Compare commits
8
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
a08144db4f | ||
|
|
7093a22912 | ||
|
|
a5ff332d4a | ||
|
|
3d621c1e4a | ||
|
|
afd010668d | ||
|
|
ede4d03bc4 | ||
|
|
0479900ff5 | ||
|
|
60cdc34011 |
@@ -4,9 +4,19 @@
|
||||
|_| \__,_|_|_/___|_.__/\__,_|_||_|
|
||||
|
||||
=============================================================
|
||||
Fail2Ban (version 0.6.1) 2006/03/16
|
||||
Fail2Ban (version 0.6.2) 2006/12/11
|
||||
=============================================================
|
||||
|
||||
ver. 0.6.2 (2006/12/11) - stable
|
||||
----------
|
||||
- Fixed UTF-8 log file parsing
|
||||
- Propagated patches introduced by Debian maintainer
|
||||
(Yaroslav Halchenko):
|
||||
* Made locale configurable
|
||||
* Fixed warning if ignoreip is empty
|
||||
- Added named group "host" for "failregex". Fixed security
|
||||
vulnerability CVE-2006-6302
|
||||
|
||||
ver. 0.6.1 (2006/03/16) - stable
|
||||
----------
|
||||
- Added permanent banning. Set banTime to a negative value to
|
||||
@@ -22,7 +32,7 @@ ver. 0.6.1 (2006/03/16) - stable
|
||||
- Added parsing of timestamp in TAI64N format (#1275325).
|
||||
Thanks to Mark Edgington
|
||||
- Added patch #1382936 (Default formatted syslog logging).
|
||||
Thanks to Patrick Börjesson
|
||||
Thanks to Patrick B�rjesson
|
||||
- Removed 192.168.0.0/16 from ignoreip. Attacks could also
|
||||
come from the local network.
|
||||
- Robust startup: if iptables module does not get fully
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
Metadata-Version: 1.0
|
||||
Name: fail2ban
|
||||
Version: 0.6.1
|
||||
Version: 0.6.2
|
||||
Summary: Ban IPs that make too many password failure
|
||||
Home-page: http://fail2ban.sourceforge.net
|
||||
Author: Cyril Jaquier
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|_| \__,_|_|_/___|_.__/\__,_|_||_|
|
||||
|
||||
=============================================================
|
||||
Fail2Ban (version 0.6.1) 2006/03/16
|
||||
Fail2Ban (version 0.6.2) 2006/12/11
|
||||
=============================================================
|
||||
|
||||
Fail2Ban scans log files like /var/log/pwdfail and bans IP
|
||||
@@ -58,8 +58,8 @@ Require: python-2.4 (http://www.python.org)
|
||||
|
||||
To install, just do:
|
||||
|
||||
> tar xvfj fail2ban-0.6.1.tar.bz2
|
||||
> cd fail2ban-0.6.1
|
||||
> tar xvfj fail2ban-0.6.2.tar.bz2
|
||||
> cd fail2ban-0.6.2
|
||||
> python setup.py install
|
||||
|
||||
This will install Fail2Ban into /usr/lib/fail2ban. The
|
||||
@@ -116,6 +116,12 @@ options:
|
||||
-v verbose. Use twice for greater effect
|
||||
-V print software version
|
||||
|
||||
Please note that a vulnerability (CVE-2006-6302) affects
|
||||
version < 0.6.2. Since 0.6.2, a named group "host" was added
|
||||
to "failregex". This group must match the host address. Old
|
||||
configuration files will still work but will generate a
|
||||
warning. In this case, please update your configuration file.
|
||||
|
||||
Contact:
|
||||
--------
|
||||
|
||||
@@ -130,10 +136,10 @@ Cyril Jaquier: <lostcontrol@users.sourceforge.net>
|
||||
Thanks:
|
||||
-------
|
||||
|
||||
Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
|
||||
Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
|
||||
Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
|
||||
Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
|
||||
Edgington, Patrick Börjesson, kojiro, zugeschmiert
|
||||
Edgington, Patrick Börjesson, kojiro, zugeschmiert
|
||||
|
||||
License:
|
||||
--------
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|_| \__,_|_|_/___|_.__/\__,_|_||_|
|
||||
|
||||
=============================================================
|
||||
ToDo $Revision: 1.11 $
|
||||
ToDo $Revision: 242 $
|
||||
=============================================================
|
||||
|
||||
See Feature Request Tracking System at SourceForge.net
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
# $Revision: 484 $
|
||||
#
|
||||
# 2005.06.21 modified for readability Iain Lea iain@bricbrac.de
|
||||
|
||||
@@ -11,6 +11,15 @@
|
||||
#
|
||||
background = false
|
||||
|
||||
# Option: locale
|
||||
# Notes.: global (cannot be redefined per section) locale to use for
|
||||
# timestamp pattern matching by changing LC_TIME for
|
||||
# fail2ban process. Empty entry sets locale to default one
|
||||
# (usually specified by LC_ALL environment variable).
|
||||
# Values: LOCALE Default:
|
||||
#
|
||||
locale =
|
||||
|
||||
# Option: logtargets
|
||||
# Notes.: log targets. Space separated list of logging targets.
|
||||
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
|
||||
@@ -248,7 +257,7 @@ timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
|
||||
# Notes.: regex to match the password failure messages in the logfile.
|
||||
# Values: TEXT Default: authentication failure|user .* not found
|
||||
#
|
||||
failregex = authentication failure|user .* not found
|
||||
failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
|
||||
|
||||
|
||||
[VSFTPD]
|
||||
@@ -288,7 +297,7 @@ timepattern = %%b %%d %%H:%%M:%%S
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
failregex = FAIL LOGIN
|
||||
failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+)
|
||||
|
||||
|
||||
[SSH]
|
||||
@@ -324,4 +333,4 @@ timepattern = %%b %%d %%H:%%M:%%S
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
failregex = Authentication failure|Failed password|Invalid user
|
||||
failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# $Revision: 1.9 $
|
||||
# $Revision: 484 $
|
||||
#
|
||||
# 2005.06.21 modified for readability Iain Lea iain@bricbrac.de
|
||||
|
||||
@@ -28,6 +28,15 @@ verbose = 1
|
||||
#
|
||||
debug = false
|
||||
|
||||
# Option: locale
|
||||
# Notes.: global (cannot be redefined per section) locale to use for
|
||||
# timestamp pattern matching by changing LC_TIME for
|
||||
# fail2ban process. Empty entry sets locale to default one
|
||||
# (usually specified by LC_ALL environment variable).
|
||||
# Values: LOCALE Default:
|
||||
#
|
||||
locale =
|
||||
|
||||
# Option: logtargets
|
||||
# Notes.: log targets. Space separated list of logging targets.
|
||||
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
|
||||
@@ -383,7 +392,7 @@ timepattern = %%b %%d %%H:%%M:%%S
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
failregex = FAIL LOGIN
|
||||
failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+)
|
||||
|
||||
[SSH]
|
||||
# Option: enabled
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
# $Revision: 484 $
|
||||
#
|
||||
# 2005.06.21 modified for readability Iain Lea iain@bricbrac.de
|
||||
|
||||
@@ -11,6 +11,15 @@
|
||||
#
|
||||
background = false
|
||||
|
||||
# Option: locale
|
||||
# Notes.: global (cannot be redefined per section) locale to use for
|
||||
# timestamp pattern matching by changing LC_TIME for
|
||||
# fail2ban process. Empty entry sets locale to default one
|
||||
# (usually specified by LC_ALL environment variable).
|
||||
# Values: LOCALE Default:
|
||||
#
|
||||
locale =
|
||||
|
||||
# Option: logtargets
|
||||
# Notes.: log targets. Space separated list of logging targets.
|
||||
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
|
||||
@@ -242,7 +251,8 @@ timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
|
||||
# Notes.: regex to match the password failure messages in the logfile.
|
||||
# Values: TEXT Default: authentication failure|user .* not found
|
||||
#
|
||||
failregex = authentication failure|user .* not found
|
||||
failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
|
||||
|
||||
|
||||
[VSFTPD]
|
||||
# Option: enabled
|
||||
@@ -275,7 +285,7 @@ timepattern = %%b %%d %%H:%%M:%%S
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
failregex = FAIL LOGIN
|
||||
failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+)
|
||||
|
||||
|
||||
[SSH]
|
||||
@@ -311,4 +321,4 @@ timepattern = %%b %%d %%H:%%M:%%S
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
failregex = Authentication failure|Failed password|Invalid user
|
||||
failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
|
||||
|
||||
+1
-1
@@ -16,7 +16,7 @@
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
# $Revision: 216 $
|
||||
|
||||
# Command line options for Fail2Ban. Refer to "fail2ban -h" for
|
||||
# valid options.
|
||||
|
||||
+1
-1
@@ -17,7 +17,7 @@
|
||||
#
|
||||
# Author: Sireyessire, Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
# $Revision: 216 $
|
||||
|
||||
opts="start stop restart showlog"
|
||||
|
||||
|
||||
+78
-78
@@ -1,78 +1,78 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# fail2ban
|
||||
#
|
||||
# chkconfig: 345 91 9
|
||||
# description: if many unsuccessfull login attempts from some ip address \
|
||||
# during a short period happen, this address is banned \
|
||||
# by the firewall
|
||||
#
|
||||
# Author: Andrey G. Grozin
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
|
||||
# Source function library.
|
||||
. /etc/init.d/functions
|
||||
|
||||
# Get config.
|
||||
. /etc/sysconfig/network
|
||||
|
||||
# Check that networking is up.
|
||||
[ "${NETWORKING}" = "no" ] && exit 0
|
||||
[ -f /etc/fail2ban.conf ] || exit 0
|
||||
|
||||
FAIL2BAN="/usr/bin/fail2ban"
|
||||
PIDFILE="/var/run/fail2ban.pid"
|
||||
|
||||
RETVAL=0
|
||||
|
||||
start() {
|
||||
echo -n $"Starting fail2ban: "
|
||||
"${FAIL2BAN}" -b > /dev/null
|
||||
RETVAL=$?
|
||||
echo
|
||||
}
|
||||
|
||||
stop() {
|
||||
if [ -f "${PIDFILE}" ]; then
|
||||
echo -n $"Stopping fail2ban: "
|
||||
"${FAIL2BAN}" -k > /dev/null
|
||||
echo
|
||||
fi
|
||||
}
|
||||
|
||||
restart() {
|
||||
stop
|
||||
start
|
||||
}
|
||||
|
||||
# See how we were called.
|
||||
case "$1" in
|
||||
start)
|
||||
start
|
||||
;;
|
||||
stop)
|
||||
stop
|
||||
;;
|
||||
status)
|
||||
status fail2ban
|
||||
RETVAL=$?
|
||||
;;
|
||||
reload)
|
||||
restart
|
||||
;;
|
||||
restart)
|
||||
restart
|
||||
;;
|
||||
condrestart)
|
||||
if [ -f "${PIDFILE}" ]; then
|
||||
restart
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
echo $"Usage: $0 {start|stop|status|restart|condrestart}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
#!/bin/bash
|
||||
#
|
||||
# fail2ban
|
||||
#
|
||||
# chkconfig: 345 91 9
|
||||
# description: if many unsuccessfull login attempts from some ip address \
|
||||
# during a short period happen, this address is banned \
|
||||
# by the firewall
|
||||
#
|
||||
# Author: Andrey G. Grozin
|
||||
#
|
||||
# $Revision: 216 $
|
||||
|
||||
# Source function library.
|
||||
. /etc/init.d/functions
|
||||
|
||||
# Get config.
|
||||
. /etc/sysconfig/network
|
||||
|
||||
# Check that networking is up.
|
||||
[ "${NETWORKING}" = "no" ] && exit 0
|
||||
[ -f /etc/fail2ban.conf ] || exit 0
|
||||
|
||||
FAIL2BAN="/usr/bin/fail2ban"
|
||||
PIDFILE="/var/run/fail2ban.pid"
|
||||
|
||||
RETVAL=0
|
||||
|
||||
start() {
|
||||
echo -n $"Starting fail2ban: "
|
||||
"${FAIL2BAN}" -b > /dev/null
|
||||
RETVAL=$?
|
||||
echo
|
||||
}
|
||||
|
||||
stop() {
|
||||
if [ -f "${PIDFILE}" ]; then
|
||||
echo -n $"Stopping fail2ban: "
|
||||
"${FAIL2BAN}" -k > /dev/null
|
||||
echo
|
||||
fi
|
||||
}
|
||||
|
||||
restart() {
|
||||
stop
|
||||
start
|
||||
}
|
||||
|
||||
# See how we were called.
|
||||
case "$1" in
|
||||
start)
|
||||
start
|
||||
;;
|
||||
stop)
|
||||
stop
|
||||
;;
|
||||
status)
|
||||
status fail2ban
|
||||
RETVAL=$?
|
||||
;;
|
||||
reload)
|
||||
restart
|
||||
;;
|
||||
restart)
|
||||
restart
|
||||
;;
|
||||
condrestart)
|
||||
if [ -f "${PIDFILE}" ]; then
|
||||
restart
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
echo $"Usage: $0 {start|stop|status|restart|condrestart}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
|
||||
@@ -16,10 +16,10 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.1 $
|
||||
# $Revision: 50 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.1 $"
|
||||
__date__ = "$Date: 2005/02/18 13:26:41 $"
|
||||
__version__ = "$Revision: 50 $"
|
||||
__date__ = "$Date: 2005-02-18 14:30:54 +0100 (Fri, 18 Feb 2005) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
@@ -16,11 +16,11 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.6 $
|
||||
# $Revision: 216 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.6 $"
|
||||
__date__ = "$Date: 2005/11/20 17:07:47 $"
|
||||
__version__ = "$Revision: 216 $"
|
||||
__date__ = "$Date: 2005-11-20 18:07:47 +0100 (Sun, 20 Nov 2005) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
|
||||
Vendored
+22
@@ -1,3 +1,25 @@
|
||||
fail2ban (0.6.2-1) unstable; urgency=low
|
||||
|
||||
* New upstream release:
|
||||
+ locale_config, vsftpd_regexp, and empty_ip patches got absorbed upstream
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Mon, 11 Dec 2006 20:53:30 -0500
|
||||
|
||||
fail2ban (0.6.1-12) unstable; urgency=low
|
||||
|
||||
* Added section for WUFTPD (Thanks to Jesse Wyant) (closes: #386381)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Wed, 18 Oct 2006 01:05:31 -0400
|
||||
|
||||
fail2ban (0.6.1-11) unstable; urgency=low
|
||||
|
||||
* Adjusted manpage for fail2ban.conf to point to shipped examples of
|
||||
configuration files as the source of details about available configuration
|
||||
options (closes: #382403)
|
||||
* Changes in man/fail2ban.conf.5 are managed via dpatch now
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Wed, 16 Aug 2006 00:18:59 +0300
|
||||
|
||||
fail2ban (0.6.1-10) unstable; urgency=low
|
||||
|
||||
* Adjusted to comply with recent changes in debian python policy and use
|
||||
|
||||
Vendored
+2
-2
@@ -3,8 +3,8 @@ Section: net
|
||||
Priority: optional
|
||||
Maintainer: Yaroslav Halchenko <debian@onerussian.com>
|
||||
Uploaders: Barak Pearlmutter <bap@debian.org>
|
||||
Build-Depends: debhelper (>= 4.1.67), dpatch
|
||||
Build-Depends-Indep: python, python-dev, help2man, python-central (>= 0.4.17)
|
||||
Build-Depends: debhelper (>= 5.0.37.2), dpatch
|
||||
Build-Depends-Indep: python, python-dev, help2man, python-central (>= 0.5)
|
||||
XS-Python-Version: current, >= 2.3
|
||||
Standards-Version: 3.7.2
|
||||
|
||||
|
||||
Vendored
-22
@@ -1,22 +0,0 @@
|
||||
#! /bin/sh /usr/share/dpatch/dpatch-run
|
||||
## 00_empty_ip.dpatch by <debian@onerussian.com>
|
||||
##
|
||||
## All lines beginning with `## DP:' are a description of the patch.
|
||||
## DP: Filter out empty IPs for ignoreip
|
||||
|
||||
@DPATCH@
|
||||
|
||||
diff -x '*~' -Naur fail2ban-0.6.1.pre/fail2ban.py fail2ban-0.6.1.post/fail2ban.py
|
||||
--- fail2ban-0.6.1.pre/fail2ban.py 2006-03-19 00:20:44.000000000 -0500
|
||||
+++ fail2ban-0.6.1.post/fail2ban.py 2006-07-03 21:56:10.000000000 -0400
|
||||
@@ -356,7 +356,9 @@
|
||||
"ONLY DISPLAYED IN THE LOG MESSAGES")
|
||||
|
||||
# Ignores IP list
|
||||
- ignoreIPList = conf["ignoreip"].split(' ')
|
||||
+ # and filter out empty entries. Otherwise
|
||||
+ # WARNING: is not a valid IP address
|
||||
+ ignoreIPList = filter(None, conf["ignoreip"].split(' '))
|
||||
|
||||
# Checks for root user. This is necessary because log files
|
||||
# are owned by root and firewall needs root access.
|
||||
Vendored
-128
@@ -1,128 +0,0 @@
|
||||
#! /bin/sh /usr/share/dpatch/dpatch-run
|
||||
## 00_locale_config.dpatch by <debian@onerussian.com>
|
||||
##
|
||||
## All lines beginning with `## DP:' are a description of the patch.
|
||||
## DP: Set up LC_TIME per configuration option, not by resetting LC_ALL to
|
||||
## DP: default locale as it was done before. So this patch effectively changes
|
||||
## DP: bug into a feature
|
||||
|
||||
@DPATCH@
|
||||
|
||||
diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.hostsdeny fail2ban-0.6.1.post/config/fail2ban.conf.hostsdeny
|
||||
--- fail2ban-0.6.1.pre/config/fail2ban.conf.hostsdeny 2006-03-27 12:56:38.000000000 -0500
|
||||
+++ fail2ban-0.6.1.post/config/fail2ban.conf.hostsdeny 2006-07-03 22:20:21.000000000 -0400
|
||||
@@ -11,6 +11,15 @@
|
||||
#
|
||||
background = false
|
||||
|
||||
+# Option: locale
|
||||
+# Notes.: global (cannot be redefined per section) locale to use for
|
||||
+# timestamp pattern matching by changing LC_TIME for
|
||||
+# fail2ban process. Empty entry sets locale to default one
|
||||
+# (usually specified by LC_ALL environment variable).
|
||||
+# Values: LOCALE Default:
|
||||
+#
|
||||
+locale =
|
||||
+
|
||||
# Option: logtargets
|
||||
# Notes.: log targets. Space separated list of logging targets.
|
||||
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
|
||||
diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.iptables fail2ban-0.6.1.post/config/fail2ban.conf.iptables
|
||||
--- fail2ban-0.6.1.pre/config/fail2ban.conf.iptables 2006-03-27 12:56:38.000000000 -0500
|
||||
+++ fail2ban-0.6.1.post/config/fail2ban.conf.iptables 2006-07-03 22:17:30.000000000 -0400
|
||||
@@ -28,6 +28,15 @@
|
||||
#
|
||||
debug = false
|
||||
|
||||
+# Option: locale
|
||||
+# Notes.: global (cannot be redefined per section) locale to use for
|
||||
+# timestamp pattern matching by changing LC_TIME for
|
||||
+# fail2ban process. Empty entry sets locale to default one
|
||||
+# (usually specified by LC_ALL environment variable).
|
||||
+# Values: LOCALE Default:
|
||||
+#
|
||||
+locale =
|
||||
+
|
||||
# Option: logtargets
|
||||
# Notes.: log targets. Space separated list of logging targets.
|
||||
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
|
||||
diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.shorewall fail2ban-0.6.1.post/config/fail2ban.conf.shorewall
|
||||
--- fail2ban-0.6.1.pre/config/fail2ban.conf.shorewall 2006-03-27 12:56:38.000000000 -0500
|
||||
+++ fail2ban-0.6.1.post/config/fail2ban.conf.shorewall 2006-07-03 22:20:01.000000000 -0400
|
||||
@@ -11,6 +11,15 @@
|
||||
#
|
||||
background = false
|
||||
|
||||
+# Option: locale
|
||||
+# Notes.: global (cannot be redefined per section) locale to use for
|
||||
+# timestamp pattern matching by changing LC_TIME for
|
||||
+# fail2ban process. Empty entry sets locale to default one
|
||||
+# (usually specified by LC_ALL environment variable).
|
||||
+# Values: LOCALE Default:
|
||||
+#
|
||||
+locale =
|
||||
+
|
||||
# Option: logtargets
|
||||
# Notes.: log targets. Space separated list of logging targets.
|
||||
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
|
||||
diff -x '*~' -Naur fail2ban-0.6.1.pre/fail2ban fail2ban-0.6.1.post/fail2ban
|
||||
--- fail2ban-0.6.1.pre/fail2ban 2006-03-19 00:20:44.000000000 -0500
|
||||
+++ fail2ban-0.6.1.post/fail2ban 2006-07-03 22:38:11.000000000 -0400
|
||||
@@ -26,14 +26,7 @@
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
-import sys, traceback, logging, locale
|
||||
-
|
||||
-# Set the locale with the user's default setting
|
||||
-try:
|
||||
- locale.setlocale(locale.LC_ALL, '')
|
||||
-except Exception:
|
||||
- print "Unable to set locale to " + `locale.getdefaultlocale()`
|
||||
- sys.exit(-1)
|
||||
+import sys, traceback, logging
|
||||
|
||||
# Inserts our own modules path first in the list
|
||||
# fix for bug #343821
|
||||
diff -x '*~' -Naur fail2ban-0.6.1.pre/fail2ban.py fail2ban-0.6.1.post/fail2ban.py
|
||||
--- fail2ban-0.6.1.pre/fail2ban.py 2006-03-19 00:20:44.000000000 -0500
|
||||
+++ fail2ban-0.6.1.post/fail2ban.py 2006-07-03 23:02:03.000000000 -0400
|
||||
@@ -25,7 +25,8 @@
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
-import time, sys, getopt, os, string, signal, logging, logging.handlers, copy
|
||||
+import time, sys, getopt, os, string, signal, logging, logging.handlers, \
|
||||
+ copy, locale
|
||||
from ConfigParser import *
|
||||
|
||||
from version import version
|
||||
@@ -240,6 +241,7 @@
|
||||
["bool", "debug", False],
|
||||
["int", "verbose", conf["verbose"]],
|
||||
["str", "pidlock", "/var/run/fail2ban.pid"],
|
||||
+ ["str", "locale", ""],
|
||||
["int", "maxfailures", 5],
|
||||
["int", "bantime", 600],
|
||||
["int", "findtime", 600],
|
||||
@@ -262,10 +264,18 @@
|
||||
# have to be overridden
|
||||
for t, label, v in optionValues:
|
||||
confReader.setValue("DEFAULT", label, `conf[label]`)
|
||||
-
|
||||
+
|
||||
# PID lock
|
||||
pidLock.setPath(conf["pidlock"])
|
||||
-
|
||||
+
|
||||
+ # Set the LC_TIME with the user's default setting
|
||||
+ try:
|
||||
+ logSys.info("Setting LC_TIME locale option to '%s'"%conf["locale"])
|
||||
+ locale.setlocale(locale.LC_TIME, conf["locale"])
|
||||
+ except Exception:
|
||||
+ logSys.error("Unable to set locale to '%s'"%conf["locale"])
|
||||
+ sys.exit(-1)
|
||||
+
|
||||
# Now we can kill properly a running instance if needed
|
||||
if conf["kill"]:
|
||||
pid = pidLock.exists()
|
||||
-44
@@ -1,44 +0,0 @@
|
||||
#! /bin/sh /usr/share/dpatch/dpatch-run
|
||||
## 00_vsftpd_regexp.dpatch by <debian@onerussian.com>
|
||||
##
|
||||
## All lines beginning with `## DP:' are a description of the patch.
|
||||
## DP: Fix of debian bug #366687: strict regexp for vsftpd
|
||||
|
||||
@DPATCH@
|
||||
|
||||
diff -rNu fail2ban-0.6.1.orig/config/fail2ban.conf.iptables fail2ban-0.6.1.fixed/config/fail2ban.conf.iptables
|
||||
--- fail2ban-0.6.1.orig/config/fail2ban.conf.iptables 2006-03-27 12:56:38.000000000 -0500
|
||||
+++ fail2ban-0.6.1.fixed/config/fail2ban.conf.iptables 2006-05-10 13:47:40.000000000 -0400
|
||||
@@ -383,7 +383,7 @@
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
-failregex = FAIL LOGIN
|
||||
+failregex = \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$
|
||||
|
||||
[PROFTPD]
|
||||
# Option: enabled
|
||||
diff -rNu fail2ban-0.6.1.orig/config/fail2ban.conf.shorewall fail2ban-0.6.1.fixed/config/fail2ban.conf.shorewall
|
||||
--- fail2ban-0.6.1.orig/config/fail2ban.conf.shorewall 2006-03-27 12:56:38.000000000 -0500
|
||||
+++ fail2ban-0.6.1.fixed/config/fail2ban.conf.shorewall 2006-05-10 13:47:40.000000000 -0400
|
||||
@@ -383,7 +383,7 @@
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
-failregex = FAIL LOGIN
|
||||
+failregex = \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$
|
||||
|
||||
[PROFTPD]
|
||||
# Option: enabled
|
||||
diff -rNu fail2ban-0.6.1.orig/config/fail2ban.conf.hostsdeny fail2ban-0.6.1.fixed/config/fail2ban.conf.hostsdeny
|
||||
--- fail2ban-0.6.1.orig/config/fail2ban.conf.hostsdeny 2006-03-27 12:56:38.000000000 -0500
|
||||
+++ fail2ban-0.6.1.fixed/config/fail2ban.conf.hostsdeny 2006-05-10 13:47:40.000000000 -0400
|
||||
@@ -383,7 +383,7 @@
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
-failregex = FAIL LOGIN
|
||||
+failregex = \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$
|
||||
|
||||
[PROFTPD]
|
||||
# Option: enabled
|
||||
Vendored
+2
-3
@@ -1,7 +1,6 @@
|
||||
00_empty_ip
|
||||
00_locale_config
|
||||
00_verbosity
|
||||
00_proftpd_section
|
||||
00_vsftpd_regexp
|
||||
01_apache2_other
|
||||
02_sasl_section
|
||||
03_wuftpd
|
||||
03_fail2ban_conf_5_manpage
|
||||
|
||||
+39
@@ -0,0 +1,39 @@
|
||||
#! /bin/sh /usr/share/dpatch/dpatch-run
|
||||
## fail2ban_conf_5_manpage.dpatch by <debian@onerussian.com>
|
||||
##
|
||||
## All lines beginning with `## DP:' are a description of the patch.
|
||||
## DP: Adjusts manpage for configuration file to reflect Debian specific
|
||||
## DP: changes
|
||||
|
||||
@DPATCH@
|
||||
|
||||
diff -Naur fail2ban-0.6.1.orig/man/fail2ban.conf.5 fail2ban-0.6.1.mod/man/fail2ban.conf.5
|
||||
--- fail2ban-0.6.1.orig/man/fail2ban.conf.5 2006-08-16 00:30:19.000000000 +0300
|
||||
+++ fail2ban-0.6.1.mod/man/fail2ban.conf.5 2006-08-16 00:28:44.000000000 +0300
|
||||
@@ -5,7 +5,7 @@
|
||||
.SH "DESCRIPTION"
|
||||
\fB/etc/fail2ban.conf\fR contains data about the general configuration of fail2ban, the mail notification and services to monitor.
|
||||
.SH "VARIABLES"
|
||||
-Please look at the file itself
|
||||
+Please look at the file itself. Had you modified it and kept modified version during upgrades, please look at fail2ban.conf.iptables.gz file at /usr/share/doc/fail2ban/examples, which provides full version of the shipped configuration file.
|
||||
.SH "FILES"
|
||||
.I /etc/fail2ban.conf
|
||||
.SH "REPORTING BUGS"
|
||||
@@ -13,8 +13,16 @@
|
||||
via bug tracker
|
||||
.SH "AUTHOR"
|
||||
Cyril Jaquier <lostcontrol@users.sourceforge.net>
|
||||
+.br
|
||||
+Modified by
|
||||
+.br
|
||||
+ - Yaroslav O. Halchenko <debian@onerussian.com>.
|
||||
+.br
|
||||
+Sponsored for Debian by
|
||||
+.br
|
||||
+ - Barak A. Pearlmutter <barak@cs.nuim.ie>.
|
||||
.SH "SEE ALSO"
|
||||
-.BR fail2ban (8)
|
||||
+.BR fail2ban(8)
|
||||
.TP
|
||||
See
|
||||
.BR "http://fail2ban.sourceforge.net/".
|
||||
+160
@@ -0,0 +1,160 @@
|
||||
#! /bin/sh /usr/share/dpatch/dpatch-run
|
||||
## 03_wuftpd.dpatch by <debian@onerussian.com>
|
||||
##
|
||||
## All lines beginning with `## DP:' are a description of the patch.
|
||||
## DP: No description.
|
||||
|
||||
@DPATCH@
|
||||
diff -urNad trunk-0.6~/config/fail2ban.conf.hostsdeny trunk-0.6/config/fail2ban.conf.hostsdeny
|
||||
--- trunk-0.6~/config/fail2ban.conf.hostsdeny 2006-09-04 23:34:12.000000000 -0400
|
||||
+++ trunk-0.6/config/fail2ban.conf.hostsdeny 2006-10-18 01:05:08.000000000 -0400
|
||||
@@ -291,6 +291,47 @@
|
||||
failregex = FAIL LOGIN
|
||||
|
||||
|
||||
+[WUFTPD]
|
||||
+# Option: enabled
|
||||
+# Notes.: enable monitoring for this section.
|
||||
+# Values: [true | false] Default: false
|
||||
+#
|
||||
+enabled = false
|
||||
+
|
||||
+# Option: logfile
|
||||
+# Notes.: logfile to monitor.
|
||||
+# Values: FILE Default: /var/log/proftpd/proftpd.log
|
||||
+# Other.: /var/log/auth.log
|
||||
+#
|
||||
+logfile = /var/log/auth.log
|
||||
+
|
||||
+# Option: port
|
||||
+# Notes.: specifies port to monitor
|
||||
+# Values: [ NUM | STRING ] Default: ftp
|
||||
+#
|
||||
+port = ftp
|
||||
+
|
||||
+# Option: timeregex
|
||||
+# Notes.: regex to match timestamp in wu-ftpd logfile.
|
||||
+# Values: [Oct 11 15:19:59]
|
||||
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+#
|
||||
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+
|
||||
+# Option: timepattern
|
||||
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
|
||||
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
+#
|
||||
+timepattern = %%b %%d %%H:%%M:%%S
|
||||
+
|
||||
+# Option: failregex
|
||||
+# Notes.: regex to match the password failures messages in the logfile.
|
||||
+# Values: TEXT Default:
|
||||
+#
|
||||
+failregex = wu-ftpd\[\d+\]:\s+\(pam_unix\)\s+authentication failure.*rhost=(?P<host>\S+)
|
||||
+
|
||||
+
|
||||
[SSH]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
diff -urNad trunk-0.6~/config/fail2ban.conf.iptables trunk-0.6/config/fail2ban.conf.iptables
|
||||
--- trunk-0.6~/config/fail2ban.conf.iptables 2006-09-04 23:34:12.000000000 -0400
|
||||
+++ trunk-0.6/config/fail2ban.conf.iptables 2006-10-18 01:05:08.000000000 -0400
|
||||
@@ -385,6 +385,47 @@
|
||||
#
|
||||
failregex = FAIL LOGIN
|
||||
|
||||
+[WUFTPD]
|
||||
+# Option: enabled
|
||||
+# Notes.: enable monitoring for this section.
|
||||
+# Values: [true | false] Default: false
|
||||
+#
|
||||
+enabled = false
|
||||
+
|
||||
+# Option: logfile
|
||||
+# Notes.: logfile to monitor.
|
||||
+# Values: FILE Default: /var/log/proftpd/proftpd.log
|
||||
+# Other.: /var/log/auth.log
|
||||
+#
|
||||
+logfile = /var/log/auth.log
|
||||
+
|
||||
+# Option: port
|
||||
+# Notes.: specifies port to monitor
|
||||
+# Values: [ NUM | STRING ] Default: ftp
|
||||
+#
|
||||
+port = ftp
|
||||
+
|
||||
+# Option: timeregex
|
||||
+# Notes.: regex to match timestamp in wu-ftpd logfile.
|
||||
+# Values: [Oct 11 15:19:59]
|
||||
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+#
|
||||
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+
|
||||
+# Option: timepattern
|
||||
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
|
||||
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
+#
|
||||
+timepattern = %%b %%d %%H:%%M:%%S
|
||||
+
|
||||
+# Option: failregex
|
||||
+# Notes.: regex to match the password failures messages in the logfile.
|
||||
+# Values: TEXT Default:
|
||||
+#
|
||||
+failregex = wu-ftpd\[\d+\]:\s+\(pam_unix\)\s+authentication failure.*rhost=(?P<host>\S+)
|
||||
+
|
||||
+
|
||||
[SSH]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
diff -urNad trunk-0.6~/config/fail2ban.conf.shorewall trunk-0.6/config/fail2ban.conf.shorewall
|
||||
--- trunk-0.6~/config/fail2ban.conf.shorewall 2006-09-04 23:34:12.000000000 -0400
|
||||
+++ trunk-0.6/config/fail2ban.conf.shorewall 2006-10-18 01:05:08.000000000 -0400
|
||||
@@ -278,6 +278,47 @@
|
||||
failregex = FAIL LOGIN
|
||||
|
||||
|
||||
+[WUFTPD]
|
||||
+# Option: enabled
|
||||
+# Notes.: enable monitoring for this section.
|
||||
+# Values: [true | false] Default: false
|
||||
+#
|
||||
+enabled = false
|
||||
+
|
||||
+# Option: logfile
|
||||
+# Notes.: logfile to monitor.
|
||||
+# Values: FILE Default: /var/log/proftpd/proftpd.log
|
||||
+# Other.: /var/log/auth.log
|
||||
+#
|
||||
+logfile = /var/log/auth.log
|
||||
+
|
||||
+# Option: port
|
||||
+# Notes.: specifies port to monitor
|
||||
+# Values: [ NUM | STRING ] Default: ftp
|
||||
+#
|
||||
+port = ftp
|
||||
+
|
||||
+# Option: timeregex
|
||||
+# Notes.: regex to match timestamp in wu-ftpd logfile.
|
||||
+# Values: [Oct 11 15:19:59]
|
||||
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+#
|
||||
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+
|
||||
+# Option: timepattern
|
||||
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
|
||||
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
+#
|
||||
+timepattern = %%b %%d %%H:%%M:%%S
|
||||
+
|
||||
+# Option: failregex
|
||||
+# Notes.: regex to match the password failures messages in the logfile.
|
||||
+# Values: TEXT Default:
|
||||
+#
|
||||
+failregex = wu-ftpd\[\d+\]:\s+\(pam_unix\)\s+authentication failure.*rhost=(?P<host>\S+)
|
||||
+
|
||||
+
|
||||
[SSH]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
Vendored
+1
-1
@@ -3,4 +3,4 @@
|
||||
# Site Directory Pattern Version Script
|
||||
version=3
|
||||
|
||||
http://sf.net/fail2ban/ fail2ban-(.*)\.tar\.bz2 debian svn-upgrade
|
||||
http://sf.net/fail2ban/ fail2ban-(0\.6\..*)\.tar\.bz2 debian svn-upgrade
|
||||
|
||||
@@ -18,22 +18,15 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.7 $
|
||||
# $Revision: 449 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.7 $"
|
||||
__date__ = "$Date: 2005/12/27 15:09:50 $"
|
||||
__version__ = "$Revision: 449 $"
|
||||
__date__ = "$Date: 2006-11-06 23:43:42 +0100 (Mon, 06 Nov 2006) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
import sys, traceback, logging, locale
|
||||
|
||||
# Set the locale with the user's default setting
|
||||
try:
|
||||
locale.setlocale(locale.LC_ALL, '')
|
||||
except Exception:
|
||||
print "Unable to set locale to " + `locale.getdefaultlocale()`
|
||||
sys.exit(-1)
|
||||
import sys, traceback, logging
|
||||
|
||||
# Inserts our own modules path first in the list
|
||||
# fix for bug #343821
|
||||
|
||||
+48
-36
@@ -17,15 +17,16 @@
|
||||
# Author: Cyril Jaquier
|
||||
# Modified by: Yaroslav Halchenko (SYSLOG, findtime, and oth)
|
||||
#
|
||||
# $Revision: 1.24 $
|
||||
# $Revision: 449 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.24 $"
|
||||
__date__ = "$Date: 2006/01/22 11:10:29 $"
|
||||
__version__ = "$Revision: 449 $"
|
||||
__date__ = "$Date: 2006-11-06 23:43:42 +0100 (Mon, 06 Nov 2006) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
import time, sys, getopt, os, string, signal, logging, logging.handlers, copy
|
||||
import time, sys, getopt, os, string, signal, logging, logging.handlers, \
|
||||
copy, locale
|
||||
from ConfigParser import *
|
||||
|
||||
from version import version
|
||||
@@ -213,7 +214,7 @@ def main():
|
||||
# Reads the command line options.
|
||||
try:
|
||||
cmdOpts = 'hvVbdkc:t:f:i:r:p:e:'
|
||||
cmdLongOpts = ['help','version']
|
||||
cmdLongOpts = ['help', 'version']
|
||||
optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
|
||||
except getopt.GetoptError:
|
||||
dispUsage()
|
||||
@@ -240,6 +241,7 @@ def main():
|
||||
["bool", "debug", False],
|
||||
["int", "verbose", conf["verbose"]],
|
||||
["str", "pidlock", "/var/run/fail2ban.pid"],
|
||||
["str", "locale", ""],
|
||||
["int", "maxfailures", 5],
|
||||
["int", "bantime", 600],
|
||||
["int", "findtime", 600],
|
||||
@@ -266,6 +268,14 @@ def main():
|
||||
# PID lock
|
||||
pidLock.setPath(conf["pidlock"])
|
||||
|
||||
# Set the LC_TIME with the user's default setting
|
||||
try:
|
||||
logSys.info("Setting LC_TIME locale option to '%s'"%conf["locale"])
|
||||
locale.setlocale(locale.LC_TIME, conf["locale"])
|
||||
except Exception:
|
||||
logSys.error("Unable to set locale to '%s'"%conf["locale"])
|
||||
sys.exit(-1)
|
||||
|
||||
# Now we can kill properly a running instance if needed
|
||||
if conf["kill"]:
|
||||
pid = pidLock.exists()
|
||||
@@ -300,7 +310,7 @@ def main():
|
||||
# a socket (file, so it starts with /)
|
||||
# or hostname
|
||||
# or hostname:port
|
||||
syslogtargets = re.findall("(/[\w/]*)|([^/ ][^: ]*)(:(\d+)){,1}",
|
||||
syslogtargets = re.findall("(/[\w/]*)|([^/ ][^: ]*)(:(\d+)){,1}",
|
||||
conf["syslog-target"])
|
||||
# we are waiting for a single match
|
||||
syslogtargets = syslogtargets[0]
|
||||
@@ -314,7 +324,7 @@ def main():
|
||||
if len(syslogtargets) == 0: # everything default
|
||||
hdlr = logging.handlers.SysLogHandler()
|
||||
else:
|
||||
if not ( syslogtargets[0] == "" ): # got socket
|
||||
if not (syslogtargets[0] == ""): # got socket
|
||||
syslogtarget = syslogtargets[0]
|
||||
else: # got hostname and maybe a port
|
||||
if syslogtargets[3] == "": # no port specified
|
||||
@@ -356,7 +366,9 @@ def main():
|
||||
"ONLY DISPLAYED IN THE LOG MESSAGES")
|
||||
|
||||
# Ignores IP list
|
||||
ignoreIPList = conf["ignoreip"].split(' ')
|
||||
# and filter out empty entries. Otherwise
|
||||
# WARNING: is not a valid IP address
|
||||
ignoreIPList = filter(None, conf["ignoreip"].split(' '))
|
||||
|
||||
# Checks for root user. This is necessary because log files
|
||||
# are owned by root and firewall needs root access.
|
||||
@@ -382,15 +394,15 @@ def main():
|
||||
logSys.debug("MaxFailure is " + `conf["maxfailures"]`)
|
||||
|
||||
# Options
|
||||
optionValues = (["bool", "enabled", False],
|
||||
["str", "host", "localhost"],
|
||||
["int", "port", "25"],
|
||||
["str", "from", "root"],
|
||||
["str", "to", "root"],
|
||||
["str", "user", ''],
|
||||
["str", "password", ''],
|
||||
["bool", "localtime", False],
|
||||
["str", "subject", "[Fail2Ban] Banned <ip>"],
|
||||
optionValues = (["bool", "enabled", False],
|
||||
["str", "host", "localhost"],
|
||||
["int", "port", "25"],
|
||||
["str", "from", "root"],
|
||||
["str", "to", "root"],
|
||||
["str", "user", ''],
|
||||
["str", "password", ''],
|
||||
["bool", "localtime", False],
|
||||
["str", "subject", "[Fail2Ban] Banned <ip>"],
|
||||
["str", "message", "Fail2Ban notification"])
|
||||
|
||||
# Gets global configuration options
|
||||
@@ -408,18 +420,18 @@ def main():
|
||||
logSys.debug("to: " + mailConf["to"] + " from: " + mailConf["from"])
|
||||
|
||||
# Options
|
||||
optionValues = (["bool", "enabled", False],
|
||||
["str", "logfile", "/dev/null"],
|
||||
["int", "maxfailures", conf["maxfailures"]],
|
||||
["int", "bantime", conf["bantime"]],
|
||||
["int", "findtime", conf["findtime"]],
|
||||
["str", "timeregex", ""],
|
||||
["str", "timepattern", ""],
|
||||
["str", "failregex", ""],
|
||||
["str", "fwstart", ""],
|
||||
["str", "fwend", ""],
|
||||
["str", "fwban", ""],
|
||||
["str", "fwunban", ""],
|
||||
optionValues = (["bool", "enabled", False],
|
||||
["str", "logfile", "/dev/null"],
|
||||
["int", "maxfailures", conf["maxfailures"]],
|
||||
["int", "bantime", conf["bantime"]],
|
||||
["int", "findtime", conf["findtime"]],
|
||||
["str", "timeregex", ""],
|
||||
["str", "timepattern", ""],
|
||||
["str", "failregex", ""],
|
||||
["str", "fwstart", ""],
|
||||
["str", "fwend", ""],
|
||||
["str", "fwban", ""],
|
||||
["str", "fwunban", ""],
|
||||
["str", "fwcheck", ""])
|
||||
|
||||
logSys.info("Fail2Ban v" + version + " is running")
|
||||
@@ -431,10 +443,10 @@ def main():
|
||||
if isEnabledSection(l["enabled"], t):
|
||||
# Creates a logreader object
|
||||
enabledSections.append(t)
|
||||
lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
|
||||
lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
|
||||
l["failregex"], l["maxfailures"], l["findtime"])
|
||||
# Creates a firewall object
|
||||
fObj = Firewall(l["fwstart"], l["fwend"], l["fwban"], l["fwunban"],
|
||||
fObj = Firewall(l["fwstart"], l["fwend"], l["fwban"], l["fwunban"],
|
||||
l["fwcheck"], l["bantime"])
|
||||
# "Name" the firewall
|
||||
fObj.setSection(t)
|
||||
@@ -513,7 +525,7 @@ def main():
|
||||
e = element[1].getFailures()
|
||||
for key in e.iterkeys():
|
||||
if element[3].has_key(key):
|
||||
element[3][key] = (element[3][key][0] + e[key][0],
|
||||
element[3][key] = (element[3][key][0] + e[key][0],
|
||||
e[key][1])
|
||||
else:
|
||||
element[3][key] = (e[key][0], e[key][1])
|
||||
@@ -530,9 +542,9 @@ def main():
|
||||
if failTime < unixTime - findTime:
|
||||
del element[3][attempt]
|
||||
elif fails[attempt][0] >= element[1].getMaxRetry():
|
||||
aInfo = {"section": element[0],
|
||||
"ip": attempt,
|
||||
"failures": element[3][attempt][0],
|
||||
aInfo = {"section": element[0],
|
||||
"ip": attempt,
|
||||
"failures": element[3][attempt][0],
|
||||
"failtime": failTime}
|
||||
logSys.info(element[0] + ": " + aInfo["ip"] +
|
||||
" has " + `aInfo["failures"]` +
|
||||
@@ -540,7 +552,7 @@ def main():
|
||||
element[2].addBanIP(aInfo, conf["debug"])
|
||||
# Send a mail notification
|
||||
if 'mail' in locals():
|
||||
mail.sendmail(mailConf["subject"],
|
||||
mail.sendmail(mailConf["subject"],
|
||||
mailConf["message"], aInfo)
|
||||
del element[3][attempt]
|
||||
except ExternalError, e:
|
||||
|
||||
@@ -16,10 +16,10 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.1 $
|
||||
# $Revision: 6 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.1 $"
|
||||
__date__ = "$Date: 2004/10/09 15:33:33 $"
|
||||
__version__ = "$Revision: 6 $"
|
||||
__date__ = "$Date: 2004-10-09 17:33:33 +0200 (Sat, 09 Oct 2004) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
@@ -16,11 +16,11 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.10 $
|
||||
# $Revision: 222 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.10 $"
|
||||
__date__ = "$Date: 2005/12/16 23:48:52 $"
|
||||
__version__ = "$Revision: 222 $"
|
||||
__date__ = "$Date: 2005-12-17 00:48:52 +0100 (Sat, 17 Dec 2005) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
|
||||
@@ -16,10 +16,10 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.1 $
|
||||
# $Revision: 7 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.1 $"
|
||||
__date__ = "$Date: 2004/10/10 13:33:40 $"
|
||||
__version__ = "$Revision: 7 $"
|
||||
__date__ = "$Date: 2004-10-10 15:33:40 +0200 (Sun, 10 Oct 2004) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
+18
-13
@@ -16,11 +16,11 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.16 $
|
||||
# $Revision: 484 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.16 $"
|
||||
__date__ = "$Date: 2006/01/03 15:13:04 $"
|
||||
__version__ = "$Revision: 484 $"
|
||||
__date__ = "$Date: 2006-12-10 22:16:26 +0100 (Sun, 10 Dec 2006) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
@@ -136,6 +136,11 @@ class LogReader:
|
||||
self.setFilePos(logFile)
|
||||
lastLine = None
|
||||
for line in logFile:
|
||||
try:
|
||||
# Try to convert UTF-8 string to Latin-1
|
||||
line = line.decode('utf-8').encode('latin-1')
|
||||
except UnicodeDecodeError:
|
||||
pass
|
||||
if not self.hasTime(line):
|
||||
# There is no valid time in this line
|
||||
continue
|
||||
@@ -172,16 +177,16 @@ class LogReader:
|
||||
timeMatch = re.search(self.timeregex, match.string)
|
||||
if timeMatch:
|
||||
date = self.getUnixTime(timeMatch.group())
|
||||
# Bug fix for Debian #330827
|
||||
hostMatch = match.groupdict()
|
||||
if len(hostMatch)==0:
|
||||
logSys.warn("Must have been using old style of failregex! "
|
||||
"Security Breach! Read README.Debian")
|
||||
ipMatch = textToIp(match.string)
|
||||
else:
|
||||
ipMatch = reduce(lambda x,y:x+textToIp(y),
|
||||
hostMatch.values(), [])
|
||||
|
||||
try:
|
||||
# Fix for CVE-2006-6302
|
||||
matchString = match.group("host")
|
||||
except IndexError:
|
||||
# However does not break the current configuration
|
||||
logSys.warn("No 'host' group defined. This is a security " +
|
||||
"issue. Please fix your configuration file " +
|
||||
"and look at CVE-2006-6302")
|
||||
matchString = match.string
|
||||
ipMatch = textToIp(matchString)
|
||||
if ipMatch:
|
||||
for ip in ipMatch:
|
||||
failList.append([ip, date])
|
||||
|
||||
+1
-9
@@ -13,16 +13,8 @@ Please report bugs at http://sourceforge.net/projects/fail2ban/
|
||||
via bug tracker
|
||||
.SH "AUTHOR"
|
||||
Cyril Jaquier <lostcontrol@users.sourceforge.net>
|
||||
.br
|
||||
Modified by
|
||||
.br
|
||||
- Yaroslav O. Halchenko <debian@onerussian.com>.
|
||||
.br
|
||||
Sponsored for Debian by
|
||||
.br
|
||||
- Barak A. Pearlmutter <barak@cs.nuim.ie>.
|
||||
.SH "SEE ALSO"
|
||||
.BR fail2ban(8)
|
||||
.BR fail2ban (8)
|
||||
.TP
|
||||
See
|
||||
.BR "http://fail2ban.sourceforge.net/".
|
||||
|
||||
@@ -18,11 +18,11 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.6 $
|
||||
# $Revision: 234 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.6 $"
|
||||
__date__ = "$Date: 2006/01/22 11:08:42 $"
|
||||
__version__ = "$Revision: 234 $"
|
||||
__date__ = "$Date: 2006-01-22 12:08:42 +0100 (Sun, 22 Jan 2006) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
|
||||
+3
-3
@@ -16,10 +16,10 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.1 $
|
||||
# $Revision: 82 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.1 $"
|
||||
__date__ = "$Date: 2005/03/06 17:51:24 $"
|
||||
__version__ = "$Revision: 82 $"
|
||||
__date__ = "$Date: 2005-03-06 18:51:24 +0100 (Sun, 06 Mar 2005) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
+3
-3
@@ -16,11 +16,11 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.8 $
|
||||
# $Revision: 216 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.8 $"
|
||||
__date__ = "$Date: 2005/11/20 17:07:47 $"
|
||||
__version__ = "$Revision: 216 $"
|
||||
__date__ = "$Date: 2005-11-20 18:07:47 +0100 (Sun, 20 Nov 2005) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
|
||||
+3
-3
@@ -16,11 +16,11 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.3 $
|
||||
# $Revision: 229 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.3 $"
|
||||
__date__ = "$Date: 2006/01/03 15:13:41 $"
|
||||
__version__ = "$Revision: 229 $"
|
||||
__date__ = "$Date: 2006-01-03 16:13:41 +0100 (Tue, 03 Jan 2006) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
|
||||
+3
-3
@@ -16,11 +16,11 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
# $Revision: 216 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.2 $"
|
||||
__date__ = "$Date: 2005/11/20 17:07:47 $"
|
||||
__version__ = "$Revision: 216 $"
|
||||
__date__ = "$Date: 2005-11-20 18:07:47 +0100 (Sun, 20 Nov 2005) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
|
||||
+3
-3
@@ -16,11 +16,11 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
# $Revision: 216 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.2 $"
|
||||
__date__ = "$Date: 2005/11/20 17:07:47 $"
|
||||
__version__ = "$Revision: 216 $"
|
||||
__date__ = "$Date: 2005-11-20 18:07:47 +0100 (Sun, 20 Nov 2005) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
|
||||
+3
-3
@@ -16,11 +16,11 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
# $Revision: 216 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.2 $"
|
||||
__date__ = "$Date: 2005/11/20 17:07:47 $"
|
||||
__version__ = "$Revision: 216 $"
|
||||
__date__ = "$Date: 2005-11-20 18:07:47 +0100 (Sun, 20 Nov 2005) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
|
||||
+4
-4
@@ -16,12 +16,12 @@
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.15 $
|
||||
# $Revision: 486 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.15 $"
|
||||
__date__ = "$Date: 2006/03/15 23:07:12 $"
|
||||
__version__ = "$Revision: 486 $"
|
||||
__date__ = "$Date: 2006-12-11 22:43:57 +0100 (Mon, 11 Dec 2006) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
version = "0.6.1"
|
||||
version = "0.6.2"
|
||||
|
||||
Reference in New Issue
Block a user