Hope for release tomorrow

* commit '0f75ed5e2ab1159e45a7771a7a4e90c877ec848e':
  Just use a system wide python in the tests digest.py
  DOC: Slight tune up to RELEASE doc -- no need for PYTHONPATH to run tests
  MANIFEST: updated for some new files, sorted all entries, removed some duplicates
  Initial changes for the release -- simplified ChangeLog header etc

.gitignore

@@ -1,4 +1,3 @@
-.pc/*
 *~
 build
 dist
@@ -10,3 +9,4 @@ htmlcov
 *.bak
 __pycache__
 .vagrant/
+.idea/

.travis.yml

@@ -8,14 +8,21 @@ python:
   - "3.3"
   - "3.4"
   - "pypy"
+  - "pypy3"
 before_install:
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get update -qq; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then travis_retry sudo apt-get update -qq; fi
 install:
-  - pip install pyinotify
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get install -qq python-gamin; cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/; fi
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then cd ..; pip install -q coveralls; cd -; fi
+  - travis_retry pip install pyinotify
+  - if [[ $TRAVIS_PYTHON_VERSION == 2* || $TRAVIS_PYTHON_VERSION == 'pypy' ]]; then travis_retry pip install dnspython; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 3* || $TRAVIS_PYTHON_VERSION == 'pypy3' ]]; then travis_retry pip install dnspython3; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then travis_retry sudo apt-get install -qq python-gamin; cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then cd ..; travis_retry pip install -q coveralls; cd -; fi
+  # overcome buggy pypy
+  - if [[ $TRAVIS_PYTHON_VERSION == pypy ]] ; then dpkg --compare-versions $(pypy --version 2>&1 | awk '/PyPy/{print $2;}') ge 2.5.1 || { d=$PWD; cd /tmp; wget http://buildbot.pypy.org/nightly/trunk/pypy-c-jit-latest-linux64.tar.bz2; tar -xjvf pypy*bz2; cd pypy-*/bin/; export PATH=$PWD:$PATH; cd $d; } ; fi
 script:
   - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coverage run --rcfile=.travis_coveragerc setup.py test; else python setup.py test; fi
+# test installation
+  - sudo python setup.py install
 after_success:
 # Coverage config file must be .coveragerc for coveralls
   - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then cp -v .travis_coveragerc .coveragerc; fi

3rdparty/logwatch/fail2ban

@@ -1,181 +0,0 @@
-#!/usr/bin/perl
-##########################################################################
-# $Id: fail2ban 150 2013-06-18 22:19:38Z mtremaine $
-##########################################################################
-# $Log: fail2ban,v $
-# Revision 1.5  2008/08/18 16:07:46  mike
-# Patches from Paul Gear <paul at libertysys.com> -mgt
-#
-# Revision 1.4  2008/06/30 23:07:51  kirk
-# fixed copyright holders for files where I know who they should be
-#
-# Revision 1.3  2008/03/24 23:31:26  kirk
-# added copyright/license notice to each script
-#
-# Revision 1.2  2006/12/15 04:53:59  bjorn
-# Additional filtering, by Willi Mann.
-#
-# Revision 1.1  2006/05/30 19:04:26  bjorn
-# Added fail2ban service, written by Yaroslav Halchenko.
-#
-# Written by Yaroslav Halchenko <debian@onerussian.com> for fail2ban
-#
-##########################################################################
-
-########################################################
-## Copyright (c) 2008  Yaroslav Halchenko
-## Covered under the included MIT/X-Consortium License:
-##    http://www.opensource.org/licenses/mit-license.php
-## All modifications and contributions by other persons to
-## this script are assumed to have been donated to the
-## Logwatch project and thus assume the above copyright
-## and licensing terms.  If you want to make contributions
-## under your own copyright or a different license this
-## must be explicitly stated in the contribution an the
-## Logwatch project reserves the right to not accept such
-## contributions.  If you have made significant
-## contributions to this script and want to claim
-## copyright please contact logwatch-devel@lists.sourceforge.net.
-#########################################################
-
-use strict;
-use Logwatch ':all';
-
-my $Debug = $ENV{'LOGWATCH_DEBUG'} || 0;
-my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
-my $IgnoreHost = $ENV{'sshd_ignore_host'} || "";
-my $DebugCounter = 0;
-my $ReInitializations = 0;
-my @IptablesErrors = ();
-my @ActionErrors = ();
-my $NotValidIP = 0;		# reported invalid IPs number
-my @OtherList = ();
-
-my %ServicesBans = ();
-
-if ( $Debug >= 5 ) {
-	print STDERR "\n\nDEBUG: Inside Fail2Ban Filter \n\n";
-	$DebugCounter = 1;
-}
-
-while (defined(my $ThisLine = <STDIN>)) {
-    if ( $Debug >= 5 ) {
-	print STDERR "DEBUG($DebugCounter): $ThisLine";
-	$DebugCounter++;
-    }
-    chomp($ThisLine);
-    if ( ($ThisLine =~ /..,... DEBUG: /) or
-	 ($ThisLine =~ /..,... \S*\s*: DEBUG /) or # syntax of 0.7.? fail2ban
-	 ($ThisLine =~ /..,... INFO: (Fail2Ban v.* is running|Exiting|Enabled sections:)/) or
-	 ($ThisLine =~ /INFO\s+Log rotation detected for/) or
-	 ($ThisLine =~ /INFO\s+Jail.+(?:stopped|started|uses poller)/) or
-	 ($ThisLine =~ /INFO\s+Changed logging target to/) or
-	 ($ThisLine =~ /INFO\s+Creating new jail/) or
-	 ($ThisLine =~ /..,... \S+\s*: INFO\s+(Set |Socket|Exiting|Gamin|Created|Added|Using)/) or # syntax of 0.7.? fail2ban
-	 ($ThisLine =~ /..,... WARNING: Verbose level is /) or
-	 ($ThisLine =~ /..,... WARNING: Restoring firewall rules/)
-       )
-    {
-	if ( $Debug >= 6 ) {
-	    print STDERR "DEBUG($DebugCounter): line ignored\n";
-	}
-    } elsif ( my ($Service,$Action,$Host) = ($ThisLine =~ m/WARNING:?\s\[?(.*?)[]:]?\s(Ban|Unban)[^\.]* (\S+)/)) {
-	if ( $Debug >= 6 ) {
-	    print STDERR "DEBUG($DebugCounter): Found $Action for $Service from $Host\n";
-	}
-	$ServicesBans{$Service}{$Host}{$Action}++;
-	$ServicesBans{$Service}{"(all)"}{$Action}++;
-    } elsif ( my ($Service,$Host,$NumFailures) = ($ThisLine =~ m/INFO: (\S+): (.+) has (\d+) login failure\(s\). Banned./)) {
-	if ($Debug >= 4) {
-	    print STDERR "DEBUG: Found host $Host trying to access $Service - failed $NumFailures times\n";
-	}
-	push @{$ServicesBans{$Service}{$Host}{'Failures'}}, $NumFailures;
-    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ ERROR:\s(.*):\s(\S+)\salready in ban list/)) {
-   	 $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
-    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/WARNING\s*\[(.*)\]\s*(\S+)\s*already banned/)) {
-       $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
-    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ WARNING:\s(.*):\sReBan (\S+)/)) {
-	    $ServicesBans{$Service}{$Host}{'ReBan'}++;
-    } elsif ($ThisLine =~ / ERROR:?\s*(Execution of command )?\'?iptables/) {
-	    push @IptablesErrors, "$ThisLine\n";
-    } elsif ($ThisLine =~ /ERROR.*returned \d+$/) {
-       push @ActionErrors, "$ThisLine\n";
-    } elsif (($ThisLine =~ /..,... WARNING: \#\S+ reinitialization of firewalls/) or
-	    ($ThisLine =~ / ERROR\s*Invariant check failed. Trying to restore a sane environment/)) {
-	    $ReInitializations++;
-    } elsif ($ThisLine =~ /..,... WARNING:  is not a valid IP address/) {
-	# just ignore - this will be fixed within fail2ban and is harmless warning
-    }
-    else
-    {
-	# Report any unmatched entries...
-	push @OtherList, "$ThisLine\n";
-    }
-}
-
-###########################################################
-
-
-if (keys %ServicesBans) {
-    printf("\nBanned services with Fail2Ban:				 Bans:Unbans\n");
-    foreach my $service (sort {$a cmp $b} keys %ServicesBans) {
-	printf("   %-55s [%3d:%-3d]\n", "$service:",
-	       $ServicesBans{$service}{'(all)'}{'Ban'},
-	       $ServicesBans{$service}{'(all)'}{'Unban'});
-	delete $ServicesBans{$service}{'(all)'};
-	my $totalSort = TotalCountOrder(%{$ServicesBans{$service}}, \&SortIP);
-	if ($Detail >= 5) {
-	    foreach my $ip (sort $totalSort keys %{$ServicesBans{$service}}) {
-		   my $name = LookupIP($ip);
-		   printf("      %-53s %3d:%-3d\n",
-		       $name,
-		       $ServicesBans{$service}{$ip}{'Ban'},
-		       $ServicesBans{$service}{$ip}{'Unban'});
-		   if (($Detail >= 10) and ($ServicesBans{$service}{$ip}{'Failures'}>0)) {
-		      print "	   Failed ";
-		      foreach my $fails (@{$ServicesBans{$service}{$ip}{'Failures'}}) {
-			      print " $fails";
-		      }
-		    print " times";
-		    printf("\n	   %d Duplicate Ban attempts", $ServicesBans{$service}{$ip}{'AlreadyInTheList'}) ;
-		    printf("\n	   %d ReBans due to rules reinitilizations", $ServicesBans{$service}{$ip}{'ReBan'}) ;
-		    print "\n";
-		   }
-	    }
-	   }
-    }
-}
-
-
-if ($Detail>0) {
-    if ($#IptablesErrors > 0) {
-	   printf("\n%d faulty iptables invocation(s)", $#IptablesErrors);
-	   if ($Detail > 5) {
-	    print ":\n";
-	    print @IptablesErrors ;
-	   }
-    }
-    if ($#ActionErrors > 0) {
-       printf("\n%d error(s) returned from actions", $#ActionErrors);
-       if ($Detail > 5) {
-           print ":\n";
-           print @ActionErrors ;
-       }
-    }
-    if ($ReInitializations > 0) {
-	   printf("\n%d fail2ban rules reinitialization(s)", $ReInitializations);
-    }
-    if ($#OtherList >= 0) {
-	   print "\n**Unmatched Entries**\n";
-	   print @OtherList;
-    }
-}
-
-exit(0);
-
-# vi: shiftwidth=3 tabstop=3 syntax=perl et
-# Local Variables:
-# mode: perl
-# perl-indent-level: 3
-# indent-tabs-mode: nil
-# End:

CONTRIBUTING.md

@@ -15,3 +15,13 @@ join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-us
 
 ### You would like to contribute (new filters/actions/code/documentation)?
 send a [pull request](https://github.com/fail2ban/fail2ban/pulls)
+
+Pull requests guidelines
+========================
+
+- If there is an issue on github to be closed by the pull request, include
+  ```Closes #ISSUE``` (where ISSUE is issue's number)
+  
+- Add a brief summary of the change to the ChangeLog file into a corresponding
+  section out of Fixes, New Features or Enhancements (improvements to existing
+  features)

ChangeLog

@@ -3,11 +3,93 @@
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
-================================================================================
-Fail2Ban (version 0.9.0.dev)                                          2014/xx/xx
-================================================================================
+Fail2Ban: Changelog
+===================
 
-ver. 0.9.1 (2014/xx/xx) - better, faster, stronger
+ver. 0.9.2 (2015/04/29) - better-quick-now-than-later
+----------
+
+- Fixes:
+   * Fix ufw action commands
+   * infinite busy loop on _escapedTags match in substituteRecursiveTags gh-907.
+     Thanks TonyThompson
+   * port[s] typo in jail.conf/nginx-http-auth gh-913. Thanks Frederik Wagner
+     (fnerdwq)
+   * $ typo in jail.conf. Thanks Skibbi. Debian bug #767255
+   * grep'ing for IP in *mail-whois-lines.conf should now match also
+     at the beginning and EOL.  Thanks Dean Lee
+   * jail.conf
+     - php-url-fopen: separate logpath entries by newline
+   * failregex declared direct in jail was joined to single line (specifying of
+     multiple expressions was not possible).
+   * filters.d/exim.conf - cover different settings of exim logs
+     details. Thanks bes.internal
+   * filter.d/postfix-sasl.conf - failregex is now case insensitive
+   * filters.d/postfix.conf - add 'Client host rejected error message' failregex
+   * fail2ban/__init__.py - add strptime thread safety hack-around
+   * recidive uses iptables-allports banaction by default now.
+     Avoids problems with iptables versions not understanding 'all' for
+     protocols and ports
+   * filter.d/dovecot.conf
+     - match pam_authenticate line from EL7
+     - match unknown user line from EL7
+   * Use use_poll=True for Python 2.7 and >=3.4 to overcome "Bad file
+     descriptor" msgs issue (gh-161)
+   * filter.d/postfix-sasl.conf - tweak failregex and add ignoreregex to ignore
+     system authentication issues
+   * fail2ban-regex reads filter file(s) completely, incl. '.local' file etc.
+     (gh-954)
+   * firewallcmd-* actions: split output into separate lines for grepping (gh-908)
+   * Guard unicode encode/decode issues while storing records in the database.
+     Fixes "binding parameter error (unsupported type)" (gh-973), thanks to kot
+	 for reporting
+   * filter.d/sshd added regex for matching openSUSE ssh authentication failure
+   * filter.d/asterisk.conf:
+     - Dropped "Sending fake auth rejection" failregex since it incorrectly
+	   targets the asterisk server itself
+     - match "hacking attempt detected" logs
+
+- New Features:
+   - New filters:
+     - postfix-rbl  Thanks Lee Clemens
+     - apache-fakegooglebot.conf  Thanks Lee Clemens
+     - nginx-botsearch  Thanks Frantisek Sumsal
+     - drupal-auth  Thanks Lee Clemens
+   - New recursive embedded substitution feature added:
+     - `<<PREF>HOST>` becomes `<IPV4HOST>` for PREF=`IPV4`;
+     - `<<PREF>HOST>` becomes `1.2.3.4` for PREF=`IPV4` and IPV4HOST=`1.2.3.4`;
+   - New interpolation feature for config readers - `%(known/parameter)s`.
+     (means last known option with name `parameter`). This interpolation makes
+     possible to extend a stock filter or jail regexp in .local file
+     (opposite to simply set failregex/ignoreregex that overwrites it),
+     see gh-867.
+   - Monit config for fail2ban in files/monit/
+   - New actions:
+     - action.d/firewallcmd-multiport and action.d/firewallcmd-allports Thanks Donald Yandt
+     - action.d/sendmail-geoip-lines.conf
+     - action.d/nsupdate to update DNSBL. Thanks Andrew St. Jean
+   - New status argument for fail2ban-client -- flavor:
+     fail2ban-client status <jail> [flavor]
+     - empty or "basic" works as-is
+     - "cymru" additionally prints (ASN, Country RIR) per banned IP
+       (requires dnspython or dnspython3)
+   - Flush log at USR1 signal
+
+- Enhancements:
+   * Enable multiport for firewallcmd-new action.  Closes gh-834
+   * files/debian-initd migrated from the debian branch and should be
+     suitable for manual installations now (thanks Juan Karlo de Guzman)
+   * Define empty ignoreregex in filters which didn't have it to avoid
+     warnings (gh-934)
+   * action.d/{sendmail-*,xarf-login-attack}.conf - report local
+     timezone not UTC time/zone. Closes gh-911
+   * Conditionally log Ignore IP with reason (dns, ip, command). Closes gh-916
+   * Absorbed DNSUtils.cidr into addr2bin in filter.py, added unittests
+   * Added syslogsocket configuration to fail2ban.conf
+   * Note in the jail.conf for the recidive jail to increase dbpurgeage (gh-964)
+
+
+ver. 0.9.1 (2014/10/29) - better, faster, stronger
 ----------
 
 - Refactoring (IMPORTANT -- Please review your setup and configuration):
@@ -16,6 +98,8 @@ ver. 0.9.1 (2014/xx/xx) - better, faster, stronger
      provides defaults for the chain, port, protocol and name tags
 
 - Fixes:
+   * start of file2ban aborted (on slow hosts, systemd considers the server has
+     been timed out and kills him), see gh-824
    * UTF-8 fixes in pure-ftp thanks to Johannes Weberhofer. Closes gh-806.
    * systemd backend error on bad utf-8 in python3
    * badips.py action error when logging HTTP error raised with badips request
@@ -48,18 +132,26 @@ ver. 0.9.1 (2014/xx/xx) - better, faster, stronger
    * cyrus-imap -- also catch also failed logins via secured (imaps/pop3s).
      Regression was introduced while strengthening failregex in 0.8.11 (bd175f)
      Debian bug #755173
-   * postfix-sasl -- added journalmatch.  Thanks Luc Maisonobe
+   * postfix-sasl - added journalmatch.  Thanks Luc Maisonobe
+   * postfix* - match with a new daemon string (postfix/submission/smtpd).
+     Closes gh-804 .  Thanks Paul Traina
+   * apache - added filter for AH01630 client denied by server configuration.
 
 - New features:
    - New filters:
      - monit  Thanks Jason H Martin
      - directadmin  Thanks niorg
+     - apache-shellshock  Thanks Eugene Hopkinson (SlowRiot)
    - New actions:
      - symbiosis-blacklist-allports  for Bytemark symbiosis firewall
    - fail2ban-client can fetch the running server version
    - Added Cloudflare API action
 
 - Enhancements
+   * Start performance of fail2ban-client (and tests) increased, start time
+     and cpu usage rapidly reduced. Introduced a shared storage logic, to
+     bypass reading lots of config files (see gh-824).
+     Thanks to Joost Molenaar for good catch (reported gh-820).
    * Fail2ban-regex - add print-all-matched option. Closes gh-652
    * Suppress fail2ban-client warnings for non-critical config options
    * Match non "Bye Bye" disconnect messages for sshd locked account regex
@@ -71,6 +163,7 @@ ver. 0.9.1 (2014/xx/xx) - better, faster, stronger
      not affect SYSLOG output
    * Log unhandled exceptions
    * cyrus-imap: catch "user not found" attempts
+   * Add support for Portsentry
 
 ver. 0.9.0 (2014/03/14) - beta
 ----------

DEVELOP

@@ -81,6 +81,18 @@ some quick commands::
   status test
 
 
+Testing with vagrant
+--------------------
+
+Testing can now be done inside a vagrant VM.  Vagrantfile provided in
+source code repository established two VMs:
+
+- VM "secure" which can be used for testing fail2ban code.
+- VM "attacker" which hcan be used to perform attack against our "secure" VM.
+
+Both VMs are sharing the 192.168.200/24 network. If you are using this network
+take a look into the Vagrantfile and change the IP.
+
 
 Coding Standards
 ================

MANIFEST

@@ -1,122 +1,272 @@
-README.md
-README.Solaris
-ChangeLog
-TODO
-THANKS
+CONTRIBUTING.md
 COPYING
+ChangeLog
 DEVELOP
 FILTERS
+README.Solaris
+README.md
+RELEASE
+THANKS
+TODO
+Vagrantfile
+bin/fail2ban-client
+bin/fail2ban-regex
+bin/fail2ban-server
+bin/fail2ban-testcases
+config/action.d/apf.conf
+config/action.d/badips.conf
+config/action.d/badips.py
+config/action.d/blocklist_de.conf
+config/action.d/bsd-ipfw.conf
+config/action.d/cloudflare.conf
+config/action.d/complain.conf
+config/action.d/dshield.conf
+config/action.d/dummy.conf
+config/action.d/firewallcmd-allports.conf
+config/action.d/firewallcmd-ipset.conf
+config/action.d/firewallcmd-multiport.conf
+config/action.d/firewallcmd-new.conf
+config/action.d/hostsdeny.conf
+config/action.d/ipfilter.conf
+config/action.d/ipfw.conf
+config/action.d/iptables-allports.conf
+config/action.d/iptables-common.conf
+config/action.d/iptables-ipset-proto4.conf
+config/action.d/iptables-ipset-proto6-allports.conf
+config/action.d/iptables-ipset-proto6.conf
+config/action.d/iptables-multiport-log.conf
+config/action.d/iptables-multiport.conf
+config/action.d/iptables-new.conf
+config/action.d/iptables-xt_recent-echo.conf
+config/action.d/iptables.conf
+config/action.d/mail-buffered.conf
+config/action.d/mail-whois-lines.conf
+config/action.d/mail-whois.conf
+config/action.d/mail.conf
+config/action.d/mynetwatchman.conf
+config/action.d/nsupdate.conf
+config/action.d/nsupdate.conf
+config/action.d/osx-afctl.conf
+config/action.d/osx-ipfw.conf
+config/action.d/pf.conf
+config/action.d/route.conf
+config/action.d/sendmail-buffered.conf
+config/action.d/sendmail-common.conf
+config/action.d/sendmail-geoip-lines.conf
+config/action.d/sendmail-whois-ipjailmatches.conf
+config/action.d/sendmail-whois-ipmatches.conf
+config/action.d/sendmail-whois-lines.conf
+config/action.d/sendmail-whois-matches.conf
+config/action.d/sendmail-whois.conf
+config/action.d/sendmail.conf
+config/action.d/shorewall.conf
+config/action.d/smtp.py
+config/action.d/symbiosis-blacklist-allports.conf
+config/action.d/ufw.conf
+config/action.d/xarf-login-attack.conf
+config/fail2ban.conf
+config/filter.d/3proxy.conf
+config/filter.d/apache-auth.conf
+config/filter.d/apache-badbots.conf
+config/filter.d/apache-botsearch.conf
+config/filter.d/apache-common.conf
+config/filter.d/apache-fakegooglebot.conf
+config/filter.d/apache-modsecurity.conf
+config/filter.d/apache-nohome.conf
+config/filter.d/apache-noscript.conf
+config/filter.d/apache-overflows.conf
+config/filter.d/apache-shellshock.conf
+config/filter.d/assp.conf
+config/filter.d/asterisk.conf
+config/filter.d/botsearch-common.conf
+config/filter.d/common.conf
+config/filter.d/counter-strike.conf
+config/filter.d/courier-auth.conf
+config/filter.d/courier-smtp.conf
+config/filter.d/cyrus-imap.conf
+config/filter.d/directadmin.conf
+config/filter.d/dovecot.conf
+config/filter.d/dropbear.conf
+config/filter.d/ejabberd-auth.conf
+config/filter.d/exim-common.conf
+config/filter.d/exim-spam.conf
+config/filter.d/exim.conf
+config/filter.d/freeswitch.conf
+config/filter.d/groupoffice.conf
+config/filter.d/gssftpd.conf
+config/filter.d/guacamole.conf
+config/filter.d/horde.conf
+config/filter.d/ignorecommands
+config/filter.d/ignorecommands/apache-fakegooglebot
+config/filter.d/kerio.conf
+config/filter.d/lighttpd-auth.conf
+config/filter.d/monit.conf
+config/filter.d/mysqld-auth.conf
+config/filter.d/nagios.conf
+config/filter.d/named-refused.conf
+config/filter.d/nginx-botsearch.conf
+config/filter.d/nginx-http-auth.conf
+config/filter.d/nsd.conf
+config/filter.d/openwebmail.conf
+config/filter.d/oracleims.conf
+config/filter.d/pam-generic.conf
+config/filter.d/pam-generic.conf
+config/filter.d/pam-generic.conf
+config/filter.d/perdition.conf
+config/filter.d/php-url-fopen.conf
+config/filter.d/php-url-fopen.conf
+config/filter.d/php-url-fopen.conf
+config/filter.d/portsentry.conf
+config/filter.d/postfix-rbl.conf
+config/filter.d/postfix-sasl.conf
+config/filter.d/postfix-sasl.conf
+config/filter.d/postfix-sasl.conf
+config/filter.d/postfix.conf
+config/filter.d/proftpd.conf
+config/filter.d/pure-ftpd.conf
+config/filter.d/qmail.conf
+config/filter.d/recidive.conf
+config/filter.d/roundcube-auth.conf
+config/filter.d/selinux-common.conf
+config/filter.d/selinux-ssh.conf
+config/filter.d/sendmail-auth.conf
+config/filter.d/sendmail-reject.conf
+config/filter.d/sendmail-spam.conf
+config/filter.d/sieve.conf
+config/filter.d/sogo-auth.conf
+config/filter.d/solid-pop3d.conf
+config/filter.d/squid.conf
+config/filter.d/squirrelmail.conf
+config/filter.d/sshd-ddos.conf
+config/filter.d/sshd.conf
+config/filter.d/stunnel.conf
+config/filter.d/suhosin.conf
+config/filter.d/tine20.conf
+config/filter.d/uwimap-auth.conf
+config/filter.d/vsftpd.conf
+config/filter.d/webmin-auth.conf
+config/filter.d/wuftpd.conf
+config/filter.d/xinetd-fail.conf
+config/jail.conf
+config/paths-common.conf
+config/paths-debian.conf
+config/paths-fedora.conf
+config/paths-freebsd.conf
+config/paths-osx.conf
+doc/run-rootless.txt
 fail2ban-2to3
 fail2ban-testcases-all
 fail2ban-testcases-all-python3
-bin/fail2ban-client
-bin/fail2ban-server
-bin/fail2ban-testcases
-bin/fail2ban-regex
-doc/run-rootless.txt
-fail2ban/client/configreader.py
-fail2ban/client/configparserinc.py
-fail2ban/client/jailreader.py
-fail2ban/client/fail2banreader.py
-fail2ban/client/jailsreader.py
-fail2ban/client/beautifier.py
-fail2ban/client/filterreader.py
-fail2ban/client/actionreader.py
+fail2ban/__init__.py
 fail2ban/client/__init__.py
+fail2ban/client/actionreader.py
+fail2ban/client/beautifier.py
+fail2ban/client/configparserinc.py
+fail2ban/client/configreader.py
 fail2ban/client/configurator.py
 fail2ban/client/csocket.py
-fail2ban/server/asyncserver.py
-fail2ban/server/database.py
-fail2ban/server/filter.py
-fail2ban/server/filterpyinotify.py
-fail2ban/server/filtergamin.py
-fail2ban/server/filterpoll.py
-fail2ban/server/filtersystemd.py
-fail2ban/server/iso8601.py
-fail2ban/server/server.py
+fail2ban/client/fail2banreader.py
+fail2ban/client/filterreader.py
+fail2ban/client/jailreader.py
+fail2ban/client/jailsreader.py
+fail2ban/exceptions.py
+fail2ban/helpers.py
+fail2ban/protocol.py
+fail2ban/server/__init__.py
+fail2ban/server/action.py
 fail2ban/server/actions.py
+fail2ban/server/asyncserver.py
+fail2ban/server/banmanager.py
+fail2ban/server/database.py
+fail2ban/server/datedetector.py
+fail2ban/server/datetemplate.py
 fail2ban/server/faildata.py
 fail2ban/server/failmanager.py
-fail2ban/server/datedetector.py
-fail2ban/server/jailthread.py
-fail2ban/server/transmitter.py
-fail2ban/server/action.py
-fail2ban/server/ticket.py
+fail2ban/server/failregex.py
+fail2ban/server/filter.py
+fail2ban/server/filtergamin.py
+fail2ban/server/filterpoll.py
+fail2ban/server/filterpyinotify.py
+fail2ban/server/filtersystemd.py
+fail2ban/server/iso8601.py
 fail2ban/server/jail.py
 fail2ban/server/jails.py
-fail2ban/server/__init__.py
-fail2ban/server/banmanager.py
-fail2ban/server/datetemplate.py
+fail2ban/server/jailthread.py
 fail2ban/server/mytime.py
-fail2ban/server/failregex.py
-fail2ban/server/database.py
-fail2ban/tests/banmanagertestcase.py
-fail2ban/tests/failmanagertestcase.py
-fail2ban/tests/clientreadertestcase.py
-fail2ban/tests/filtertestcase.py
+fail2ban/server/server.py
+fail2ban/server/strptime.py
+fail2ban/server/ticket.py
+fail2ban/server/transmitter.py
 fail2ban/tests/__init__.py
-fail2ban/tests/dummyjail.py
-fail2ban/tests/samplestestcase.py
-fail2ban/tests/datedetectortestcase.py
+fail2ban/tests/action_d/__init__.py
+fail2ban/tests/action_d/test_badips.py
+fail2ban/tests/action_d/test_smtp.py
+fail2ban/tests/actionstestcase.py
 fail2ban/tests/actiontestcase.py
-fail2ban/tests/servertestcase.py
-fail2ban/tests/sockettestcase.py
-fail2ban/tests/utils.py
-fail2ban/tests/misctestcase.py
-fail2ban/tests/databasetestcase.py
-fail2ban/tests/config/jail.conf
+fail2ban/tests/banmanagertestcase.py
+fail2ban/tests/clientreadertestcase.py
+fail2ban/tests/config/action.d/brokenaction.conf
 fail2ban/tests/config/fail2ban.conf
+fail2ban/tests/config/filter.d/simple.conf
+fail2ban/tests/config/filter.d/test.conf
+fail2ban/tests/config/filter.d/test.local
+fail2ban/tests/config/jail.conf
 fail2ban/tests/config/paths-common.conf
+fail2ban/tests/config/paths-debian.conf
 fail2ban/tests/config/paths-freebsd.conf
 fail2ban/tests/config/paths-osx.conf
-fail2ban/tests/config/paths-debian.conf
-fail2ban/tests/config/filter.d/simple.conf
-fail2ban/tests/config/action.d/brokenaction.conf
-fail2ban/tests/files/config/apache-auth/digest/.htaccess
-fail2ban/tests/files/config/apache-auth/digest/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest_time/.htaccess
-fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd
+fail2ban/tests/databasetestcase.py
+fail2ban/tests/datedetectortestcase.py
+fail2ban/tests/dummyjail.py
+fail2ban/tests/failmanagertestcase.py
+fail2ban/tests/files/action.d/action.py
+fail2ban/tests/files/action.d/action_checkainfo.py
+fail2ban/tests/files/action.d/action_errors.py
+fail2ban/tests/files/action.d/action_modifyainfo.py
+fail2ban/tests/files/action.d/action_noAction.py
+fail2ban/tests/files/action.d/action_nomethod.py
+fail2ban/tests/files/config/apache-auth/README
 fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htaccess
-fail2ban/tests/files/config/apache-auth/basic/authz_owner/cant_get_me.html
 fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htpasswd
+fail2ban/tests/files/config/apache-auth/basic/authz_owner/cant_get_me.html
 fail2ban/tests/files/config/apache-auth/basic/file/.htaccess
 fail2ban/tests/files/config/apache-auth/basic/file/.htpasswd
 fail2ban/tests/files/config/apache-auth/digest.py
-fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess
-fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd
+fail2ban/tests/files/config/apache-auth/digest/.htaccess
+fail2ban/tests/files/config/apache-auth/digest/.htpasswd
 fail2ban/tests/files/config/apache-auth/digest_anon/.htaccess
 fail2ban/tests/files/config/apache-auth/digest_anon/.htpasswd
-fail2ban/tests/files/config/apache-auth/README
+fail2ban/tests/files/config/apache-auth/digest_time/.htaccess
+fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd
+fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess
+fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd
 fail2ban/tests/files/config/apache-auth/noentry/.htaccess
 fail2ban/tests/files/database_v1.db
-fail2ban/tests/files/ignorecommand.py
 fail2ban/tests/files/filter.d/substition.conf
 fail2ban/tests/files/filter.d/testcase-common.conf
 fail2ban/tests/files/filter.d/testcase01.conf
-fail2ban/tests/files/testcase01.log
-fail2ban/tests/files/testcase02.log
-fail2ban/tests/files/testcase03.log
-fail2ban/tests/files/testcase04.log
-fail2ban/tests/files/testcase-usedns.log
-fail2ban/tests/files/testcase-journal.log
-fail2ban/tests/files/testcase-multiline.log
-fail2ban/tests/files/logs/bsd/syslog-plain.txt
-fail2ban/tests/files/logs/bsd/syslog-v.txt
-fail2ban/tests/files/logs/bsd/syslog-vv.txt
+fail2ban/tests/files/ignorecommand.py
 fail2ban/tests/files/logs/3proxy
 fail2ban/tests/files/logs/apache-auth
 fail2ban/tests/files/logs/apache-badbots
 fail2ban/tests/files/logs/apache-botscripts
+fail2ban/tests/files/logs/apache-botsearch
+fail2ban/tests/files/logs/apache-fakegooglebot
 fail2ban/tests/files/logs/apache-modsecurity
 fail2ban/tests/files/logs/apache-nohome
 fail2ban/tests/files/logs/apache-noscript
 fail2ban/tests/files/logs/apache-overflows
+fail2ban/tests/files/logs/apache-shellshock
 fail2ban/tests/files/logs/assp
 fail2ban/tests/files/logs/asterisk
+fail2ban/tests/files/logs/bsd/syslog-plain.txt
+fail2ban/tests/files/logs/bsd/syslog-v.txt
+fail2ban/tests/files/logs/bsd/syslog-vv.txt
 fail2ban/tests/files/logs/counter-strike
 fail2ban/tests/files/logs/courier-auth
 fail2ban/tests/files/logs/courier-smtp
 fail2ban/tests/files/logs/cyrus-imap
+fail2ban/tests/files/logs/directadmin
 fail2ban/tests/files/logs/dovecot
 fail2ban/tests/files/logs/dropbear
 fail2ban/tests/files/logs/ejabberd-auth
@@ -126,193 +276,94 @@ fail2ban/tests/files/logs/freeswitch
 fail2ban/tests/files/logs/groupoffice
 fail2ban/tests/files/logs/gssftpd
 fail2ban/tests/files/logs/guacamole
+fail2ban/tests/files/logs/horde
 fail2ban/tests/files/logs/kerio
 fail2ban/tests/files/logs/lighttpd-auth
+fail2ban/tests/files/logs/monit
 fail2ban/tests/files/logs/mysqld-auth
 fail2ban/tests/files/logs/nagios
+fail2ban/tests/files/logs/named-refused
+fail2ban/tests/files/logs/nginx-botsearch
+fail2ban/tests/files/logs/nginx-http-auth
 fail2ban/tests/files/logs/nsd
+fail2ban/tests/files/logs/openwebmail
+fail2ban/tests/files/logs/oracleims
+fail2ban/tests/files/logs/pam-generic
 fail2ban/tests/files/logs/perdition
 fail2ban/tests/files/logs/php-url-fopen
-fail2ban/tests/files/logs/postfix-sasl
-fail2ban/tests/files/logs/named-refused
-fail2ban/tests/files/logs/nginx-http-auth
-fail2ban/tests/files/logs/pam-generic
+fail2ban/tests/files/logs/portsentry
 fail2ban/tests/files/logs/postfix
+fail2ban/tests/files/logs/postfix-rbl
+fail2ban/tests/files/logs/postfix-sasl
 fail2ban/tests/files/logs/proftpd
 fail2ban/tests/files/logs/pure-ftpd
 fail2ban/tests/files/logs/qmail
 fail2ban/tests/files/logs/recidive
 fail2ban/tests/files/logs/roundcube-auth
 fail2ban/tests/files/logs/selinux-ssh
+fail2ban/tests/files/logs/sendmail-auth
+fail2ban/tests/files/logs/sendmail-reject
 fail2ban/tests/files/logs/sendmail-spam
 fail2ban/tests/files/logs/sieve
-fail2ban/tests/files/logs/squid
-fail2ban/tests/files/logs/stunnel
-fail2ban/tests/files/logs/suhosin
 fail2ban/tests/files/logs/sogo-auth
 fail2ban/tests/files/logs/solid-pop3d
+fail2ban/tests/files/logs/squid
+fail2ban/tests/files/logs/squirrelmail
 fail2ban/tests/files/logs/sshd
 fail2ban/tests/files/logs/sshd-ddos
+fail2ban/tests/files/logs/stunnel
+fail2ban/tests/files/logs/suhosin
+fail2ban/tests/files/logs/tine20
+fail2ban/tests/files/logs/uwimap-auth
 fail2ban/tests/files/logs/vsftpd
 fail2ban/tests/files/logs/webmin-auth
 fail2ban/tests/files/logs/wuftpd
-fail2ban/tests/files/logs/uwimap-auth
 fail2ban/tests/files/logs/xinetd-fail
-fail2ban/tests/config/jail.conf
-fail2ban/tests/config/fail2ban.conf
-fail2ban/tests/config/filter.d/simple.conf
-fail2ban/tests/config/action.d/brokenaction.conf
-setup.py
-setup.cfg
-fail2ban/__init__.py
-fail2ban/exceptions.py
-fail2ban/helpers.py
+fail2ban/tests/files/testcase-journal.log
+fail2ban/tests/files/testcase-multiline.log
+fail2ban/tests/files/testcase-usedns.log
+fail2ban/tests/files/testcase01.log
+fail2ban/tests/files/testcase02.log
+fail2ban/tests/files/testcase03.log
+fail2ban/tests/files/testcase04.log
+fail2ban/tests/filtertestcase.py
+fail2ban/tests/misctestcase.py
+fail2ban/tests/samplestestcase.py
+fail2ban/tests/servertestcase.py
+fail2ban/tests/sockettestcase.py
+fail2ban/tests/utils.py
 fail2ban/version.py
-fail2ban/protocol.py
-setup.py
-setup.cfg
-kill-server
-config/jail.conf
-config/fail2ban.conf
-config/filter.d/common.conf
-config/filter.d/apache-auth.conf
-config/filter.d/apache-badbots.conf
-config/filter.d/apache-botsearch.conf
-config/filter.d/apache-modsecurity.conf
-config/filter.d/apache-nohome.conf
-config/filter.d/apache-noscript.conf
-config/filter.d/apache-overflows.conf
-config/filter.d/nginx-http-auth.conf
-config/filter.d/counter-strike.conf
-config/filter.d/courier-auth.conf
-config/filter.d/courier-smtp.conf
-config/filter.d/cyrus-imap.conf
-config/filter.d/ejabberd-auth.conf
-config/filter.d/exim.conf
-config/filter.d/freeswitch.conf
-config/filter.d/gssftpd.conf
-config/filter.d/kerio.conf
-config/filter.d/horde.conf
-config/filter.d/suhosin.conf
-config/filter.d/nagios.conf
-config/filter.d/named-refused.conf
-config/filter.d/nsd.conf
-config/filter.d/openwebmail.conf
-config/filter.d/pam-generic.conf
-config/filter.d/php-url-fopen.conf
-config/filter.d/postfix-sasl.conf
-config/filter.d/pam-generic.conf
-config/filter.d/php-url-fopen.conf
-config/filter.d/postfix-sasl.conf
-config/filter.d/postfix.conf
-config/filter.d/proftpd.conf
-config/filter.d/pure-ftpd.conf
-config/filter.d/qmail.conf
-config/filter.d/pam-generic.conf
-config/filter.d/php-url-fopen.conf
-config/filter.d/postfix-sasl.conf
-config/filter.d/sendmail-auth.conf
-config/filter.d/sendmail-reject.conf
-config/filter.d/sieve.conf
-config/filter.d/solid-pop3d.conf
-config/filter.d/squid.conf
-config/filter.d/sshd.conf
-config/filter.d/sshd-ddos.conf
-config/filter.d/stunnel.conf
-config/filter.d/vsftpd.conf
-config/filter.d/webmin-auth.conf
-config/filter.d/wuftpd.conf
-config/filter.d/xinetd-fail.conf
-config/filter.d/asterisk.conf
-config/filter.d/dovecot.conf
-config/filter.d/dropbear.conf
-config/filter.d/lighttpd-auth.conf
-config/filter.d/recidive.conf
-config/filter.d/roundcube-auth.conf
-config/filter.d/assp.conf
-config/filter.d/sogo-auth.conf
-config/filter.d/mysqld-auth.conf
-config/filter.d/selinux-common.conf
-config/filter.d/selinux-ssh.conf
-config/filter.d/3proxy.conf
-config/filter.d/apache-common.conf
-config/filter.d/exim-common.conf
-config/filter.d/exim-spam.conf
-config/filter.d/freeswitch.conf
-config/filter.d/groupoffice.conf
-config/filter.d/perdition.conf
-config/filter.d/uwimap-auth.conf
-config/filter.d/courier-auth.conf
-config/filter.d/courier-smtp.conf
-config/filter.d/ejabberd-auth.conf
-config/filter.d/guacamole.conf
-config/filter.d/sendmail-spam.conf
-config/action.d/apf.conf
-config/action.d/blocklist_de.conf
-config/action.d/osx-afctl.conf
-config/action.d/osx-ipfw.conf
-config/action.d/sendmail-common.conf
-config/action.d/badips.conf
-config/action.d/bsd-ipfw.conf
-config/action.d/dummy.conf
-config/action.d/firewallcmd-new.conf
-config/action.d/firewallcmd-ipset.conf
-config/action.d/iptables-ipset-proto6-allports.conf
-config/action.d/iptables-common.conf
-config/action.d/iptables-ipset-proto4.conf
-config/action.d/iptables-ipset-proto6.conf
-config/action.d/iptables-xt_recent-echo.conf
-config/action.d/route.conf
-config/action.d/complain.conf
-config/action.d/dshield.conf
-config/action.d/hostsdeny.conf
-config/action.d/ipfw.conf
-config/action.d/ipfilter.conf
-config/action.d/iptables.conf
-config/action.d/iptables-allports.conf
-config/action.d/iptables-multiport.conf
-config/action.d/iptables-multiport-log.conf
-config/action.d/iptables-new.conf
-config/action.d/mail.conf
-config/action.d/mail-buffered.conf
-config/action.d/mail-whois.conf
-config/action.d/mail-whois-lines.conf
-config/action.d/mynetwatchman.conf
-config/action.d/pf.conf
-config/action.d/sendmail.conf
-config/action.d/sendmail-buffered.conf
-config/action.d/sendmail-whois-ipmatches.conf
-config/action.d/sendmail-whois.conf
-config/action.d/sendmail-whois-lines.conf
-config/action.d/shorewall.conf
-config/action.d/xarf-login-attack.conf
-config/action.d/ufw.conf
-config/fail2ban.conf
-doc/run-rootless.txt
-man/fail2ban-client.1
-man/fail2ban.1
-man/jail.conf.5
-man/fail2ban-client.h2m
-man/fail2ban-server.1
-man/fail2ban-server.h2m
-man/fail2ban-regex.1
-man/fail2ban-regex.h2m
-man/generate-man
-files/gentoo-initd
+files/bash-completion
+files/cacti/README
+files/cacti/cacti_host_template_fail2ban.xml
+files/cacti/fail2ban_stats.sh
+files/debian-initd
+files/fail2ban-logrotate
+files/fail2ban-tmpfiles.conf
+files/fail2ban.service
+files/fail2ban.upstart
+files/gen_badbots
 files/gentoo-confd
-files/redhat-initd
+files/gentoo-initd
+files/ipmasq-ZZZzzz_fail2ban.rul
+files/logwatch/fail2ban
 files/macosx-initd
+files/monit/fail2ban
+files/nagios/README
+files/nagios/check_fail2ban
+files/redhat-initd
 files/solaris-fail2ban.xml
 files/solaris-svc-fail2ban
 files/suse-initd
-files/fail2ban-logrotate
-files/cacti/fail2ban_stats.sh
-files/cacti/cacti_host_template_fail2ban.xml
-files/cacti/README
-files/nagios/check_fail2ban
-files/nagios/README
-files/bash-completion
-files/fail2ban-tmpfiles.conf
-files/fail2ban.service
-files/ipmasq-ZZZzzz_fail2ban.rul
-files/gen_badbots
+kill-server
+man/fail2ban-client.1
+man/fail2ban-client.h2m
+man/fail2ban-regex.1
+man/fail2ban-regex.h2m
+man/fail2ban-server.1
+man/fail2ban-server.h2m
+man/fail2ban.1
+man/generate-man
+man/jail.conf.5
+setup.cfg
+setup.py

MANIFEST.in

@@ -1,4 +1,5 @@
-include ChangeLog COPYING DEVELOP FILTERS README.* THANKS TODO
+include ChangeLog COPYING DEVELOP FILTERS README.* THANKS TODO CONTRIBUTING* Vagrantfile
 graft doc
 graft files
 recursive-include config *.conf *.py
+recursive-include config/filter.d/ignorecommands *

README.md

@@ -2,7 +2,7 @@
                         / _|__ _(_) |_  ) |__  __ _ _ _  
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
-                       v0.9.0                  2014/03/14
+                       v0.9.2                  2015/04/29
 
 ## Fail2Ban: ban hosts that cause multiple authentication errors
 
@@ -33,11 +33,12 @@ Optional:
   - Linux >= 2.6.13
 - [gamin >= 0.0.21](http://www.gnome.org/~veillard/gamin)
 - [systemd >= 204](http://www.freedesktop.org/wiki/Software/systemd)
+- [dnspython](http://www.dnspython.org/)
 
 To install, just do:
 
-    tar xvfj fail2ban-0.9.0.tar.bz2
-    cd fail2ban-0.9.0
+    tar xvfj fail2ban-0.9.2.tar.bz2
+    cd fail2ban-0.9.2
     python setup.py install
 
 This will install Fail2Ban into the python library directory. The executable

RELEASE

@@ -47,6 +47,10 @@ Preparation
 
 * Ensure the MANIFEST is complete
 
+  ad-hoc bash script to run in a clean clone:
+
+     find -type f | grep -v -e '\.git' -e '/doc/' -e '\.travis' -e MANIFEST | sed -e 's,^\./,,g' | while read f; do grep -ne "^$f\$" MANIFEST >/dev/null || echo "$f" ; done
+
 * Run::
 
   python setup.py sdist
@@ -57,24 +61,24 @@ Preparation
 
   * Which indicates that testcases/files/logs/mysqld.log has been moved or is a directory::
 
-      tar -C /tmp -jxf dist/fail2ban-0.9.0.tar.bz2
+      tar -C /tmp -jxf dist/fail2ban-0.9.2.tar.bz2
 
 * clean up current direcory::
 
-    diff -rul --exclude \*.pyc . /tmp/fail2ban-0.9.0/
+    diff -rul --exclude \*.pyc . /tmp/fail2ban-0.9.2/
 
   * Only differences should be files that you don't want distributed.
 
 
 * Ensure the tests work from the tarball::
 
-    cd /tmp/fail2ban-0.9.0/ && export PYTHONPATH=`pwd` && bin/fail2ban-testcases
+    cd /tmp/fail2ban-0.9.2/ && bin/fail2ban-testcases
 
 * Add/finalize the corresponding entry in the ChangeLog
 
   * To generate a list of committers use e.g.::
 
-      git shortlog -sn 0.8.12.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
+      git shortlog -sn 0.9.2.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
 
   * Ensure the top of the ChangeLog has the right version and current date.
   * Ensure the top entry of the ChangeLog has the right version and current date.
@@ -97,7 +101,7 @@ Preparation
 * Tag the release by using a signed (and annotated) tag.  Cut/paste
   release ChangeLog entry as tag annotation::
 
-    git tag -s 0.9.1
+    git tag -s 0.9.2
 
 Pre Release
 ===========
@@ -140,7 +144,7 @@ Pre Release
 
     * https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
 
-  * An potentially to the fail2ban-users email list.
+  * And potentially to the fail2ban-users email list.
 
 
 * Wait for feedback from distributors
@@ -181,7 +185,7 @@ Post Release
 
 Add the following to the top of the ChangeLog::
 
-  ver. 0.9.1 (2014/XX/XXX) - wanna-be-released
+  ver. 0.9.3 (2014/XX/XXX) - wanna-be-released
   -----------
   
   - Fixes:

THANKS

@@ -6,6 +6,7 @@ the project.  If you have been left off, please let us know
 (preferably send a pull request on github with the "fix") and you will
 be added
 
+Aaron Brice
 Adam Tkac
 Adrien Clerc
 ache
@@ -13,6 +14,7 @@ ag4ve (Shawn)
 Alasdair D. Campbell
 Amir Caspi
 Amy
+Andrew St. Jean
 Andrey G. Grozin
 Andy Fragen
 Arturo 'Buanzo' Busleiman
@@ -26,16 +28,20 @@ Christian Rauch
 Christophe Carles
 Christoph Haas
 Christos Psonis
+craneworks
 Cyril Jaquier
 Daniel B. Cid
 Daniel B.
 Daniel Black
 David Nutter
 Derek Atkins
+Donald Yandt
 Eric Gerbier
 Enrico Labedzki
+Eugene Hopkinson (SlowRiot)
 ftoppi
 François Boulogne
+Frantisek Sumsal
 Frédéric
 Georgiy Mernov
 Guilhem Lettron
@@ -80,7 +86,9 @@ Michael Hanselmann
 Mika (mkl)
 Nick Munger
 onorua
+Orion Poplawski
 Paul Marrapese
+Paul Traina
 Noel Butler
 Patrick Börjesson
 Pressy

Vagrantfile

@@ -1,10 +1,5 @@
 Vagrant.configure("2") do |config|
 
-  config.vm.define "builder" do |builder|
-    builder.vm.box = "vm144"
-    builder.vm.provision "shell", path: "provision.sh"
-  end
-
     config.vm.define "secure" do |secure|
         secure.vm.box = "ubuntu/trusty64"
         secure.vm.hostname = "secure.dev.fail2ban.org"

bin/fail2ban-client

@@ -59,53 +59,53 @@ class Fail2banClient:
 		self.__conf["pidfile"] = None
 
 	def dispVersion(self):
-		print("Fail2Ban v" + version)
-		print()
-		print("Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors")
-		print("Copyright of modifications held by their respective authors.")
-		print("Licensed under the GNU General Public License v2 (GPL).")
-		print()
-		print("Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.")
-		print("Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.")
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
 
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
-		print("Usage: "+self.__argv[0]+" [OPTIONS] <COMMAND>")
-		print()
-		print("Fail2Ban v" + version + " reads log file that contains password failure report")
-		print("and bans the corresponding IP addresses using firewall rules.")
-		print()
-		print("Options:")
-		print("    -c <DIR>                configuration directory")
-		print("    -s <FILE>               socket path")
-		print("    -p <FILE>               pidfile path")
-		print("    -d                      dump configuration. For debugging")
-		print("    -i                      interactive mode")
-		print("    -v                      increase verbosity")
-		print("    -q                      decrease verbosity")
-		print("    -x                      force execution of the server (remove socket file)")
-		print("    -b                      start server in background (default)")
-		print("    -f                      start server in foreground (note that the client forks once itself)")
-		print("    -h, --help              display this help message")
-		print("    -V, --version           print the version")
-		print()
-		print("Command:")
+		print "Usage: "+self.__argv[0]+" [OPTIONS] <COMMAND>"
+		print
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+		print "Options:"
+		print "    -c <DIR>                configuration directory"
+		print "    -s <FILE>               socket path"
+		print "    -p <FILE>               pidfile path"
+		print "    -d                      dump configuration. For debugging"
+		print "    -i                      interactive mode"
+		print "    -v                      increase verbosity"
+		print "    -q                      decrease verbosity"
+		print "    -x                      force execution of the server (remove socket file)"
+		print "    -b                      start server in background (default)"
+		print "    -f                      start server in foreground (note that the client forks once itself)"
+		print "    -h, --help              display this help message"
+		print "    -V, --version           print the version"
+		print
+		print "Command:"
 
 		# Prints the protocol
 		printFormatted()
 
-		print()
-		print("Report bugs to https://github.com/fail2ban/fail2ban/issues")
+		print
+		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
 
 	def dispInteractive(self):
-		print("Fail2Ban v" + version + " reads log file that contains password failure report")
-		print("and bans the corresponding IP addresses using firewall rules.")
-		print()
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
 
 	def __sigTERMhandler(self, signum, frame):
 		# Print a new line because we probably come from wait
-		print()
+		print
 		logSys.warning("Caught signal %d. Exiting" % signum)
 		sys.exit(-1)
 
@@ -152,19 +152,19 @@ class Fail2banClient:
 				client = CSocket(self.__conf["socket"])
 				ret = client.send(c)
 				if ret[0] == 0:
-					logSys.debug("OK : " + repr(ret[1]))
+					logSys.debug("OK : " + `ret[1]`)
 					if showRet:
-						print(beautifier.beautify(ret[1]))
+						print beautifier.beautify(ret[1])
 				else:
-					logSys.error("NOK: " + repr(ret[1].args))
+					logSys.error("NOK: " + `ret[1].args`)
 					if showRet:
-						print(beautifier.beautifyError(ret[1]))
+						print beautifier.beautifyError(ret[1])
 					streamRet = False
 			except socket.error:
 				if showRet:
 					logSys.error("Unable to contact server. Is it running?")
 				return False
-			except Exception as e:
+			except Exception, e:
 				if showRet:
 					logSys.error(e)
 				return False
@@ -383,7 +383,7 @@ class Fail2banClient:
 					readline.parse_and_bind("tab: complete")
 					self.dispInteractive()
 					while True:
-						cmd = input(self.PROMPT)
+						cmd = raw_input(self.PROMPT)
 						if cmd == "exit" or cmd == "quit":
 							# Exit
 							return True
@@ -392,10 +392,10 @@ class Fail2banClient:
 						elif not cmd == "":
 							try:
 								self.__processCommand(shlex.split(cmd))
-							except Exception as e:
+							except Exception, e:
 								logSys.error(e)
 			except (EOFError, KeyboardInterrupt):
-				print()
+				print
 				return True
 		# Single command mode
 		else:
@@ -409,21 +409,21 @@ class Fail2banClient:
 		# TODO: get away from stew of return codes and exception
 		# handling -- handle via exceptions
 		try:
+			self.__configurator.Reload()
 			self.__configurator.readAll()
 			ret = self.__configurator.getOptions(jail)
 			self.__configurator.convertToProtocol()
 			self.__stream = self.__configurator.getConfigStream()
-		except Exception as e:
+		except Exception, e:
 			logSys.error("Failed during configuration: %s" % e)
 			ret = False
 		return ret
 
-	#@staticmethod
+	@staticmethod
 	def dumpConfig(cmd):
 		for c in cmd:
-			print(c)
+			print c
 		return True
-	dumpConfig = staticmethod(dumpConfig)
 
 
 class ServerExecutionException(Exception):

bin/fail2ban-regex

@@ -29,10 +29,10 @@ __author__ = "Fail2Ban Developers"
 __copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko"
 __license__ = "GPL"
 
-import getopt, sys, time, logging, os, locale, shlex, time, urllib.request, urllib.parse, urllib.error
+import getopt, sys, time, logging, os, locale, shlex, time, urllib
 from optparse import OptionParser, Option
 
-from configparser import NoOptionError, NoSectionError, MissingSectionHeaderError
+from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
 
 try:
 	from systemd import journal
@@ -50,7 +50,7 @@ from fail2ban.helpers import FormatterWithTraceBack, getLogger
 logSys = getLogger("fail2ban")
 
 def debuggexURL(sample, regex):
-	q = urllib.parse.urlencode({ 're': regex.replace('<HOST>', '(?&.ipv4)'),
+	q = urllib.urlencode({ 're': regex.replace('<HOST>', '(?&.ipv4)'),
 							'str': sample,
 							'flavor': 'python' })
 	return 'http://www.debuggex.com/?' + q
@@ -69,7 +69,7 @@ def pprint_list(l, header=None):
 		s = "|- %s\n" % header
 	else:
 		s = ''
-	print(s + "|  " + "\n|  ".join(l) + '\n`-')
+	print s + "|  " + "\n|  ".join(l) + '\n`-'
 
 def file_lines_gen(hdlr):
 	for line in hdlr:
@@ -220,6 +220,7 @@ class Fail2banRegex(object):
 		self._datepattern_set = False
 		self._journalmatch = None
 
+		self.share_config=dict()
 		self._filter = Filter(None)
 		self._ignoreregex = list()
 		self._failregex = list()
@@ -244,14 +245,14 @@ class Fail2banRegex(object):
 			self._filter.setDatePattern(pattern)
 			self._datepattern_set = True
 			if pattern is not None:
-				print("Use      datepattern : %s" % (
-					self._filter.getDatePattern()[1], ))
+				print "Use      datepattern : %s" % (
+					self._filter.getDatePattern()[1], )
 
 	def setMaxLines(self, v):
 		if not self._maxlines_set:
 			self._filter.setMaxLines(int(v))
 			self._maxlines_set = True
-			print("Use         maxlines : %d" % self._filter.getMaxLines())
+			print "Use         maxlines : %d" % self._filter.getMaxLines()
 
 	def setJournalMatch(self, v):
 		if self._journalmatch is None:
@@ -260,38 +261,49 @@ class Fail2banRegex(object):
 	def readRegex(self, value, regextype):
 		assert(regextype in ('fail', 'ignore'))
 		regex = regextype + 'regex'
-		if os.path.isfile(value):
-			print("Use %11s file : %s" % (regex, value))
-			reader = FilterReader(value, 'fail2ban-regex-jail', {})
-			reader.setBaseDir(None)
-
-			if reader.readexplicit():
-				reader.getOptions(None)
-				readercommands = reader.convert()
-				regex_values = [
-					RegexStat(m[3])
-					for m in [x for x in readercommands if x[0] == 'set' and x[2] == "add%sregex" % regextype]]
-				# Read out and set possible value of maxlines
-				for command in readercommands:
-					if command[2] == "maxlines":
-						maxlines = int(command[3])
-						try:
-							self.setMaxLines(maxlines)
-						except ValueError:
-							print("ERROR: Invalid value for maxlines (%(maxlines)r) " \
-								  "read from %(value)s" % locals())
-							return False
-					elif command[2] == 'addjournalmatch':
-						journalmatch = command[3]
-						self.setJournalMatch(shlex.split(journalmatch))
-					elif command[2] == 'datepattern':
-						datepattern = command[3]
-						self.setDatePattern(datepattern)
+		if os.path.isfile(value) or os.path.isfile(value + '.conf'):
+			if os.path.basename(os.path.dirname(value)) == 'filter.d':
+				## within filter.d folder - use standard loading algorithm to load filter completely (with .local etc.):
+				basedir = os.path.dirname(os.path.dirname(value))
+				value = os.path.splitext(os.path.basename(value))[0]
+				print "Use %11s filter file : %s, basedir: %s" % (regex, value, basedir)
+				reader = FilterReader(value, 'fail2ban-regex-jail', {}, share_config=self.share_config, basedir=basedir)
+				if not reader.read():
+					print "ERROR: failed to load filter %s" % value
+					return False
 			else:
-				print("ERROR: failed to read %s" % value)
-				return False
+				## foreign file - readexplicit this file and includes if possible:
+				print "Use %11s file : %s" % (regex, value)
+				reader = FilterReader(value, 'fail2ban-regex-jail', {}, share_config=self.share_config)
+				reader.setBaseDir(None)
+				if not reader.readexplicit():
+					print "ERROR: failed to read %s" % value
+					return False
+			reader.getOptions(None)
+			readercommands = reader.convert()
+			regex_values = [
+				RegexStat(m[3])
+				for m in filter(
+					lambda x: x[0] == 'set' and x[2] == "add%sregex" % regextype,
+					readercommands)]
+			# Read out and set possible value of maxlines
+			for command in readercommands:
+				if command[2] == "maxlines":
+					maxlines = int(command[3])
+					try:
+						self.setMaxLines(maxlines)
+					except ValueError:
+						print "ERROR: Invalid value for maxlines (%(maxlines)r) " \
+							  "read from %(value)s" % locals()
+						return False
+				elif command[2] == 'addjournalmatch':
+					journalmatch = command[3]
+					self.setJournalMatch(shlex.split(journalmatch))
+				elif command[2] == 'datepattern':
+					datepattern = command[3]
+					self.setDatePattern(datepattern)
 		else:
-			print("Use %11s line : %s" % (regex, shortstr(value)))
+			print "Use %11s line : %s" % (regex, shortstr(value))
 			regex_values = [RegexStat(value)]
 
 		setattr(self, "_" + regex, regex_values)
@@ -308,8 +320,8 @@ class Fail2banRegex(object):
 			if ret is not None:
 				found = True
 				regex = self._ignoreregex[ret].inc()
-		except RegexException as e:
-			print(e)
+		except RegexException, e:
+			print e
 			return False
 		return found
 
@@ -325,11 +337,11 @@ class Fail2banRegex(object):
 				regex = self._failregex[match[0]]
 				regex.inc()
 				regex.appendIP(match)
-		except RegexException as e:
-			print(e)
+		except RegexException, e:
+			print e
 			return False
 		except IndexError:
-			print("Sorry, but no <HOST> found in regex")
+			print "Sorry, but no <HOST> found in regex"
 			return False
 		for bufLine in orgLineBuffer[int(fullBuffer):]:
 			if bufLine not in self._filter._Filter__lineBuffer:
@@ -403,21 +415,21 @@ class Fail2banRegex(object):
 					ans = [[]]
 					for arg in [l, regexlist]:
 						ans = [ x + [y] for x in ans for y in arg ]
-					b = [a[0] +  ' | ' + a[1].getFailRegex() + ' |  ' + debuggexURL(a[0], a[1].getFailRegex()) for a in ans]
+					b = map(lambda a: a[0] +  ' | ' + a[1].getFailRegex() + ' |  ' + debuggexURL(a[0], a[1].getFailRegex()), ans)
 					pprint_list([x.rstrip() for x in b], header)
 				else:
-					print("%s too many to print.  Use --print-all-%s " \
-						  "to print all %d lines" % (header, ltype, lines))
+					print "%s too many to print.  Use --print-all-%s " \
+						  "to print all %d lines" % (header, ltype, lines)
 			elif lines < self._maxlines or getattr(self, '_print_all_' + ltype):
 				pprint_list([x.rstrip() for x in l], header)
 			else:
-				print("%s too many to print.  Use --print-all-%s " \
-					  "to print all %d lines" % (header, ltype, lines))
+				print "%s too many to print.  Use --print-all-%s " \
+					  "to print all %d lines" % (header, ltype, lines)
 
 	def printStats(self):
-		print()
-		print("Results")
-		print("=======")
+		print
+		print "Results"
+		print "======="
 
 		def print_failregexes(title, failregexes):
 			# Print title
@@ -438,7 +450,7 @@ class Fail2banRegex(object):
 								timeString,
 								ip[-1] and " (multiple regex matched)" or ""))
 
-			print("\n%s: %d total" % (title, total))
+			print "\n%s: %d total" % (title, total)
 			pprint_list(out, " #) [# of hits] regular expression")
 			return total
 
@@ -448,7 +460,7 @@ class Fail2banRegex(object):
 
 
 		if self._filter.dateDetector is not None:
-			print("\nDate template hits:")
+			print "\nDate template hits:"
 			out = []
 			for template in self._filter.dateDetector.templates:
 				if self._verbose or template.hits:
@@ -456,10 +468,10 @@ class Fail2banRegex(object):
 						template.hits, template.name))
 			pprint_list(out, "[# of hits] date format")
 
-		print("\nLines: %s" % self._line_stats, end=' ')
+		print "\nLines: %s" % self._line_stats,
 		if self._time_elapsed is not None:
-			print("[processed in %.2f sec]" % self._time_elapsed, end=' ')
-		print()
+			print "[processed in %.2f sec]" % self._time_elapsed,
+		print
 
 		if self._print_all_matched:
 			self.printLines('matched')
@@ -484,10 +496,10 @@ if __name__ == "__main__":
 		parser.print_help()
 		sys.exit(-1)
 
-	print()
-	print("Running tests")
-	print("=============")
-	print()
+	print
+	print "Running tests"
+	print "============="
+	print
 
 	fail2banRegex = Fail2banRegex(opts)
 
@@ -536,15 +548,15 @@ if __name__ == "__main__":
 	if os.path.isfile(cmd_log):
 		try:
 			hdlr = open(cmd_log, 'rb')
-			print("Use         log file : %s" % cmd_log)
-			print("Use         encoding : %s" % fail2banRegex.encoding)
+			print "Use         log file : %s" % cmd_log
+			print "Use         encoding : %s" % fail2banRegex.encoding
 			test_lines = file_lines_gen(hdlr)
-		except IOError as e:
-			print(e)
+		except IOError, e:
+			print e
 			sys.exit(-1)
 	elif cmd_log == "systemd-journal":
 		if not journal:
-			print("Error: systemd library not found. Exiting...")
+			print "Error: systemd library not found. Exiting..."
 			sys.exit(-1)
 		myjournal = journal.Reader(converters={'__CURSOR': lambda x: x})
 		journalmatch = fail2banRegex._journalmatch
@@ -557,14 +569,14 @@ if __name__ == "__main__":
 					else:
 						myjournal.add_match(element)
 			except ValueError:
-				print("Error: Invalid journalmatch: %s" % shortstr(" ".join(journalmatch)))
+				print "Error: Invalid journalmatch: %s" % shortstr(" ".join(journalmatch))
 				sys.exit(-1)
-		print("Use    journal match : %s" % " ".join(journalmatch))
+		print "Use    journal match : %s" % " ".join(journalmatch)
 		test_lines = journal_lines_gen(myjournal)
 	else:
-		print("Use      single line : %s" % shortstr(cmd_log))
+		print "Use      single line : %s" % shortstr(cmd_log)
 		test_lines = [ cmd_log ]
-	print()
+	print
 
 	fail2banRegex.process(test_lines)
 

bin/fail2ban-server

@@ -51,37 +51,37 @@ class Fail2banServer:
 		self.__conf["pidfile"] = "/var/run/fail2ban/fail2ban.pid"
 
 	def dispVersion(self):
-		print("Fail2Ban v" + version)
-		print()
-		print("Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors")
-		print("Copyright of modifications held by their respective authors.")
-		print("Licensed under the GNU General Public License v2 (GPL).")
-		print()
-		print("Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.")
-		print("Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.")
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
 
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
-		print("Usage: "+self.__argv[0]+" [OPTIONS]")
-		print()
-		print("Fail2Ban v" + version + " reads log file that contains password failure report")
-		print("and bans the corresponding IP addresses using firewall rules.")
-		print()
-		print("Only use this command for debugging purpose. Start the server with")
-		print("fail2ban-client instead. The default behaviour is to start the server")
-		print("in background.")
-		print()
-		print("Options:")
-		print("    -b                   start in background")
-		print("    -f                   start in foreground")
-		print("    -s <FILE>            socket path")
-		print("    -p <FILE>            pidfile path")
-		print("    -x                   force execution of the server (remove socket file)")
-		print("    -h, --help           display this help message")
-		print("    -V, --version        print the version")
-		print()
-		print("Report bugs to https://github.com/fail2ban/fail2ban/issues")
+		print "Usage: "+self.__argv[0]+" [OPTIONS]"
+		print
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+		print "Only use this command for debugging purpose. Start the server with"
+		print "fail2ban-client instead. The default behaviour is to start the server"
+		print "in background."
+		print
+		print "Options:"
+		print "    -b                   start in background"
+		print "    -f                   start in foreground"
+		print "    -s <FILE>            socket path"
+		print "    -p <FILE>            pidfile path"
+		print "    -x                   force execution of the server (remove socket file)"
+		print "    -h, --help           display this help message"
+		print "    -V, --version        print the version"
+		print
+		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
 
 	def __getCmdLineOptions(self, optList):
 		""" Gets the command line options
@@ -125,7 +125,7 @@ class Fail2banServer:
 								self.__conf["pidfile"],
 								self.__conf["force"])
 			return True
-		except Exception as e:
+		except Exception, e:
 			logSys.exception(e)
 			self.__server.quit()
 			return False

bin/fail2ban-testcases

@@ -114,8 +114,8 @@ logSys.addHandler(stdout)
 # Let know the version
 #
 if not opts.log_level or opts.log_level != 'critical': # pragma: no cover
-	print(("Fail2ban %s test suite. Python %s. Please wait..." \
-	    % (version, str(sys.version).replace('\n', ''))))
+	print("Fail2ban %s test suite. Python %s. Please wait..." \
+	    % (version, str(sys.version).replace('\n', '')))
 
 tests = gatherTests(regexps, opts.no_network)
 #

config/action.d/badips.py

@@ -111,6 +111,8 @@ class BadIPsAction(ActionBase):
 		------
 		HTTPError
 			Any issues with badips.com request.
+		ValueError
+			If badips.com response didn't contain necessary information
 		"""
 		try:
 			response = urlopen(
@@ -122,7 +124,13 @@ class BadIPsAction(ActionBase):
 				messages['err'])
 			raise
 		else:
-			categories = json.loads(response.read().decode('utf-8'))['categories']
+			response_json = json.loads(response.read().decode('utf-8'))
+			if not 'categories' in response_json:
+				err = "badips.com response lacked categories specification. Response was: %s" \
+				  % (response_json,)
+				self._logSys.error(err)
+				raise ValueError(err)
+			categories = response_json['categories']
 			categories_names = set(
 				value['Name'] for value in categories)
 			if incParents:

config/action.d/bsd-ipfw.conf

@@ -38,7 +38,7 @@ actioncheck =
 # Values:  CMD
 #
 # requires an ipfw rule like "deny ip from table(1) to me"
-actionban = ipfw table <table> add <ip>
+actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || { echo "$e" 1>&2; exit $x; }
 
 
 # Option:  actionunban
@@ -47,7 +47,7 @@ actionban = ipfw table <table> add <ip>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipfw table <table> delete <ip>
+actionunban = e=`ipfw table <table> delete <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || { echo "$e" 1>&2; exit $x; }
 
 [Init]
 # Option:  table

config/action.d/firewallcmd-allports.conf

@@ -0,0 +1,53 @@
+# Fail2Ban configuration file
+#
+# Author: Donald Yandt 
+# Because of the --remove-rules in stop this action requires firewalld-0.3.8+
+
+
+[INCLUDES]
+
+before = iptables-blocktype.conf
+
+[Definition]
+
+actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
+              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -j f2b-<name>
+
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -j f2b-<name>
+             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
+             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
+
+
+# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-recidive$'
+
+actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
+
+actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+
+actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+
+[Init]
+
+# Default name of the chain
+#
+name = default
+
+chain = INPUT_direct
+
+# DEV NOTES:
+#
+# Author: Donald Yandt 
+# Uses "FirewallD" instead of the "iptables daemon".
+#
+#
+# Output:
+
+# actionstart:
+# $ firewall-cmd --direct --add-chain ipv4 filter f2b-recidive
+# success
+# $ firewall-cmd --direct --add-rule ipv4 filter f2b-recidive 1000 -j RETURN
+# success
+# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-recidive
+# success
+

config/action.d/firewallcmd-multiport.conf

@@ -0,0 +1,63 @@
+# Fail2Ban configuration file
+#
+# Author: Donald Yandt 
+# Because of the --remove-rules in stop this action requires firewalld-0.3.8+
+
+[INCLUDES]
+
+before = iptables-blocktype.conf
+
+[Definition]
+
+actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
+              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
+             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
+
+# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$'
+
+actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
+
+actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+
+actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+
+[Init]
+
+# Default name of the chain
+name = default
+
+chain = INPUT_direct
+
+# Could also use port numbers separated by a comma. 
+port = 1:65535
+
+
+# Option:  protocol
+# Values:  [ tcp | udp | icmp | all ]
+
+protocol = tcp
+
+
+
+# DEV NOTES:
+#
+# Author: Donald Yandt 
+# Uses "FirewallD" instead of the "iptables daemon".
+#
+#
+# Output:
+# actionstart:
+# $ firewall-cmd --direct --add-chain ipv4 filter f2b-apache-modsecurity
+# success
+# $ firewall-cmd --direct --add-rule ipv4 filter f2b-apache-modsecurity 1000 -j RETURN
+# success
+# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 80,443 -j f2b-apache-modsecurity
+# success
+# actioncheck:
+# $ firewall-cmd --direct --get-chains ipv4 filter f2b-apache-modsecurity | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$'
+# f2b-apache-modsecurity
+

config/action.d/firewallcmd-new.conf

@@ -10,9 +10,9 @@ before = iptables-common.conf
 
 actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
               firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
 
-actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
              firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
              firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
 
@@ -43,7 +43,7 @@ chain = INPUT_direct
 # success
 # $ firewall-cmd --direct --add-rule ipv4 filter fail2ban-name 1000 -j RETURN
 # success
-# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp --dport 22 -j fail2ban-name
+# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 22 -j fail2ban-name
 # success
 # $ firewall-cmd --direct --get-chains ipv4 filter
 # fail2ban-name

config/action.d/mail-whois-lines.conf

@@ -42,7 +42,7 @@ actionban = printf %%b "Hi,\n
             Here is more information about <ip>:\n
             `whois <ip> || echo missing whois program`\n\n
             Lines containing IP:<ip> in <logpath>\n
-            `grep '[^0-9]<ip>[^0-9]' <logpath>`\n\n
+            `grep -E '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from  `uname -n`" <dest>
 

config/action.d/nsupdate.conf

@@ -0,0 +1,114 @@
+# Fail2Ban configuration file
+#
+# Author: Andrew St. Jean
+#
+# Use nsupdate to perform dynamic DNS updates on a BIND zone file.
+# One may want to do this to update a local RBL with banned IP addresses.
+#
+# Options
+#
+# domain	DNS domain that will appear in nsupdate add and delete
+#		commands.
+#
+# ttl		The time to live (TTL) in seconds of the TXT resource
+#		record.
+#
+# rdata		Data portion of the TXT resource record.
+#
+# nsupdatecmd	Full path to the nsupdate command.
+#
+# keyfile	Full path to TSIG key file used for authentication between
+#		nsupdate and BIND.
+#
+# Create an nsupdate.local to set at least the <domain> and <keyfile>
+# options as they don't have default values.
+#
+# The ban and unban commands assume nsupdate will authenticate to the BIND
+# server using a TSIG key. The full path to the key file must be specified
+# in the <keyfile> parameter. Use this command to generate your TSIG key.
+#
+# dnssec-keygen -a HMAC-MD5 -b 256 -n HOST <key_name>
+#
+# Replace <key_name> with some meaningful name.
+#
+# This command will generate two files. Specify the .private file in the
+# <keyfile> option. Note that the .key file must also be present in the same
+# directory for nsupdate to use the key.
+#
+# Don't forget to add the key and appropriate allow-update or update-policy
+# option to your named.conf file.
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart =
+
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop =
+
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck =
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = echo <ip> | awk -F. '{print "prereq nxrrset "$4"."$3"."$2"."$1".<domain> TXT"; print "update add "$4"."$3"."$2"."$1".<domain> <ttl> IN TXT \"<rdata>\""; print "send"}' | <nsupdatecmd> -k <keyfile>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = echo <ip> | awk -F. '{print "update delete "$4"."$3"."$2"."$1".<domain>"; print "send"}' | <nsupdatecmd> -k <keyfile>
+
+[Init]
+
+# Option:  domain
+# Notes.:  DNS domain that nsupdate will update.
+# Values:  STRING
+#
+domain = 
+
+# Option:  ttl
+# Notes.:  time to live (TTL) in seconds of TXT resource record
+#          added by nsupdate.
+# Values:  NUM
+#
+ttl = 60
+
+# Option:  rdata
+# Notes.:  data portion of the TXT resource record added by nsupdate.
+# Values:  STRING
+#
+rdata = Your IP has been banned
+
+# Option:  nsupdatecmd
+# Notes.:  specifies the full path to the nsupdate program that dynamically
+#          updates BIND zone files.
+# Values:  CMD
+#
+nsupdatecmd = /usr/bin/nsupdate
+
+# Option:  keyfile
+# Notes.:  specifies the full path to the file containing the
+#	   TSIG key for communicating with BIND.
+# Values:  STRING
+#
+keyfile = 
+

config/action.d/sendmail-common.conf

@@ -15,7 +15,7 @@ after = sendmail-common.local
 # Values:  CMD
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
-              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+              Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"`
               From: <sendername> <<sender>>
               To: <dest>\n
               Hi,\n
@@ -28,7 +28,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
 # Values:  CMD
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
-             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+             Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"`
              From: <sendername> <<sender>>
              To: <dest>\n
              Hi,\n

config/action.d/sendmail-geoip-lines.conf

@@ -0,0 +1,49 @@
+# Fail2Ban configuration file
+#
+# Author: Viktor Szépe
+#
+#
+
+[INCLUDES]
+
+before = sendmail-common.conf
+
+[Definition]
+
+# Option:  actionban
+# Notes.:  Command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+#          You need to install geoiplookup and the GeoLite or GeoIP databases.
+#          (geoip-bin and geoip-database in Debian)
+#          The host command comes from bind9-host package.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
+            Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"`
+            From: <sendername> <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here is more information about <ip>:\n
+            http://bgp.he.net/ip/<ip>
+            http://www.projecthoneypot.org/ip_<ip>
+            http://whois.domaintools.com/<ip>\n\n
+            Country:`geoiplookup -f /usr/share/GeoIP/GeoIP.dat "<ip>" | cut -d':' -f2-`
+            AS:`geoiplookup -f /usr/share/GeoIP/GeoIPASNum.dat "<ip>" | cut -d':' -f2-`
+            hostname: `host -t A <ip> 2>&1`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `grep -E '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+[Init]
+
+# Default name of the chain
+#
+name = default
+
+# Path to the log files which contain relevant lines for the abuser IP
+#
+logpath = /dev/null

config/action.d/sendmail-whois-ipjailmatches.conf

@@ -17,13 +17,13 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+            Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here are more information about <ip>:\n
+            Here is more information about <ip>:\n
             `/usr/bin/whois <ip>`\n\n
             Matches for <name> with <ipjailfailures> failures IP:<ip>\n
             <ipjailmatches>\n\n

config/action.d/sendmail-whois-ipmatches.conf

@@ -17,13 +17,13 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+            Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here are more information about <ip>:\n
+            Here is more information about <ip>:\n
             `/usr/bin/whois <ip>`\n\n
             Matches with <ipfailures> failures IP:<ip>\n
             <ipmatches>\n\n

config/action.d/sendmail-whois-lines.conf

@@ -17,7 +17,7 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+            Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
@@ -26,7 +26,7 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Here is more information about <ip>:\n
             `/usr/bin/whois <ip> || echo missing whois program`\n\n
             Lines containing IP:<ip> in <logpath>\n
-            `grep '[^0-9]<ip>[^0-9]' <logpath>`\n\n
+            `grep -E '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
             Regards,\n
             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 

config/action.d/sendmail-whois-matches.conf

@@ -17,13 +17,13 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+            Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here are more information about <ip>:\n
+            Here is more information about <ip>:\n
             `/usr/bin/whois <ip>`\n\n
             Matches:\n
             <matches>\n\n

config/action.d/sendmail-whois.conf

@@ -17,7 +17,7 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+            Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n

config/action.d/sendmail.conf

@@ -17,7 +17,7 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+            Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n

config/action.d/ufw.conf

@@ -13,9 +13,11 @@ actionstop =
 
 actioncheck = 
 
-actionban = [ -n "<application>" ] && app="app <application>" ; ufw insert <insertpos> <blocktype> from <ip> to <destination> $app
+actionban = [ -n "<application>" ] && app="app <application>"
+            ufw insert <insertpos> <blocktype> from <ip> to <destination> $app
 
-actionunban = [ -n "<application>" ] && app="app <application>" ; ufw delete <blocktype> from <ip> to <destination> $app
+actionunban = [ -n "<application>" ] && app="app <application>"
+              ufw delete <blocktype> from <ip> to <destination> $app
 
 [Init]
 # Option: insertpos

config/action.d/xarf-login-attack.conf

@@ -46,7 +46,7 @@ actionban = oifs=${IFS}; IFS=.;SEP_IP=( <ip> ); set -- ${SEP_IP}; ADDRESSES=$(di
             REPORTID=<time>@`uname -n`
             TLP=<tlp>
             PORT=<port>
-            DATE=`LC_TIME=C date -u --date=@<time> +"%%a, %%d %%h %%Y %%T +0000"`
+            DATE=`LC_TIME=C date --date=@<time> +"%%a, %%d %%h %%Y %%T %%z"`
             if [ ! -z "$ADDRESSES" ]; then
                 (printf -- %%b "<header>\n<message>\n<report>\n";
                  date '+Note: Local timezone is %%z (%%Z)';

config/fail2ban.conf

@@ -34,6 +34,12 @@ loglevel = INFO
 #
 logtarget = /var/log/fail2ban.log
 
+# Option: syslogsocket
+# Notes: Set the syslog socket file. Only used when logtarget is SYSLOG
+#        auto uses platform.system() to determine predefined paths
+# Values: [ auto | FILE ]  Default: auto
+syslogsocket = auto
+
 # Option: socket
 # Notes.: Set the socket file. This is used to communicate with the daemon. Do
 #         not remove this file when Fail2ban runs. It will not be possible to

config/filter.d/apache-auth.conf

@@ -10,7 +10,7 @@ before = apache-common.conf
 [Definition]
 
 
-failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$
+failregex = ^%(_apache_error_client)s (AH(01797|01630): )?client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$
             ^%(_apache_error_client)s (AH01617: )?user .*? authentication failure for "\S*": Password Mismatch(, referer: \S+)?$
             ^%(_apache_error_client)s (AH01618: )?user .*? not found(: )?\S*(, referer: \S+)?\s*$
             ^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme: \S*(, referer: \S+)?\s*$

config/filter.d/apache-botsearch.conf

@@ -17,7 +17,9 @@
 [INCLUDES]
 
 # overwrite with apache-common.local if _apache_error_client is incorrect.
+# Load regexes for filtering from botsearch-common.conf
 before = apache-common.conf
+         botsearch-common.conf
 
 [Definition]
 
@@ -31,18 +33,8 @@ ignoreregex =
 
 # Webroot represents the webroot on which all other files are based
 webroot = /var/www/
-# Block is the actual non-found directories to block
-block = (<webmail>|<phpmyadmin>|<wordpress>)[^,]*
-
-# These are just convient definitions that assist the blocking of stuff that 
-# isn't installed
-webmail = roundcube|(ext)?mail|horde|(v-?)?webmail
-
-phpmyadmin = (typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin)
-
-wordpress = wp-(login|signup)\.php
 
 
 # DEV Notes:
 #
-# Author: Daniel Black
+# Author: Daniel Black

config/filter.d/apache-fakegooglebot.conf

@@ -0,0 +1,14 @@
+# Fail2Ban filter for fake Googlebot User Agents
+
+[Definition]
+
+failregex = ^<HOST> .*Googlebot.*$
+
+ignoreregex =
+
+
+# DEV Notes:
+#
+# Author: Lee Clemens
+# Thanks: Johannes B. Ullrich, Ph.D.
+# Reference: https://isc.sans.edu/forums/diary/When+Google+isnt+Google/15968/

config/filter.d/apache-shellshock.conf

@@ -0,0 +1,26 @@
+# Fail2Ban filter to block web requests containing custom headers attempting to exploit the shellshock bug
+#
+#
+
+[INCLUDES]
+
+# overwrite with apache-common.local if _apache_error_client is incorrect.
+before = apache-common.conf
+
+[Definition]
+
+failregex = ^%(_apache_error_client)s (AH01215: )?/bin/(ba)?sh: warning: HTTP_.*?: ignoring function definition attempt(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01215: )?/bin/(ba)?sh: error importing function definition for `HTTP_.*?'(, referer: \S+)?\s*$
+
+ignoreregex = 
+
+
+# DEV Notes:
+#
+# https://wiki.apache.org/httpd/ListOfErrors for apache error IDs
+#
+# example log lines: 
+# [Thu Sep 25 09:27:18.813902 2014] [cgi:error] [pid 16860] [client 89.207.132.76:59635] AH01215: /bin/bash: warning: HTTP_TEST: ignoring function definition attempt
+# [Thu Sep 25 09:29:56.141832 2014] [cgi:error] [pid 16864] [client 162.247.73.206:41273] AH01215: /bin/bash: error importing function definition for `HTTP_TEST'
+#
+# Author: Eugene Hopkinson (riot@riot.so)

config/filter.d/asterisk.conf

@@ -22,7 +22,7 @@ failregex = ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Registration from '[^']*'
             ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)$
             ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
             ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Failed to authenticate (user|device) [^@]+@<HOST>\S*$
-            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s (?:handle_request_subscribe: )?Sending fake auth rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S*$
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s hacking attempt detected '<HOST>'$
             ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d*",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"(,Challenge="\w+",ReceivedChallenge="\w+")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$
             ^(%(__prefix_line)s|\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])? )Ext\. s: "Rejecting unknown SIP connection from <HOST>"$
 

config/filter.d/botsearch-common.conf

@@ -0,0 +1,19 @@
+# Generic configuration file for -botsearch filters
+
+[Init]
+
+# Block is the actual non-found directories to block
+block = \/?(<webmail>|<phpmyadmin>|<wordpress>|cgi-bin|mysqladmin)[^,]*
+
+# These are just convient definitions that assist the blocking of stuff that 
+# isn't installed
+webmail = roundcube|(ext)?mail|horde|(v-?)?webmail
+
+phpmyadmin = (typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin)
+
+wordpress = wp-(login|signup)\.php
+
+# DEV Notes:
+# Taken from apache-botsearch filter
+# 
+# Author: Frantisek Sumsal

config/filter.d/common.conf

@@ -53,4 +53,8 @@ __bsd_syslog_verbose = (<[^.]+\.[^.]+>)
 # This can be optional (for instance if we match named native log files)
 __prefix_line = \s*%(__bsd_syslog_verbose)s?\s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s%(__daemon_extra_re)s?\s*
 
+# PAM authentication mechanism check for failures, e.g.: pam_unix, pam_sss,
+# pam_ldap
+__pam_auth = pam_unix
+
 # Author: Yaroslav Halchenko

config/filter.d/counter-strike.conf

@@ -6,6 +6,7 @@
 
 failregex = ^: Bad Rcon: "rcon \d+ "\S+"  sv_contact ".*?"" from "<HOST>:\d+"$
 
+ignoreregex =
 
 [Init]
 

config/filter.d/dovecot.conf

@@ -9,9 +9,10 @@ before = common.conf
 
 _daemon = (auth|dovecot(-auth)?|auth-worker)
 
-failregex = ^%(__prefix_line)s(pam_unix(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
+failregex = ^%(__prefix_line)s(%(__pam_auth)s(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
             ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>(, lip=(\d{1,3}\.){3}\d{1,3})?(, TLS( handshaking(: SSL_accept\(\) failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s*$
-            ^%(__prefix_line)s(Info|dovecot: auth\(default\)): pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$
+            ^%(__prefix_line)s(Info|dovecot: auth\(default\)|auth-worker\(\d+\)): pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$
+            ^%(__prefix_line)sauth-worker\(\d+\): pam\(\S+,<HOST>\): unknown user\s*$
 
 ignoreregex = 
 

config/filter.d/drupal-auth.conf

@@ -0,0 +1,26 @@
+# Fail2Ban filter to block repeated failed login attempts to Drupal site(s)
+#
+#
+# Drupal must be setup to use Syslog, which defaults to the following format:
+#
+#   !base_url|!timestamp|!type|!ip|!request_uri|!referer|!uid|!link|!message
+#
+#
+
+[INCLUDES]
+
+before = common.conf
+
+
+[Definition]
+
+failregex = ^%(__prefix_line)s(https?:\/\/)([\da-z\.-]+)\.([a-z\.]{2,6})(\/[\w\.-]+)*\|\d{10}\|user\|<HOST>\|.+\|.+\|\d\|.*\|Login attempt failed for .+\.$
+
+ignoreregex =
+
+
+# DEV Notes:
+#
+# https://www.drupal.org/documentation/modules/syslog
+#
+# Author: Lee Clemens

config/filter.d/exim.conf

@@ -14,10 +14,10 @@ before = exim-common.conf
 [Definition]
 
 failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
-             ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
+             ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[<HOST>\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
              ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$
              ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
-             ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\]:\d+ )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
+             ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
 
 ignoreregex = 
 

config/filter.d/groupoffice.conf

@@ -8,7 +8,7 @@
 
 failregex = ^\[\]LOGIN FAILED for user: "\S+" from IP: <HOST>$
 
-
+ignoreregex =
 
 # Author: Daniel Black
 

config/filter.d/ignorecommands/apache-fakegooglebot

@@ -0,0 +1,32 @@
+#!/usr/bin/python
+# Inspired by https://isc.sans.edu/forums/diary/When+Google+isnt+Google/15968/
+#
+# Written in Python to reuse built-in Python batteries and not depend on
+# presence of host and cut commands
+#
+import sys
+
+def process_args(argv):
+    if len(argv) != 2:
+       sys.stderr.write("Please provide a single IP as an argument. Got: %s\n"
+                        % (argv[1:]))
+       sys.exit(2)
+
+    ip = argv[1]
+
+    from fail2ban.server.filter import DNSUtils
+    if not DNSUtils.isValidIP(ip):
+       sys.stderr.write("Argument must be a single valid IP. Got: %s\n"
+                        % ip)
+       sys.exit(3)
+    return ip
+
+def is_googlebot(ip):
+    import re
+    from fail2ban.server.filter import DNSUtils
+
+    host = DNSUtils.ipToName(ip)
+    sys.exit(0 if (host and re.match('crawl-.*\.googlebot\.com', host)) else 1)
+
+if __name__ == '__main__':
+    is_googlebot(process_args(sys.argv))

config/filter.d/kerio.conf

@@ -6,6 +6,9 @@ failregex = ^ SMTP Spam attack detected from <HOST>,
             ^ IP address <HOST> found in DNS blacklist \S+, mail from \S+ to \S+$
             ^ Relay attempt from IP address <HOST>
             ^ Attempt to deliver to unknown recipient \S+, from \S+, IP address <HOST>$
+
+ignoreregex =
+
 [Init]
 
 datepattern = ^\[%%d/%%b/%%Y %%H:%%M:%%S\]

config/filter.d/monit.conf

@@ -7,3 +7,4 @@
 failregex = ^\[[A-Z]+\s+\]\s*error\s*:\s*Warning:\s+Client '<HOST>' supplied unknown user '\w+' accessing monit httpd$
             ^\[[A-Z]+\s+\]\s*error\s*:\s*Warning:\s+Client '<HOST>' supplied wrong password for user '\w+' accessing monit httpd$
 
+ignoreregex =

config/filter.d/named-refused.conf

@@ -38,6 +38,8 @@ failregex = ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (vie
             ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
             ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$
 
+ignoreregex =
+
 # DEV Notes:
 # Trying to generalize the
 #          structure which is general to capture general patterns in log

config/filter.d/nginx-botsearch.conf

@@ -0,0 +1,20 @@
+# Fail2Ban filter to match web requests for selected URLs that don't exist
+#
+
+[INCLUDES]
+
+# Load regexes for filtering
+before = botsearch-common.conf
+
+[Definition]
+
+failregex = ^<HOST> \- \S+ \[\] \"(GET|POST) \/<block> \S+\" 404 .+$
+            ^ \[error\] \d+#\d+: \*\d+ (\S+ )?\"\S+\" (failed|is not found) \(2\: No such file or directory\), client\: <HOST>\, server\: \S*\, request: \"(GET|POST) \/<block> \S+\"\, .*?$
+
+ignoreregex = 
+
+
+# DEV Notes:
+# Based on apache-botsearch filter
+# 
+# Author: Frantisek Sumsal

config/filter.d/nsd.conf

@@ -24,3 +24,5 @@ _daemon = nsd
 
 failregex =  ^\[\]%(__prefix_line)sinfo: ratelimit block .* query <HOST> TYPE255$
               ^\[\]%(__prefix_line)sinfo: .* <HOST> refused, no acl matches\.$
+
+ignoreregex =

config/filter.d/pam-generic.conf

@@ -13,7 +13,7 @@ before = common.conf
 # Default: catch all failed logins
 _ttys_re=\S*
 
-__pam_re=\(?pam_unix(?:\(\S+\))?\)?:?
+__pam_re=\(?%(__pam_auth)s(?:\(\S+\))?\)?:?
 _daemon = \S+
 
 failregex = ^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=%(_ttys_re)s ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$

config/filter.d/portsentry.conf

@@ -0,0 +1,12 @@
+# Fail2Ban filter for failure attempts in Counter Strike-1.6
+#
+#
+
+[Definition]
+
+failregex = \/<HOST> Port\: [0-9]+ (TCP|UDP) Blocked$
+
+ignoreregex =
+
+# Author: Pacop <pacoparu@gmail.com>
+

config/filter.d/postfix-rbl.conf

@@ -0,0 +1,19 @@
+# Fail2Ban filter for Postfix's RBL based Blocked hosts
+#
+#
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+[Definition]
+
+_daemon = postfix/smtpd
+
+failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 454 4\.7\.1 Service unavailable; Client host \[\S+\] blocked using .* from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$
+
+ignoreregex =
+
+# Author: Lee Clemens

config/filter.d/postfix-sasl.conf

@@ -7,9 +7,11 @@ before = common.conf
 
 [Definition]
 
-_daemon = postfix/smtpd
+_daemon = postfix/(submission/)?smtp(d|s)
 
-failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$
+failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/:]*={0,2})?\s*$
+
+ignoreregex = authentication failed: Connection lost to authentication server$
 
 [Init]
 

config/filter.d/postfix.conf

@@ -10,9 +10,10 @@ before = common.conf
 
 [Definition]
 
-_daemon = postfix/smtpd
+_daemon = postfix/(submission/)?smtp(d|s)
 
 failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
+            ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$
             ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
             ^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$
             ^%(__prefix_line)simproper command pipelining after \S+ from [^[]*\[<HOST>\]:?$

config/filter.d/recidive.conf

@@ -29,6 +29,8 @@ _jailname = recidive
 
 failregex = ^(%(__prefix_line)s| %(_daemon)s%(__pid_re)s?:\s+)NOTICE\s+\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+<HOST>\s*$
 
+ignoreregex = 
+
 [Init]
 
 journalmatch = _SYSTEMD_UNIT=fail2ban.service PRIORITY=5

config/filter.d/squid.conf

@@ -7,7 +7,7 @@
 failregex = ^\s+\d\s<HOST>\s+[A-Z_]+_DENIED/403 .*$
             ^\s+\d\s<HOST>\s+NONE/405 .*$
 
-
+ignoreregex =
 
 # Author: Daniel Black
 

config/filter.d/squirrelmail.conf

@@ -3,6 +3,7 @@
 
 failregex = ^ \[LOGIN_ERROR\].*from <HOST>: Unknown user or password incorrect\.$
 
+ignoreregex =
 
 [Init]
 

config/filter.d/sshd.conf

@@ -33,6 +33,7 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|erro
             ^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked<SKIPLINES>(?P=__prefix)(?:error: )?Received disconnect from <HOST>: 11: .+ \[preauth\]$
             ^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\]<SKIPLINES>(?P=__prefix)(?:error: )?Connection closed by <HOST> \[preauth\]$
             ^(?P<__prefix>%(__prefix_line)s)Connection from <HOST> port \d+(?: on \S+ port \d+)?<SKIPLINES>(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$
+            ^%(__prefix_line)spam_unix\(sshd:auth\):\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=<HOST>\s.*$
 
 ignoreregex = 
 

config/filter.d/stunnel.conf

@@ -4,6 +4,8 @@
 
 failregex = ^ LOG\d\[\d+:\d+\]:\ SSL_accept from <HOST>:\d+ : (?P<CODE>[\dA-F]+): error:(?P=CODE):SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate$
 
+ignoreregex =
+
 # DEV NOTES:
 # 
 # Author: Daniel Black

config/filter.d/vsftpd.conf

@@ -10,7 +10,7 @@ before = common.conf
 
 [Definition]
 
-__pam_re=\(?pam_unix(?:\(\S+\))?\)?:?
+__pam_re=\(?%(__pam_auth)s(?:\(\S+\))?\)?:?
 _daemon =  vsftpd
 
 failregex = ^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=(ftp)? ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$

config/filter.d/wuftpd.conf

@@ -11,7 +11,7 @@ before = common.conf
 [Definition]
 
 _daemon = wu-ftpd
-__pam_re=\(?pam_unix(?:\(wu-ftpd:auth\))?\)?:?
+__pam_re=\(?%(__pam_auth)s(?:\(wu-ftpd:auth\))?\)?:?
 
 failregex = ^%(__prefix_line)sfailed login from \S+ \[<HOST>\]\s*$
             ^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=(ftp)? ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$

config/jail.conf

@@ -79,6 +79,11 @@ maxretry = 5
 #              See "journalmatch" in the jails associated filter config
 # auto:      will try to use the following backends, in order:
 #              pyinotify, gamin, polling.
+#
+# Note: if systemd backend is choses as the default but you enable a jail
+#       for which logs are present only in its own log files, specify some other
+#       backend for that jail (e.g. polling) and provide empty value for
+#       journalmatch. See https://github.com/fail2ban/fail2ban/issues/959#issuecomment-74901200
 backend = auto
 
 # "usedns" specifies if jails should trust hostnames in logs,
@@ -277,18 +282,36 @@ logpath  = %(apache_error_log)s
 maxretry = 2
 
 
+[apache-fakegooglebot]
+
+port     = http,https
+logpath  = %(apache_access_log)s
+maxretry = 1
+ignorecommand = %(ignorecommands_dir)s/apache-fakegooglebot <ip>
+
+
 [apache-modsecurity]
 
 port     = http,https
 logpath  = %(apache_error_log)s
 maxretry = 2
 
+[apache-shellshock]
+
+port    = http,https
+logpath = %(apache_error_log)s
+maxretry = 1
 
 [nginx-http-auth]
 
-ports   = http,https
+port    = http,https
 logpath = %(nginx_error_log)s
 
+[nginx-botsearch]
+
+port     = http,https
+logpath  = %(nginx_error_log)s
+maxretry = 2
 
 # Ban attackers that try to use PHP's URL-fopen() functionality
 # through GET/POST variables. - Experimental, with more than a year
@@ -297,7 +320,8 @@ logpath = %(nginx_error_log)s
 [php-url-fopen]
 
 port    = http,https
-logpath = %(nginx_access_log)s %(apache_access_log)s
+logpath = %(nginx_access_log)s
+          %(apache_access_log)s
 
 
 [suhosin]
@@ -361,6 +385,11 @@ maxretry = 5
 #
 #
 
+[drupal-auth]
+
+port     = http,https
+logpath  = %(syslog_daemon)s
+
 [guacamole]
 
 port     = http,https
@@ -459,6 +488,13 @@ port     = smtp,465,submission
 logpath  = %(postfix_log)s
 
 
+[postfix-rbl]
+
+port     = smtp,465,submission
+logpath  = %(syslog_mail)s
+maxretry = 1
+
+
 [sendmail-auth]
 
 port    = submission,465,smtp
@@ -643,15 +679,16 @@ maxretry = 5
 
 
 # Jail for more extended banning of persistent abusers
-# !!! WARNING !!!
-#   Make sure that your loglevel specified in fail2ban.conf/.local
-#   is not at DEBUG level -- which might then cause fail2ban to fall into
-#   an infinite loop constantly feeding itself with non-informative lines
+# !!! WARNINGS !!!
+# 1. Make sure that your loglevel specified in fail2ban.conf/.local
+#    is not at DEBUG level -- which might then cause fail2ban to fall into
+#    an infinite loop constantly feeding itself with non-informative lines
+# 2. Increase dbpurgeage defined in fail2ban.conf to e.g. 648000 (7.5 days)
+#    to maintain entries for failed logins for sufficient amount of time
 [recidive]
 
 logpath  = /var/log/fail2ban.log
-port     = all
-protocol = all
+banaction = iptables-allports
 bantime  = 604800  ; 1 week
 findtime = 86400   ; 1 day
 maxretry = 5
@@ -714,3 +751,8 @@ banaction = iptables-allports
 enabled = false
 logpath = /var/log/directadmin/login.log
 port = 2222
+
+[portsentry]
+enabled  = false
+logpath  = /var/lib/portsentry/portsentry.history
+maxretry = 1

config/paths-common.conf

@@ -61,3 +61,6 @@ dovecot_log = %(syslog_mail_warn)s
 solidpop3d_log = %(syslog_local0)s
 
 mysql_log = %(syslog_daemon)s
+
+# Directory with ignorecommand scripts
+ignorecommands_dir = /etc/fail2ban/filter.d/ignorecommands

debian/NEWS

@@ -1,79 +0,0 @@
-fail2ban (0.9.0+git48-gabcab00-1) experimental; urgency=low
-
-  [ Yaroslav Halchenko ]
-  * This version went through big refactoring which allowed to gain new
-    features such as multiline matching (see upstream's changelog for more
-    information).
-  * Although .local files are still supported, customizations are advised
-    to be provided under corresponding .d/ directories.  E.g. see
-    /etc/fail2ban/jail.d/defaults-debian.conf which is where now sshd
-    jail is enabled by default to match previous behavior of Fail2Ban in
-    Debian.
-
-  [ Daniel Schaal ]
-  * All jails definitions were rewritten to become more concise and uniform.
-    From this version on log paths are defined in distro specific files,
-    for Debian this is in /etc/fail2ban/paths-debian.conf.
-
- -- Yaroslav Halchenko <debian@onerussian.com>  Tue, 25 Mar 2014 08:38:31 -0400
-
-fail2ban (0.8.11-1) unstable; urgency=low
-
-  * retroactive for 0.8.9: by default iptables-* actions do not simply
-    DROP packets from offending IP but rather reject with
-    icmp-port-unreachable.  If DROP behaviour is preferable, provide
-    config/action.d/iptables-blocktype.local with [Init] section defining
-    blocktype = DROP or override action definition to provide
-    blocktype=DROP option in jail.local
-  * Many failregex's were tight-up in this release which could
-    theoretically effect operation in comparison to previous release(s).
-
- -- Yaroslav Halchenko <debian@onerussian.com>  Sat, 16 Nov 2013 22:27:50 -0500
-
-fail2ban (0.8.4-3) unstable; urgency=low
-
-  * Jail named-refused-udp is unsafe and opens possibility for easy DoS,
-    thus discouraged to be used, and commented out (see #583364 for more
-    information).
-
- -- Yaroslav Halchenko <debian@onerussian.com>  Mon, 28 Jun 2010 22:12:22 -0400
-
-fail2ban (0.7.1-0.2) unstable; urgency=low
-
-  fail2ban 0.7 is a complete rewrite of the 0.6 version, and if you
-  customized any of provided configuration or startup files
-  (/etc/default/fail2ban, /etc/fail2ban.conf, /etc/init.d/fail2ban),
-  please read further. The configuration scheme has changed upstream:
-  0.7 ignores /etc/fail2ban.conf and instead uses a split configuration
-  under /etc/fail2ban/. To retain your customizations, for example to
-  monitor anything other than sshd, you will need to set them under that
-  new directory; use *.local files for customizations. Please see
-  /usr/share/doc/fail2ban/README.Debian.gz and
-  http://fail2ban.sourceforge.net for further description of new
-  configuration scheme. Detailed documentation is under development (see
-  #400416).  When you are satisfied with the new settings, please delete
-  /etc/fail2ban.conf to avoid confusion.
-
-  Fail2ban 0.7 uses client/server architecture and fail2ban-client is to
-  substitute fail2ban command to provide an interface between the user and
-  fail2ban-server. That is why some command line parameters present in
-  fail2ban 0.6 are invalid in fail2ban-client. Such change affects
-  /etc/default/fail2ban; you should review that file if you customized it.
-  Please enable sections as directed in README.Debian.gz mentioned above.
-  You must use newly shipped init.d/fail2ban, or otherwise fail2ban will
-  not start.
-
-  This note was rewritten in release 0.7.5-2 to clarify its meaning.
-
- -- Yaroslav Halchenko <debian@onerussian.com>  Sat,  9 Dec 2006 18:24:36 -0500
-
-fail2ban (0.6.0-4) unstable; urgency=low
-
-  In this version the new section ApacheAttacks was introduced to ban IPs
-  which are found to run some known attack on the host. For now it captures
-  just awstats and mambo related attacks. To make this feature work, the bug of
-  wrongly specified timeregexp for Apache's access.log file was fixed.
-  Besides that group of log files has changed to be adm, and now they are
-  readable by the group.
-
- -- Yaroslav Halchenko <debian@onerussian.com>  Fri, 10 Feb 2006 13:05:07 -0500

debian/README.Debian

@@ -1,234 +0,0 @@
-fail2ban (>=0.7.0) for Debian
------------------------------
-
-This package is ~99% identical to the upstream version. Few features
-could have been added but not yet propagated into upstream version and
-some modifications might be Debian-specific. Debian specific jail.conf
-file is shipped. Original upstream file is available from
-/usr/share/doc/fail2ban/examples/jail.conf
-
-Currently, the major difference with upstream: python libraries are
-placed under /usr/share/fail2ban instead of /usr/lib/fail2ban to
-comply with policy regarding architecture independent resources.
-
-Upgrade from 0.6 versions:
--------------------------
-
-* New Config Files Format:
-
-If you had introduced your own sections in /etc/fail2ban.conf, you
-would need manually to convert them into a new format. At minimum you
-need to create /etc/fail2ban/filter.d/NAME.local (leave .conf files
-for me and upstream please to avoid any conflicts -- introduce your
-changes in .local) with failregex in [Definition] section. And provide
-appropriate jail definition in /etc/fail2ban/jail.local
-
-
-* Enabled Sections:
-
-Only handling of ssh files is enabled by default. If you want to use
-fail2ban with apache, please enable apache section manually in
-/etc/fail2ban/jail.local by including next lines:
-
-[apache]
-enabled = true
-
-NOTE: -e command line parameter is non existant in 0.7.x
-
-
-* Interpolations vs actions/filters parameters:
-
-For details see #398739 or wait for a closure of #400416
-
-Every pair of .conf and then .local (if exists) files is read
-separately from any other configuration file, so interpolations cannot
-penetrate from jail.* into actions.d/*. To overcome this, it is
-necessary to create a PARAMETER which can be substituted in actions
-[Definition] section, if it is also defined in the [Init] section of
-that file and is used in place of necessary allocation as <PARAMETER>
-tag. Parameters can be specified in the definitions within
-jail.{conf,local}. For instance, 1 lengthy example, where the same
-name "fwchain" is used both as interpolation (in jail.local) and as a
-parameter (in iptables-flex.local) (from #398739)
-
-==> /etc/fail2ban/jail.local <==
-[DEFAULT]
-action = iptables-flex[name=%(__name__)s, port=%(port)s, fwchain=%(fwchain)s, post_start_commands=%(post_start_commands)s, pre_end_commands=%(pre_end_commands)s]
-fwchain = INPUT
-[ssh]
-fwchain = ssh-tarpit
-==> /etc/fail2ban/action.d/iptables-flex.local <==
-[Definition]
-actionstart = iptables -N fail2ban-<name>
-               iptables -I <fwchain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
-               iptables -I <fwchain> -j <whitelist>
-actionstop  = iptables -D <fwchain> -j <whitelist>
-               iptables -D <fwchain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
-               iptables -F fail2ban-<name>
-               iptables -X fail2ban-<name>
-actioncheck = iptables -n -L <fwchain> | grep -q fail2ban-<name>
-actionban   = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
-[Init]
-whitelist = ssh-whitelist
-fwchain = INPUT
-name = default
-port = ssh
-protocol = tcp
-
-
-* Multiport banning: Comment for #373592, #545971
-
-iptables-multiport action is now default banaction (file jail.conf, to
-be customized within jail.local). Therefore assure that you have built
-multiport module if you use custom kernel.
-
-If you would like to ban all ports for that host, just redefine
-fwban/fwunban commands to don't have --dport %(port)s statement at
-all, or use shorewall, where actionban bans whole IP.
-
-* Blocking of NEW connections only
-Comment for the wishlist #350746.
-
-It might be benefitial in some cases to ban only new connections. For
-that just use iptables-new action instead of default banaction
-
-/etc/fail2ban/jail.local:
-
-[DEFAULT]
-banaction=iptables-new
-
-(you can override banaction within interesting for you section).
- Also you can redefine the whole action parameter if you like.
-
-
-* Interaction with ipmasq
-  Comment to #461417
-
-Although fail2ban should detect and recreate missing chains if the external
-command wipes out iptables, it is better to explicitly to force-reload
-fail2ban. For this reason there is examples/ipmasq-ZZZzzz|fail2ban.rul file is
-shipped along to be installed under name ZZZzzz|fail2ban.rul within
-/etc/ipmasq.
-
-* Interaction with logrotate with custom logtarget
-  Comment to #631917
-
-if you use an alternative logtarget (e.g. SYSLOG) thus not using
-/var/log/fail2ban.log you should divert logrotate configuration into
-a disabled state, e.g.
-
-sudo dpkg-divert --rename --divert \
-	 /etc/logrotate.d/fail2ban.disabled /etc/logrotate.d/fail2ban
-
-
-Troubleshooting:
----------------
-
-* Updated failregex:
-
-To resolve the security bug #330827 [1] failregex expressions must
-provide a named group (?P<host>...) as a placeholder of the abuser's
-host. Alternative tag (since 0.7.5) can be "<HOST>". The naming of the
-group was introduced to capture possible future generalizations of
-failregex to provide even more information.
-
-[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=330827
-
-You might benefit from using fail2ban-regex command shipped along to
-construct and debug your failregex statements.
-
-* "Interpolations" in the config file:
-
-Since version 0.6.0-3 to reduce duplication, thus to improve
-readability of the config file, interpolations provided by the module
-ConfigParser are used. If you had custom sections defined before, you
-might benefit from updating config file and adding appropriate
-information for the new sections.
-
-N.B. If you have some nice additional sections defined, I would really
-appreciate if you share them with me or upstream author, so they could
-be eventually included in the fail2ban package for general use by the
-rest of the community.
-
-
-* Mailing:
-
-Since actions.d/mail*.conf commands rely on presence of "mail"
-command, mailx package (or another package providing mailx
-functionality such as mailutils) is required if those actions are
-activated in jail.{conf,local}.
-
-
-* Dirty exit:
-
-If firewall rules gets cleaned out before fail2ban exits (like was
-happening with firestarter), errors get reported during the exit of
-fail2ban, but they are "safe" and can be ignored.
-
-
-** SSHD Configuration Specific Problems
-
-* Ban "Not allowed" attempts:
-
-Make sure that you have
-ChallengeResponseAuthentication no
-PasswordAuthentication yes
-
-Details from the bug report #350980 [2]
-
-[2]  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350980
-
-
-* Not caught attempts to login as root
-
-On the boxes running older versions of openssh (e.g. sarge
-distribution) in the case when PermitRootLogin is set to something
-else than "yes" and iff AllowUsers is active, failed root logins do
-not confirm to the standard logging message -- they omit the source
-IP, thus allowing attack to persist since such messages are not caught
-by fail2ban.
-
-
-* Bantime:
-
-An IP is banned for "bantime" not since the last failed login attempt
-from the IP, but rather since the moment when failed login was
-detected by fail2ban. Thus, if fail2ban gets [re]started, any IP which
-had enough of failed logins with durations less than "findtime" between
-them prior to the [re]start moment, will be banned for
-"bantime" since [re]start moment, not since the last failed login
-time.
-
-* Findtime:
-
-"Findtime" option of a jail actually defines a duration to reset the
-counter of failed login attempts, if no new attempt was detected within
-that time frame (i.e.  within "findtime").
-
-See
-http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Jail_Options
-for more information on jail options.
-
-
-* Syslog entries can be 'forged' by a regular user
-
-From
-http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Possibility_of_DOS_attack_by_a_local_user
-
-Especially on systems wich provide ssh/CGI/PHP services to unknown
-users it is possible to block other users from ssh and probably other
-access as a unprivileged user may issue:
-
-logger -p auth.warning -t 'sshd[123]' 'Illegal user user1 from 1.2.3.4'
-
-N.B. chmod o-x /usr/bin/logger should provide at least obfuscation
-solution
-
-Or the malicious user may write via PHP's openlog()/syslog() to syslog.
-
-P.S. Anyone is welcome to recommend proper security solution to this
-issue, such as an alternative to sysklogd which allows better control
-over users logging to specific facilities (such as AUTH)
-
- -- Yaroslav Halchenko <debian@onerussian.com>, Thu, 28 Jul 2011 23:19:44 -0400

debian/TODO

@@ -1,6 +0,0 @@
-* Collect more sections for other log files
-* Find proper answer to "Syslog entries can be 'forged' by a regular
-   user" mentioned in README.Debian
-
- -- Yaroslav O. Halchenko <debian@onerussian.com>  Wed,  6 Dec 2006 22:14:26 -0500
-

debian/backports/00list.sarge-backports

@@ -1 +0,0 @@
-nopycentral.patch

debian/backports/nopycentral.patch

@@ -1,40 +0,0 @@
-diff -x '*~' -x .svn -Naur trunk/debian/control trunk.backports/debian/control
---- trunk/debian/control	2006-10-23 00:57:02.000000000 -0400
-+++ trunk.backports/debian/control	2006-12-04 08:45:25.000000000 -0500
-@@ -4,13 +4,13 @@
- Maintainer: Yaroslav Halchenko <debian@onerussian.com>
- Uploaders: Barak Pearlmutter <bap@debian.org>
- Build-Depends: debhelper (>= 5.0.37.2), dpatch
--Build-Depends-Indep: python, python-dev, help2man, python-central (>= 0.5.6)
-+Build-Depends-Indep: python, python2.4, python2.4-dev, help2man
- XS-Python-Version: current, >= 2.4
- Standards-Version: 3.7.2
- 
- Package: fail2ban
- Architecture: all
--Depends: ${python:Depends}, iptables, lsb-base (>=2.0-7)
-+Depends: python2.4, iptables, lsb-base (>=2.0-7)
- Suggests: python-gamin
- XB-Python-Version: ${python:Versions}
- Description: bans IPs that cause multiple authentication errors
-diff -x '*~' -x .svn -Naur trunk/debian/rules trunk.backports/debian/rules
---- trunk/debian/rules	2006-11-11 21:19:14.000000000 -0500
-+++ trunk.backports/debian/rules	2006-12-04 08:45:45.000000000 -0500
-@@ -39,7 +39,7 @@
- 	dh_installdirs
- 
- 	# Add here commands to install the package into debian/fail2ban.
--	python setup.py install --root=$(DESTDIR) --no-compile
-+	python2.4 setup.py install --root=$(DESTDIR) --no-compile
- 	#X Evil - must be removed after Debian switches over to 2.4, now
- 	#  distutils.setup will override the enterpreter line to /usr/bin/python
- 	install fail2ban-server fail2ban-client $(DESTDIR)/usr/bin
-@@ -62,7 +62,7 @@
- 	dh_installlogrotate
- 	dh_installinit -- defaults 99
- 	dh_installman man/*.1
--	dh_pycentral
-+	dh_python
- 	dh_link
- 	dh_compress
- 	dh_fixperms

debian/compat

@@ -1 +0,0 @@
-9

debian/control

@@ -1,29 +0,0 @@
-Source: fail2ban
-Section: net
-Priority: optional
-Maintainer: Yaroslav Halchenko <debian@onerussian.com>
-Build-Depends: debhelper (>= 9), python3 (>= 3.0~), python3-pyinotify, dh-systemd
-Homepage: http://www.fail2ban.org
-Vcs-Git: git://github.com/fail2ban/fail2ban.git
-Vcs-Browser: http://github.com/fail2ban/fail2ban
-Standards-Version: 3.9.4
-
-
-Package: fail2ban
-Architecture: all
-Depends: ${python3:Depends}, ${misc:Depends}, lsb-base (>=2.0-7)
-Recommends: iptables, whois, python3-pyinotify
-Suggests: python-gamin, mailx, system-log-daemon, python3-systemd
-Description: ban hosts that cause multiple authentication errors
- Fail2ban monitors log files (e.g. /var/log/auth.log,
- /var/log/apache/access.log) and temporarily or persistently bans
- failure-prone addresses by updating existing firewall rules.  Fail2ban allows
- easy specification of different actions to be taken such as to ban an
- IP using iptables or hostsdeny rules, or simply to send a
- notification email.
- .
- By default, it comes with filter expressions for various services
- (sshd, apache, qmail, proftpd, sasl etc.) but configuration can be
- easily extended for monitoring any other text file.  All filters and
- actions are given in the config files, thus fail2ban can be adopted
- to be used with a variety of files and firewalls.

debian/copyright

@@ -1,31 +0,0 @@
-This package was originally debianized by Yaroslav Halchenko
-<debian@onerussian.com> on Mon Jul  4 14:41:34 HST 2005
-
-It was downloaded from http://www.sourceforge.net/projects/fail2ban
-
-Author: Cyril Jaquier: <cyril.jaquier@fail2ban.org>
-        http://fail2ban.sourceforge.net
-
-Copyright: 2004-2009 Cyril Jaquier
-
-This program is free software; you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation; either version 2 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program; if not, write to the
-Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
-MA 02110-1301, USA.
-
-On Debian systems, the complete text of the GNU General Public
-License, version 2, can be found in /usr/share/common-licenses/GPL-2.
-
-The Debian packaging is (C) 2006-2011, Yaroslav Halchenko <debian@onerussian.com>
-and is licensed under the GPL, see above.
-

debian/docs

@@ -1,3 +0,0 @@
-README.md
-TODO
-doc/run-rootless.txt

debian/fail2ban.default

@@ -1,39 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-#
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-# Command line options for Fail2Ban. Refer to "fail2ban-client -h" for
-# valid options.
-FAIL2BAN_OPTS=""
-
-# Run fail2ban as a different user. If not set, fail2ban
-# will run as root.
-#
-# The user is not created automatically.
-# The user can be created e.g. with
-#    useradd --system --no-create-home --home-dir / --groups adm fail2ban
-# Log files are readable by group adm by default. Adding the fail2ban
-# user to this group allows it to read the logfiles.
-#
-# Another manual step that needs to be taken is to allow write access
-# for fail2ban user to fail2ban log files. The /etc/init.d/fail2ban
-# script will change the ownership when starting fail2ban. Logrotate
-# needs to be configured separately, see /etc/logrotate.d/fail2ban.
-#
-# FAIL2BAN_USER="fail2ban"

debian/fail2ban.logrotate

@@ -1,17 +0,0 @@
-/var/log/fail2ban.log {
-   
-    weekly
-    rotate 4
-    compress
-
-    delaycompress
-    missingok
-    postrotate
-	fail2ban-client flushlogs 1>/dev/null
-    endscript
-
-    # If fail2ban runs as non-root it still needs to have write access
-    # to logfiles.
-    # create 640 fail2ban adm
-    create 640 root adm
-}

debian/gbp.conf

@@ -1,18 +0,0 @@
-[DEFAULT]
-# the default branch for upstream sources:
-upstream-branch = upstream
-# the default branch for the debian patch:
-debian-branch = debian-releases/experimental
-# use pristine-tar
-# pristine-tar = True
-# the default tag formats used:
-upstream-tag = %(version)s
-debian-tag = debian/%(version)s
-
-
-# Options only affecting git-buildpackage
-[git-buildpackage]
-# use this for more svn-buildpackage like bahaviour:
-export-dir = ../build-area/
-tarball-dir = ../tarballs/
-

debian/patches/deb_manpages_reportbug

@@ -1,26 +0,0 @@
-From: Yaroslav Halchenko <debian@onerussian.com>
-Date: Fri, 8 Feb 2008 00:40:57 -0500
-Subject: tune ups in upstream manpages to direct users to use reportbug
-
---- a/man/fail2ban-client.1
-+++ b/man/fail2ban-client.1
-@@ -369,7 +369,7 @@
- Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
- Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
- .SH "REPORTING BUGS"
--Report bugs to https://github.com/fail2ban/fail2ban/issues
-+Report bugs via Debian bug tracking system \fIhttp://www.debian.org/Bugs/\fR .
- .SH COPYRIGHT
- Copyright \(co 2004\-2008 Cyril Jaquier, 2008\- Fail2Ban Contributors
- .br
---- a/man/fail2ban-server.1
-+++ b/man/fail2ban-server.1
-@@ -38,7 +38,7 @@
- Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
- Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
- .SH "REPORTING BUGS"
--Report bugs to https://github.com/fail2ban/fail2ban/issues
-+Report bugs via Debian bug tracking system \fIhttp://www.debian.org/Bugs/\fR .
- .SH COPYRIGHT
- Copyright \(co 2004\-2008 Cyril Jaquier, 2008\- Fail2Ban Contributors
- .br

debian/patches/lucid-dsc-patch

@@ -1,46 +0,0 @@
-From: Yaroslav Halchenko <debian@onerussian.com>
-Date: Thu, 6 Dec 2012 12:50:12 -0500
-Subject: [PATCH] Patch for elderly Debian/Ubuntu (e.g. 10.04) releases without dh_python2
-
-Use again pycentral etc
-
-crafted post 0.8.8-1 release when a user complained about inability to upgrade
-
----
- debian/control |  2 ++
- debian/rules   | 12 +++++-------
- 2 files changed, 7 insertions(+), 7 deletions(-)
-
---- a/debian/control
-+++ b/debian/control
-@@ -3,6 +3,8 @@ Section: net
- Priority: optional
- Maintainer: Yaroslav Halchenko <debian@onerussian.com>
- Build-Depends: debhelper (>= 5.0.37.2), python (>= 2.5.4-1~), python-pyinotify
-+Build-Depends-Indep: python-central (>= 0.5.6)
-+XS-Python-Version: current, >= 2.4
- Homepage: http://www.fail2ban.org
- Vcs-Git: git://github.com/fail2ban/fail2ban.git
- Vcs-Browser: http://github.com/fail2ban/fail2ban
---- a/debian/rules
-+++ b/debian/rules
-@@ -72,14 +72,12 @@ binary-indep: install
- 	dh_installdocs
- 	dh_installexamples config/jail.conf files/ipmasq-*
- 	dh_installlogrotate
--	dh_python2 /usr/share/fail2ban
-+	dh_pycentral
- 	dh_installinit -- defaults 99
--
--	# perform swap of order of calls to init and pycentral (or even
--	# bleedingly new dh_python2) in prerm to close #422655 --
--	# python-cleanup section is cut and placed at the end of the file
--	# since .init script would trigger their compilation again
--	sed -i -e '/^#.*ed by dh_python2/,/# End auto/{H;d};$$G' \
-+	# perform swap of order of calls to init and pycentral in prerm
-+	# to close #422655 -- pycentral section is cut and placed at
-+	# the end of the file
-+	sed -i -e '/^#.*ed by dh_pycentral/,/# End auto/{H;d};$$G' \
- 		debian/fail2ban.prerm.debhelper
- 
- 	dh_installman man/*.[15]

debian/patches/series

@@ -1,2 +0,0 @@
-deb_manpages_reportbug
-convert-to-python3.patch

debian/postinst

@@ -1,98 +0,0 @@
-#! /bin/sh
-# postinst script for fail2ban
-#
-# see: dh_installdeb(1)
-
-set -e
-
-# summary of how this script can be called:
-#        * <postinst> `configure' <most-recently-configured-version>
-#        * <old-postinst> `abort-upgrade' <new version>
-#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
-#          <new-version>
-#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
-#          <failed-install-package> <version> `removing'
-#          <conflicting-package> <version>
-# for details, see http://www.debian.org/doc/debian-policy/ or
-# the debian-policy package
-#
-preversion=$2
-
-case "$1" in
-    configure)
-       # To fix the bug in generated by previous version files permissions
-       # also closes #352053
-
-       LOG=/var/log/fail2ban.log
-       touch $LOG
-       chown root:adm ${LOG}*
-       chmod 640 ${LOG}*
-        
-       # Note regarding changed configuration file
-       # Note regarding changed configuration file
-		if [ ! -z $preversion ]; then
-			if dpkg --compare-versions $preversion lt 0.7.1-1; then
-			cat <<EOF
-WARNING!
-  
-  Fail2ban 0.7 is a complete rewrite of the 0.6 version, and if you
-  customized any of provided configuration or startup files
-  (/etc/default/fail2ban, /etc/fail2ban.conf, /etc/init.d/fail2ban), please
-  read relevant entry in /usr/share/doc/fail2ban/NEWS.Debian.gz.
-  
-EOF
-			fi
-			if dpkg --compare-versions $preversion lt 0.5.4-5.14; then
-			cat <<EOF
-WARNING!
-
- Configuration file /etc/fail2ban.conf, failregex configuration
- parameter specificly, were changed in 0.5.4-5 to close reported
- security breach, and in 0.5.4-5.14 to close few other bugs.
-
-updating from <0.5.4-5
- Unless configuration file (or corresponding failregex'es) gets updated,
- security breach is not closed and corresponding warning will be reported
- by the fail2ban (in the log files).
-
-updating from <0.5.4-5.14
- Bugs #329163, #331695 dealing with changed iptables rules
- outside of fail2ban were fixed in 0.5.4-5.14, and require upgrade of the
- configuration file (fwcheck option was introduced) to take full
- advantage of the problem solution (otherwise some problems might
- persist)
-
- Please review the configuration file and make appropriate changes.
-ENJOY!
-
-EOF
-			fi
-		fi
-		;;
-
-    abort-upgrade|abort-remove|abort-deconfigure)
-
-    ;;
-
-    *)
-        echo "postinst called with unknown argument \`$1'" >&2
-        exit 1
-    ;;
-esac
-
-if dpkg-maintscript-helper supports mv_conffile 2>/dev/null; then
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/action.d/firewall-cmd-direct-new.conf /etc/fail2ban/action.d/firewallcmd-new.conf 0.8.13-1~ -- "$@"
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/lighttpd-fastcgi.conf /etc/fail2ban/filter.d/suhosin.conf 0.8.13-1~ -- "$@"
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/sasl.conf /etc/fail2ban/filter.d/postfix-sasl.conf 0.8.13-1~ -- "$@"
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/couriersmtp.conf /etc/fail2ban/filter.d/courier-smtp.conf 0.9.0-1~ -- "$@"
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/courierlogin.conf /etc/fail2ban/filter.d/courier-auth.conf 0.9.0-1~ -- "$@"
-fi
-
-# dh_installdeb will replace this with shell code automatically
-# generated by other debhelper scripts.
-
-#DEBHELPER#
-
-exit 0
-
-

debian/postrm

@@ -1,52 +0,0 @@
-#! /bin/sh
-# postrm script for fail2ban
-#
-# see: dh_installdeb(1)
-
-set -e
-
-# summary of how this script can be called:
-#        * <postrm> `remove'
-#        * <postrm> `purge'
-#        * <old-postrm> `upgrade' <new-version>
-#        * <new-postrm> `failed-upgrade' <old-version>
-#        * <new-postrm> `abort-install'
-#        * <new-postrm> `abort-install' <old-version>
-#        * <new-postrm> `abort-upgrade' <old-version>
-#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
-# for details, see /usr/doc/packaging-manual/
-
-
-case "$1" in
-       purge|disappear)
-       				
-		# Remove configuration
-                rm -f /etc/fail2ban.conf
-		
-		# Remove logs
-		rm -f /var/log/fail2ban*
-		
-		# Remove sqlite db
-		rm -f /var/lib/fail2ban/fail2ban.sqlite3
-		;;
-       remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
-		# nothing
-		# We may not delete the user fail2ban, as there may be
-		# files owned by it in /var/log/ and /etc/.
-        	;;
-esac
-
-if dpkg-maintscript-helper supports mv_conffile 2>/dev/null; then
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/action.d/firewall-cmd-direct-new.conf /etc/fail2ban/action.d/firewallcmd-new.conf 0.8.13-1~ -- "$@"
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/lighttpd-fastcgi.conf /etc/fail2ban/filter.d/suhosin.conf 0.8.13-1~ -- "$@"
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/sasl.conf /etc/fail2ban/filter.d/postfix-sasl.conf 0.8.13-1~ -- "$@"
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/couriersmtp.conf /etc/fail2ban/filter.d/courier-smtp.conf 0.9.0-1~ -- "$@"
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/courierlogin.conf /etc/fail2ban/filter.d/courier-auth.conf 0.9.0-1~ -- "$@"
-fi
-
-# dh_installdeb will replace this with shell code automatically
-# generated by other debhelper scripts.
-
-#DEBHELPER#
-
-

debian/preinst

@@ -1,15 +0,0 @@
-#!/bin/sh
-
-set -e
-
-if dpkg-maintscript-helper supports mv_conffile 2>/dev/null; then
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/action.d/firewall-cmd-direct-new.conf /etc/fail2ban/action.d/firewallcmd-new.conf 0.8.13-1~ -- "$@"
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/lighttpd-fastcgi.conf /etc/fail2ban/filter.d/suhosin.conf 0.8.13-1~ -- "$@"
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/sasl.conf /etc/fail2ban/filter.d/postfix-sasl.conf 0.8.13-1~ -- "$@"
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/couriersmtp.conf /etc/fail2ban/filter.d/courier-smtp.conf 0.9.0-1~ -- "$@"
-    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/courierlogin.conf /etc/fail2ban/filter.d/courier-auth.conf 0.9.0-1~ -- "$@"
-fi
-
-#DEBHELPER#
-
-exit 0

debian/rules

@@ -1,53 +0,0 @@
-#!/usr/bin/make -f
-# -*- makefile -*-
-# Sample debian/rules that uses debhelper.
-# This file was originally written by Joey Hess and Craig Small.
-# As a special exception, when this file is copied by dh-make into a
-# dh-make output file, you may use that output file without restriction.
-# This special exception was added by Craig Small in version 0.37 of dh-make.
-
-# Uncomment this to turn on verbose mode.
-#export DH_VERBOSE=1
-
-%:
-	dh $@ --with python3,systemd --buildsystem pybuild
-
-DESTDIR=$(CURDIR)/debian/fail2ban
-
-override_dh_clean:
-	rm -rf fail2ban.egg-info
-	dh_clean
-
-override_dh_install:
-	rm -f $(DESTDIR)/usr/share/doc/fail2ban/README.Solaris
-	: # Remove explicitely created /var/run/fail2ban
-	: # just to please lintian since init file will
-	: # take care about it anyways
-	rm -rf $(DESTDIR)/var/run/
-	: # Install bash completion
-	install -d $(DESTDIR)/etc/bash_completion.d
-	install -m 644 files/bash-completion $(DESTDIR)/etc/bash_completion.d/fail2ban
-	: # Install systemd files
-	install -d $(DESTDIR)/lib/systemd/system
-	install -d $(DESTDIR)/usr/lib/tmpfiles.d
-	install -m 644 files/fail2ban.service $(DESTDIR)/lib/systemd/system
-	install -m 644 files/fail2ban-tmpfiles.conf $(DESTDIR)/usr/lib/tmpfiles.d
-	install -d $(DESTDIR)/lib/systemd/system
-	: # Install default jail enabler
-	install -m 644 debian/source/jail.d_defaults-debian.conf $(DESTDIR)/etc/fail2ban/jail.d/defaults-debian.conf
-	dh_install
-
-override_dh_auto_test:
-ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
-	cd build && PYTHONPATH=../.pybuild/pythonX.Y_3.4/build/ scripts-*/fail2ban-testcases --no-network
-
-endif
-
-override_dh_installexamples:
-	dh_installexamples files/ipmasq-* files/nagios files/cacti
-
-override_dh_installinit:
-	dh_installinit -- defaults 99
-
-override_dh_installman:
-	dh_installman man/*.[15]

debian/source/format

@@ -1 +0,0 @@
-3.0 (quilt)

debian/source/jail.d_defaults-debian.conf

@@ -1,2 +0,0 @@
-[sshd]
-enabled = true

debian/watch

@@ -1,6 +0,0 @@
-# watch control file for uscan
-# Run the "uscan" command to check for upstream updates and more.
-# Site		Directory		Pattern			Version	Script
-version=3
-opts="filenamemangle=s/.*\/(.*).tar.gz/fail2ban_$1\.orig.tar.gz/" \
- http://githubredir.debian.net/github/fail2ban/fail2ban /([\.0-9]*).tar.gz

fail2ban/__init__.py

@@ -68,3 +68,7 @@ logging.notice = _root_notice
 
 # add NOTICE to the priority map of all the levels
 logging.handlers.SysLogHandler.priority_map['NOTICE'] = 'notice'
+
+from time import strptime
+# strptime thread safety hack-around - http://bugs.python.org/issue7980
+strptime("2012", "%Y")

fail2ban/client/actionreader.py

@@ -26,7 +26,7 @@ __license__ = "GPL"
 
 import os
 
-from .configreader import ConfigReader, DefinitionInitConfigReader
+from .configreader import DefinitionInitConfigReader
 from ..helpers import getLogger
 
 # Gets the instance of the logger.
@@ -47,15 +47,19 @@ class ActionReader(DefinitionInitConfigReader):
 		DefinitionInitConfigReader.__init__(
 			self, file_, jailName, initOpts, **kwargs)
 
+	def setFile(self, fileName):
+		self.__file = fileName
+		DefinitionInitConfigReader.setFile(self, os.path.join("action.d", fileName))
+	
+	def getFile(self):
+		return self.__file
+
 	def setName(self, name):
 		self._name = name
 
 	def getName(self):
 		return self._name
 
-	def read(self):
-		return ConfigReader.read(self, os.path.join("action.d", self._file))
-
 	def convert(self):
 		head = ["set", self._jailName]
 		stream = list()

fail2ban/client/beautifier.py

@@ -45,7 +45,7 @@ class Beautifier:
 		return self.__inputCmd
 		
 	def beautify(self, response):
-		logSys.debug("Beautify " + repr(response) + " with " + repr(self.__inputCmd))
+		logSys.debug("Beautify " + `response` + " with " + `self.__inputCmd`)
 		inC = self.__inputCmd
 		msg = response
 		try:
@@ -85,6 +85,9 @@ class Beautifier:
 						val = " ".join(res1[1]) if isinstance(res1[1], list) else res1[1]
 						msg.append("%s %s:\t%s" % (prefix1, res1[0], val))
 				msg = "\n".join(msg)
+			elif inC[1] == "syslogsocket":
+				msg = "Current syslog socket is:\n"
+				msg = msg + "`- " + response
 			elif inC[1] == "logtarget":
 				msg = "Current logging target is:\n"
 				msg = msg + "`- " + response
@@ -99,7 +102,7 @@ class Beautifier:
 				elif response == 4:
 					msg = msg + "DEBUG"
 				else:
-					msg = msg + repr(response)
+					msg = msg + `response`
 			elif inC[1] == "dbfile":
 				if response is None:
 					msg = "Database currently disabled"
@@ -180,13 +183,13 @@ class Beautifier:
 					msg += ", ".join(response)
 		except Exception:
 			logSys.warning("Beautifier error. Please report the error")
-			logSys.error("Beautify " + repr(response) + " with " + repr(self.__inputCmd) +
+			logSys.error("Beautify " + `response` + " with " + `self.__inputCmd` +
 						 " failed")
-			msg = msg + repr(response)
+			msg = msg + `response`
 		return msg
 
 	def beautifyError(self, response):
-		logSys.debug("Beautify (error) " + repr(response) + " with " + repr(self.__inputCmd))
+		logSys.debug("Beautify (error) " + `response` + " with " + `self.__inputCmd`)
 		msg = response
 		if isinstance(response, UnknownJailException):
 			msg = "Sorry but the jail '" + response.args[0] + "' does not exist"

fail2ban/client/configparserinc.py

@@ -58,10 +58,11 @@ if sys.version_info >= (3,2): # pragma: no cover
 				parser, option, accum, rest, section, map, depth)
 
 else: # pragma: no cover
-	from configparser import SafeConfigParser
+	from ConfigParser import SafeConfigParser
 
 # Gets the instance of the logger.
 logSys = getLogger(__name__)
+logLevel = 7
 
 __all__ = ['SafeConfigParserWithIncludes']
 
@@ -98,31 +99,74 @@ after = 1.conf
 
 	if sys.version_info >= (3,2):
 		# overload constructor only for fancy new Python3's
-		def __init__(self, *args, **kwargs):
+		def __init__(self, share_config=None, *args, **kwargs):
 			kwargs = kwargs.copy()
 			kwargs['interpolation'] = BasicInterpolationWithName()
 			kwargs['inline_comment_prefixes'] = ";"
 			super(SafeConfigParserWithIncludes, self).__init__(
 				*args, **kwargs)
+			self._cfg_share = share_config
 
-	#@staticmethod
-	def getIncludes(resource, seen = []):
+	else:
+		def __init__(self, share_config=None, *args, **kwargs):
+			SafeConfigParser.__init__(self, *args, **kwargs)
+			self._cfg_share = share_config
+
+	@property
+	def share_config(self):
+		return self._cfg_share
+
+	def _getSharedSCPWI(self, filename):
+		SCPWI = SafeConfigParserWithIncludes
+		# read single one, add to return list, use sharing if possible:
+		if self._cfg_share:
+			# cache/share each file as include (ex: filter.d/common could be included in each filter config):
+			hashv = 'inc:'+(filename if not isinstance(filename, list) else '\x01'.join(filename))
+			cfg, i = self._cfg_share.get(hashv, (None, None))
+			if cfg is None:
+				cfg = SCPWI(share_config=self._cfg_share)
+				i = cfg.read(filename, get_includes=False)
+				self._cfg_share[hashv] = (cfg, i)
+			elif logSys.getEffectiveLevel() <= logLevel:
+				logSys.log(logLevel, "    Shared file: %s", filename)
+		else:
+			# don't have sharing:
+			cfg = SCPWI()
+			i = cfg.read(filename, get_includes=False)
+		return (cfg, i)
+
+	def _getIncludes(self, filenames, seen=[]):
+		if not isinstance(filenames, list):
+			filenames = [ filenames ]
+		# retrieve or cache include paths:
+		if self._cfg_share:
+			# cache/share include list:
+			hashv = 'inc-path:'+('\x01'.join(filenames))
+			fileNamesFull = self._cfg_share.get(hashv)
+			if fileNamesFull is None:
+				fileNamesFull = []
+				for filename in filenames:
+					fileNamesFull += self.__getIncludesUncached(filename, seen)
+				self._cfg_share[hashv] = fileNamesFull
+			return fileNamesFull
+		# don't have sharing:
+		fileNamesFull = []
+		for filename in filenames:
+			fileNamesFull += self.__getIncludesUncached(filename, seen)
+		return fileNamesFull
+
+	def __getIncludesUncached(self, resource, seen=[]):
 		"""
 		Given 1 config resource returns list of included files
 		(recursively) with the original one as well
 		Simple loops are taken care about
 		"""
-		
-		# Use a short class name ;)
 		SCPWI = SafeConfigParserWithIncludes
-		
-		parser = SafeConfigParser()
 		try:
-			if sys.version_info >= (3,2): # pragma: no cover
-				parser.read(resource, encoding='utf-8')
-			else:
-				parser.read(resource)
-		except UnicodeDecodeError as e:
+			parser, i = self._getSharedSCPWI(resource)
+			if not i:
+				return []
+		except UnicodeDecodeError, e:
 			logSys.error("Error decoding config file '%s': %s" % (resource, e))
 			return []
 		
@@ -141,22 +185,76 @@ after = 1.conf
 						if r in seen:
 							continue
 						s = seen + [resource]
-						option_list += SCPWI.getIncludes(r, s)
+						option_list += self._getIncludes(r, s)
 		# combine lists
 		return newFiles[0][1] + [resource] + newFiles[1][1]
-		#print "Includes list for " + resource + " is " + `resources`
-	getIncludes = staticmethod(getIncludes)
 
+	def get_defaults(self):
+		return self._defaults
 
-	def read(self, filenames):
-		fileNamesFull = []
+	def get_sections(self):
+		return self._sections
+
+	def read(self, filenames, get_includes=True):
 		if not isinstance(filenames, list):
 			filenames = [ filenames ]
-		for filename in filenames:
-			fileNamesFull += SafeConfigParserWithIncludes.getIncludes(filename)
-		logSys.debug("Reading files: %s" % fileNamesFull)
+		# retrieve (and cache) includes:
+		fileNamesFull = []
+		if get_includes:
+			fileNamesFull += self._getIncludes(filenames)
+		else:
+			fileNamesFull = filenames
+
+		if not fileNamesFull:
+			return []
+
+		logSys.info("  Loading files: %s", fileNamesFull)
+
+		if get_includes or len(fileNamesFull) > 1:
+			# read multiple configs:
+			ret = []
+			alld = self.get_defaults()
+			alls = self.get_sections()
+			for filename in fileNamesFull:
+				# read single one, add to return list, use sharing if possible:
+				cfg, i = self._getSharedSCPWI(filename)
+				if i:
+					ret += i
+					# merge defaults and all sections to self:
+					alld.update(cfg.get_defaults())
+					for n, s in cfg.get_sections().iteritems():
+						if isinstance(s, dict):
+							s2 = alls.get(n)
+							if isinstance(s2, dict):
+								# save previous known values, for possible using in local interpolations later:
+								sk = {}
+								for k, v in s2.iteritems():
+									if not k.startswith('known/'):
+										sk['known/'+k] = v
+								s2.update(sk)
+								# merge section
+								s2.update(s)
+							else:
+								alls[n] = s.copy()
+						else:
+							alls[n] = s
+
+			return ret
+
+		# read one config :
+		if logSys.getEffectiveLevel() <= logLevel:
+			logSys.log(logLevel, "    Reading file: %s", fileNamesFull[0])
+		# read file(s) :
 		if sys.version_info >= (3,2): # pragma: no cover
 			return SafeConfigParser.read(self, fileNamesFull, encoding='utf-8')
 		else:
 			return SafeConfigParser.read(self, fileNamesFull)
 
+	def merge_section(self, section, options, pref='known/'):
+		alls = self.get_sections()
+		sk = {}
+		for k, v in options.iteritems():
+			if pref == '' or not k.startswith(pref):
+				sk[pref+k] = v
+		alls[section].update(sk)
+

fail2ban/client/configreader.py

@@ -25,26 +25,133 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import glob, os
-from configparser import NoOptionError, NoSectionError
+from ConfigParser import NoOptionError, NoSectionError
 
-from .configparserinc import SafeConfigParserWithIncludes
+from .configparserinc import SafeConfigParserWithIncludes, logLevel
 from ..helpers import getLogger
 
 # Gets the instance of the logger.
 logSys = getLogger(__name__)
 
-class ConfigReader(SafeConfigParserWithIncludes):
+class ConfigReader():
+	"""Generic config reader class.
+
+	A caching adapter which automatically reuses already shared configuration.
+	"""
+
+	def __init__(self, use_config=None, share_config=None, **kwargs):
+		# use given shared config if possible (see read):
+		self._cfg_share = None
+		self._cfg = None
+		if use_config is not None:
+			self._cfg = use_config
+		# share config if possible:
+		if share_config is not None:
+			self._cfg_share = share_config
+			self._cfg_share_kwargs = kwargs
+			self._cfg_share_basedir = None
+		elif self._cfg is None:
+			self._cfg = ConfigReaderUnshared(**kwargs)
+
+	def setBaseDir(self, basedir):
+		if self._cfg:
+			self._cfg.setBaseDir(basedir)
+		else:
+			self._cfg_share_basedir = basedir
+
+	def getBaseDir(self):
+		if self._cfg:
+			return self._cfg.getBaseDir()
+		else:
+			return self._cfg_share_basedir
+
+	@property
+	def share_config(self):
+		return self._cfg_share
+
+	def read(self, name, once=True):
+		""" Overloads a default (not shared) read of config reader.
+
+	  To prevent mutiple reads of config files with it includes, reads into 
+	  the config reader, if it was not yet cached/shared by 'name'.
+	  """
+		# already shared ?
+		if not self._cfg:
+			self._create_unshared(name)
+		# performance feature - read once if using shared config reader:
+		if once and self._cfg.read_cfg_files is not None:
+			return self._cfg.read_cfg_files
+
+		# load:
+		logSys.info("Loading configs for %s under %s ", name, self._cfg.getBaseDir())
+		ret = self._cfg.read(name)
+
+		# save already read and return:
+		self._cfg.read_cfg_files = ret
+		return ret
+
+	def _create_unshared(self, name=''):
+		""" Allocates and share a config file by it name.
+
+	  Automatically allocates unshared or reuses shared handle by given 'name' and 
+	  init arguments inside a given shared storage.
+	  """
+		if not self._cfg and self._cfg_share is not None:
+			self._cfg = self._cfg_share.get(name)
+			if not self._cfg:
+				self._cfg = ConfigReaderUnshared(share_config=self._cfg_share, **self._cfg_share_kwargs)
+				if self._cfg_share_basedir is not None:
+					self._cfg.setBaseDir(self._cfg_share_basedir)
+				self._cfg_share[name] = self._cfg
+		else:
+			self._cfg = ConfigReaderUnshared(**self._cfg_share_kwargs)
+
+	def sections(self):
+		if self._cfg is not None:
+			return self._cfg.sections()
+		return []
+
+	def has_section(self, sec):
+		if self._cfg is not None:
+			return self._cfg.has_section(sec)
+		return False
+
+	def merge_section(self, *args, **kwargs):
+		if self._cfg is not None:
+			return self._cfg.merge_section(*args, **kwargs)
+
+	def options(self, *args):
+		if self._cfg is not None:
+			return self._cfg.options(*args)
+		return {}
+
+	def get(self, sec, opt):
+		if self._cfg is not None:
+			return self._cfg.get(sec, opt)
+		return None
+
+	def getOptions(self, *args, **kwargs):
+		if self._cfg is not None:
+			return self._cfg.getOptions(*args, **kwargs)
+		return {}
+
+class ConfigReaderUnshared(SafeConfigParserWithIncludes):
+	"""Unshared config reader (previously ConfigReader).
+
+	Do not use this class (internal not shared/cached represenation).
+	Use ConfigReader instead.
+	"""
 
 	DEFAULT_BASEDIR = '/etc/fail2ban'
 	
-	def __init__(self, basedir=None):
-		SafeConfigParserWithIncludes.__init__(self)
+	def __init__(self, basedir=None, *args, **kwargs):
+		SafeConfigParserWithIncludes.__init__(self, *args, **kwargs)
+		self.read_cfg_files = None
 		self.setBaseDir(basedir)
-		self.__opts = None
 	
 	def setBaseDir(self, basedir):
 		if basedir is None:
-			basedir = ConfigReader.DEFAULT_BASEDIR	# stock system location
+			basedir = ConfigReaderUnshared.DEFAULT_BASEDIR	# stock system location
 		self._basedir = basedir.rstrip('/')
 	
 	def getBaseDir(self):
@@ -55,7 +162,7 @@ class ConfigReader(SafeConfigParserWithIncludes):
 			raise ValueError("Base configuration directory %s does not exist "
 							  % self._basedir)
 		basename = os.path.join(self._basedir, filename)
-		logSys.info("Reading configs for %s under %s "  % (basename, self._basedir))
+		logSys.debug("Reading configs for %s under %s " , filename, self._basedir)
 		config_files = [ basename + ".conf" ]
 
 		# possible further customizations under a .conf.d directory
@@ -67,18 +174,18 @@ class ConfigReader(SafeConfigParserWithIncludes):
 		config_files += sorted(glob.glob('%s/*.local' % config_dir))
 
 		# choose only existing ones
-		config_files = list(filter(os.path.exists, config_files))
+		config_files = filter(os.path.exists, config_files)
 
 		if len(config_files):
 			# at least one config exists and accessible
-			logSys.debug("Reading config files: " + ', '.join(config_files))
+			logSys.debug("Reading config files: %s", ', '.join(config_files))
 			config_files_read = SafeConfigParserWithIncludes.read(self, config_files)
 			missed = [ cf for cf in config_files if cf not in config_files_read ]
 			if missed:
-				logSys.error("Could not read config files: " + ', '.join(missed))
+				logSys.error("Could not read config files: %s", ', '.join(missed))
 			if config_files_read:
 				return True
-			logSys.error("Found no accessible config files for %r under %s" %
+			logSys.error("Found no accessible config files for %r under %s",
 						 ( filename, self.getBaseDir() ))
 			return False
 		else:
@@ -98,7 +205,7 @@ class ConfigReader(SafeConfigParserWithIncludes):
 	# 1 -> the name of the option
 	# 2 -> the default value for the option
 	
-	def getOptions(self, sec, options, pOptions = None):
+	def getOptions(self, sec, options, pOptions=None):
 		values = dict()
 		for option in options:
 			try:
@@ -111,7 +218,7 @@ class ConfigReader(SafeConfigParserWithIncludes):
 				if not pOptions is None and option[1] in pOptions:
 					continue
 				values[option[1]] = v
-			except NoSectionError as e:
+			except NoSectionError, e:
 				# No "Definition" section or wrong basedir
 				logSys.error(e)
 				values[option[1]] = option[2]
@@ -121,24 +228,22 @@ class ConfigReader(SafeConfigParserWithIncludes):
 					logSys.warning("'%s' not defined in '%s'. Using default one: %r"
 								% (option[1], sec, option[2]))
 					values[option[1]] = option[2]
-				else:
-					logSys.debug(
-						"Non essential option '%s' not defined in '%s'.",
-						option[1], sec)
+				elif logSys.getEffectiveLevel() <= logLevel:
+					logSys.log(logLevel, "Non essential option '%s' not defined in '%s'.", option[1], sec)
 			except ValueError:
 				logSys.warning("Wrong value for '" + option[1] + "' in '" + sec +
-							"'. Using default one: '" + repr(option[2]) + "'")
+							"'. Using default one: '" + `option[2]` + "'")
 				values[option[1]] = option[2]
 		return values
 
 class DefinitionInitConfigReader(ConfigReader):
 	"""Config reader for files with options grouped in [Definition] and
-       [Init] sections.
+	[Init] sections.
 
-       Is a base class for readers of filters and actions, where definitions
-       in jails might provide custom values for options defined in [Init]
-       section.
-       """
+	Is a base class for readers of filters and actions, where definitions
+	in jails might provide custom values for options defined in [Init]
+	section.
+	"""
 
 	_configOpts = []
 	
@@ -166,7 +271,9 @@ class DefinitionInitConfigReader(ConfigReader):
 
 	# needed for fail2ban-regex that doesn't need fancy directories
 	def readexplicit(self):
-		return SafeConfigParserWithIncludes.read(self, self._file)
+		if not self._cfg:
+			self._create_unshared(self._file)
+		return SafeConfigParserWithIncludes.read(self._cfg, self._file)
 	
 	def getOptions(self, pOpts):
 		self._opts = ConfigReader.getOptions(
@@ -174,7 +281,7 @@ class DefinitionInitConfigReader(ConfigReader):
 		
 		if self.has_section("Init"):
 			for opt in self.options("Init"):
-				if opt not in self._initOpts:
+				if not self._initOpts.has_key(opt):
 					self._initOpts[opt] = self.get("Init", opt)
 	
 	def convert(self):

fail2ban/client/configurator.py

@@ -33,12 +33,20 @@ logSys = getLogger(__name__)
 
 class Configurator:
 	
-	def __init__(self):
+	def __init__(self, force_enable=False, share_config=None):
 		self.__settings = dict()
 		self.__streams = dict()
-		self.__fail2ban = Fail2banReader()
-		self.__jails = JailsReader()
-	
+		# always share all config readers:
+		if share_config is None:
+			share_config = dict()
+		self.__share_config = share_config
+		self.__fail2ban = Fail2banReader(share_config=share_config)
+		self.__jails = JailsReader(force_enable=force_enable, share_config=share_config)
+
+	def Reload(self):
+		# clear all shared handlers:
+		self.__share_config.clear()
+
 	def setBaseDir(self, folderName):
 		self.__fail2ban.setBaseDir(folderName)
 		self.__jails.setBaseDir(folderName)

fail2ban/client/csocket.py

@@ -57,13 +57,12 @@ class CSocket:
 		self.__csock.close()
 		return ret
 	
-	#@staticmethod
+	@staticmethod
 	def receive(sock):
 		msg = EMPTY_BYTES
 		while msg.rfind(CSocket.END_STRING) == -1:
 			chunk = sock.recv(6)
 			if chunk == '':
-				raise RuntimeError("socket connection broken")
+				raise RuntimeError, "socket connection broken"
 			msg = msg + chunk
 		return loads(msg)
-	receive = staticmethod(receive)

fail2ban/client/fail2banreader.py

@@ -46,6 +46,7 @@ class Fail2banReader(ConfigReader):
 	def getOptions(self):
 		opts = [["string", "loglevel", "INFO" ],
 				["string", "logtarget", "STDERR"],
+				["string", "syslogsocket", "auto"],
 				["string", "dbfile", "/var/lib/fail2ban/fail2ban.sqlite3"],
 				["int", "dbpurgeage", 86400]]
 		self.__opts = ConfigReader.getOptions(self, "Definition", opts)
@@ -57,6 +58,8 @@ class Fail2banReader(ConfigReader):
 				stream.append(["set", "loglevel", self.__opts[opt]])
 			elif opt == "logtarget":
 				stream.append(["set", "logtarget", self.__opts[opt]])
+			elif opt == "syslogsocket":
+				stream.append(["set", "syslogsocket", self.__opts[opt]])
 			elif opt == "dbfile":
 				stream.append(["set", "dbfile", self.__opts[opt]])
 			elif opt == "dbpurgeage":

fail2ban/client/filterreader.py

@@ -26,7 +26,7 @@ __license__ = "GPL"
 
 import os, shlex
 
-from .configreader import ConfigReader, DefinitionInitConfigReader
+from .configreader import DefinitionInitConfigReader
 from ..server.action import CommandAction
 from ..helpers import getLogger
 
@@ -40,16 +40,28 @@ class FilterReader(DefinitionInitConfigReader):
 		["string", "failregex", ""],
 	]
 
-	def read(self):
-		return ConfigReader.read(self, os.path.join("filter.d", self._file))
+	def setFile(self, fileName):
+		self.__file = fileName
+		DefinitionInitConfigReader.setFile(self, os.path.join("filter.d", fileName))
 	
-	def convert(self):
-		stream = list()
+	def getFile(self):
+		return self.__file
+
+	def getCombined(self):
 		combinedopts = dict(list(self._opts.items()) + list(self._initOpts.items()))
+		if not len(combinedopts):
+			return {}
 		opts = CommandAction.substituteRecursiveTags(combinedopts)
 		if not opts:
 			raise ValueError('recursive tag definitions unable to be resolved')
-		for opt, value in opts.items():
+		return opts
+	
+	def convert(self):
+		stream = list()
+		opts = self.getCombined()
+		if not len(opts):
+			return stream
+		for opt, value in opts.iteritems():
 			if opt == "failregex":
 				for regex in value.split('\n'):
 					# Do not send a command if the rule is empty.
@@ -59,7 +71,7 @@ class FilterReader(DefinitionInitConfigReader):
 				for regex in value.split('\n'):
 					# Do not send a command if the rule is empty.
 					if regex != '':
-						stream.append(["set", self._jailName, "addignoreregex", regex])		
+						stream.append(["set", self._jailName, "addignoreregex", regex])
 		if self._initOpts:
 			if 'maxlines' in self._initOpts:
 				# We warn when multiline regex is used without maxlines > 1

fail2ban/client/jailreader.py

@@ -27,7 +27,7 @@ __license__ = "GPL"
 import re, glob, os.path
 import json
 
-from .configreader import ConfigReader
+from .configreader import ConfigReaderUnshared, ConfigReader
 from .filterreader import FilterReader
 from .actionreader import ActionReader
 from ..helpers import getLogger
@@ -87,6 +87,8 @@ class JailReader(ConfigReader):
 		return pathList
 
 	def getOptions(self):
+		opts1st = [["bool", "enabled", False],
+				["string", "filter", ""]]
 		opts = [["bool", "enabled", False],
 				["string", "logpath", None],
 				["string", "logencoding", None],
@@ -101,7 +103,9 @@ class JailReader(ConfigReader):
 				["string", "ignoreip", None],
 				["string", "filter", ""],
 				["string", "action", ""]]
-		self.__opts = ConfigReader.getOptions(self, self.__name, opts)
+
+		# Read first options only needed for merge defaults ('known/...' from filter):
+		self.__opts = ConfigReader.getOptions(self, self.__name, opts1st)
 		if not self.__opts:
 			return False
 		
@@ -111,16 +115,26 @@ class JailReader(ConfigReader):
 				filterName, filterOpt = JailReader.extractOptions(
 					self.__opts["filter"])
 				self.__filter = FilterReader(
-					filterName, self.__name, filterOpt, basedir=self.getBaseDir())
+					filterName, self.__name, filterOpt, share_config=self.share_config, basedir=self.getBaseDir())
 				ret = self.__filter.read()
-				if ret:
-					self.__filter.getOptions(self.__opts)
-				else:
+				# merge options from filter as 'known/...':
+				self.__filter.getOptions(self.__opts)
+				ConfigReader.merge_section(self, self.__name, self.__filter.getCombined(), 'known/')
+				if not ret:
 					logSys.error("Unable to read the filter")
 					return False
 			else:
 				self.__filter = None
 				logSys.warning("No filter set for jail %s" % self.__name)
+
+			# Read second all options (so variables like %(known/param) can be interpolated):
+			self.__opts = ConfigReader.getOptions(self, self.__name, opts)
+			if not self.__opts:
+				return False
+		
+			# cumulate filter options again (ignore given in jail):
+			if self.__filter:
+				self.__filter.getOptions(self.__opts)
 		
 			# Read action
 			for act in self.__opts["action"].split('\n'):
@@ -141,14 +155,14 @@ class JailReader(ConfigReader):
 					else:
 						action = ActionReader(
 							actName, self.__name, actOpt,
-							basedir=self.getBaseDir())
+							share_config=self.share_config, basedir=self.getBaseDir())
 						ret = action.read()
 						if ret:
 							action.getOptions(self.__opts)
 							self.__actions.append(action)
 						else:
 							raise AttributeError("Unable to read action")
-				except Exception as e:
+				except Exception, e:
 					logSys.error("Error in action definition " + act)
 					logSys.debug("Caught exception: %s" % (e,))
 					return False
@@ -202,7 +216,10 @@ class JailReader(ConfigReader):
 			elif opt == "usedns":
 				stream.append(["set", self.__name, "usedns", self.__opts[opt]])
 			elif opt == "failregex":
-				stream.append(["set", self.__name, "addfailregex", self.__opts[opt]])
+				for regex in self.__opts[opt].split('\n'):
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addfailregex", regex])
 			elif opt == "ignorecommand":
 				stream.append(["set", self.__name, "ignorecommand", self.__opts[opt]])
 			elif opt == "ignoreregex":
@@ -213,14 +230,14 @@ class JailReader(ConfigReader):
 		if self.__filter:
 			stream.extend(self.__filter.convert())
 		for action in self.__actions:
-			if isinstance(action, ConfigReader):
+			if isinstance(action, (ConfigReaderUnshared, ConfigReader)):
 				stream.extend(action.convert())
 			else:
 				stream.append(action)
 		stream.insert(0, ["add", self.__name, backend])
 		return stream
 	
-	#@staticmethod
+	@staticmethod
 	def extractOptions(option):
 		match = JailReader.optionCRE.match(option)
 		if not match:
@@ -235,4 +252,3 @@ class JailReader(ConfigReader):
 					val for val in optmatch.group(2,3,4) if val is not None][0]
 				option_opts[opt.strip()] = value.strip()
 		return option_name, option_opts
-	extractOptions = staticmethod(extractOptions)