Compare commits

...
36 changed files with 480 additions and 408 deletions
+12 -2
View File
@@ -4,9 +4,19 @@
|_| \__,_|_|_/___|_.__/\__,_|_||_|
=============================================================
Fail2Ban (version 0.6.1) 2006/03/16
Fail2Ban (version 0.6.2) 2006/12/11
=============================================================
ver. 0.6.2 (2006/12/11) - stable
----------
- Fixed UTF-8 log file parsing
- Propagated patches introduced by Debian maintainer
(Yaroslav Halchenko):
* Made locale configurable
* Fixed warning if ignoreip is empty
- Added named group "host" for "failregex". Fixed security
vulnerability CVE-2006-6302
ver. 0.6.1 (2006/03/16) - stable
----------
- Added permanent banning. Set banTime to a negative value to
@@ -22,7 +32,7 @@ ver. 0.6.1 (2006/03/16) - stable
- Added parsing of timestamp in TAI64N format (#1275325).
Thanks to Mark Edgington
- Added patch #1382936 (Default formatted syslog logging).
Thanks to Patrick Börjesson
Thanks to Patrick B�rjesson
- Removed 192.168.0.0/16 from ignoreip. Attacks could also
come from the local network.
- Robust startup: if iptables module does not get fully
+1 -1
View File
@@ -1,6 +1,6 @@
Metadata-Version: 1.0
Name: fail2ban
Version: 0.6.1
Version: 0.6.2
Summary: Ban IPs that make too many password failure
Home-page: http://fail2ban.sourceforge.net
Author: Cyril Jaquier
+11 -5
View File
@@ -4,7 +4,7 @@
|_| \__,_|_|_/___|_.__/\__,_|_||_|
=============================================================
Fail2Ban (version 0.6.1) 2006/03/16
Fail2Ban (version 0.6.2) 2006/12/11
=============================================================
Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -58,8 +58,8 @@ Require: python-2.4 (http://www.python.org)
To install, just do:
> tar xvfj fail2ban-0.6.1.tar.bz2
> cd fail2ban-0.6.1
> tar xvfj fail2ban-0.6.2.tar.bz2
> cd fail2ban-0.6.2
> python setup.py install
This will install Fail2Ban into /usr/lib/fail2ban. The
@@ -116,6 +116,12 @@ options:
-v verbose. Use twice for greater effect
-V print software version
Please note that a vulnerability (CVE-2006-6302) affects
version < 0.6.2. Since 0.6.2, a named group "host" was added
to "failregex". This group must match the host address. Old
configuration files will still work but will generate a
warning. In this case, please update your configuration file.
Contact:
--------
@@ -130,10 +136,10 @@ Cyril Jaquier: <lostcontrol@users.sourceforge.net>
Thanks:
-------
Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
Edgington, Patrick Börjesson, kojiro, zugeschmiert
Edgington, Patrick Börjesson, kojiro, zugeschmiert
License:
--------
+1 -1
View File
@@ -4,7 +4,7 @@
|_| \__,_|_|_/___|_.__/\__,_|_||_|
=============================================================
ToDo $Revision: 1.11 $
ToDo $Revision: 242 $
=============================================================
See Feature Request Tracking System at SourceForge.net
+13 -4
View File
@@ -1,6 +1,6 @@
# Fail2Ban configuration file
#
# $Revision: 1.2 $
# $Revision: 484 $
#
# 2005.06.21 modified for readability Iain Lea iain@bricbrac.de
@@ -11,6 +11,15 @@
#
background = false
# Option: locale
# Notes.: global (cannot be redefined per section) locale to use for
# timestamp pattern matching by changing LC_TIME for
# fail2ban process. Empty entry sets locale to default one
# (usually specified by LC_ALL environment variable).
# Values: LOCALE Default:
#
locale =
# Option: logtargets
# Notes.: log targets. Space separated list of logging targets.
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
@@ -248,7 +257,7 @@ timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
# Notes.: regex to match the password failure messages in the logfile.
# Values: TEXT Default: authentication failure|user .* not found
#
failregex = authentication failure|user .* not found
failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
[VSFTPD]
@@ -288,7 +297,7 @@ timepattern = %%b %%d %%H:%%M:%%S
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
failregex = FAIL LOGIN
failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+)
[SSH]
@@ -324,4 +333,4 @@ timepattern = %%b %%d %%H:%%M:%%S
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
failregex = Authentication failure|Failed password|Invalid user
failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
+11 -2
View File
@@ -1,6 +1,6 @@
# Fail2Ban configuration file
#
# $Revision: 1.9 $
# $Revision: 484 $
#
# 2005.06.21 modified for readability Iain Lea iain@bricbrac.de
@@ -28,6 +28,15 @@ verbose = 1
#
debug = false
# Option: locale
# Notes.: global (cannot be redefined per section) locale to use for
# timestamp pattern matching by changing LC_TIME for
# fail2ban process. Empty entry sets locale to default one
# (usually specified by LC_ALL environment variable).
# Values: LOCALE Default:
#
locale =
# Option: logtargets
# Notes.: log targets. Space separated list of logging targets.
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
@@ -383,7 +392,7 @@ timepattern = %%b %%d %%H:%%M:%%S
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
failregex = FAIL LOGIN
failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+)
[SSH]
# Option: enabled
+14 -4
View File
@@ -1,6 +1,6 @@
# Fail2Ban configuration file
#
# $Revision: 1.2 $
# $Revision: 484 $
#
# 2005.06.21 modified for readability Iain Lea iain@bricbrac.de
@@ -11,6 +11,15 @@
#
background = false
# Option: locale
# Notes.: global (cannot be redefined per section) locale to use for
# timestamp pattern matching by changing LC_TIME for
# fail2ban process. Empty entry sets locale to default one
# (usually specified by LC_ALL environment variable).
# Values: LOCALE Default:
#
locale =
# Option: logtargets
# Notes.: log targets. Space separated list of logging targets.
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
@@ -242,7 +251,8 @@ timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
# Notes.: regex to match the password failure messages in the logfile.
# Values: TEXT Default: authentication failure|user .* not found
#
failregex = authentication failure|user .* not found
failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
[VSFTPD]
# Option: enabled
@@ -275,7 +285,7 @@ timepattern = %%b %%d %%H:%%M:%%S
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
failregex = FAIL LOGIN
failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+)
[SSH]
@@ -311,4 +321,4 @@ timepattern = %%b %%d %%H:%%M:%%S
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
failregex = Authentication failure|Failed password|Invalid user
failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
+1 -1
View File
@@ -16,7 +16,7 @@
#
# Author: Cyril Jaquier
#
# $Revision: 1.2 $
# $Revision: 216 $
# Command line options for Fail2Ban. Refer to "fail2ban -h" for
# valid options.
+1 -1
View File
@@ -17,7 +17,7 @@
#
# Author: Sireyessire, Cyril Jaquier
#
# $Revision: 1.2 $
# $Revision: 216 $
opts="start stop restart showlog"
+78 -78
View File
@@ -1,78 +1,78 @@
#!/bin/bash
#
# fail2ban
#
# chkconfig: 345 91 9
# description: if many unsuccessfull login attempts from some ip address \
# during a short period happen, this address is banned \
# by the firewall
#
# Author: Andrey G. Grozin
#
# $Revision: 1.2 $
# Source function library.
. /etc/init.d/functions
# Get config.
. /etc/sysconfig/network
# Check that networking is up.
[ "${NETWORKING}" = "no" ] && exit 0
[ -f /etc/fail2ban.conf ] || exit 0
FAIL2BAN="/usr/bin/fail2ban"
PIDFILE="/var/run/fail2ban.pid"
RETVAL=0
start() {
echo -n $"Starting fail2ban: "
"${FAIL2BAN}" -b > /dev/null
RETVAL=$?
echo
}
stop() {
if [ -f "${PIDFILE}" ]; then
echo -n $"Stopping fail2ban: "
"${FAIL2BAN}" -k > /dev/null
echo
fi
}
restart() {
stop
start
}
# See how we were called.
case "$1" in
start)
start
;;
stop)
stop
;;
status)
status fail2ban
RETVAL=$?
;;
reload)
restart
;;
restart)
restart
;;
condrestart)
if [ -f "${PIDFILE}" ]; then
restart
fi
;;
*)
echo $"Usage: $0 {start|stop|status|restart|condrestart}"
exit 1
;;
esac
exit $RETVAL
#!/bin/bash
#
# fail2ban
#
# chkconfig: 345 91 9
# description: if many unsuccessfull login attempts from some ip address \
# during a short period happen, this address is banned \
# by the firewall
#
# Author: Andrey G. Grozin
#
# $Revision: 216 $
# Source function library.
. /etc/init.d/functions
# Get config.
. /etc/sysconfig/network
# Check that networking is up.
[ "${NETWORKING}" = "no" ] && exit 0
[ -f /etc/fail2ban.conf ] || exit 0
FAIL2BAN="/usr/bin/fail2ban"
PIDFILE="/var/run/fail2ban.pid"
RETVAL=0
start() {
echo -n $"Starting fail2ban: "
"${FAIL2BAN}" -b > /dev/null
RETVAL=$?
echo
}
stop() {
if [ -f "${PIDFILE}" ]; then
echo -n $"Stopping fail2ban: "
"${FAIL2BAN}" -k > /dev/null
echo
fi
}
restart() {
stop
start
}
# See how we were called.
case "$1" in
start)
start
;;
stop)
stop
;;
status)
status fail2ban
RETVAL=$?
;;
reload)
restart
;;
restart)
restart
;;
condrestart)
if [ -f "${PIDFILE}" ]; then
restart
fi
;;
*)
echo $"Usage: $0 {start|stop|status|restart|condrestart}"
exit 1
;;
esac
exit $RETVAL
+3 -3
View File
@@ -16,10 +16,10 @@
# Author: Cyril Jaquier
#
# $Revision: 1.1 $
# $Revision: 50 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.1 $"
__date__ = "$Date: 2005/02/18 13:26:41 $"
__version__ = "$Revision: 50 $"
__date__ = "$Date: 2005-02-18 14:30:54 +0100 (Fri, 18 Feb 2005) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
+3 -3
View File
@@ -16,11 +16,11 @@
# Author: Cyril Jaquier
#
# $Revision: 1.6 $
# $Revision: 216 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.6 $"
__date__ = "$Date: 2005/11/20 17:07:47 $"
__version__ = "$Revision: 216 $"
__date__ = "$Date: 2005-11-20 18:07:47 +0100 (Sun, 20 Nov 2005) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
+22
View File
@@ -1,3 +1,25 @@
fail2ban (0.6.2-1) unstable; urgency=low
* New upstream release:
+ locale_config, vsftpd_regexp, and empty_ip patches got absorbed upstream
-- Yaroslav Halchenko <debian@onerussian.com> Mon, 11 Dec 2006 20:53:30 -0500
fail2ban (0.6.1-12) unstable; urgency=low
* Added section for WUFTPD (Thanks to Jesse Wyant) (closes: #386381)
-- Yaroslav Halchenko <debian@onerussian.com> Wed, 18 Oct 2006 01:05:31 -0400
fail2ban (0.6.1-11) unstable; urgency=low
* Adjusted manpage for fail2ban.conf to point to shipped examples of
configuration files as the source of details about available configuration
options (closes: #382403)
* Changes in man/fail2ban.conf.5 are managed via dpatch now
-- Yaroslav Halchenko <debian@onerussian.com> Wed, 16 Aug 2006 00:18:59 +0300
fail2ban (0.6.1-10) unstable; urgency=low
* Adjusted to comply with recent changes in debian python policy and use
+2 -2
View File
@@ -3,8 +3,8 @@ Section: net
Priority: optional
Maintainer: Yaroslav Halchenko <debian@onerussian.com>
Uploaders: Barak Pearlmutter <bap@debian.org>
Build-Depends: debhelper (>= 4.1.67), dpatch
Build-Depends-Indep: python, python-dev, help2man, python-central (>= 0.4.17)
Build-Depends: debhelper (>= 5.0.37.2), dpatch
Build-Depends-Indep: python, python-dev, help2man, python-central (>= 0.5)
XS-Python-Version: current, >= 2.3
Standards-Version: 3.7.2
-22
View File
@@ -1,22 +0,0 @@
#! /bin/sh /usr/share/dpatch/dpatch-run
## 00_empty_ip.dpatch by <debian@onerussian.com>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: Filter out empty IPs for ignoreip
@DPATCH@
diff -x '*~' -Naur fail2ban-0.6.1.pre/fail2ban.py fail2ban-0.6.1.post/fail2ban.py
--- fail2ban-0.6.1.pre/fail2ban.py 2006-03-19 00:20:44.000000000 -0500
+++ fail2ban-0.6.1.post/fail2ban.py 2006-07-03 21:56:10.000000000 -0400
@@ -356,7 +356,9 @@
"ONLY DISPLAYED IN THE LOG MESSAGES")
# Ignores IP list
- ignoreIPList = conf["ignoreip"].split(' ')
+ # and filter out empty entries. Otherwise
+ # WARNING: is not a valid IP address
+ ignoreIPList = filter(None, conf["ignoreip"].split(' '))
# Checks for root user. This is necessary because log files
# are owned by root and firewall needs root access.
-128
View File
@@ -1,128 +0,0 @@
#! /bin/sh /usr/share/dpatch/dpatch-run
## 00_locale_config.dpatch by <debian@onerussian.com>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: Set up LC_TIME per configuration option, not by resetting LC_ALL to
## DP: default locale as it was done before. So this patch effectively changes
## DP: bug into a feature
@DPATCH@
diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.hostsdeny fail2ban-0.6.1.post/config/fail2ban.conf.hostsdeny
--- fail2ban-0.6.1.pre/config/fail2ban.conf.hostsdeny 2006-03-27 12:56:38.000000000 -0500
+++ fail2ban-0.6.1.post/config/fail2ban.conf.hostsdeny 2006-07-03 22:20:21.000000000 -0400
@@ -11,6 +11,15 @@
#
background = false
+# Option: locale
+# Notes.: global (cannot be redefined per section) locale to use for
+# timestamp pattern matching by changing LC_TIME for
+# fail2ban process. Empty entry sets locale to default one
+# (usually specified by LC_ALL environment variable).
+# Values: LOCALE Default:
+#
+locale =
+
# Option: logtargets
# Notes.: log targets. Space separated list of logging targets.
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.iptables fail2ban-0.6.1.post/config/fail2ban.conf.iptables
--- fail2ban-0.6.1.pre/config/fail2ban.conf.iptables 2006-03-27 12:56:38.000000000 -0500
+++ fail2ban-0.6.1.post/config/fail2ban.conf.iptables 2006-07-03 22:17:30.000000000 -0400
@@ -28,6 +28,15 @@
#
debug = false
+# Option: locale
+# Notes.: global (cannot be redefined per section) locale to use for
+# timestamp pattern matching by changing LC_TIME for
+# fail2ban process. Empty entry sets locale to default one
+# (usually specified by LC_ALL environment variable).
+# Values: LOCALE Default:
+#
+locale =
+
# Option: logtargets
# Notes.: log targets. Space separated list of logging targets.
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.shorewall fail2ban-0.6.1.post/config/fail2ban.conf.shorewall
--- fail2ban-0.6.1.pre/config/fail2ban.conf.shorewall 2006-03-27 12:56:38.000000000 -0500
+++ fail2ban-0.6.1.post/config/fail2ban.conf.shorewall 2006-07-03 22:20:01.000000000 -0400
@@ -11,6 +11,15 @@
#
background = false
+# Option: locale
+# Notes.: global (cannot be redefined per section) locale to use for
+# timestamp pattern matching by changing LC_TIME for
+# fail2ban process. Empty entry sets locale to default one
+# (usually specified by LC_ALL environment variable).
+# Values: LOCALE Default:
+#
+locale =
+
# Option: logtargets
# Notes.: log targets. Space separated list of logging targets.
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
diff -x '*~' -Naur fail2ban-0.6.1.pre/fail2ban fail2ban-0.6.1.post/fail2ban
--- fail2ban-0.6.1.pre/fail2ban 2006-03-19 00:20:44.000000000 -0500
+++ fail2ban-0.6.1.post/fail2ban 2006-07-03 22:38:11.000000000 -0400
@@ -26,14 +26,7 @@
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
-import sys, traceback, logging, locale
-
-# Set the locale with the user's default setting
-try:
- locale.setlocale(locale.LC_ALL, '')
-except Exception:
- print "Unable to set locale to " + `locale.getdefaultlocale()`
- sys.exit(-1)
+import sys, traceback, logging
# Inserts our own modules path first in the list
# fix for bug #343821
diff -x '*~' -Naur fail2ban-0.6.1.pre/fail2ban.py fail2ban-0.6.1.post/fail2ban.py
--- fail2ban-0.6.1.pre/fail2ban.py 2006-03-19 00:20:44.000000000 -0500
+++ fail2ban-0.6.1.post/fail2ban.py 2006-07-03 23:02:03.000000000 -0400
@@ -25,7 +25,8 @@
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
-import time, sys, getopt, os, string, signal, logging, logging.handlers, copy
+import time, sys, getopt, os, string, signal, logging, logging.handlers, \
+ copy, locale
from ConfigParser import *
from version import version
@@ -240,6 +241,7 @@
["bool", "debug", False],
["int", "verbose", conf["verbose"]],
["str", "pidlock", "/var/run/fail2ban.pid"],
+ ["str", "locale", ""],
["int", "maxfailures", 5],
["int", "bantime", 600],
["int", "findtime", 600],
@@ -262,10 +264,18 @@
# have to be overridden
for t, label, v in optionValues:
confReader.setValue("DEFAULT", label, `conf[label]`)
-
+
# PID lock
pidLock.setPath(conf["pidlock"])
-
+
+ # Set the LC_TIME with the user's default setting
+ try:
+ logSys.info("Setting LC_TIME locale option to '%s'"%conf["locale"])
+ locale.setlocale(locale.LC_TIME, conf["locale"])
+ except Exception:
+ logSys.error("Unable to set locale to '%s'"%conf["locale"])
+ sys.exit(-1)
+
# Now we can kill properly a running instance if needed
if conf["kill"]:
pid = pidLock.exists()
-44
View File
@@ -1,44 +0,0 @@
#! /bin/sh /usr/share/dpatch/dpatch-run
## 00_vsftpd_regexp.dpatch by <debian@onerussian.com>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: Fix of debian bug #366687: strict regexp for vsftpd
@DPATCH@
diff -rNu fail2ban-0.6.1.orig/config/fail2ban.conf.iptables fail2ban-0.6.1.fixed/config/fail2ban.conf.iptables
--- fail2ban-0.6.1.orig/config/fail2ban.conf.iptables 2006-03-27 12:56:38.000000000 -0500
+++ fail2ban-0.6.1.fixed/config/fail2ban.conf.iptables 2006-05-10 13:47:40.000000000 -0400
@@ -383,7 +383,7 @@
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
-failregex = FAIL LOGIN
+failregex = \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$
[PROFTPD]
# Option: enabled
diff -rNu fail2ban-0.6.1.orig/config/fail2ban.conf.shorewall fail2ban-0.6.1.fixed/config/fail2ban.conf.shorewall
--- fail2ban-0.6.1.orig/config/fail2ban.conf.shorewall 2006-03-27 12:56:38.000000000 -0500
+++ fail2ban-0.6.1.fixed/config/fail2ban.conf.shorewall 2006-05-10 13:47:40.000000000 -0400
@@ -383,7 +383,7 @@
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
-failregex = FAIL LOGIN
+failregex = \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$
[PROFTPD]
# Option: enabled
diff -rNu fail2ban-0.6.1.orig/config/fail2ban.conf.hostsdeny fail2ban-0.6.1.fixed/config/fail2ban.conf.hostsdeny
--- fail2ban-0.6.1.orig/config/fail2ban.conf.hostsdeny 2006-03-27 12:56:38.000000000 -0500
+++ fail2ban-0.6.1.fixed/config/fail2ban.conf.hostsdeny 2006-05-10 13:47:40.000000000 -0400
@@ -383,7 +383,7 @@
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
-failregex = FAIL LOGIN
+failregex = \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$
[PROFTPD]
# Option: enabled
+2 -3
View File
@@ -1,7 +1,6 @@
00_empty_ip
00_locale_config
00_verbosity
00_proftpd_section
00_vsftpd_regexp
01_apache2_other
02_sasl_section
03_wuftpd
03_fail2ban_conf_5_manpage
+39
View File
@@ -0,0 +1,39 @@
#! /bin/sh /usr/share/dpatch/dpatch-run
## fail2ban_conf_5_manpage.dpatch by <debian@onerussian.com>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: Adjusts manpage for configuration file to reflect Debian specific
## DP: changes
@DPATCH@
diff -Naur fail2ban-0.6.1.orig/man/fail2ban.conf.5 fail2ban-0.6.1.mod/man/fail2ban.conf.5
--- fail2ban-0.6.1.orig/man/fail2ban.conf.5 2006-08-16 00:30:19.000000000 +0300
+++ fail2ban-0.6.1.mod/man/fail2ban.conf.5 2006-08-16 00:28:44.000000000 +0300
@@ -5,7 +5,7 @@
.SH "DESCRIPTION"
\fB/etc/fail2ban.conf\fR contains data about the general configuration of fail2ban, the mail notification and services to monitor.
.SH "VARIABLES"
-Please look at the file itself
+Please look at the file itself. Had you modified it and kept modified version during upgrades, please look at fail2ban.conf.iptables.gz file at /usr/share/doc/fail2ban/examples, which provides full version of the shipped configuration file.
.SH "FILES"
.I /etc/fail2ban.conf
.SH "REPORTING BUGS"
@@ -13,8 +13,16 @@
via bug tracker
.SH "AUTHOR"
Cyril Jaquier <lostcontrol@users.sourceforge.net>
+.br
+Modified by
+.br
+ - Yaroslav O. Halchenko <debian@onerussian.com>.
+.br
+Sponsored for Debian by
+.br
+ - Barak A. Pearlmutter <barak@cs.nuim.ie>.
.SH "SEE ALSO"
-.BR fail2ban (8)
+.BR fail2ban(8)
.TP
See
.BR "http://fail2ban.sourceforge.net/".
+160
View File
@@ -0,0 +1,160 @@
#! /bin/sh /usr/share/dpatch/dpatch-run
## 03_wuftpd.dpatch by <debian@onerussian.com>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: No description.
@DPATCH@
diff -urNad trunk-0.6~/config/fail2ban.conf.hostsdeny trunk-0.6/config/fail2ban.conf.hostsdeny
--- trunk-0.6~/config/fail2ban.conf.hostsdeny 2006-09-04 23:34:12.000000000 -0400
+++ trunk-0.6/config/fail2ban.conf.hostsdeny 2006-10-18 01:05:08.000000000 -0400
@@ -291,6 +291,47 @@
failregex = FAIL LOGIN
+[WUFTPD]
+# Option: enabled
+# Notes.: enable monitoring for this section.
+# Values: [true | false] Default: false
+#
+enabled = false
+
+# Option: logfile
+# Notes.: logfile to monitor.
+# Values: FILE Default: /var/log/proftpd/proftpd.log
+# Other.: /var/log/auth.log
+#
+logfile = /var/log/auth.log
+
+# Option: port
+# Notes.: specifies port to monitor
+# Values: [ NUM | STRING ] Default: ftp
+#
+port = ftp
+
+# Option: timeregex
+# Notes.: regex to match timestamp in wu-ftpd logfile.
+# Values: [Oct 11 15:19:59]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option: timepattern
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT Default:
+#
+failregex = wu-ftpd\[\d+\]:\s+\(pam_unix\)\s+authentication failure.*rhost=(?P<host>\S+)
+
+
[SSH]
# Option: enabled
# Notes.: enable monitoring for this section.
diff -urNad trunk-0.6~/config/fail2ban.conf.iptables trunk-0.6/config/fail2ban.conf.iptables
--- trunk-0.6~/config/fail2ban.conf.iptables 2006-09-04 23:34:12.000000000 -0400
+++ trunk-0.6/config/fail2ban.conf.iptables 2006-10-18 01:05:08.000000000 -0400
@@ -385,6 +385,47 @@
#
failregex = FAIL LOGIN
+[WUFTPD]
+# Option: enabled
+# Notes.: enable monitoring for this section.
+# Values: [true | false] Default: false
+#
+enabled = false
+
+# Option: logfile
+# Notes.: logfile to monitor.
+# Values: FILE Default: /var/log/proftpd/proftpd.log
+# Other.: /var/log/auth.log
+#
+logfile = /var/log/auth.log
+
+# Option: port
+# Notes.: specifies port to monitor
+# Values: [ NUM | STRING ] Default: ftp
+#
+port = ftp
+
+# Option: timeregex
+# Notes.: regex to match timestamp in wu-ftpd logfile.
+# Values: [Oct 11 15:19:59]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option: timepattern
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT Default:
+#
+failregex = wu-ftpd\[\d+\]:\s+\(pam_unix\)\s+authentication failure.*rhost=(?P<host>\S+)
+
+
[SSH]
# Option: enabled
# Notes.: enable monitoring for this section.
diff -urNad trunk-0.6~/config/fail2ban.conf.shorewall trunk-0.6/config/fail2ban.conf.shorewall
--- trunk-0.6~/config/fail2ban.conf.shorewall 2006-09-04 23:34:12.000000000 -0400
+++ trunk-0.6/config/fail2ban.conf.shorewall 2006-10-18 01:05:08.000000000 -0400
@@ -278,6 +278,47 @@
failregex = FAIL LOGIN
+[WUFTPD]
+# Option: enabled
+# Notes.: enable monitoring for this section.
+# Values: [true | false] Default: false
+#
+enabled = false
+
+# Option: logfile
+# Notes.: logfile to monitor.
+# Values: FILE Default: /var/log/proftpd/proftpd.log
+# Other.: /var/log/auth.log
+#
+logfile = /var/log/auth.log
+
+# Option: port
+# Notes.: specifies port to monitor
+# Values: [ NUM | STRING ] Default: ftp
+#
+port = ftp
+
+# Option: timeregex
+# Notes.: regex to match timestamp in wu-ftpd logfile.
+# Values: [Oct 11 15:19:59]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option: timepattern
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT Default:
+#
+failregex = wu-ftpd\[\d+\]:\s+\(pam_unix\)\s+authentication failure.*rhost=(?P<host>\S+)
+
+
[SSH]
# Option: enabled
# Notes.: enable monitoring for this section.
+1 -1
View File
@@ -3,4 +3,4 @@
# Site Directory Pattern Version Script
version=3
http://sf.net/fail2ban/ fail2ban-(.*)\.tar\.bz2 debian svn-upgrade
http://sf.net/fail2ban/ fail2ban-(0\.6\..*)\.tar\.bz2 debian svn-upgrade
+4 -11
View File
@@ -18,22 +18,15 @@
# Author: Cyril Jaquier
#
# $Revision: 1.7 $
# $Revision: 449 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.7 $"
__date__ = "$Date: 2005/12/27 15:09:50 $"
__version__ = "$Revision: 449 $"
__date__ = "$Date: 2006-11-06 23:43:42 +0100 (Mon, 06 Nov 2006) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
import sys, traceback, logging, locale
# Set the locale with the user's default setting
try:
locale.setlocale(locale.LC_ALL, '')
except Exception:
print "Unable to set locale to " + `locale.getdefaultlocale()`
sys.exit(-1)
import sys, traceback, logging
# Inserts our own modules path first in the list
# fix for bug #343821
+48 -36
View File
@@ -17,15 +17,16 @@
# Author: Cyril Jaquier
# Modified by: Yaroslav Halchenko (SYSLOG, findtime, and oth)
#
# $Revision: 1.24 $
# $Revision: 449 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.24 $"
__date__ = "$Date: 2006/01/22 11:10:29 $"
__version__ = "$Revision: 449 $"
__date__ = "$Date: 2006-11-06 23:43:42 +0100 (Mon, 06 Nov 2006) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
import time, sys, getopt, os, string, signal, logging, logging.handlers, copy
import time, sys, getopt, os, string, signal, logging, logging.handlers, \
copy, locale
from ConfigParser import *
from version import version
@@ -213,7 +214,7 @@ def main():
# Reads the command line options.
try:
cmdOpts = 'hvVbdkc:t:f:i:r:p:e:'
cmdLongOpts = ['help','version']
cmdLongOpts = ['help', 'version']
optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
except getopt.GetoptError:
dispUsage()
@@ -240,6 +241,7 @@ def main():
["bool", "debug", False],
["int", "verbose", conf["verbose"]],
["str", "pidlock", "/var/run/fail2ban.pid"],
["str", "locale", ""],
["int", "maxfailures", 5],
["int", "bantime", 600],
["int", "findtime", 600],
@@ -266,6 +268,14 @@ def main():
# PID lock
pidLock.setPath(conf["pidlock"])
# Set the LC_TIME with the user's default setting
try:
logSys.info("Setting LC_TIME locale option to '%s'"%conf["locale"])
locale.setlocale(locale.LC_TIME, conf["locale"])
except Exception:
logSys.error("Unable to set locale to '%s'"%conf["locale"])
sys.exit(-1)
# Now we can kill properly a running instance if needed
if conf["kill"]:
pid = pidLock.exists()
@@ -300,7 +310,7 @@ def main():
# a socket (file, so it starts with /)
# or hostname
# or hostname:port
syslogtargets = re.findall("(/[\w/]*)|([^/ ][^: ]*)(:(\d+)){,1}",
syslogtargets = re.findall("(/[\w/]*)|([^/ ][^: ]*)(:(\d+)){,1}",
conf["syslog-target"])
# we are waiting for a single match
syslogtargets = syslogtargets[0]
@@ -314,7 +324,7 @@ def main():
if len(syslogtargets) == 0: # everything default
hdlr = logging.handlers.SysLogHandler()
else:
if not ( syslogtargets[0] == "" ): # got socket
if not (syslogtargets[0] == ""): # got socket
syslogtarget = syslogtargets[0]
else: # got hostname and maybe a port
if syslogtargets[3] == "": # no port specified
@@ -356,7 +366,9 @@ def main():
"ONLY DISPLAYED IN THE LOG MESSAGES")
# Ignores IP list
ignoreIPList = conf["ignoreip"].split(' ')
# and filter out empty entries. Otherwise
# WARNING: is not a valid IP address
ignoreIPList = filter(None, conf["ignoreip"].split(' '))
# Checks for root user. This is necessary because log files
# are owned by root and firewall needs root access.
@@ -382,15 +394,15 @@ def main():
logSys.debug("MaxFailure is " + `conf["maxfailures"]`)
# Options
optionValues = (["bool", "enabled", False],
["str", "host", "localhost"],
["int", "port", "25"],
["str", "from", "root"],
["str", "to", "root"],
["str", "user", ''],
["str", "password", ''],
["bool", "localtime", False],
["str", "subject", "[Fail2Ban] Banned <ip>"],
optionValues = (["bool", "enabled", False],
["str", "host", "localhost"],
["int", "port", "25"],
["str", "from", "root"],
["str", "to", "root"],
["str", "user", ''],
["str", "password", ''],
["bool", "localtime", False],
["str", "subject", "[Fail2Ban] Banned <ip>"],
["str", "message", "Fail2Ban notification"])
# Gets global configuration options
@@ -408,18 +420,18 @@ def main():
logSys.debug("to: " + mailConf["to"] + " from: " + mailConf["from"])
# Options
optionValues = (["bool", "enabled", False],
["str", "logfile", "/dev/null"],
["int", "maxfailures", conf["maxfailures"]],
["int", "bantime", conf["bantime"]],
["int", "findtime", conf["findtime"]],
["str", "timeregex", ""],
["str", "timepattern", ""],
["str", "failregex", ""],
["str", "fwstart", ""],
["str", "fwend", ""],
["str", "fwban", ""],
["str", "fwunban", ""],
optionValues = (["bool", "enabled", False],
["str", "logfile", "/dev/null"],
["int", "maxfailures", conf["maxfailures"]],
["int", "bantime", conf["bantime"]],
["int", "findtime", conf["findtime"]],
["str", "timeregex", ""],
["str", "timepattern", ""],
["str", "failregex", ""],
["str", "fwstart", ""],
["str", "fwend", ""],
["str", "fwban", ""],
["str", "fwunban", ""],
["str", "fwcheck", ""])
logSys.info("Fail2Ban v" + version + " is running")
@@ -431,10 +443,10 @@ def main():
if isEnabledSection(l["enabled"], t):
# Creates a logreader object
enabledSections.append(t)
lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
l["failregex"], l["maxfailures"], l["findtime"])
# Creates a firewall object
fObj = Firewall(l["fwstart"], l["fwend"], l["fwban"], l["fwunban"],
fObj = Firewall(l["fwstart"], l["fwend"], l["fwban"], l["fwunban"],
l["fwcheck"], l["bantime"])
# "Name" the firewall
fObj.setSection(t)
@@ -513,7 +525,7 @@ def main():
e = element[1].getFailures()
for key in e.iterkeys():
if element[3].has_key(key):
element[3][key] = (element[3][key][0] + e[key][0],
element[3][key] = (element[3][key][0] + e[key][0],
e[key][1])
else:
element[3][key] = (e[key][0], e[key][1])
@@ -530,9 +542,9 @@ def main():
if failTime < unixTime - findTime:
del element[3][attempt]
elif fails[attempt][0] >= element[1].getMaxRetry():
aInfo = {"section": element[0],
"ip": attempt,
"failures": element[3][attempt][0],
aInfo = {"section": element[0],
"ip": attempt,
"failures": element[3][attempt][0],
"failtime": failTime}
logSys.info(element[0] + ": " + aInfo["ip"] +
" has " + `aInfo["failures"]` +
@@ -540,7 +552,7 @@ def main():
element[2].addBanIP(aInfo, conf["debug"])
# Send a mail notification
if 'mail' in locals():
mail.sendmail(mailConf["subject"],
mail.sendmail(mailConf["subject"],
mailConf["message"], aInfo)
del element[3][attempt]
except ExternalError, e:
+3 -3
View File
@@ -16,10 +16,10 @@
# Author: Cyril Jaquier
#
# $Revision: 1.1 $
# $Revision: 6 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.1 $"
__date__ = "$Date: 2004/10/09 15:33:33 $"
__version__ = "$Revision: 6 $"
__date__ = "$Date: 2004-10-09 17:33:33 +0200 (Sat, 09 Oct 2004) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
+3 -3
View File
@@ -16,11 +16,11 @@
# Author: Cyril Jaquier
#
# $Revision: 1.10 $
# $Revision: 222 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.10 $"
__date__ = "$Date: 2005/12/16 23:48:52 $"
__version__ = "$Revision: 222 $"
__date__ = "$Date: 2005-12-17 00:48:52 +0100 (Sat, 17 Dec 2005) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
+3 -3
View File
@@ -16,10 +16,10 @@
# Author: Cyril Jaquier
#
# $Revision: 1.1 $
# $Revision: 7 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.1 $"
__date__ = "$Date: 2004/10/10 13:33:40 $"
__version__ = "$Revision: 7 $"
__date__ = "$Date: 2004-10-10 15:33:40 +0200 (Sun, 10 Oct 2004) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
+18 -13
View File
@@ -16,11 +16,11 @@
# Author: Cyril Jaquier
#
# $Revision: 1.16 $
# $Revision: 484 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.16 $"
__date__ = "$Date: 2006/01/03 15:13:04 $"
__version__ = "$Revision: 484 $"
__date__ = "$Date: 2006-12-10 22:16:26 +0100 (Sun, 10 Dec 2006) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
@@ -136,6 +136,11 @@ class LogReader:
self.setFilePos(logFile)
lastLine = None
for line in logFile:
try:
# Try to convert UTF-8 string to Latin-1
line = line.decode('utf-8').encode('latin-1')
except UnicodeDecodeError:
pass
if not self.hasTime(line):
# There is no valid time in this line
continue
@@ -172,16 +177,16 @@ class LogReader:
timeMatch = re.search(self.timeregex, match.string)
if timeMatch:
date = self.getUnixTime(timeMatch.group())
# Bug fix for Debian #330827
hostMatch = match.groupdict()
if len(hostMatch)==0:
logSys.warn("Must have been using old style of failregex! "
"Security Breach! Read README.Debian")
ipMatch = textToIp(match.string)
else:
ipMatch = reduce(lambda x,y:x+textToIp(y),
hostMatch.values(), [])
try:
# Fix for CVE-2006-6302
matchString = match.group("host")
except IndexError:
# However does not break the current configuration
logSys.warn("No 'host' group defined. This is a security " +
"issue. Please fix your configuration file " +
"and look at CVE-2006-6302")
matchString = match.string
ipMatch = textToIp(matchString)
if ipMatch:
for ip in ipMatch:
failList.append([ip, date])
+1 -9
View File
@@ -13,16 +13,8 @@ Please report bugs at http://sourceforge.net/projects/fail2ban/
via bug tracker
.SH "AUTHOR"
Cyril Jaquier <lostcontrol@users.sourceforge.net>
.br
Modified by
.br
- Yaroslav O. Halchenko <debian@onerussian.com>.
.br
Sponsored for Debian by
.br
- Barak A. Pearlmutter <barak@cs.nuim.ie>.
.SH "SEE ALSO"
.BR fail2ban(8)
.BR fail2ban (8)
.TP
See
.BR "http://fail2ban.sourceforge.net/".
+3 -3
View File
@@ -18,11 +18,11 @@
# Author: Cyril Jaquier
#
# $Revision: 1.6 $
# $Revision: 234 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.6 $"
__date__ = "$Date: 2006/01/22 11:08:42 $"
__version__ = "$Revision: 234 $"
__date__ = "$Date: 2006-01-22 12:08:42 +0100 (Sun, 22 Jan 2006) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
+3 -3
View File
@@ -16,10 +16,10 @@
# Author: Cyril Jaquier
#
# $Revision: 1.1 $
# $Revision: 82 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.1 $"
__date__ = "$Date: 2005/03/06 17:51:24 $"
__version__ = "$Revision: 82 $"
__date__ = "$Date: 2005-03-06 18:51:24 +0100 (Sun, 06 Mar 2005) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
+3 -3
View File
@@ -16,11 +16,11 @@
# Author: Cyril Jaquier
#
# $Revision: 1.8 $
# $Revision: 216 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.8 $"
__date__ = "$Date: 2005/11/20 17:07:47 $"
__version__ = "$Revision: 216 $"
__date__ = "$Date: 2005-11-20 18:07:47 +0100 (Sun, 20 Nov 2005) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
+3 -3
View File
@@ -16,11 +16,11 @@
# Author: Cyril Jaquier
#
# $Revision: 1.3 $
# $Revision: 229 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.3 $"
__date__ = "$Date: 2006/01/03 15:13:41 $"
__version__ = "$Revision: 229 $"
__date__ = "$Date: 2006-01-03 16:13:41 +0100 (Tue, 03 Jan 2006) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
+3 -3
View File
@@ -16,11 +16,11 @@
# Author: Cyril Jaquier
#
# $Revision: 1.2 $
# $Revision: 216 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.2 $"
__date__ = "$Date: 2005/11/20 17:07:47 $"
__version__ = "$Revision: 216 $"
__date__ = "$Date: 2005-11-20 18:07:47 +0100 (Sun, 20 Nov 2005) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
+3 -3
View File
@@ -16,11 +16,11 @@
# Author: Cyril Jaquier
#
# $Revision: 1.2 $
# $Revision: 216 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.2 $"
__date__ = "$Date: 2005/11/20 17:07:47 $"
__version__ = "$Revision: 216 $"
__date__ = "$Date: 2005-11-20 18:07:47 +0100 (Sun, 20 Nov 2005) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
+3 -3
View File
@@ -16,11 +16,11 @@
# Author: Cyril Jaquier
#
# $Revision: 1.2 $
# $Revision: 216 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.2 $"
__date__ = "$Date: 2005/11/20 17:07:47 $"
__version__ = "$Revision: 216 $"
__date__ = "$Date: 2005-11-20 18:07:47 +0100 (Sun, 20 Nov 2005) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
+4 -4
View File
@@ -16,12 +16,12 @@
# Author: Cyril Jaquier
#
# $Revision: 1.15 $
# $Revision: 486 $
__author__ = "Cyril Jaquier"
__version__ = "$Revision: 1.15 $"
__date__ = "$Date: 2006/03/15 23:07:12 $"
__version__ = "$Revision: 486 $"
__date__ = "$Date: 2006-12-11 22:43:57 +0100 (Mon, 11 Dec 2006) $"
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
version = "0.6.1"
version = "0.6.2"