version"
-		print
-		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
+		print("Usage: "+self.__argv[0]+" [OPTIONS]")
+		print()
+		print("Fail2Ban v" + version + " reads log file that contains password failure report")
+		print("and bans the corresponding IP addresses using firewall rules.")
+		print()
+		print("Only use this command for debugging purpose. Start the server with")
+		print("fail2ban-client instead. The default behaviour is to start the server")
+		print("in background.")
+		print()
+		print("Options:")
+		print("    -b                   start in background")
+		print("    -f                   start in foreground")
+		print("    -s <FILE>            socket path")
+		print("    -p <FILE>            pidfile path")
+		print("    -x                   force execution of the server (remove socket file)")
+		print("    -h, --help           display this help message")
+		print("    -V, --version        print the version")
+		print()
+		print("Report bugs to https://github.com/fail2ban/fail2ban/issues")
 
 	def __getCmdLineOptions(self, optList):
 		""" Gets the command line options
@@ -104,10 +98,10 @@ class Fail2banServer:
 			if opt[0] == "-x":
 				self.__conf["force"] = True
 			if opt[0] in ["-h", "--help"]:
-	 			self.dispUsage()
+				self.dispUsage()
 				sys.exit(0)
 			if opt[0] in ["-V", "--version"]:
-	 			self.dispVersion()
+				self.dispVersion()
 				sys.exit(0)
 
 	def start(self, argv):
@@ -131,7 +125,7 @@ class Fail2banServer:
 								self.__conf["pidfile"],
 								self.__conf["force"])
 			return True
-		except Exception, e:
+		except Exception as e:
 			logSys.exception(e)
 			self.__server.quit()
 			return False

bin/fail2ban-testcases

@@ -0,0 +1,129 @@
+#!/usr/bin/python
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+"""Script to run Fail2Ban tests battery
+"""
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2012- Yaroslav Halchenko"
+__license__ = "GPL"
+
+import logging
+import unittest, sys, time, os
+
+# Check if local fail2ban module exists, and use if it exists by 
+# modifying the path. This is such that tests can be used in dev
+# environment.
+if os.path.exists("fail2ban/__init__.py"):
+	sys.path.insert(0, ".")
+from fail2ban.version import version
+
+from fail2ban.tests.utils import gatherTests
+from fail2ban.helpers import FormatterWithTraceBack, getLogger
+from fail2ban.server.mytime import MyTime
+
+from optparse import OptionParser, Option
+
+def get_opt_parser():
+	# use module docstring for help output
+	p = OptionParser(
+				usage="%s [OPTIONS] [regexps]\n" % sys.argv[0] + __doc__,
+				version="%prog " + version)
+
+	p.add_options([
+		Option('-l', "--log-level", type="choice",
+			   dest="log_level",
+			   choices=('heavydebug', 'debug', 'info', 'notice', 'warning', 'error', 'critical'),
+			   default=None,
+			   help="Log level for the logger to use during running tests"),
+		Option('-n', "--no-network", action="store_true",
+			   dest="no_network",
+			   help="Do not run tests that require the network"),
+		Option("-t", "--log-traceback", action='store_true',
+			   help="Enrich log-messages with compressed tracebacks"),
+		Option("--full-traceback", action='store_true',
+			   help="Either to make the tracebacks full, not compressed (as by default)"),
+
+		])
+
+	return p
+
+parser = get_opt_parser()
+(opts, regexps) = parser.parse_args()
+
+#
+# Logging
+#
+logSys = getLogger("fail2ban")
+
+# Numerical level of verbosity corresponding to a log "level"
+verbosity = {'heavydebug': 4,
+			 'debug': 3,
+			 'info': 2,
+			 'notice': 2,
+			 'warning': 1,
+			 'error': 1,
+			 'critical': 0,
+			 None: 1}[opts.log_level]
+
+if opts.log_level is not None: # pragma: no cover
+	# so we had explicit settings
+	logSys.setLevel(getattr(logging, opts.log_level.upper()))
+else: # pragma: no cover
+	# suppress the logging but it would leave unittests' progress dots
+	# ticking, unless like with '-l critical' which would be silent
+	# unless error occurs
+	logSys.setLevel(getattr(logging, 'CRITICAL'))
+
+# Add the default logging handler
+stdout = logging.StreamHandler(sys.stdout)
+
+fmt = ' %(message)s'
+
+if opts.log_traceback:
+	Formatter = FormatterWithTraceBack
+	fmt = (opts.full_traceback and ' %(tb)s' or ' %(tbc)s') + fmt
+else:
+	Formatter = logging.Formatter
+
+# Custom log format for the verbose tests runs
+if verbosity > 1: # pragma: no cover
+	stdout.setFormatter(Formatter(' %(asctime)-15s %(thread)s' + fmt))
+else: # pragma: no cover
+	# just prefix with the space
+	stdout.setFormatter(Formatter(fmt))
+logSys.addHandler(stdout)
+
+#
+# Let know the version
+#
+if not opts.log_level or opts.log_level != 'critical': # pragma: no cover
+	print(("Fail2ban %s test suite. Python %s. Please wait..." \
+	    % (version, str(sys.version).replace('\n', ''))))
+
+tests = gatherTests(regexps, opts.no_network)
+#
+# Run the tests
+#
+testRunner = unittest.TextTestRunner(verbosity=verbosity)
+
+tests_results = testRunner.run(tests)
+
+if not tests_results.wasSuccessful(): # pragma: no cover
+	sys.exit(1)

client/actionreader.py

@@ -1,90 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-
-__author__ = "Cyril Jaquier"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import logging
-from configreader import ConfigReader
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.client.config")
-
-class ActionReader(ConfigReader):
-	
-	def __init__(self, action, name, **kwargs):
-		ConfigReader.__init__(self, **kwargs)
-		self.__file = action[0]
-		self.__cInfo = action[1]
-		self.__name = name
-	
-	def setFile(self, fileName):
-		self.__file = fileName
-	
-	def getFile(self):
-		return self.__file
-	
-	def setName(self, name):
-		self.__name = name
-	
-	def getName(self):
-		return self.__name
-	
-	def read(self):
-		return ConfigReader.read(self, "action.d/" + self.__file)
-	
-	def getOptions(self, pOpts):
-		opts = [["string", "actionstart", ""],
-				["string", "actionstop", ""],
-				["string", "actioncheck", ""],
-				["string", "actionban", ""],
-				["string", "actionunban", ""]]
-		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
-		
-		if self.has_section("Init"):
-			for opt in self.options("Init"):
-				if not self.__cInfo.has_key(opt):
-					self.__cInfo[opt] = self.get("Init", opt)
-	
-	def convert(self):
-		head = ["set", self.__name]
-		stream = list()
-		stream.append(head + ["addaction", self.__file])
-		for opt in self.__opts:
-			if opt == "actionstart":
-				stream.append(head + ["actionstart", self.__file, self.__opts[opt]])
-			elif opt == "actionstop":
-				stream.append(head + ["actionstop", self.__file, self.__opts[opt]])
-			elif opt == "actioncheck":
-				stream.append(head + ["actioncheck", self.__file, self.__opts[opt]])
-			elif opt == "actionban":
-				stream.append(head + ["actionban", self.__file, self.__opts[opt]])
-			elif opt == "actionunban":
-				stream.append(head + ["actionunban", self.__file, self.__opts[opt]])
-		# cInfo
-		if self.__cInfo:
-			for p in self.__cInfo:
-				stream.append(head + ["setcinfo", self.__file, p, self.__cInfo[p]])
-
-		return stream
-		

client/filterreader.py

@@ -1,79 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Cyril Jaquier
-# 
-
-__author__ = "Cyril Jaquier"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import os
-import logging
-from configreader import ConfigReader
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.client.config")
-
-class FilterReader(ConfigReader):
-	
-	def __init__(self, fileName, name, **kwargs):
-		ConfigReader.__init__(self, **kwargs)
-		# Defer initialization to the set Methods
-		self.__file = self.__name = self.__opts = None
-		self.setFile(fileName)
-		self.setName(name)
-	
-	def setFile(self, fileName):
-		self.__file = fileName
-		self.__opts = None
-	
-	def getFile(self):
-		return self.__file
-	
-	def setName(self, name):
-		self.__name = name
-
-	def getName(self):
-		return self.__name
-	
-	def read(self):
-		return ConfigReader.read(self, os.path.join("filter.d", self.__file))
-	
-	def getOptions(self, pOpts):
-		opts = [["string", "ignoreregex", ""],
-				["string", "failregex", ""],
-				]
-		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
-	
-	def convert(self):
-		stream = list()
-		for opt in self.__opts:
-			if opt == "failregex":
-				for regex in self.__opts[opt].split('\n'):
-					# Do not send a command if the rule is empty.
-					if regex != '':
-						stream.append(["set", self.__name, "addfailregex", regex])
-			elif opt == "ignoreregex":
-				for regex in self.__opts[opt].split('\n'):
-					# Do not send a command if the rule is empty.
-					if regex != '':
-						stream.append(["set", self.__name, "addignoreregex", regex])		
-		return stream
-		

common/helpers.py

@@ -1,28 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-__author__ = "Cyril Jaquier, Arturo 'Buanzo' Busleiman, Yaroslav Halchenko"
-__license__ = "GPL"
-
-
-def formatExceptionInfo():
-	""" Consistently format exception information """
-	import sys
-	cla, exc = sys.exc_info()[:2]
-	return (cla.__name__, str(exc))

config/action.d/badips.py

@@ -0,0 +1,363 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+import sys
+if sys.version_info < (2, 7):
+	raise ImportError("badips.py action requires Python >= 2.7")
+import json
+from functools import partial
+import threading
+import logging
+if sys.version_info >= (3, ):
+	from urllib.request import Request, urlopen
+	from urllib.parse import urlencode
+	from urllib.error import HTTPError
+else:
+	from urllib2 import Request, urlopen, HTTPError
+	from urllib import urlencode
+
+from fail2ban.server.actions import ActionBase
+from fail2ban.version import version as f2bVersion
+
+class BadIPsAction(ActionBase):
+	"""Fail2Ban action which reports bans to badips.com, and also
+	blacklist bad IPs listed on badips.com by using another action's
+	ban method.
+
+	Parameters
+	----------
+	jail : Jail
+		The jail which the action belongs to.
+	name : str
+		Name assigned to the action.
+	category : str
+		Valid badips.com category for reporting failures.
+	score : int, optional
+		Minimum score for bad IPs. Default 3.
+	age : str, optional
+		Age of last report for bad IPs, per badips.com syntax.
+		Default "24h" (24 hours)
+	key : str, optional
+		Key issued by badips.com to report bans, for later retrieval
+		of personalised content.
+	banaction : str, optional
+		Name of banaction to use for blacklisting bad IPs. If `None`,
+		no blacklist of IPs will take place.
+		Default `None`.
+	bancategory : str, optional
+		Name of category to use for blacklisting, which can differ
+		from category used for reporting. e.g. may want to report
+		"postfix", but want to use whole "mail" category for blacklist.
+		Default `category`.
+	bankey : str, optional
+		Key issued by badips.com to blacklist IPs reported with the
+		associated key.
+	updateperiod : int, optional
+		Time in seconds between updating bad IPs blacklist.
+		Default 900 (15 minutes)
+
+	Raises
+	------
+	ValueError
+		If invalid `category`, `score`, `banaction` or `updateperiod`.
+	"""
+
+	_badips = "http://www.badips.com"
+	_Request = partial(
+		Request, headers={'User-Agent': "Fail2Ban %s" % f2bVersion})
+
+	def __init__(self, jail, name, category, score=3, age="24h", key=None,
+		banaction=None, bancategory=None, bankey=None, updateperiod=900):
+		super(BadIPsAction, self).__init__(jail, name)
+
+		self.category = category
+		self.score = score
+		self.age = age
+		self.key = key
+		self.banaction = banaction
+		self.bancategory = bancategory or category
+		self.bankey = bankey
+		self.updateperiod = updateperiod
+
+		self._bannedips = set()
+		# Used later for threading.Timer for updating badips
+		self._timer = None
+
+	def getCategories(self, incParents=False):
+		"""Get badips.com categories.
+
+		Returns
+		-------
+		set
+			Set of categories.
+
+		Raises
+		------
+		HTTPError
+			Any issues with badips.com request.
+		"""
+		try:
+			response = urlopen(
+				self._Request("/".join([self._badips, "get", "categories"])))
+		except HTTPError as response:
+			messages = json.loads(response.read().decode('utf-8'))
+			self._logSys.error(
+				"Failed to fetch categories. badips.com response: '%s'",
+				messages['err'])
+			raise
+		else:
+			categories = json.loads(response.read().decode('utf-8'))['categories']
+			categories_names = set(
+				value['Name'] for value in categories)
+			if incParents:
+				categories_names.update(set(
+					value['Parent'] for value in categories
+					if "Parent" in value))
+			return categories_names
+
+	def getList(self, category, score, age, key=None):
+		"""Get badips.com list of bad IPs.
+
+		Parameters
+		----------
+		category : str
+			Valid badips.com category.
+		score : int
+			Minimum score for bad IPs.
+		age : str
+			Age of last report for bad IPs, per badips.com syntax.
+		key : str, optional
+			Key issued by badips.com to fetch IPs reported with the
+			associated key.
+
+		Returns
+		-------
+		set
+			Set of bad IPs.
+
+		Raises
+		------
+		HTTPError
+			Any issues with badips.com request.
+		"""
+		try:
+			url = "?".join([
+				"/".join([self._badips, "get", "list", category, str(score)]),
+				urlencode({'age': age})])
+			if key:
+				url = "&".join([url, urlencode({'key': key})])
+			response = urlopen(self._Request(url))
+		except HTTPError as response:
+			messages = json.loads(response.read().decode('utf-8'))
+			self._logSys.error(
+				"Failed to fetch bad IP list. badips.com response: '%s'",
+				messages['err'])
+			raise
+		else:
+			return set(response.read().decode('utf-8').split())
+
+	@property
+	def category(self):
+		"""badips.com category for reporting IPs.
+		"""
+		return self._category
+
+	@category.setter
+	def category(self, category):
+		if category not in self.getCategories():
+			self._logSys.error("Category name '%s' not valid. "
+				"see badips.com for list of valid categories",
+				category)
+			raise ValueError("Invalid category: %s" % category)
+		self._category = category
+
+	@property
+	def bancategory(self):
+		"""badips.com bancategory for fetching IPs.
+		"""
+		return self._bancategory
+
+	@bancategory.setter
+	def bancategory(self, bancategory):
+		if bancategory not in self.getCategories(incParents=True):
+			self._logSys.error("Category name '%s' not valid. "
+				"see badips.com for list of valid categories",
+				bancategory)
+			raise ValueError("Invalid bancategory: %s" % bancategory)
+		self._bancategory = bancategory
+
+	@property
+	def score(self):
+		"""badips.com minimum score for fetching IPs.
+		"""
+		return self._score
+
+	@score.setter
+	def score(self, score):
+		score = int(score)
+		if 0 <= score <= 5:
+			self._score = score
+		else:
+			raise ValueError("Score must be 0-5")
+
+	@property
+	def banaction(self):
+		"""Jail action to use for banning/unbanning.
+		"""
+		return self._banaction
+
+	@banaction.setter
+	def banaction(self, banaction):
+		if banaction is not None and banaction not in self._jail.actions:
+			self._logSys.error("Action name '%s' not in jail '%s'",
+				banaction, self._jail.name)
+			raise ValueError("Invalid banaction")
+		self._banaction = banaction
+
+	@property
+	def updateperiod(self):
+		"""Period in seconds between banned bad IPs will be updated.
+		"""
+		return self._updateperiod
+
+	@updateperiod.setter
+	def updateperiod(self, updateperiod):
+		updateperiod = int(updateperiod)
+		if updateperiod > 0:
+			self._updateperiod = updateperiod
+		else:
+			raise ValueError("Update period must be integer greater than 0")
+
+	def _banIPs(self, ips):
+		for ip in ips:
+			try:
+				self._jail.actions[self.banaction].ban({
+					'ip': ip,
+					'failures': 0,
+					'matches': "",
+					'ipmatches': "",
+					'ipjailmatches': "",
+				})
+			except Exception as e:
+				self._logSys.error(
+					"Error banning IP %s for jail '%s' with action '%s': %s",
+					ip, self._jail.name, self.banaction, e,
+					exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG)
+			else:
+				self._bannedips.add(ip)
+				self._logSys.info(
+					"Banned IP %s for jail '%s' with action '%s'",
+					ip, self._jail.name, self.banaction)
+
+	def _unbanIPs(self, ips):
+		for ip in ips:
+			try:
+				self._jail.actions[self.banaction].unban({
+					'ip': ip,
+					'failures': 0,
+					'matches': "",
+					'ipmatches': "",
+					'ipjailmatches': "",
+				})
+			except Exception as e:
+				self._logSys.info(
+					"Error unbanning IP %s for jail '%s' with action '%s': %s",
+					ip, self._jail.name, self.banaction, e,
+					exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG)
+			else:
+				self._logSys.info(
+					"Unbanned IP %s for jail '%s' with action '%s'",
+					ip, self._jail.name, self.banaction)
+			finally:
+				self._bannedips.remove(ip)
+
+	def start(self):
+		"""If `banaction` set, blacklists bad IPs.
+		"""
+		if self.banaction is not None:
+			self.update()
+
+	def update(self):
+		"""If `banaction` set, updates blacklisted IPs.
+
+		Queries badips.com for list of bad IPs, removing IPs from the
+		blacklist if no longer present, and adds new bad IPs to the
+		blacklist.
+		"""
+		if self.banaction is not None:
+			if self._timer:
+				self._timer.cancel()
+				self._timer = None
+
+			try:
+				ips = self.getList(
+					self.bancategory, self.score, self.age, self.bankey)
+				# Remove old IPs no longer listed
+				self._unbanIPs(self._bannedips - ips)
+				# Add new IPs which are now listed
+				self._banIPs(ips - self._bannedips)
+
+				self._logSys.info(
+					"Updated IPs for jail '%s'. Update again in %i seconds",
+					self._jail.name, self.updateperiod)
+			finally:
+				self._timer = threading.Timer(self.updateperiod, self.update)
+				self._timer.start()
+
+	def stop(self):
+		"""If `banaction` set, clears blacklisted IPs.
+		"""
+		if self.banaction is not None:
+			if self._timer:
+				self._timer.cancel()
+				self._timer = None
+			self._unbanIPs(self._bannedips.copy())
+
+	def ban(self, aInfo):
+		"""Reports banned IP to badips.com.
+
+		Parameters
+		----------
+		aInfo : dict
+			Dictionary which includes information in relation to
+			the ban.
+
+		Raises
+		------
+		HTTPError
+			Any issues with badips.com request.
+		"""
+		try:
+			url = "/".join([self._badips, "add", self.category, aInfo['ip']])
+			if self.key:
+				url = "?".join([url, urlencode({'key': self.key})])
+			response = urlopen(self._Request(url))
+		except HTTPError as response:
+			messages = json.loads(response.read().decode('utf-8'))
+			self._logSys.error(
+				"Response from badips.com report: '%s'",
+				messages['err'])
+			raise
+		else:
+			messages = json.loads(response.read().decode('utf-8'))
+			self._logSys.info(
+				"Response from badips.com report: '%s'",
+				messages['suc'])
+
+Action = BadIPsAction

config/action.d/blocklist_de.conf

@@ -7,13 +7,13 @@
 # Action to report IP address to blocklist.de
 # Blocklist.de must be signed up to at www.blocklist.de
 # Once registered, one or more servers can be added.
-# This action requires the server 'email address' and the assoicate apikey.
+# This action requires the server 'email address' and the associated apikey.
 #
 # From blocklist.de:
 #   www.blocklist.de is a free and voluntary service provided by a
 #   Fraud/Abuse-specialist, whose servers are often attacked on SSH-,
 #   Mail-Login-, FTP-, Webserver- and other services.
-#   The mission is to report all attacks to the abuse deparments of the
+#   The mission is to report all attacks to the abuse departments of the
 #   infected PCs/servers to ensure that the responsible provider can inform
 #   the customer about the infection and disable them
 #
@@ -25,7 +25,7 @@
 #   * The recidive where the IP has been banned multiple times
 #   * Where maxretry has been set quite high, beyond the normal user typing
 #     password incorrectly.
-#   * For filters that have a low likelyhood of receiving human errors
+#   * For filters that have a low likelihood of receiving human errors
 #
 
 [Definition]

config/action.d/cloudflare.conf

@@ -0,0 +1,55 @@
+#
+# Author: Mike Rushton
+#
+# Referenced from from http://www.normyee.net/blog/2012/02/02/adding-cloudflare-support-to-fail2ban by NORM YEE
+#
+# To get your Cloudflare API key: https://www.cloudflare.com/my-account
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart =
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop =
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck =
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = curl https://www.cloudflare.com/api_json.html -d 'a=ban' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = curl https://www.cloudflare.com/api_json.html -d 'a=nul' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
+
+
+[Init]
+
+# Default Cloudflare API token 
+cftoken = 
+
+# Default Cloudflare username
+cfuser = 

config/action.d/complain.conf

@@ -5,7 +5,7 @@
 # offending IP address.
 # This uses the https://abusix.com/contactdb.html to lookup abuse contacts.
 #
-# DEPENDANCIES:
+# DEPENDENCIES:
 # This requires the dig command from bind-utils
 #
 # You should provide the <logpath> in the jail config - lines from the log

config/action.d/firewallcmd-ipset.conf

@@ -14,7 +14,7 @@
 
 [INCLUDES]
 
-before = iptables-blocktype.conf
+before = iptables-common.conf
 
 [Definition]
 
@@ -31,22 +31,6 @@ actionunban = ipset del fail2ban-<name> <ip> -exist
 
 [Init]
 
-# Default name of the chain
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ]
-#
-protocol = tcp
-
 # Option:  chain
 # Notes    specifies the iptables chain to which the fail2ban rules should be
 #          added

config/action.d/firewallcmd-new.conf

@@ -4,42 +4,26 @@
 
 [INCLUDES]
 
-before = iptables-blocktype.conf
+before = iptables-common.conf
 
 [Definition]
 
-actionstart = firewall-cmd --direct --add-chain ipv4 filter fail2ban-<name>
-              firewall-cmd --direct --add-rule ipv4 filter fail2ban-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
+              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
 
-actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
-             firewall-cmd --direct --remove-rules ipv4 filter fail2ban-<name>
-             firewall-cmd --direct --remove-chain ipv4 filter fail2ban-<name>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
+             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
+             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
 
-actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q '^fail2ban-<name>$'
+actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q 'f2b-<name>$'
 
-actionban = firewall-cmd --direct --add-rule ipv4 filter fail2ban-<name> 0 -s <ip> -j <blocktype>
+actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
 
-actionunban = firewall-cmd --direct --remove-rule ipv4 filter fail2ban-<name> 0 -s <ip> -j <blocktype>
+actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
 
 [Init]
 
-# Default name of the chain
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ]
-#
-protocol = tcp
-
 # Option:  chain
 # Notes    specifies the iptables chain to which the fail2ban rules should be
 #          added

config/action.d/iptables-allports.conf

@@ -8,7 +8,7 @@
 
 [INCLUDES]
 
-before = iptables-blocktype.conf
+before = iptables-common.conf
 
 
 [Definition]
@@ -17,23 +17,23 @@ before = iptables-blocktype.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> -p <protocol> -j fail2ban-<name>
+actionstart = iptables -N f2b-<name>
+              iptables -A f2b-<name> -j RETURN
+              iptables -I <chain> -p <protocol> -j f2b-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D <chain> -p <protocol> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -X fail2ban-<name>
+actionstop = iptables -D <chain> -p <protocol> -j f2b-<name>
+             iptables -F f2b-<name>
+             iptables -X f2b-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -41,7 +41,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
+actionban = iptables -I f2b-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -49,22 +49,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>
+actionunban = iptables -D f2b-<name> -s <ip> -j <blocktype>
 
 [Init]
 
-# Default name of the chain
-#
-name = default
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
-#          added
-# Values:  STRING  Default: INPUT
-chain = INPUT

config/action.d/iptables-blocktype.conf

@@ -1,22 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Daniel Black
-#
-# This is a included configuration file and includes the defination for the blocktype
-# used in all iptables based actions by default.
-#
-# The user can override the default in iptables-blocktype.local
-
-[INCLUDES]
-
-after = iptables-blocktype.local
-
-[Init]
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp-port-unreachable
-

config/action.d/iptables-common.conf

@@ -0,0 +1,45 @@
+# Fail2Ban configuration file
+#
+# Author: Daniel Black
+#
+# This is a included configuration file and includes the definitions for the iptables
+# used in all iptables based actions by default.
+#
+# The user can override the defaults in iptables-common.local
+
+[INCLUDES]
+
+after = iptables-blocktype.local
+        iptables-common.local
+# iptables-blocktype.local is obsolete
+
+[Init]
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the Fail2Ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT
+
+# Default name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+blocktype = REJECT --reject-with icmp-port-unreachable

config/action.d/iptables-ipset-proto4.conf

@@ -19,7 +19,7 @@
 
 [INCLUDES]
 
-before = iptables-blocktype.conf
+before = iptables-common.conf
 
 [Definition]
 
@@ -27,16 +27,16 @@ before = iptables-blocktype.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipset --create fail2ban-<name> iphash
-              iptables -I INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
+actionstart = ipset --create f2b-<name> iphash
+              iptables -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
-             ipset --flush fail2ban-<name>
-             ipset --destroy fail2ban-<name>
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
+             ipset --flush f2b-<name>
+             ipset --destroy f2b-<name>
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -44,7 +44,7 @@ actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset --test fail2ban-<name> <ip> ||  ipset --add fail2ban-<name> <ip>
+actionban = ipset --test f2b-<name> <ip> ||  ipset --add f2b-<name> <ip>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -52,22 +52,7 @@ actionban = ipset --test fail2ban-<name> <ip> ||  ipset --add fail2ban-<name> <i
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipset --test fail2ban-<name> <ip> && ipset --del fail2ban-<name> <ip>
+actionunban = ipset --test f2b-<name> <ip> && ipset --del f2b-<name> <ip>
 
 [Init]
 
-# Default name of the ipset
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default: ssh
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp

config/action.d/iptables-ipset-proto6-allports.conf

@@ -15,8 +15,7 @@
 
 [INCLUDES]
 
-before = iptables-blocktype.conf
-
+before = iptables-common.conf
 
 [Definition]
 
@@ -24,16 +23,16 @@ before = iptables-blocktype.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
-              iptables -I INPUT -m set --match-set fail2ban-<name> src -j <blocktype>
+actionstart = ipset create f2b-<name> hash:ip timeout <bantime>
+              iptables -I <chain> -m set --match-set f2b-<name> src -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D INPUT -m set --match-set fail2ban-<name> src -j <blocktype>
-             ipset flush fail2ban-<name>
-             ipset destroy fail2ban-<name>
+actionstop = iptables -D <chain> -m set --match-set f2b-<name> src -j <blocktype>
+             ipset flush f2b-<name>
+             ipset destroy f2b-<name>
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -41,7 +40,7 @@ actionstop = iptables -D INPUT -m set --match-set fail2ban-<name> src -j <blockt
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist
+actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -49,16 +48,12 @@ actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipset del fail2ban-<name> <ip> -exist
+actionunban = ipset del f2b-<name> <ip> -exist
 
 [Init]
 
-# Default name of the ipset
-#
-name = default
-
 # Option: bantime
 # Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
 # Values:  [ NUM ]  Default: 600
-
+#
 bantime = 600

config/action.d/iptables-ipset-proto6.conf

@@ -15,8 +15,7 @@
 
 [INCLUDES]
 
-before = iptables-blocktype.conf
-
+before = iptables-common.conf
 
 [Definition]
 
@@ -24,16 +23,16 @@ before = iptables-blocktype.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
-              iptables -I INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
+actionstart = ipset create f2b-<name> hash:ip timeout <bantime>
+              iptables -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
-             ipset flush fail2ban-<name>
-             ipset destroy fail2ban-<name>
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
+             ipset flush f2b-<name>
+             ipset destroy f2b-<name>
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -41,7 +40,7 @@ actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist
+actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -49,28 +48,12 @@ actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipset del fail2ban-<name> <ip> -exist
+actionunban = ipset del f2b-<name> <ip> -exist
 
 [Init]
 
-# Default name of the ipset
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default: ssh
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
 # Option: bantime
 # Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
 # Values:  [ NUM ]  Default: 600
-
+#
 bantime = 600

config/action.d/iptables-multiport-log.conf

@@ -3,15 +3,15 @@
 # Author: Guido Bozzetto
 # Modified: Cyril Jaquier
 #
-# make "fail2ban-<name>" chain to match drop IP
-# make "fail2ban-<name>-log" chain to log and drop
-# insert a jump to fail2ban-<name> from -I <chain> if proto/port match
+# make "f2b-<name>" chain to match drop IP
+# make "f2b-<name>-log" chain to log and drop
+# insert a jump to f2b-<name> from -I <chain> if proto/port match
 #
 #
 
 [INCLUDES]
 
-before = iptables-blocktype.conf
+before = iptables-common.conf
 
 [Definition]
 
@@ -19,28 +19,28 @@ before = iptables-blocktype.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> 1 -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
-              iptables -N fail2ban-<name>-log
-              iptables -I fail2ban-<name>-log -j LOG --log-prefix "$(expr fail2ban-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
-              iptables -A fail2ban-<name>-log -j <blocktype>
+actionstart = iptables -N f2b-<name>
+              iptables -A f2b-<name> -j RETURN
+              iptables -I <chain> 1 -p <protocol> -m multiport --dports <port> -j f2b-<name>
+              iptables -N f2b-<name>-log
+              iptables -I f2b-<name>-log -j LOG --log-prefix "$(expr f2b-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
+              iptables -A f2b-<name>-log -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -F fail2ban-<name>-log
-             iptables -X fail2ban-<name>
-             iptables -X fail2ban-<name>-log
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
+             iptables -F f2b-<name>
+             iptables -F f2b-<name>-log
+             iptables -X f2b-<name>
+             iptables -X f2b-<name>-log
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L fail2ban-<name>-log >/dev/null
+actioncheck = iptables -n -L f2b-<name>-log >/dev/null
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -48,7 +48,7 @@ actioncheck = iptables -n -L fail2ban-<name>-log >/dev/null
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log
+actionban = iptables -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -56,28 +56,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j fail2ban-<name>-log
+actionunban = iptables -D f2b-<name> -s <ip> -j f2b-<name>-log
 
 [Init]
 
-# Default name of the chain
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
-#          added
-# Values:  STRING  Default: INPUT
-chain = INPUT

config/action.d/iptables-multiport.conf

@@ -6,7 +6,7 @@
 
 [INCLUDES]
 
-before = iptables-blocktype.conf
+before = iptables-common.conf
 
 [Definition]
 
@@ -14,23 +14,23 @@ before = iptables-blocktype.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+actionstart = iptables -N f2b-<name>
+              iptables -A f2b-<name> -j RETURN
+              iptables -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -X fail2ban-<name>
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
+             iptables -F f2b-<name>
+             iptables -X f2b-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -38,7 +38,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
+actionban = iptables -I f2b-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -46,28 +46,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>
+actionunban = iptables -D f2b-<name> -s <ip> -j <blocktype>
 
 [Init]
 
-# Default name of the chain
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
-#          added
-# Values:  STRING  Default: INPUT
-chain = INPUT

config/action.d/iptables-new.conf

@@ -8,8 +8,7 @@
 
 [INCLUDES]
 
-before = iptables-blocktype.conf
-
+before = iptables-common.conf
 
 [Definition]
 
@@ -17,23 +16,23 @@ before = iptables-blocktype.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+actionstart = iptables -N f2b-<name>
+              iptables -A f2b-<name> -j RETURN
+              iptables -I <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -X fail2ban-<name>
+actionstop = iptables -D <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
+             iptables -F f2b-<name>
+             iptables -X f2b-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -41,7 +40,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
+actionban = iptables -I f2b-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -49,28 +48,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>
+actionunban = iptables -D f2b-<name> -s <ip> -j <blocktype>
 
 [Init]
 
-# Default name of the chain
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
-#          added
-# Values:  STRING  Default: INPUT
-chain = INPUT

config/action.d/iptables-xt_recent-echo.conf

@@ -6,8 +6,7 @@
 
 [INCLUDES]
 
-before = iptables-blocktype.conf
-
+before = iptables-common.conf
 
 [Definition]
 
@@ -23,30 +22,30 @@ before = iptables-blocktype.conf
 # iptables-persistent package).
 # 
 # Explanation of the rule below:
-#    Check if any packets coming from an IP on the fail2ban-<name>
+#    Check if any packets coming from an IP on the f2b-<name>
 #    list have been seen in the last 3600 seconds. If yes, update the
 #    timestamp for this IP and drop the packet. If not, let the packet
 #    through.
 #
-#    Fail2ban inserts blacklisted hosts into the fail2ban-<name> list
+#    Fail2ban inserts blacklisted hosts into the f2b-<name> list
 #    and removes them from the list after some time, according to its
 #    own rules. The 3600 second timeout is independent and acts as a
 #    safeguard in case the fail2ban process dies unexpectedly. The
 #    shorter of the two timeouts actually matters.
-actionstart = if [ `id -u` -eq 0 ];then iptables -I INPUT -m recent --update --seconds 3600 --name fail2ban-<name> -j <blocktype>;fi
+actionstart = if [ `id -u` -eq 0 ];then iptables -I <chain> -m recent --update --seconds 3600 --name f2b-<name> -j <blocktype>;fi
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = echo / > /proc/net/xt_recent/fail2ban-<name>
-             if [ `id -u` -eq 0 ];then iptables -D INPUT -m recent --update --seconds 3600 --name fail2ban-<name> -j <blocktype>;fi
+actionstop = echo / > /proc/net/xt_recent/f2b-<name>
+             if [ `id -u` -eq 0 ];then iptables -D <chain> -m recent --update --seconds 3600 --name f2b-<name> -j <blocktype>;fi
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = test -e /proc/net/xt_recent/fail2ban-<name>
+actioncheck = test -e /proc/net/xt_recent/f2b-<name>
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -54,7 +53,7 @@ actioncheck = test -e /proc/net/xt_recent/fail2ban-<name>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = echo +<ip> > /proc/net/xt_recent/fail2ban-<name>
+actionban = echo +<ip> > /proc/net/xt_recent/f2b-<name>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -62,16 +61,7 @@ actionban = echo +<ip> > /proc/net/xt_recent/fail2ban-<name>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = echo -<ip> > /proc/net/xt_recent/fail2ban-<name>
+actionunban = echo -<ip> > /proc/net/xt_recent/f2b-<name>
 
 [Init]
 
-# Default name of the chain
-#
-name = default
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp

config/action.d/iptables.conf

@@ -6,7 +6,7 @@
 
 [INCLUDES]
 
-before = iptables-blocktype.conf
+before = iptables-common.conf
 
 [Definition]
 
@@ -14,23 +14,23 @@ before = iptables-blocktype.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> -p <protocol> --dport <port> -j fail2ban-<name>
+actionstart = iptables -N f2b-<name>
+              iptables -A f2b-<name> -j RETURN
+              iptables -I <chain> -p <protocol> --dport <port> -j f2b-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D <chain> -p <protocol> --dport <port> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -X fail2ban-<name>
+actionstop = iptables -D <chain> -p <protocol> --dport <port> -j f2b-<name>
+             iptables -F f2b-<name>
+             iptables -X f2b-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -38,7 +38,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
+actionban = iptables -I f2b-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -46,28 +46,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>
+actionunban = iptables -D f2b-<name> -s <ip> -j <blocktype>
 
 [Init]
 
-# Default name of the chain
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
-#          added
-# Values:  STRING  Default: INPUT
-chain = INPUT

config/action.d/sendmail-common.conf

@@ -8,6 +8,56 @@
 
 after = sendmail-common.local
 
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
+              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+              From: <sendername> <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
+             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+             From: <sendername> <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = 
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = 
+
 [Init]
 
 # Recipient mail address

config/action.d/sendmail-whois-ipjailmatches.conf

@@ -0,0 +1,37 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+#
+
+[INCLUDES]
+
+before = sendmail-common.conf
+
+[Definition]
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+            From: <sendername> <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n
+            `/usr/bin/whois <ip>`\n\n
+            Matches for <name> with <ipjailfailures> failures IP:<ip>\n
+            <ipjailmatches>\n\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+[Init]
+
+# Default name of the chain
+#
+name = default

config/action.d/sendmail-whois-ipmatches.conf

@@ -0,0 +1,37 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+#
+
+[INCLUDES]
+
+before = sendmail-common.conf
+
+[Definition]
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+            From: <sendername> <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n
+            `/usr/bin/whois <ip>`\n\n
+            Matches with <ipfailures> failures IP:<ip>\n
+            <ipmatches>\n\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+[Init]
+
+# Default name of the chain
+#
+name = default

config/action.d/sendmail-whois-lines.conf

@@ -10,38 +10,6 @@ before = sendmail-common.conf
 
 [Definition]
 
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
-              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-              From: <sendername> <<sender>>
-              To: <dest>\n
-              Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
-             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-             From: <sendername> <<sender>>
-             To: <dest>\n
-             Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -62,14 +30,6 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Regards,\n
             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = 
-
 [Init]
 
 # Default name of the chain

config/action.d/sendmail-whois-matches.conf

@@ -0,0 +1,37 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+#
+
+[INCLUDES]
+
+before = sendmail-common.conf
+
+[Definition]
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+            From: <sendername> <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n
+            `/usr/bin/whois <ip>`\n\n
+            Matches:\n
+            <matches>\n\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+[Init]
+
+# Default name of the chain
+#
+name = default

config/action.d/sendmail-whois.conf

@@ -10,38 +10,6 @@ before = sendmail-common.conf
 
 [Definition]
 
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
-              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-              From: <sendername> <<sender>>
-              To: <dest>\n
-              Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
-             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-             From: <sendername> <<sender>>
-             To: <dest>\n
-             Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -60,14 +28,6 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Regards,\n
             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = 
-
 [Init]
 
 # Default name of the chain

config/action.d/sendmail.conf

@@ -10,38 +10,6 @@ before = sendmail-common.conf
 
 [Definition]
 
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
-              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-              From: <sendername> <<sender>>
-              To: <dest>\n
-              Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
-             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-             From: <sendername> <<sender>>
-             To: <dest>\n
-             Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -58,14 +26,6 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Regards,\n
             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = 
-
 [Init]
 
 # Default name of the chain

config/action.d/shorewall.conf

@@ -9,7 +9,9 @@
 # connections. So if the attempter goes on trying using the same connection
 # he could even log in. In order to get the same behavior of the iptable
 # action (so that the ban is immediate) the /etc/shorewall/shorewall.conf
-# file should me modified with "BLACKLISTNEWONLY=No".
+# file should me modified with "BLACKLISTNEWONLY=No". Note that as of
+# Shorewall 4.5.13 BLACKLISTNEWONLY is deprecated; however the equivalent
+# of BLACKLISTNEWONLY=No can now be achieved by setting BLACKLIST="ALL".
 # 
 
 [Definition]

config/action.d/smtp.py

@@ -0,0 +1,224 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+import socket
+import smtplib
+from email.mime.text import MIMEText
+from email.utils import formatdate, formataddr
+
+from fail2ban.server.actions import ActionBase, CallingMap
+
+messages = {}
+messages['start'] = \
+"""Hi,
+
+The jail %(jailname)s has been started successfully.
+
+Regards,
+Fail2Ban"""
+
+messages['stop'] = \
+"""Hi,
+
+The jail %(jailname)s has been stopped.
+
+Regards,
+Fail2Ban"""
+
+messages['ban'] = {}
+messages['ban']['head'] = \
+"""Hi,
+
+The IP %(ip)s has just been banned for %(bantime)i seconds
+by Fail2Ban after %(failures)i attempts against %(jailname)s.
+"""
+messages['ban']['tail'] = \
+"""
+Regards,
+Fail2Ban"""
+messages['ban']['matches'] = \
+"""
+Matches for this ban:
+%(matches)s
+"""
+messages['ban']['ipmatches'] = \
+"""
+Matches for %(ip)s:
+%(ipmatches)s
+"""
+messages['ban']['ipjailmatches'] = \
+"""
+Matches for %(ip)s for jail %(jailname)s:
+%(ipjailmatches)s
+"""
+
+class SMTPAction(ActionBase):
+	"""Fail2Ban action which sends emails to inform on jail starting,
+	stopping and bans.
+	"""
+
+	def __init__(
+		self, jail, name, host="localhost", user=None, password=None,
+		sendername="Fail2Ban", sender="fail2ban", dest="root", matches=None):
+		"""Initialise action.
+
+		Parameters
+		----------
+		jail : Jail
+			The jail which the action belongs to.
+		name : str
+			Named assigned to the action.
+		host : str, optional
+			SMTP host, of host:port format. Default host "localhost" and
+			port "25"
+		user : str, optional
+			Username used for authentication with SMTP server.
+		password : str, optional
+			Password used for authentication with SMTP server.
+		sendername : str, optional
+			Name to use for from address in email. Default "Fail2Ban".
+		sender : str, optional
+			Email address to use for from address in email.
+			Default "fail2ban".
+		dest : str, optional
+			Email addresses of intended recipient(s) in comma space ", "
+			delimited format. Default "root".
+		matches : str, optional
+			Type of matches to be included from ban in email. Can be one
+			of "matches", "ipmatches" or "ipjailmatches". Default None
+			(see man jail.conf.5).
+		"""
+
+		super(SMTPAction, self).__init__(jail, name)
+
+		self.host = host
+		#TODO: self.ssl = ssl
+
+		self.user = user
+		self.password =password
+
+		self.fromname = sendername
+		self.fromaddr = sender
+		self.toaddr = dest
+
+		self.matches = matches
+
+		self.message_values = CallingMap(
+			jailname = self._jail.name,
+			hostname = socket.gethostname,
+			bantime = self._jail.actions.getBanTime,
+			)
+
+	def _sendMessage(self, subject, text):
+		"""Sends message based on arguments and instance's properties.
+
+		Parameters
+		----------
+		subject : str
+			Subject of the email.
+		text : str
+			Body of the email.
+
+		Raises
+		------
+		SMTPConnectionError
+			Error on connecting to host.
+		SMTPAuthenticationError
+			Error authenticating with SMTP server.
+		SMTPException
+			See Python `smtplib` for full list of other possible
+			exceptions.
+		"""
+		msg = MIMEText(text)
+		msg['Subject'] = subject
+		msg['From'] = formataddr((self.fromname, self.fromaddr))
+		msg['To'] = self.toaddr
+		msg['Date'] = formatdate()
+
+		smtp = smtplib.SMTP()
+		try:
+			self._logSys.debug("Connected to SMTP '%s', response: %i: %s",
+				self.host, *smtp.connect(self.host))
+			if self.user and self.password:
+				smtp.login(self.user, self.password)
+			failed_recipients = smtp.sendmail(
+				self.fromaddr, self.toaddr.split(", "), msg.as_string())
+		except smtplib.SMTPConnectError:
+			self._logSys.error("Error connecting to host '%s'", self.host)
+			raise
+		except smtplib.SMTPAuthenticationError:
+			self._logSys.error(
+				"Failed to authenticate with host '%s' user '%s'",
+				self.host, self.user)
+			raise
+		except smtplib.SMTPException:
+			self._logSys.error(
+				"Error sending mail to host '%s' from '%s' to '%s'",
+				self.host, self.fromaddr, self.toaddr)
+			raise
+		else:
+			if failed_recipients:
+				self._logSys.warning(
+					"Email to '%s' failed to following recipients: %r",
+					self.toaddr, failed_recipients)
+			self._logSys.debug("Email '%s' successfully sent", subject)
+		finally:
+			try:
+				self._logSys.debug("Disconnected from '%s', response %i: %s",
+					self.host, *smtp.quit())
+			except smtplib.SMTPServerDisconnected:
+				pass # Not connected
+
+	def start(self):
+		"""Sends email to recipients informing that the jail has started.
+		"""
+		self._sendMessage(
+			"[Fail2Ban] %(jailname)s: started on %(hostname)s" %
+				self.message_values,
+			messages['start'] % self.message_values)
+
+	def stop(self):
+		"""Sends email to recipients informing that the jail has stopped.
+		"""
+		self._sendMessage(
+			"[Fail2Ban] %(jailname)s: stopped on %(hostname)s" %
+				self.message_values,
+			messages['stop'] % self.message_values)
+
+	def ban(self, aInfo):
+		"""Sends email to recipients informing that ban has occurred.
+
+		Parameters
+		----------
+		aInfo : dict
+			Dictionary which includes information in relation to
+			the ban.
+		"""
+		aInfo.update(self.message_values)
+		message = "".join([
+			messages['ban']['head'],
+			messages['ban'].get(self.matches, ""),
+			messages['ban']['tail']
+			])
+		self._sendMessage(
+			"[Fail2Ban] %(jailname)s: banned %(ip)s from %(hostname)s" %
+				aInfo,
+			message % aInfo)
+
+Action = SMTPAction

config/action.d/symbiosis-blacklist-allports.conf

@@ -0,0 +1,52 @@
+# Fail2Ban configuration file for Bytemark Symbiosis firewall
+#
+# Author: Yaroslav Halchenko
+#
+
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart =
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop =
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L <chain>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP.
+# Values:  CMD
+#
+actionban = echo 'all' >| /etc/symbiosis/firewall/blacklist.d/<ip>.auto
+            iptables -I <chain> 1 -s <ip> -j <blocktype>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP.
+# Values:  CMD
+#
+actionunban = rm -f /etc/symbiosis/firewall/blacklist.d/<ip>.auto
+              iptables -D <chain> -s <ip> -j <blocktype> || :
+
+[Init]
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added to.  blacklist is a chain initiated by symbiosis firewall.
+# Values:  STRING  Default: blacklist
+chain = blacklist
+
+# Option:  blocktype
+# Note:    This is to match default symbiosis firewall type for blacklisted IPs
+# Values:  STRING
+blocktype = DROP

config/action.d/ufw.conf

@@ -1,9 +1,9 @@
 # Fail2Ban action configuration file for ufw
 #
-# You are required to run "ufw enable" before this will have an effect.
+# You are required to run "ufw enable" before this will have any effect.
 #
-# The insert position should be approprate to block the required traffic.
-# A number after an allow rule to the application won't be much use.
+# The insert position should be appropriate to block the required traffic.
+# A number after an allow rule to the application won't be of much use.
 
 [Definition]
 
@@ -19,7 +19,7 @@ actionunban = [ -n "<application>" ] && app="app <application>" ; ufw delete <bl
 
 [Init]
 # Option: insertpos
-# Notes.:  The postition number in the firewall list to insert the block rule
+# Notes.:  The position number in the firewall list to insert the block rule
 insertpos = 1
 
 # Option: blocktype

config/action.d/xarf-login-attack.conf

@@ -0,0 +1,124 @@
+# Fail2Ban action for sending xarf Login-Attack messages to IP owner
+#
+# IMPORTANT: 
+# 
+# Emailing a IP owner of abuse is a serious complain. Make sure that it is
+# serious. Fail2ban developers and network owners recommend you only use this
+# action for:
+#   * The recidive where the IP has been banned multiple times
+#   * Where maxretry has been set quite high, beyond the normal user typing
+#     password incorrectly.
+#   * For filters that have a low likelihood of receiving human errors
+#
+# DEPENDENCIES:
+#
+# This requires the dig command from bind-utils
+#
+# This uses the https://abusix.com/contactdb.html to lookup abuse contacts.
+#
+# XARF is a specification for sending a formatted response
+# for non-messaging based abuse including:
+#
+# Login-Attack, Malware-Attack, Fraud (Phishing, etc.), Info DNSBL
+#
+# For details see:
+# https://github.com/abusix/xarf-specification
+# http://www.x-arf.org/schemata.html
+#
+# Author: Daniel Black
+# Based on complain written by Russell Odom <russ@gloomytrousers.co.uk>
+#
+#
+
+[Definition]
+
+actionstart =
+
+actionstop =
+
+actioncheck =
+
+actionban = oifs=${IFS}; IFS=.;SEP_IP=( <ip> ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs}
+            IP=<ip>
+            FROM=<sender>
+            SERVICE=<service>
+            FAILURES=<failures>
+            REPORTID=<time>@`uname -n`
+            TLP=<tlp>
+            PORT=<port>
+            DATE=`LC_TIME=C date -u --date=@<time> +"%%a, %%d %%h %%Y %%T +0000"`
+            if [ ! -z "$ADDRESSES" ]; then
+                (printf -- %%b "<header>\n<message>\n<report>\n";
+                 date '+Note: Local timezone is %%z (%%Z)';
+                 printf -- %%b "<ipmatches>\n\n<footer>") | <mailcmd> <mailargs> ${ADDRESSES//,/\" \"}
+            fi
+
+actionunban =
+
+[Init]
+# Option: header
+# Notes:  This is really a fixed value
+header  = Subject: abuse report about $IP - $DATE\nAuto-Submitted: auto-generated\nX-XARF: PLAIN\nContent-Transfer-Encoding: 7bit\nContent-Type: multipart/mixed; charset=utf8;\n  boundary=Abuse-bfbb0f920793ac03cb8634bde14d8a1e;\n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8;\n
+
+# Option: footer
+# Notes:  This is really a fixed value and needs to match the report and header
+#         mime delimiters
+footer = \n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e--
+
+# Option: report
+# Notes:  Intended to be fixed
+report =  --Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8; name=\"report.txt\";\n\n---\nReported-From: $FROM\nCategory: abuse\nReport-ID: $REPORTID\nReport-Type: login-attack\nService: $SERVICE\nVersion: 0.2\nUser-Agent: Fail2ban v0.9\nDate: $DATE\nSource-Type: ip-address\nSource: $IP\nPort: $PORT\nSchema-URL: http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json\nAttachment: text/plain\nOccurances: $FAILURES\nTLP: $TLP\n\n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf8; name=\"logfile.log\";
+
+# Option: Message
+# Notes:  This can be modified by the users 
+message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to abusix.com is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process.)\n\n This mail was generated by Fail2Ban in a X-ARF format! You can find more information about x-arf at http://www.x-arf.org/specification.html.\n\nThe recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here: https://abusix.com/global-reporting/abuse-contact-db\nabusix.com is neither responsible nor liable for the content or accuracy of this message.\n
+
+# Option:  loglines
+# Notes.:  The number of log lines to search for the IP for the report
+loglines = 9000
+
+# Option:  mailcmd
+# Notes.:  Your system mail command. It is passed the recipient
+# Values:  CMD
+#
+mailcmd =  /usr/sbin/sendmail
+
+# Option:  mailargs
+# Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
+#          CC reports to another address:
+#              -c me@example.com
+#          Appear to come from a different address - the '--' indicates
+#          arguments to be passed to Sendmail:
+#              -- -f me@example.com
+# Values:  [ STRING ]
+#
+mailargs = -f <sender>
+
+# Option:  tlp
+# Notes.:  Traffic light protocol defining the sharing of this information.
+#          http://www.trusted-introducer.org/ISTLPv11.pdf
+#          green is share to those involved in network security but it is not 
+#          to be released to the public.
+tlp = green
+
+# ALL of the following parameters should be set so the report contains
+# meaningful information
+
+# Option: service
+# Notes.: This is the service type that was attacked. e.g. ssh, pop3
+service = unspecified
+
+# Option:  logpath
+# Notes:   Path to the log files which contain relevant lines for the abuser IP
+# Values:  Filename(s) space separated and can contain wildcards (these are
+#          greped for the IP so make sure these aren't too long
+logpath = /dev/null
+
+# Option:  sender
+# Notes.:  This is the sender that is included in the XARF report
+sender = fail2ban@`uname -n`
+
+# Option:  port
+# Notes.:  This is the port number that received the login-attack
+port = 0
+

config/fail2ban.conf

@@ -6,20 +6,22 @@
 #           file, but provide customizations in fail2ban.local file, e.g.:
 #
 # [Definition]
-# loglevel = 4
+# loglevel = DEBUG
 #
 
 [Definition]
 
 # Option: loglevel
 # Notes.: Set the log level output.
-#         1 = ERROR
-#         2 = WARN
-#         3 = INFO
-#         4 = DEBUG
-# Values: [ NUM ]  Default: 1
+#         CRITICAL
+#         ERROR
+#         WARNING
+#         NOTICE
+#         INFO
+#         DEBUG
+# Values: [ LEVEL ]  Default: ERROR
 #
-loglevel = 3
+loglevel = INFO
 
 # Option: logtarget
 # Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
@@ -47,3 +49,15 @@ socket = /var/run/fail2ban/fail2ban.sock
 #
 pidfile = /var/run/fail2ban/fail2ban.pid
 
+# Options: dbfile
+# Notes.: Set the file for the fail2ban persistent data to be stored.
+#         A value of ":memory:" means database is only stored in memory 
+#         and data is lost when fail2ban is stopped.
+#         A value of "None" disables the database.
+# Values: [ None :memory: FILE ] Default: /var/lib/fail2ban/fail2ban.sqlite3
+dbfile = /var/lib/fail2ban/fail2ban.sqlite3
+
+# Options: dbpurgeage
+# Notes.: Sets age at which bans should be purged from the database
+# Values: [ SECONDS ] Default: 86400 (24hours)
+dbpurgeage = 86400

config/filter.d/apache-botsearch.conf

@@ -0,0 +1,48 @@
+# Fail2Ban filter to match web requests for selected URLs that don't exist
+#
+# This filter is aimed at blocking specific URLs that don't exist. This
+# could be a set of URLs places in a Disallow: directive in robots.txt or
+# just some web services that don't exist caused bots are searching for
+# exploitable content. This filter is designed to have a low false postitive
+# rate due.
+#
+# An alternative to this is the apache-noscript filter which blocks all
+# types of scripts that don't exist.
+#
+#
+# This is normally a predefined list of exploitable or valuable web services
+# that are hidden or aren't actually installed.
+#
+
+[INCLUDES]
+
+# overwrite with apache-common.local if _apache_error_client is incorrect.
+before = apache-common.conf
+
+[Definition]
+
+failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): <webroot><block>(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s script '<webroot><block>' not found or unable to stat(, referer: \S+)?\s*$
+
+ignoreregex = 
+
+
+[Init]
+
+# Webroot represents the webroot on which all other files are based
+webroot = /var/www/
+# Block is the actual non-found directories to block
+block = (<webmail>|<phpmyadmin>|<wordpress>)[^,]*
+
+# These are just convient definitions that assist the blocking of stuff that 
+# isn't installed
+webmail = roundcube|(ext)?mail|horde|(v-?)?webmail
+
+phpmyadmin = (typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin)
+
+wordpress = wp-(login|signup)\.php
+
+
+# DEV Notes:
+#
+# Author: Daniel Black

config/filter.d/apache-common.conf

@@ -8,7 +8,7 @@ after = apache-common.local
 
 [DEFAULT]
 
-_apache_error_client = \[[^]]*\] \[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]
+_apache_error_client = \[\] \[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]
 
 # Common prefix for [error] apache messages which also would include <HOST>
 # Depending on the version it could be

config/filter.d/apache-noscript.conf

@@ -1,5 +1,13 @@
 # Fail2Ban filter to block web requests for scripts (on non scripted websites)
 #
+# This matches many types of scripts that don't exist. This could generate a
+# lot of false positive matches in cases like wikis and forums where users
+# no affiliated with the website can insert links to missing files/scripts into
+# pages and cause non-malicious browsers of the site to trigger against this
+# filter.
+#
+# If you'd like to match specific URLs that don't exist see the
+# apache-botsearch filter.
 #
 
 [INCLUDES]
@@ -19,6 +27,6 @@ ignoreregex =
 #
 # https://wiki.apache.org/httpd/ListOfErrors for apache error IDs
 #
-# Second regex, script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat\s*$ is Before http-2.2
+# Second regex, script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat\s*$ is in httpd-2.2
 #
 # Author: Cyril Jaquier

config/filter.d/counter-strike.conf

@@ -0,0 +1,16 @@
+# Fail2Ban filter for failure attempts in Counter Strike-1.6
+#
+#
+
+[Definition]
+
+failregex = ^: Bad Rcon: "rcon \d+ "\S+"  sv_contact ".*?"" from "<HOST>:\d+"$
+
+
+[Init]
+
+datepattern = ^L %%d/%%m/%%Y - %%H:%%M:%%S
+
+
+# Author: Daniel Black
+

config/filter.d/courier-smtp.conf

@@ -12,7 +12,8 @@ before = common.conf
 
 _daemon = courieresmtpd
 
-failregex = ^%(__prefix_line)serror,relay=<HOST>,.*: 550 User unknown\.$
+failregex = ^%(__prefix_line)serror,relay=<HOST>,.*: 550 User (<.*> )?unknown\.?$
+            ^%(__prefix_line)serror,relay=<HOST>,msg="535 Authentication failed\.",cmd:( AUTH \S+)?( [0-9a-zA-Z\+/=]+)?$
 
 ignoreregex = 
 

config/filter.d/cyrus-imap.conf

@@ -11,9 +11,9 @@ before = common.conf
 
 [Definition]
 
-_daemon = (?:cyrus/)?(?:imapd?|pop3d?)
+_daemon = (?:cyrus/)?(?:imap(d|s)?|pop3(d|s)?)
 
-failregex = ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] \S+ .*?\[?SASL\(-13\): authentication failure: .*\]?$
+failregex = ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] \S+ .*?\[?SASL\(-13\): (authentication failure|user not found): .*\]?$
 
 ignoreregex = 
 

config/filter.d/directadmin.conf

@@ -0,0 +1,23 @@
+# Fail2Ban configuration file for Directadmin
+#
+#
+#
+
+[INCLUDES]
+
+before = common.conf
+
+[Definition]
+
+failregex = ^: \'<HOST>\' \d{1,3} failed login attempt(s)?. \s*
+
+ignoreregex = 
+
+[Init]
+datepattern = ^%%Y:%%m:%%d-%%H:%%M:%%S
+
+#
+# Requires Directadmin v1.45.3 or higher. http://www.directadmin.com/features.php?id=1590
+#
+# Author: Cyril Roos
+

config/filter.d/dovecot.conf

@@ -15,11 +15,15 @@ failregex = ^%(__prefix_line)s(pam_unix(\(dovecot:auth\))?:)?\s+authentication f
 
 ignoreregex = 
 
+[Init]
+
+journalmatch = _SYSTEMD_UNIT=dovecot.service
+
 # DEV Notes:
 # * the first regex is essentially a copy of pam-generic.conf
 # * Probably doesn't do dovecot sql/ldap backends properly
 # * Removed the 'no auth attempts' log lines from the matches because produces
-#    lots of false positives on misconfigured MTAs making regexp unuseable
+#    lots of false positives on misconfigured MTAs making regexp unusable
 #
 # Author: Martin Waschbuesch
 #         Daniel Black (rewrote with begin and end anchors)

config/filter.d/ejabberd-auth.conf

@@ -16,4 +16,22 @@
 #          searched for other failures. This tag can be used multiple times.
 # Values:  TEXT
 #
-failregex = ^(?:\.\d+)? \[info\] <0\.\d+\.\d>@ejabberd_c2s:wait_for_feature_request:\d+ \([^\)]+\) Failed authentication for \S+ from IP <HOST>$
+failregex = ^=INFO REPORT====  ===\nI\(<0\.\d+\.0>:ejabberd_c2s:\d+\) : \([^)]+\) Failed authentication for .+ from IP <HOST> \({{(?:\d+,){3}\d+},\d+}\)$
+            ^(?:\.\d+)? \[info\] <0\.\d+\.\d>@ejabberd_c2s:wait_for_feature_request:\d+ \([^\)]+\) Failed authentication for \S+ from IP <HOST>$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
+
+[Init]
+
+# "maxlines" is number of log lines to buffer for multi-line regex searches
+maxlines = 2
+
+# Option:  journalmatch
+# Notes.:  systemd journalctl style match filter for journal based backend
+# Values:  TEXT
+#
+journalmatch = 

config/filter.d/exim-spam.conf

@@ -1,6 +1,22 @@
 # Fail2Ban filter for exim the spam rejection messages
 #
-## For the SA: Action: silently tossed message... to be logged exim's SAdevnull option needs to be used.
+# Honeypot traps are very useful for fighting spam. You just activate an email
+# address on your domain that you do not intend to use at all, and that normal
+# people do not risk to try for contacting you. It may be something that 
+# spammers often test. You can also hide the address on a web page to be picked
+# by spam spiders. Or simply parse your mail logs for an invalid address 
+# already being frequently targeted by spammers. Enable the address and 
+# redirect it to the blackhole. In Exim's alias file, you would add the 
+# following line (assuming the address is honeypot@yourdomain.com):
+#
+# honeypot:  :blackhole:
+#
+# For the SA: Action: silently tossed message... to be logged exim's SAdevnull option needs to be used.
+#
+# To this filter use the jail.local should contain in the right jail:
+#
+# filter = exim-spam[honeypot=honeypot@yourdomain.com]
+#
 
 [INCLUDES]
 
@@ -13,10 +29,20 @@ before = exim-common.conf
 failregex =  ^%(pid)s \S+ F=(<>|\S+@\S+) %(host_info)srejected by local_scan\(\): .{0,256}$
              ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: .*dnsbl.*\s*$
              ^%(pid)s \S+ %(host_info)sF=(<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$
+             ^%(pid)s \S+ SA: Action: flagged as Spam but accepted: score=\d+\.\d+ required=\d+\.\d+ \(scanned in \d+/\d+ secs \| Message-Id: \S+\)\. From \S+ \(host=\S+ \[<HOST>\]\) for <honeypot>$
              ^%(pid)s \S+ SA: Action: silently tossed message: score=\d+\.\d+ required=\d+\.\d+ trigger=\d+\.\d+ \(scanned in \d+/\d+ secs \| Message-Id: \S+\)\. From \S+ \(host=(\S+ )?\[<HOST>\]\) for \S+$
 
 ignoreregex = 
 
+[Init]
+
+# Option:  honeypot
+# Notes.:  honeypot is an email address that isn't published anywhere that a
+#          legitimate email sender would send email too.
+# Values:  email address
+
+honeypot = trap@example.com
+
 # DEV Notes:
 # The %(host_info) defination contains a <HOST> match
 #

config/filter.d/guacamole.conf

@@ -0,0 +1,22 @@
+# Fail2Ban configuration file for guacamole
+#
+# Author: Steven Hiscocks
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = ^.*\nWARNING: Authentication attempt from <HOST> for user "[^"]*" failed\.$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
+
+[Init]
+# "maxlines" is number of log lines to buffer for multi-line regex searches
+maxlines = 2

config/filter.d/kerio.conf

@@ -0,0 +1,17 @@
+# Fail2ban filter for kerio
+
+[Definition]
+
+failregex = ^ SMTP Spam attack detected from <HOST>,
+            ^ IP address <HOST> found in DNS blacklist \S+, mail from \S+ to \S+$
+            ^ Relay attempt from IP address <HOST>
+            ^ Attempt to deliver to unknown recipient \S+, from \S+, IP address <HOST>$
+[Init]
+
+datepattern = ^\[%%d/%%b/%%Y %%H:%%M:%%S\]
+
+# DEV NOTES:
+# 
+# Author: A.P. Lawrence
+#
+# Based off: http://aplawrence.com/Kerio/fail2ban.html

config/filter.d/monit.conf

@@ -0,0 +1,9 @@
+# Fail2Ban filter for monit.conf, looks for failed access attempts
+#
+#
+
+[Definition]
+
+failregex = ^\[[A-Z]+\s+\]\s*error\s*:\s*Warning:\s+Client '<HOST>' supplied unknown user '\w+' accessing monit httpd$
+            ^\[[A-Z]+\s+\]\s*error\s*:\s*Warning:\s+Client '<HOST>' supplied wrong password for user '\w+' accessing monit httpd$
+

config/filter.d/named-refused.conf

@@ -34,15 +34,13 @@ __daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)
 # this can be optional (for instance if we match named native log files)
 __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
 
-failregex = ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
-            ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
-            ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$
+failregex = ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
+            ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
+            ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$
 
 # DEV Notes:
 # Trying to generalize the
 #          structure which is general to capture general patterns in log
 #          lines to cover different configurations/distributions
 #          
-# (\.\d+)? is a really ugly catch of the microseconds not captured in the date detector
-#
 # Author: Yaroslav Halchenko

config/filter.d/nginx-http-auth.conf

@@ -4,7 +4,7 @@
 [Definition]
 
 
-failregex = ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (password mismatch|was not found in ".*"), client: <HOST>, server: \S+, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"\s*$
+failregex = ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (password mismatch|was not found in ".*"), client: <HOST>, server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(, referrer: "\S+")?\s*$
 
 ignoreregex = 
 

config/filter.d/oracleims.conf

@@ -0,0 +1,61 @@
+# Fail2Ban configuration file
+# for Oracle IMS with XML logging
+#
+# Author: Joel Snyder/jms@opus1.com/2014-June-01
+#
+#
+
+
+[INCLUDES]
+
+# Read common prefixes.
+# If any customizations available -- read them from
+# common.local
+before = common.conf
+
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages
+# in the logfile. The host must be matched by a
+# group named "host". The tag "<HOST>" can
+# be used for standard IP/hostname matching and is
+# only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values:  TEXT
+#
+#
+# CONFIGURATION REQUIREMENTS FOR ORACLE IMS v6 and ABOVE:
+#
+# In OPTION.DAT you must have LOG_FORMAT=4 and
+#  bit 5 of LOG_CONNECTION must be set. 
+#
+# Many of these sub-fields are optional and can be turned on and off
+# by the system manager.  We need the "tr" field
+#  (transport information (present if bit 5 of LOG_CONNECTION is
+# set and transport information is available)).
+# "di" should be there by default if you have LOG_FORMAT=4.
+# Do not use "mi" as this is not included by default.
+#
+# Typical line IF YOU ARE USING TAGGING ! ! ! is:
+# <co ts="2014-06-02T09:45:50.29" pi="123f.3f8.4397"
+# sc="tcp_local" dr="+" ac="U"
+# tr="TCP|192.245.12.223|25|151.1.71.144|59762" ap="SMTP"
+# mi="Bad password"
+# us="01ko8hqnoif09qx0np@imap.opus1.com"
+# di="535 5.7.8 Bad username or password (Authentication failed)."/>
+# Format is generally documented in the PORT_ACCESS mapping 
+# at http://docs.oracle.com/cd/E19563-01/819-4428/bgaur/index.html
+#
+# All that would be on one line.
+# Note that you MUST have LOG_FORMAT=4 for this to work!
+#
+
+failregex = ^.*tr="[A-Z]+\|[0-9.]+\|\d+\|<HOST>\|\d+" ap="[^"]*" mi="Bad password" us="[^"]*" di="535 5.7.8 Bad username or password( \(Authentication failed\))?\."/>$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex =

config/filter.d/postfix-sasl.conf

@@ -11,4 +11,9 @@ _daemon = postfix/smtpd
 
 failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$
 
+[Init]
+
+journalmatch = _SYSTEMD_UNIT=postfix.service
+
+
 # Author: Yaroslav Halchenko

config/filter.d/postfix.conf

@@ -19,4 +19,8 @@ failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7
 
 ignoreregex = 
 
+[Init]
+
+journalmatch = _SYSTEMD_UNIT=postfix.service
+
 # Author: Cyril Jaquier

config/filter.d/pure-ftpd.conf

@@ -15,7 +15,7 @@ before = common.conf
 _daemon = pure-ftpd
 
 # Error message specified in multiple languages
-__errmsg = (?:�ϥΪ�\[.*\]���ҥ���|ʹ����\[.*\]��֤ʧ��|\[.*\] kullan�c�s� i�in giri� hatal�|����������� �� ������� ������������ \[.*\]|Godkjennelse mislyktes for \[.*\]|Beh�righetskontroll misslyckas f�r anv�ndare \[.*\]|Autentifikacia uzivatela zlyhala \[.*\]|Autentificare esuata pentru utilizatorul \[.*\]|Autentica��o falhou para usu�rio \[.*\]|Autentyfikacja nie powiod�a si� dla u�ytkownika \[.*\]|Autorisatie faalde voor gebruiker \[.*\]|\[.*\] ��� ���� ����|Autenticazione falita per l'utente \[.*\]|Azonos�t�s sikertelen \[.*\] felhaszn�l�nak|\[.*\] c'est un batard, il connait pas son code|Erreur d'authentification pour l'utilisateur \[.*\]|Autentificaci�n fallida para el usuario \[.*\]|Authentication failed for user \[.*\]|Authentifizierung fehlgeschlagen f�r Benutzer \[.*\].|Godkendelse mislykkedes for \[.*\]|Autentifikace u�ivatele selhala \[.*\])
+__errmsg = (?:Godkendelse mislykkedes for \[.*\]|Authentifizierung fehlgeschlagen für Benutzer \[.*\].|Authentication failed for user \[.*\]|Autentificación fallida para el usuario \[.*\]|\[.*\] c'est un batard, il connait pas son code|Erreur d'authentification pour l'utilisateur \[.*\]|Azonosítás sikertelen \[.*\] felhasználónak|Autenticazione falita per l'utente \[.*\]|Autorisatie faalde voor gebruiker \[.*\]|Godkjennelse mislyktes for \[.*\]|\[.*\] kullanýcýsý için giriþ hatalý|Autenticação falhou para usuário \[.*\]|Autentificare esuata pentru utilizatorul \[.*\]|Autentifikace uživatele selhala \[.*\]|Autentyfikacja nie powiodła się dla użytkownika \[.*\]|Autentifikacia uzivatela zlyhala \[.*\]|Behörighetskontroll misslyckas för användare \[.*\]|Авторизация не удалась пользователю \[.*\]|\[.*\] 嶸盪 檣隸 褒ぬ|妏蚚氪\[.*\]桄痐囮啖|使用者\[.*\]驗證失敗)
 
 failregex = ^%(__prefix_line)s\(.+?@<HOST>\) \[WARNING\] %(__errmsg)s\s*$
 
@@ -24,7 +24,13 @@ ignoreregex =
 # Author: Cyril Jaquier
 # Modified: Yaroslav Halchenko for pure-ftpd
 # Documentation thanks to Blake on http://www.fail2ban.org/wiki/index.php?title=Fail2ban:Community_Portal
+# UTF-8 editing and mechanism thanks to Johannes Weberhofer
 #
 # Only logs to syslog though facility can be changed configuration file/command line
 #
-# fgrep -r MSG_AUTH_FAILED_LOG pure-ftpd-1.0.36/src
+# To get messages in the right encoding:
+# grep MSG_AUTH_FAILED_LOG pure-ftpd-1.0.36/src/messages_[defhint]* | grep -Po '".?"' | recode latin1..utf-8 | tr -d '"' > messages
+# grep MSG_AUTH_FAILED_LOG pure-ftpd-1.0.36/src/messages_[pr][to] | grep -Po '".?"' | recode latin1..utf-8 | tr -d '"' >> messages
+# grep MSG_AUTH_FAILED_LOG pure-ftpd-1.0.36/src/messages_[cps][slkv] | grep -Po '".?"' | recode latin2..utf-8 | tr -d '"' >> messages
+# grep MSG_AUTH_FAILED_LOG pure-ftpd-1.0.36/src/messages_ru | grep -Po '".?"' | recode KOI8-R..utf-8 | tr -d '"' >> messages
+# grep MSG_AUTH_FAILED_LOG pure-ftpd-1.0.36/src/messages_[kz] | grep -Po '".*?"' | tr -d '"' | recode big5..utf-8 >> messages

config/filter.d/recidive.conf

@@ -21,12 +21,16 @@ before = common.conf
 
 [Definition]
 
-_daemon = fail2ban\.actions
+_daemon = fail2ban\.actions\s*
 
 # The name of the jail that this filter is used for. In jail.conf, name the 
 # jail using this filter 'recidive', or change this line!
 _jailname = recidive
 
-failregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions%(__pid_re)s?:\s+)WARNING\s+\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+<HOST>\s*$
+failregex = ^(%(__prefix_line)s| %(_daemon)s%(__pid_re)s?:\s+)NOTICE\s+\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+<HOST>\s*$
+
+[Init]
+
+journalmatch = _SYSTEMD_UNIT=fail2ban.service PRIORITY=5
 
 # Author: Tom Hendrikx, modifications by Amir Caspi 

config/filter.d/roundcube-auth.conf

@@ -9,7 +9,7 @@ before = common.conf
 
 [Definition]
 
-failregex = ^\s*(\[(\s[+-][0-9]{4})?\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. .* in .*?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
+failregex = ^\s*(\[\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. .* in .*?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
 
 ignoreregex = 
 # DEV Notes:

config/filter.d/sendmail-reject.conf

@@ -19,16 +19,32 @@ before = common.conf
 
 [Definition]
 
-_daemon = (?:sm-(mta|acceptingconnections))
+_daemon = (?:(sm-(mta|acceptingconnections)|sendmail))
 
 failregex = ^%(__prefix_line)s\w{14}: ruleset=check_rcpt, arg1=(?P<email><\S+@\S+>), relay=(\S+ )?\[<HOST>\]( \(may be forged\))?, reject=(550 5\.7\.1 (?P=email)\.\.\. Relaying denied\. (IP name possibly forged \[(\d+\.){3}\d+\]|Proper authentication required\.|IP name lookup failed \[(\d+\.){3}\d+\])|553 5\.1\.8 (?P=email)\.\.\. Domain of sender address \S+ does not exist|550 5\.[71]\.1 (?P=email)\.\.\. (Rejected: .*|User unknown))$
             ^%(__prefix_line)sruleset=check_relay, arg1=(?P<dom>\S+), arg2=<HOST>, relay=((?P=dom) )?\[(\d+\.){3}\d+\]( \(may be forged\))?, reject=421 4\.3\.2 (Connection rate limit exceeded\.|Too many open connections\.)$
             ^%(__prefix_line)s\w{14}: rejecting commands from  (\S+ )?\[<HOST>\] due to pre-greeting traffic after \d+ seconds$
             ^%(__prefix_line)s\w{14}: (\S+ )?\[<HOST>\]: ((?i)expn|vrfy) \S+ \[rejected\]$
+            ^(?P<__prefix>%(__prefix_line)s\w+: )<[^@]+@[^>]+>\.\.\. No such user here<SKIPLINES>(?P=__prefix)from=<[^@]+@[^>]+>, size=\d+, class=\d+, nrcpts=\d+, bodytype=\w+, proto=E?SMTP, daemon=MTA, relay=\S+ \[<HOST>\]$
 
 
 ignoreregex =
 
-# DEV Notes:
+
+[Init]
+
+# "maxlines" is number of log lines to buffer for multi-line regex searches
+maxlines = 10
+
+# DEV NOTES:
+# 
+# Regarding the last multiline regex:
+#
+# There can be a nunber of non-related lines between the first and second part
+# of this regex maxlines of 10 is quite generious. Only one of the 
+# "No such user" lines needs to be matched before the line with the HOST.
+#
+# Note the capture __prefix, includes both the __prefix_lines (which includes
+# the sendmail PID), but also the \w+ which the the sendmail assigned mail ID.
 #
 # Author: Daniel Black and Fabian Wenk

config/filter.d/sieve.conf

@@ -9,7 +9,7 @@ before = common.conf
 
 [Definition]
 
-_deamon = (?:cyrus/)?(?:tim)?sieved?
+_daemon = (?:cyrus/)?(?:tim)?sieved?
 
 failregex = ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] \S+ authentication failure$
 

config/filter.d/solid-pop3d.conf

@@ -1,4 +1,4 @@
-# Fail2Ban filter for unsuccesful solid-pop3 authentication attempts
+# Fail2Ban filter for unsuccessful solid-pop3 authentication attempts
 #
 # Doesn't currently provide PAM support as PAM log messages don't include rhost as
 # remote IP.

config/filter.d/squirrelmail.conf

@@ -0,0 +1,13 @@
+
+[Definition]
+
+failregex = ^ \[LOGIN_ERROR\].*from <HOST>: Unknown user or password incorrect\.$
+
+
+[Init]
+
+datepattern = ^%%m/%%d/%%Y %%H:%%M:%%S
+
+# DEV NOTES:
+#
+# Author: Daniel Black

config/filter.d/sshd-ddos.conf

@@ -22,4 +22,8 @@ failregex = ^%(__prefix_line)sDid not receive identification string from <HOST>\
 
 ignoreregex = 
 
+[Init]
+
+journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd
+
 # Author: Yaroslav Halchenko

config/filter.d/sshd.conf

@@ -1,5 +1,12 @@
 # Fail2Ban filter for openssh
 #
+# If you want to protect OpenSSH from being bruteforced by password
+# authentication then get public key authentication working before disabling
+# PasswordAuthentication in sshd_config.
+#
+#
+# "Connection from <HOST> port \d+" requires LogLevel VERBOSE in sshd_config
+#
 
 [INCLUDES]
 
@@ -7,7 +14,6 @@
 # common.local
 before = common.conf
 
-
 [Definition]
 
 _daemon = sshd
@@ -24,9 +30,19 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|erro
             ^%(__prefix_line)sReceived disconnect from <HOST>: 3: \S+: Auth fail$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because a group is listed in DenyGroups\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
+            ^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked<SKIPLINES>(?P=__prefix)(?:error: )?Received disconnect from <HOST>: 11: .+ \[preauth\]$
+            ^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\]<SKIPLINES>(?P=__prefix)(?:error: )?Connection closed by <HOST> \[preauth\]$
+            ^(?P<__prefix>%(__prefix_line)s)Connection from <HOST> port \d+(?: on \S+ port \d+)?<SKIPLINES>(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$
 
 ignoreregex = 
 
+[Init]
+
+# "maxlines" is number of log lines to buffer for multi-line regex searches
+maxlines = 10
+
+journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd
+
 # DEV Notes:
 #
 #   "Failed \S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because
@@ -35,3 +51,4 @@ ignoreregex =
 #   matched away first.
 #
 # Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black
+

config/filter.d/stunnel.conf

@@ -0,0 +1,11 @@
+# Fail2ban filter for stunnel
+
+[Definition]
+
+failregex = ^ LOG\d\[\d+:\d+\]:\ SSL_accept from <HOST>:\d+ : (?P<CODE>[\dA-F]+): error:(?P=CODE):SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate$
+
+# DEV NOTES:
+# 
+# Author: Daniel Black
+#
+# Based off: http://www.fail2ban.org/wiki/index.php/Fail2ban:Community_Portal#stunnel4

config/filter.d/tine20.conf

@@ -0,0 +1,21 @@
+# Fail2Ban filter for Tine 2.0 authentication
+#
+# Enable logging with:
+# $config['info_log']='/var/log/tine20/tine20.log';
+#
+
+[Definition]
+
+failregex =  ^[\da-f]{5,} [\da-f]{5,} (-- none --|.*?)( \d+(\.\d+)?(h|m|s|ms)){0,2} -  WARN \(\d+\): Tinebase_Controller::login::\d+ Login with username .*? from <HOST> failed \(-[13]\)!$
+
+ignoreregex = 
+
+# Author: Mika (mkl) from Tine20.org forum: https://www.tine20.org/forum/viewtopic.php?f=2&t=15688&p=54766
+# Editor: Daniel Black
+# Advisor: Lars Kneschke
+#
+# Usernames can contain spaces.
+#
+# Authentication: http://git.tine20.org/git?p=tine20;a=blob;f=tine20/Tinebase/Controller.php#l105
+# Logger: http://git.tine20.org/git?p=tine20;a=blob;f=tine20/Tinebase/Log/Formatter.php
+# formatMicrotimeDiff: http://git.tine20.org/git?p=tine20;a=blob;f=tine20/Tinebase/Helper.php#l276

config/paths-common.conf

@@ -0,0 +1,63 @@
+# Common
+#
+
+[INCLUDES]
+
+after  = paths-overrides.local
+
+[DEFAULT]
+
+sshd_log = %(syslog_authpriv)s
+
+dropbear_log = %(syslog_authpriv)s
+
+# There is no sensible generic defaults for syslog log targets, thus
+# leaving them empty here so that no errors while parsing/interpolating configs
+syslog_daemon =
+syslog_ftp =
+syslog_local0 =
+syslog_mail_warn =
+syslog_user =
+
+# from /etc/audit/auditd.conf
+auditd_log = /var/log/audit/audit.log
+
+exim_main_log = /var/log/exim/mainlog
+
+nginx_error_log = /var/log/nginx/error.log
+
+nginx_access_log = /var/log/nginx/access.log
+
+
+lighttpd_error_log = /var/log/lighttpd/error.log
+
+# http://www.hardened-php.net/suhosin/configuration.html#suhosin.log.syslog.facility
+# syslog_user is the default. Lighttpd also hooks errors into its log.
+
+suhosin_log = %(syslog_user)s %(lighttpd_error_log)s
+
+# defaults to ftp or local2 if ftp doesn't exist
+proftpd_log = %(syslog_ftp)s
+
+# http://svnweb.freebsd.org/ports/head/ftp/proftpd/files/patch-src_proftpd.8.in?view=markup
+# defaults to ftp but can be overwritten.
+pureftpd_log = %(syslog_ftp)s
+
+# ftp, daemon and then local7 are tried at configure time however it is overwriteable at configure time
+#
+wuftpd_log = %(syslog_ftp)s
+
+# syslog_enable defaults to no. so it defaults to vsftpd_log_file setting of /var/log/vsftpd.log
+# No distro seems to set it to syslog by default
+# If syslog set it defaults to ftp facility if exists at compile time otherwise falls back to daemonlog.
+vsftpd_log = /var/log/vsftpd.log
+
+# Technically syslog_facility in main.cf can overwrite but no-one sane does this.
+postfix_log = %(syslog_mail_warn)s
+
+dovecot_log = %(syslog_mail_warn)s
+
+# Seems to be set at compile time only to LOG_LOCAL0 (src/const.h) at Notice level
+solidpop3d_log = %(syslog_local0)s
+
+mysql_log = %(syslog_daemon)s

config/paths-debian.conf

@@ -0,0 +1,40 @@
+# Debian
+
+[INCLUDES]
+
+before = paths-common.conf
+
+after  = paths-overrides.local
+
+
+[DEFAULT]
+
+syslog_mail = /var/log/mail.log
+
+syslog_mail_warn = /var/log/mail.warn
+
+syslog_authpriv = /var/log/auth.log
+
+# syslog_auth = /var/log/auth.log
+#
+syslog_user  =  /var/log/user.log
+
+syslog_ftp = /var/log/syslog
+
+syslog_daemon =  /var/log/daemon.log
+
+syslog_local0 =  /var/log/messages
+
+
+apache_error_log = /var/log/apache2/*error.log
+
+apache_access_log = /var/log/apache2/*access.log
+
+exim_main_log = /var/log/exim4/mainlog
+
+# was in debian squeezy but not in wheezy
+# /etc/proftpd/proftpd.conf (SystemLog)
+proftpd_log = /var/log/proftpd/proftpd.log
+
+
+

config/paths-fedora.conf

@@ -0,0 +1,37 @@
+# Fedora
+
+[INCLUDES]
+
+before = paths-common.conf
+
+after  = paths-overrides.local
+
+
+[DEFAULT]
+
+syslog_mail = /var/log/maillog
+
+syslog_mail_warn = /var/log/maillog
+
+syslog_authpriv = /var/log/secure
+
+syslog_user =  /var/log/messages
+
+syslog_ftp  = /var/log/messages
+
+syslog_daemon  = /var/log/messages
+
+syslog_local0  = /var/log/messages
+
+
+apache_error_log = /var/log/httpd/*error_log
+
+apache_access_log = /var/log/httpd/*access_log
+
+# /etc/proftpd/proftpd.conf (ExtendedLog for Anonymous)
+# proftpd_log = /var/log/proftpd/auth.log
+# Tested and it worked out in /var/log/messages so assuming syslog_ftp for now.
+
+exim_main_log = /var/log/exim/main.log
+
+mysql_log = /var/lib/mysql/mysqld.log

config/paths-freebsd.conf

@@ -0,0 +1,46 @@
+# FreeBSD
+
+[INCLUDES]
+
+before = paths-common.conf
+
+after  = paths-overrides.local
+
+
+[DEFAULT]
+
+# http://www.freebsd.org/doc/handbook/configtuning-syslog.html
+#
+syslog_mail = /var/log/maillog
+
+syslog_mail_warn = /var/log/maillog
+
+syslog_authpriv = /var/log/auth.log
+
+# note - is only ftp.info - if notice /var/log/messages may be needed
+syslog_ftp = /var/log/xferlog
+
+syslog_daemon = /var/log/messages
+
+syslog_local0 = /var/log/messages
+
+# Linux things
+# we fake to avoid parse error in startups
+
+auditd_log = /dev/null
+
+# http://svnweb.freebsd.org/ports/head/www/apache24/files/patch-docs__conf__extra__httpd-ssl.conf.in?view=markup
+# http://svnweb.freebsd.org/ports/head/www/apache22/files/patch-docs__conf__extra__httpd-ssl.conf.in?view=markup
+# http://svnweb.freebsd.org/ports/head/www/apache24/files/patch-config.layout
+# http://svnweb.freebsd.org/ports/head/www/apache22/files/patch-config.layout
+
+apache_error_log = /usr/local/www/logs/*error[_.]log
+
+apache_access_log = /usr/local/www/logs/*access[_.]log
+
+# http://svnweb.freebsd.org/ports/head/www/nginx/Makefile?view=markup
+
+nginx_error_log = /var/log/nginx-error.log
+
+nginx_access_log = /var/log/nginx-access.log
+

config/paths-osx.conf

@@ -0,0 +1,27 @@
+# OSX
+#
+
+[INCLUDES]
+
+before = paths-common.conf
+
+after  = paths-overrides.local
+
+
+[DEFAULT]
+
+syslog_mail = /var/log/mail.log
+
+syslog_mail_warn = /var/log/mail.warn
+
+syslog_authpriv = /var/log/secure.log
+#syslog_auth = 
+
+#syslog_user = 
+
+#syslog_ftp = 
+
+#syslog_daemon = 
+
+#syslog_local0 =
+

debian/NEWS

@@ -1,3 +1,22 @@
+fail2ban (0.9.0+git48-gabcab00-1) experimental; urgency=low
+
+  [ Yaroslav Halchenko ]
+  * This version went through big refactoring which allowed to gain new
+    features such as multiline matching (see upstream's changelog for more
+    information).
+  * Although .local files are still supported, customizations are advised
+    to be provided under corresponding .d/ directories.  E.g. see
+    /etc/fail2ban/jail.d/defaults-debian.conf which is where now sshd
+    jail is enabled by default to match previous behavior of Fail2Ban in
+    Debian.
+
+  [ Daniel Schaal ]
+  * All jails definitions were rewritten to become more concise and uniform.
+    From this version on log paths are defined in distro specific files,
+    for Debian this is in /etc/fail2ban/paths-debian.conf.
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Tue, 25 Mar 2014 08:38:31 -0400
+
 fail2ban (0.8.11-1) unstable; urgency=low
 
   * retroactive for 0.8.9: by default iptables-* actions do not simply

debian/changelog

@@ -1,3 +1,31 @@
+fail2ban (0.9.X-python3) UNRELEASED; urgency=medium
+
+  [ Vid Luther ]
+  * python3 for everything? .. I hope.  
+
+  [ vagrant ]
+  * warning? 
+
+ -- vagrant <vagrant@vagrant.vm>  Sat, 13 Sep 2014 03:52:55 +0000
+
+fail2ban (0.9.0+git48-gabcab00-1) experimental; urgency=medium
+
+  [ Daniel Schaal ]
+  * debian/ updated for 0.9 release
+    0.9 release introduced big changes in internal organization (Python
+    module now), and new features, and stock jail.conf now follows
+    Debian's style, thus custom Debian jail.conf was deprecated.  See NEWS
+    file and upstream ChangeLog for further details.
+
+  [ Yaroslav Halchenko ]
+  * Post 0.9 release snapshot.
+  * debian/rules
+    - do not ignore tests failures
+    - run only tests not requiring network access
+    - nagios and cacti examples get installed
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Tue, 25 Mar 2014 00:43:46 -0400
+
 fail2ban (0.8.13-1) unstable; urgency=low
 
   * New upstream bug-fix release: but consider 0.9.0 (to be uploaded to

debian/compat

@@ -1 +1 @@
-5
+9

debian/control

@@ -2,7 +2,7 @@ Source: fail2ban
 Section: net
 Priority: optional
 Maintainer: Yaroslav Halchenko <debian@onerussian.com>
-Build-Depends: debhelper (>= 5.0.37.2), python (>= 2.5.4-1~), python-pyinotify
+Build-Depends: debhelper (>= 9), python3 (>= 3.0~), python3-pyinotify, dh-systemd
 Homepage: http://www.fail2ban.org
 Vcs-Git: git://github.com/fail2ban/fail2ban.git
 Vcs-Browser: http://github.com/fail2ban/fail2ban
@@ -11,9 +11,9 @@ Standards-Version: 3.9.4
 
 Package: fail2ban
 Architecture: all
-Depends: ${python:Depends}, ${misc:Depends}, lsb-base (>=2.0-7)
-Recommends: iptables, whois, python-pyinotify
-Suggests: python-gamin, mailx, system-log-daemon
+Depends: ${python3:Depends}, ${misc:Depends}, lsb-base (>=2.0-7)
+Recommends: iptables, whois, python3-pyinotify
+Suggests: python-gamin, mailx, system-log-daemon, python3-systemd
 Description: ban hosts that cause multiple authentication errors
  Fail2ban monitors log files (e.g. /var/log/auth.log,
  /var/log/apache/access.log) and temporarily or persistently bans
@@ -27,4 +27,3 @@ Description: ban hosts that cause multiple authentication errors
  easily extended for monitoring any other text file.  All filters and
  actions are given in the config files, thus fail2ban can be adopted
  to be used with a variety of files and firewalls.
-

debian/gbp.conf

@@ -2,9 +2,9 @@
 # the default branch for upstream sources:
 upstream-branch = upstream
 # the default branch for the debian patch:
-debian-branch = debian
+debian-branch = debian-releases/experimental
 # use pristine-tar
-pristine-tar = True
+# pristine-tar = True
 # the default tag formats used:
 upstream-tag = %(version)s
 debian-tag = debian/%(version)s

debian/jail.conf

@@ -1,552 +0,0 @@
-# Fail2Ban configuration file.
-#
-# This file was composed for Debian systems from the original one
-# provided now under /usr/share/doc/fail2ban/examples/jail.conf
-# for additional examples.
-#
-# Comments: use '#' for comment lines and ';' for inline comments
-#
-# To avoid merges during upgrades DO NOT MODIFY THIS FILE
-# and rather provide your changes in /etc/fail2ban/jail.local
-#
-
-# The DEFAULT allows a global definition of the options. They can be overridden
-# in each jail afterwards.
-
-[DEFAULT]
-
-# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
-# ban a host which matches an address in this list. Several addresses can be
-# defined using space separator.
-ignoreip = 127.0.0.1/8
-
-# External command that will take an tagged arguments to ignore, e.g. <ip>,
-# and return true if the IP is to be ignored. False otherwise.
-#
-# ignorecommand = /path/to/command <ip>
-ignorecommand =
-
-# "bantime" is the number of seconds that a host is banned.
-bantime  = 600
-
-# A host is banned if it has generated "maxretry" during the last "findtime"
-# seconds.
-findtime = 600
-maxretry = 3
-
-# "backend" specifies the backend used to get files modification.
-# Available options are "pyinotify", "gamin", "polling" and "auto".
-# This option can be overridden in each jail as well.
-#
-# pyinotify: requires pyinotify (a file alteration monitor) to be installed.
-#            If pyinotify is not installed, Fail2ban will use auto.
-# gamin:     requires Gamin (a file alteration monitor) to be installed.
-#            If Gamin is not installed, Fail2ban will use auto.
-# polling:   uses a polling algorithm which does not require external libraries.
-# auto:      will try to use the following backends, in order:
-#            pyinotify, gamin, polling.
-backend = auto
-
-# "usedns" specifies if jails should trust hostnames in logs,
-#   warn when reverse DNS lookups are performed, or ignore all hostnames in logs
-#
-# yes:   if a hostname is encountered, a reverse DNS lookup will be performed.
-# warn:  if a hostname is encountered, a reverse DNS lookup will be performed,
-#        but it will be logged as a warning.
-# no:    if a hostname is encountered, will not be used for banning,
-#        but it will be logged as info.
-usedns = warn
-
-#
-# Destination email address used solely for the interpolations in
-# jail.{conf,local} configuration files.
-destemail = root@localhost
-
-#
-# Name of the sender for mta actions
-sendername = Fail2Ban
-
-# Email address of the sender
-sender = fail2ban@localhost
-
-#
-# ACTIONS
-#
-
-# Default banning action (e.g. iptables, iptables-new,
-# iptables-multiport, shorewall, etc) It is used to define
-# action_* variables. Can be overridden globally or per
-# section within jail.local file
-banaction = iptables-multiport
-
-# email action. Since 0.8.1 upstream fail2ban uses sendmail
-# MTA for the mailing. Change mta configuration parameter to mail
-# if you want to revert to conventional 'mail'.
-mta = sendmail
-
-# Default protocol
-protocol = tcp
-
-# Specify chain where jumps would need to be added in iptables-* actions
-chain = INPUT
-
-#
-# Action shortcuts. To be used to define action parameter
-
-# The simplest action to take: ban only
-action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
-
-# ban & send an e-mail with whois report to the destemail.
-action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
-              %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s", sendername="%(sendername)s"]
-
-# ban & send an e-mail with whois report and relevant log lines
-# to the destemail.
-action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
-               %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"]
-
-# Choose default action.  To change, just override value of 'action' with the
-# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
-# globally (section [DEFAULT]) or per specific section
-action = %(action_)s
-
-#
-# JAILS
-#
-
-# Next jails corresponds to the standard configuration in Fail2ban 0.6 which
-# was shipped in Debian. Enable any defined here jail by including
-#
-# [SECTION_NAME]
-# enabled = true
-
-#
-# in /etc/fail2ban/jail.local.
-#
-# Optionally you may override any other parameter (e.g. banaction,
-# action, port, logpath, etc) in that section within jail.local
-
-[ssh]
-
-enabled  = true
-port     = ssh
-filter   = sshd
-logpath  = /var/log/auth.log
-maxretry = 6
-
-[dropbear]
-
-enabled  = false
-port     = ssh
-filter   = dropbear
-logpath  = /var/log/auth.log
-maxretry = 6
-
-# Generic filter for pam. Has to be used with action which bans all ports
-# such as iptables-allports, shorewall
-[pam-generic]
-
-enabled  = false
-# pam-generic filter can be customized to monitor specific subset of 'tty's
-filter   = pam-generic
-# port actually must be irrelevant but lets leave it all for some possible uses
-port     = all
-banaction = iptables-allports
-port     = anyport
-logpath  = /var/log/auth.log
-maxretry = 6
-
-[xinetd-fail]
-
-enabled   = false
-filter    = xinetd-fail
-port      = all
-banaction = iptables-multiport-log
-logpath   = /var/log/daemon.log
-maxretry  = 2
-
-
-[ssh-ddos]
-
-enabled  = false
-port     = ssh
-filter   = sshd-ddos
-logpath  = /var/log/auth.log
-maxretry = 6
-
-
-# Here we use blackhole routes for not requiring any additional kernel support
-# to store large volumes of banned IPs
-
-[ssh-route]
-
-enabled = false
-filter = sshd
-action = route
-logpath = /var/log/sshd.log
-maxretry = 6
-
-# Here we use a combination of Netfilter/Iptables and IPsets
-# for storing large volumes of banned IPs
-#
-# IPset comes in two versions. See ipset -V for which one to use
-# requires the ipset package and kernel support.
-[ssh-iptables-ipset4]
-
-enabled  = false
-port     = ssh
-filter   = sshd
-banaction = iptables-ipset-proto4
-logpath  = /var/log/sshd.log
-maxretry = 6
-
-[ssh-iptables-ipset6]
-
-enabled  = false
-port     = ssh
-filter   = sshd
-banaction = iptables-ipset-proto6
-logpath  = /var/log/sshd.log
-maxretry = 6
-
-
-#
-# HTTP servers
-#
-
-[apache]
-
-enabled  = false
-port     = http,https
-filter   = apache-auth
-logpath  = /var/log/apache*/*error.log
-maxretry = 6
-
-# default action is now multiport, so apache-multiport jail was left
-# for compatibility with previous (<0.7.6-2) releases
-[apache-multiport]
-
-enabled   = false
-port      = http,https
-filter    = apache-auth
-logpath   = /var/log/apache*/*error.log
-maxretry  = 6
-
-[apache-noscript]
-
-enabled  = false
-port     = http,https
-filter   = apache-noscript
-logpath  = /var/log/apache*/*error.log
-maxretry = 6
-
-[apache-overflows]
-
-enabled  = false
-port     = http,https
-filter   = apache-overflows
-logpath  = /var/log/apache*/*error.log
-maxretry = 2
-
-[apache-modsecurity]
-
-enabled  = false
-filter   = apache-modsecurity
-port     = http,https
-logpath  = /var/log/apache*/*error.log
-maxretry = 2
-
-[apache-nohome]
-
-enabled  = false
-filter   = apache-nohome
-port     = http,https
-logpath  = /var/log/apache*/*error.log
-maxretry = 2
-
-# Ban attackers that try to use PHP's URL-fopen() functionality
-# through GET/POST variables. - Experimental, with more than a year
-# of usage in production environments.
-
-[php-url-fopen]
-
-enabled = false
-port    = http,https
-filter  = php-url-fopen
-logpath = /var/www/*/logs/access_log
-
-# A simple PHP-fastcgi jail which works with lighttpd.
-# If you run a lighttpd server, then you probably will
-# find these kinds of messages in your error_log:
-#   ALERT – tried to register forbidden variable ‘GLOBALS’
-#   through GET variables (attacker '1.2.3.4', file '/var/www/default/htdocs/index.php')
-
-[lighttpd-fastcgi]
-
-enabled = false
-port    = http,https
-filter  = lighttpd-fastcgi
-logpath = /var/log/lighttpd/error.log
-
-# Same as above for mod_auth
-# It catches wrong authentifications
-
-[lighttpd-auth]
-
-enabled = false
-port    = http,https
-filter  = suhosin
-logpath = /var/log/lighttpd/error.log
-
-[nginx-http-auth]
-
-enabled = false
-filter  = nginx-http-auth
-port    = http,https
-logpath = /var/log/nginx/error.log
-
-# Monitor roundcube server
-
-[roundcube-auth]
-
-enabled  = false
-filter   = roundcube-auth
-port     = http,https
-logpath  = /var/log/roundcube/userlogins
-
-
-[sogo-auth]
-
-enabled  = false
-filter   = sogo-auth
-port     = http, https
-# without proxy this would be:
-# port    = 20000
-logpath  = /var/log/sogo/sogo.log
-
-
-#
-# FTP servers
-#
-
-[vsftpd]
-
-enabled  = false
-port     = ftp,ftp-data,ftps,ftps-data
-filter   = vsftpd
-logpath  = /var/log/vsftpd.log
-# or overwrite it in jails.local to be
-# logpath = /var/log/auth.log
-# if you want to rely on PAM failed login attempts
-# vsftpd's failregex should match both of those formats
-maxretry = 6
-
-
-[proftpd]
-
-enabled  = false
-port     = ftp,ftp-data,ftps,ftps-data
-filter   = proftpd
-logpath  = /var/log/proftpd/proftpd.log
-maxretry = 6
-
-
-[pure-ftpd]
-
-enabled  = false
-port     = ftp,ftp-data,ftps,ftps-data
-filter   = pure-ftpd
-logpath  = /var/log/syslog
-maxretry = 6
-
-
-[wuftpd]
-
-enabled  = false
-port     = ftp,ftp-data,ftps,ftps-data
-filter   = wuftpd
-logpath  = /var/log/syslog
-maxretry = 6
-
-
-#
-# Mail servers
-#
-
-[postfix]
-
-enabled  = false
-port     = smtp,ssmtp,submission
-filter   = postfix
-logpath  = /var/log/mail.log
-
-
-[couriersmtp]
-
-enabled  = false
-port     = smtp,ssmtp,submission
-filter   = couriersmtp
-logpath  = /var/log/mail.log
-
-
-#
-# Mail servers authenticators: might be used for smtp,ftp,imap servers, so
-# all relevant ports get banned
-#
-
-[courierauth]
-
-enabled  = false
-port     = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s
-filter   = courierlogin
-logpath  = /var/log/mail.log
-
-
-[sasl]
-
-enabled  = false
-port     = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s
-filter   = postfix-sasl
-# You might consider monitoring /var/log/mail.warn instead if you are
-# running postfix since it would provide the same log lines at the
-# "warn" level but overall at the smaller filesize.
-logpath  = /var/log/mail.log
-
-[dovecot]
-
-enabled = false
-port    = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s
-filter  = dovecot
-logpath = /var/log/mail.log
-
-# To log wrong MySQL access attempts add to /etc/my.cnf:
-# log-error=/var/log/mysqld.log
-# log-warning = 2
-[mysqld-auth]
-
-enabled  = false
-filter   = mysqld-auth
-port     = 3306
-logpath  = /var/log/mysqld.log
-
-
-# DNS Servers
-
-
-# These jails block attacks against named (bind9). By default, logging is off
-# with bind9 installation. You will need something like this:
-#
-# logging {
-#     channel security_file {
-#         file "/var/log/named/security.log" versions 3 size 30m;
-#         severity dynamic;
-#         print-time yes;
-#     };
-#     category security {
-#         security_file;
-#     };
-# };
-#
-# in your named.conf to provide proper logging
-
-# !!! WARNING !!!
-#   Since UDP is connection-less protocol, spoofing of IP and imitation
-#   of illegal actions is way too simple.  Thus enabling of this filter
-#   might provide an easy way for implementing a DoS against a chosen
-#   victim. See
-#    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
-#   Please DO NOT USE this jail unless you know what you are doing.
-#[named-refused-udp]
-#
-#enabled  = false
-#port     = domain,953
-#protocol = udp
-#filter   = named-refused
-#logpath  = /var/log/named/security.log
-
-[named-refused-tcp]
-
-enabled  = false
-port     = domain,953
-protocol = tcp
-filter   = named-refused
-logpath  = /var/log/named/security.log
-
-[freeswitch]
-
-enabled  = false
-filter   = freeswitch
-logpath  = /var/log/freeswitch.log
-maxretry = 10
-action   = iptables-multiport[name=freeswitch-tcp, port="5060,5061,5080,5081", protocol=tcp]
-           iptables-multiport[name=freeswitch-udp, port="5060,5061,5080,5081", protocol=udp]
-
-[ejabberd-auth]
-
-enabled  = false
-filter   = ejabberd-auth
-port     = xmpp-client
-protocol = tcp
-logpath  = /var/log/ejabberd/ejabberd.log
-
-
-# Multiple jails, 1 per protocol, are necessary ATM:
-# see https://github.com/fail2ban/fail2ban/issues/37
-[asterisk-tcp]
-
-enabled  = false
-filter   = asterisk
-port     = 5060,5061
-protocol = tcp
-logpath  = /var/log/asterisk/messages
-
-[asterisk-udp]
-
-enabled  = false
-filter	 = asterisk
-port     = 5060,5061
-protocol = udp
-logpath  = /var/log/asterisk/messages
-
-
-# Jail for more extended banning of persistent abusers
-# !!! WARNING !!!
-#   Make sure that your loglevel specified in fail2ban.conf/.local
-#   is not at DEBUG level -- which might then cause fail2ban to fall into
-#   an infinite loop constantly feeding itself with non-informative lines
-[recidive]
-
-enabled  = false
-filter   = recidive
-logpath  = /var/log/fail2ban.log
-action   = iptables-allports[name=recidive]
-           sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log]
-bantime  = 604800  ; 1 week
-findtime = 86400   ; 1 day
-maxretry = 5
-
-# See the IMPORTANT note in action.d/blocklist_de.conf for when to
-# use this action
-#
-# Report block via blocklist.de fail2ban reporting service API
-# See action.d/blocklist_de.conf for more information
-[ssh-blocklist]
-
-enabled  = false
-filter   = sshd
-action   = iptables[name=SSH, port=ssh, protocol=tcp]
-           sendmail-whois[name=SSH, dest="%(destemail)s", sender="%(sender)s", sendername="%(sendername)s"]
-           blocklist_de[email="%(sender)s", apikey="xxxxxx", service="%(filter)s"]
-logpath  = /var/log/sshd.log
-maxretry = 20
-
-
-# consider low maxretry and a long bantime
-# nobody except your own Nagios server should ever probe nrpe
-[nagios]
-enabled  = false
-filter   = nagios
-action   = iptables[name=Nagios, port=5666, protocol=tcp]
-           sendmail-whois[name=Nagios, dest="%(destemail)s", sender="%(sender)s", sendername="%(sendername)s"]
-logpath  = /var/log/messages     ; nrpe.cfg may define a different log_facility
-maxretry = 1

debian/patches/deb_manpages_reportbug

@@ -4,7 +4,7 @@ Subject: tune ups in upstream manpages to direct users to use reportbug
 
 --- a/man/fail2ban-client.1
 +++ b/man/fail2ban-client.1
-@@ -265,7 +265,7 @@ action <ACT> for <JAIL>
+@@ -369,7 +369,7 @@
  Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
  Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
  .SH "REPORTING BUGS"
@@ -15,7 +15,7 @@ Subject: tune ups in upstream manpages to direct users to use reportbug
  .br
 --- a/man/fail2ban-server.1
 +++ b/man/fail2ban-server.1
-@@ -38,7 +38,7 @@ print the version
+@@ -38,7 +38,7 @@
  Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
  Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
  .SH "REPORTING BUGS"

debian/patches/series

@@ -1 +1,2 @@
 deb_manpages_reportbug
+convert-to-python3.patch

debian/postinst

@@ -84,6 +84,8 @@ if dpkg-maintscript-helper supports mv_conffile 2>/dev/null; then
     dpkg-maintscript-helper mv_conffile /etc/fail2ban/action.d/firewall-cmd-direct-new.conf /etc/fail2ban/action.d/firewallcmd-new.conf 0.8.13-1~ -- "$@"
     dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/lighttpd-fastcgi.conf /etc/fail2ban/filter.d/suhosin.conf 0.8.13-1~ -- "$@"
     dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/sasl.conf /etc/fail2ban/filter.d/postfix-sasl.conf 0.8.13-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/couriersmtp.conf /etc/fail2ban/filter.d/courier-smtp.conf 0.9.0-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/courierlogin.conf /etc/fail2ban/filter.d/courier-auth.conf 0.9.0-1~ -- "$@"
 fi
 
 # dh_installdeb will replace this with shell code automatically

debian/postrm

@@ -26,6 +26,8 @@ case "$1" in
 		# Remove logs
 		rm -f /var/log/fail2ban*
 		
+		# Remove sqlite db
+		rm -f /var/lib/fail2ban/fail2ban.sqlite3
 		;;
        remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
 		# nothing
@@ -38,6 +40,8 @@ if dpkg-maintscript-helper supports mv_conffile 2>/dev/null; then
     dpkg-maintscript-helper mv_conffile /etc/fail2ban/action.d/firewall-cmd-direct-new.conf /etc/fail2ban/action.d/firewallcmd-new.conf 0.8.13-1~ -- "$@"
     dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/lighttpd-fastcgi.conf /etc/fail2ban/filter.d/suhosin.conf 0.8.13-1~ -- "$@"
     dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/sasl.conf /etc/fail2ban/filter.d/postfix-sasl.conf 0.8.13-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/couriersmtp.conf /etc/fail2ban/filter.d/courier-smtp.conf 0.9.0-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/courierlogin.conf /etc/fail2ban/filter.d/courier-auth.conf 0.9.0-1~ -- "$@"
 fi
 
 # dh_installdeb will replace this with shell code automatically