debian/README.Debian - Instructions on how to establish correct startup/shutdown sequence in systemd for shorewall (Closes: #847728 )

final recipe
updated the patch for elderly systems to use python2
2018-01-22 10:38:48 -05:00 · 2018-01-22 10:04:52 -05:00 · 2018-01-22 10:01:43 -05:00 · 2018-01-21 23:31:17 -05:00 · 2018-01-21 22:45:32 -05:00 · 2018-01-21 22:35:12 -05:00
35 changed files with 2404 additions and 0 deletions
@@ -0,0 +1,91 @@
+fail2ban (0.10.2-1) unstable; urgency=medium
+
+  This version is a major development leap forward to provide
+  IPv6 support, which also required extensions to the configuration
+  system.  That is why it is not unlikely that configuration left from the
+  previous version(s) would either not work or would not work as intended.
+
+  You are advised to accept new configuration and adjust it for your
+  customizations (if any).  See changelog.Debian.gz for more information.
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Sun, 21 Jan 2018 22:25:26 -0500
+
+fail2ban (0.9.0+git48-gabcab00-1) experimental; urgency=low
+
+  [ Yaroslav Halchenko ]
+  * This version went through big refactoring which allowed to gain new
+    features such as multiline matching (see upstream's changelog for more
+    information).
+  * Although .local files are still supported, customizations are advised
+    to be provided under corresponding .d/ directories.  E.g. see
+    /etc/fail2ban/jail.d/defaults-debian.conf which is where now sshd
+    jail is enabled by default to match previous behavior of Fail2Ban in
+    Debian.
+
+  [ Daniel Schaal ]
+  * All jails definitions were rewritten to become more concise and uniform.
+    From this version on log paths are defined in distro specific files,
+    for Debian this is in /etc/fail2ban/paths-debian.conf.
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Tue, 25 Mar 2014 08:38:31 -0400
+
+fail2ban (0.8.11-1) unstable; urgency=low
+
+  * retroactive for 0.8.9: by default iptables-* actions do not simply
+    DROP packets from offending IP but rather reject with
+    icmp-port-unreachable.  If DROP behaviour is preferable, provide
+    config/action.d/iptables-blocktype.local with [Init] section defining
+    blocktype = DROP or override action definition to provide
+    blocktype=DROP option in jail.local
+  * Many failregex's were tight-up in this release which could
+    theoretically effect operation in comparison to previous release(s).
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Sat, 16 Nov 2013 22:27:50 -0500
+
+fail2ban (0.8.4-3) unstable; urgency=low
+
+  * Jail named-refused-udp is unsafe and opens possibility for easy DoS,
+    thus discouraged to be used, and commented out (see #583364 for more
+    information).
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Mon, 28 Jun 2010 22:12:22 -0400
+
+fail2ban (0.7.1-0.2) unstable; urgency=low
+
+  fail2ban 0.7 is a complete rewrite of the 0.6 version, and if you
+  customized any of provided configuration or startup files
+  (/etc/default/fail2ban, /etc/fail2ban.conf, /etc/init.d/fail2ban),
+  please read further. The configuration scheme has changed upstream:
+  0.7 ignores /etc/fail2ban.conf and instead uses a split configuration
+  under /etc/fail2ban/. To retain your customizations, for example to
+  monitor anything other than sshd, you will need to set them under that
+  new directory; use *.local files for customizations. Please see
+  /usr/share/doc/fail2ban/README.Debian.gz and
+  http://fail2ban.sourceforge.net for further description of new
+  configuration scheme. Detailed documentation is under development (see
+  #400416).  When you are satisfied with the new settings, please delete
+  /etc/fail2ban.conf to avoid confusion.
+
+  Fail2ban 0.7 uses client/server architecture and fail2ban-client is to
+  substitute fail2ban command to provide an interface between the user and
+  fail2ban-server. That is why some command line parameters present in
+  fail2ban 0.6 are invalid in fail2ban-client. Such change affects
+  /etc/default/fail2ban; you should review that file if you customized it.
+  Please enable sections as directed in README.Debian.gz mentioned above.
+  You must use newly shipped init.d/fail2ban, or otherwise fail2ban will
+  not start.
+
+  This note was rewritten in release 0.7.5-2 to clarify its meaning.
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Sat,  9 Dec 2006 18:24:36 -0500
+
+fail2ban (0.6.0-4) unstable; urgency=low
+
+  In this version the new section ApacheAttacks was introduced to ban IPs
+  which are found to run some known attack on the host. For now it captures
+  just awstats and mambo related attacks. To make this feature work, the bug of
+  wrongly specified timeregexp for Apache's access.log file was fixed.
+  Besides that group of log files has changed to be adm, and now they are
+  readable by the group.
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Fri, 10 Feb 2006 13:05:07 -0500
@@ -0,0 +1,249 @@
+fail2ban (>=0.7.0) for Debian
+-----------------------------
+
+This package is ~99% identical to the upstream version. Few features
+could have been added but not yet propagated into upstream version and
+some modifications might be Debian-specific. Debian specific jail.conf
+file is shipped. Original upstream file is available from
+/usr/share/doc/fail2ban/examples/jail.conf
+
+Currently, the major difference with upstream: python libraries are
+placed under /usr/share/fail2ban instead of /usr/lib/fail2ban to
+comply with policy regarding architecture independent resources.
+
+Shorewall and startup sequence (#847728)
+----------------------------------------
+
+If you are using systemd, create a
+/etc/systemd/system/fail2ban.service.d/override.conf with contents:
+
+[Unit]
+Requires=shorewall.service
+After=shorewall.service
+
+go guarantee a proper sequence of startup/shotdown (shorewall should
+be started before fail2ban, and stopped after).  Similar settings
+could be adopted for other firewall solutions.
+
+
+Upgrade from 0.6 versions:
+-------------------------
+
+* New Config Files Format:
+
+If you had introduced your own sections in /etc/fail2ban.conf, you
+would need manually to convert them into a new format. At minimum you
+need to create /etc/fail2ban/filter.d/NAME.local (leave .conf files
+for me and upstream please to avoid any conflicts -- introduce your
+changes in .local) with failregex in [Definition] section. And provide
+appropriate jail definition in /etc/fail2ban/jail.local
+
+
+* Enabled Sections:
+
+Only handling of ssh files is enabled by default. If you want to use
+fail2ban with apache, please enable apache section manually in
+/etc/fail2ban/jail.local by including next lines:
+
+[apache]
+enabled = true
+
+NOTE: -e command line parameter is non existent in 0.7.x
+
+
+* Interpolations vs actions/filters parameters:
+
+For details see #398739 or wait for a closure of #400416
+
+Every pair of .conf and then .local (if exists) files is read
+separately from any other configuration file, so interpolations cannot
+penetrate from jail.* into actions.d/*. To overcome this, it is
+necessary to create a PARAMETER which can be substituted in actions
+[Definition] section, if it is also defined in the [Init] section of
+that file and is used in place of necessary allocation as <PARAMETER>
+tag. Parameters can be specified in the definitions within
+jail.{conf,local}. For instance, 1 lengthy example, where the same
+name "fwchain" is used both as interpolation (in jail.local) and as a
+parameter (in iptables-flex.local) (from #398739)
+
+==> /etc/fail2ban/jail.local <==
+[DEFAULT]
+action = iptables-flex[name=%(__name__)s, port=%(port)s, fwchain=%(fwchain)s, post_start_commands=%(post_start_commands)s, pre_end_commands=%(pre_end_commands)s]
+fwchain = INPUT
+[ssh]
+fwchain = ssh-tarpit
+==> /etc/fail2ban/action.d/iptables-flex.local <==
+[Definition]
+actionstart = iptables -N fail2ban-<name>
+               iptables -I <fwchain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+               iptables -I <fwchain> -j <whitelist>
+actionstop  = iptables -D <fwchain> -j <whitelist>
+               iptables -D <fwchain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+               iptables -F fail2ban-<name>
+               iptables -X fail2ban-<name>
+actioncheck = iptables -n -L <fwchain> | grep -q fail2ban-<name>
+actionban   = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+[Init]
+whitelist = ssh-whitelist
+fwchain = INPUT
+name = default
+port = ssh
+protocol = tcp
+
+
+* Multiport banning: Comment for #373592, #545971
+
+iptables-multiport action is now default banaction (file jail.conf, to
+be customized within jail.local). Therefore assure that you have built
+multiport module if you use custom kernel.
+
+If you would like to ban all ports for that host, just redefine
+fwban/fwunban commands to don't have --dport %(port)s statement at
+all, or use shorewall, where actionban bans whole IP.
+
+* Blocking of NEW connections only
+Comment for the wishlist #350746.
+
+It might be benefitial in some cases to ban only new connections. For
+that just use iptables-new action instead of default banaction
+
+/etc/fail2ban/jail.local:
+
+[DEFAULT]
+banaction=iptables-new
+
+(you can override banaction within interesting for you section).
+ Also you can redefine the whole action parameter if you like.
+
+
+* Interaction with ipmasq
+  Comment to #461417
+
+Although fail2ban should detect and recreate missing chains if the external
+command wipes out iptables, it is better to explicitly to force-reload
+fail2ban. For this reason there is examples/ipmasq-ZZZzzz|fail2ban.rul file is
+shipped along to be installed under name ZZZzzz|fail2ban.rul within
+/etc/ipmasq.
+
+* Interaction with logrotate with custom logtarget
+  Comment to #631917
+
+if you use an alternative logtarget (e.g. SYSLOG) thus not using
+/var/log/fail2ban.log you should divert logrotate configuration into
+a disabled state, e.g.
+
+sudo dpkg-divert --rename --divert \
+	 /etc/logrotate.d/fail2ban.disabled /etc/logrotate.d/fail2ban
+
+
+Troubleshooting:
+---------------
+
+* Updated failregex:
+
+To resolve the security bug #330827 [1] failregex expressions must
+provide a named group (?P<host>...) as a placeholder of the abuser's
+host. Alternative tag (since 0.7.5) can be "<HOST>". The naming of the
+group was introduced to capture possible future generalizations of
+failregex to provide even more information.
+
+[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=330827
+
+You might benefit from using fail2ban-regex command shipped along to
+construct and debug your failregex statements.
+
+* "Interpolations" in the config file:
+
+Since version 0.6.0-3 to reduce duplication, thus to improve
+readability of the config file, interpolations provided by the module
+ConfigParser are used. If you had custom sections defined before, you
+might benefit from updating config file and adding appropriate
+information for the new sections.
+
+N.B. If you have some nice additional sections defined, I would really
+appreciate if you share them with me or upstream author, so they could
+be eventually included in the fail2ban package for general use by the
+rest of the community.
+
+
+* Mailing:
+
+Since actions.d/mail*.conf commands rely on presence of "mail"
+command, mailx package (or another package providing mailx
+functionality such as mailutils) is required if those actions are
+activated in jail.{conf,local}.
+
+
+* Dirty exit:
+
+If firewall rules gets cleaned out before fail2ban exits (like was
+happening with firestarter), errors get reported during the exit of
+fail2ban, but they are "safe" and can be ignored.
+
+
+** SSHD Configuration Specific Problems
+
+* Ban "Not allowed" attempts:
+
+Make sure that you have
+ChallengeResponseAuthentication no
+PasswordAuthentication yes
+
+Details from the bug report #350980 [2]
+
+[2]  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350980
+
+
+* Not caught attempts to login as root
+
+On the boxes running older versions of openssh (e.g. sarge
+distribution) in the case when PermitRootLogin is set to something
+else than "yes" and iff AllowUsers is active, failed root logins do
+not confirm to the standard logging message -- they omit the source
+IP, thus allowing attack to persist since such messages are not caught
+by fail2ban.
+
+
+* Bantime:
+
+An IP is banned for "bantime" not since the last failed login attempt
+from the IP, but rather since the moment when failed login was
+detected by fail2ban. Thus, if fail2ban gets [re]started, any IP which
+had enough of failed logins with durations less than "findtime" between
+them prior to the [re]start moment, will be banned for
+"bantime" since [re]start moment, not since the last failed login
+time.
+
+* Findtime:
+
+"Findtime" option of a jail actually defines a duration to reset the
+counter of failed login attempts, if no new attempt was detected within
+that time frame (i.e.  within "findtime").
+
+See
+http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Jail_Options
+for more information on jail options.
+
+
+* Syslog entries can be 'forged' by a regular user
+
+From
+http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Possibility_of_DOS_attack_by_a_local_user
+
+Especially on systems which provide ssh/CGI/PHP services to unknown
+users it is possible to block other users from ssh and probably other
+access as a unprivileged user may issue:
+
+logger -p auth.warning -t 'sshd[123]' 'Illegal user user1 from 1.2.3.4'
+
+N.B. chmod o-x /usr/bin/logger should provide at least obfuscation
+solution
+
+Or the malicious user may write via PHP's openlog()/syslog() to syslog.
+
+P.S. Anyone is welcome to recommend proper security solution to this
+issue, such as an alternative to sysklogd which allows better control
+over users logging to specific facilities (such as AUTH)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>, Mon, 22 Jan 2018 10:37:00 -0500
@@ -0,0 +1,10 @@
+* completions installation
+
+W: fail2ban: package-installs-into-obsolete-dir etc/bash_completion.d/ : ^etc/bash_completion.d/ -> usr/share/bash-completion/completions (see also https://bugs.debian.org/776954)
+W: fail2ban: package-installs-into-obsolete-dir etc/bash_completion.d/fail2ban : ^etc/bash_completion.d/ -> usr/share/bash-completion/completions (see also https://bugs.debian.org/776954)
+
+* Find proper answer to "Syslog entries can be 'forged' by a regular
+   user" mentioned in README.Debian
+
+ -- Yaroslav O. Halchenko <debian@onerussian.com>  Wed,  6 Dec 2006 22:14:26 -0500
+
@@ -0,0 +1 @@
+nopycentral.patch
@@ -0,0 +1,40 @@
+diff -x '*~' -x .svn -Naur trunk/debian/control trunk.backports/debian/control
+--- trunk/debian/control	2006-10-23 00:57:02.000000000 -0400
+++ trunk.backports/debian/control	2006-12-04 08:45:25.000000000 -0500
+@@ -4,13 +4,13 @@
+ Maintainer: Yaroslav Halchenko <debian@onerussian.com>
+ Uploaders: Barak Pearlmutter <bap@debian.org>
+ Build-Depends: debhelper (>= 5.0.37.2), dpatch
+-Build-Depends-Indep: python, python-dev, help2man, python-central (>= 0.5.6)
+Build-Depends-Indep: python, python2.4, python2.4-dev, help2man
+ XS-Python-Version: current, >= 2.4
+ Standards-Version: 3.7.2
+ 
+ Package: fail2ban
+ Architecture: all
+-Depends: ${python:Depends}, iptables, lsb-base (>=2.0-7)
+Depends: python2.4, iptables, lsb-base (>=2.0-7)
+ Suggests: python-gamin
+ XB-Python-Version: ${python:Versions}
+ Description: bans IPs that cause multiple authentication errors
+diff -x '*~' -x .svn -Naur trunk/debian/rules trunk.backports/debian/rules
+--- trunk/debian/rules	2006-11-11 21:19:14.000000000 -0500
+++ trunk.backports/debian/rules	2006-12-04 08:45:45.000000000 -0500
+@@ -39,7 +39,7 @@
+ 	dh_installdirs
+ 
+ 	# Add here commands to install the package into debian/fail2ban.
+-	python setup.py install --root=$(DESTDIR) --no-compile
+	python2.4 setup.py install --root=$(DESTDIR) --no-compile
+ 	#X Evil - must be removed after Debian switches over to 2.4, now
+ 	#  distutils.setup will override the enterpreter line to /usr/bin/python
+ 	install fail2ban-server fail2ban-client $(DESTDIR)/usr/bin
+@@ -62,7 +62,7 @@
+ 	dh_installlogrotate
+ 	dh_installinit -- defaults 99
+ 	dh_installman man/*.1
+-	dh_pycentral
+	dh_python
+ 	dh_link
+ 	dh_compress
+ 	dh_fixperms
@@ -0,0 +1 @@
+9
@@ -0,0 +1,43 @@
+Source: fail2ban
+Section: net
+Priority: optional
+Maintainer: Yaroslav Halchenko <debian@onerussian.com>
+Build-Depends:
+ debhelper (>= 9)
+ , debhelper (>= 9.20160709) | dh-systemd
+ , python3
+ , python3-pyinotify
+ , sqlite3
+Homepage: http://www.fail2ban.org
+Vcs-Git: git://github.com/fail2ban/fail2ban.git -b debian
+Vcs-Browser: http://github.com/fail2ban/fail2ban
+Standards-Version: 4.1.3
+
+
+Package: fail2ban
+Architecture: all
+Depends: ${python3:Depends}, ${misc:Depends}, lsb-base (>=2.0-7)
+Recommends: python, iptables, whois, python3-pyinotify, python3-systemd
+Suggests: mailx, system-log-daemon, monit, sqlite3
+Description: ban hosts that cause multiple authentication errors
+ Fail2ban monitors log files (e.g. /var/log/auth.log,
+ /var/log/apache/access.log) and temporarily or persistently bans
+ failure-prone addresses by updating existing firewall rules.  Fail2ban
+ allows easy specification of different actions to be taken such as to ban
+ an IP using iptables or hostsdeny rules, or simply to send a notification
+ email.
+ .
+ By default, it comes with filter expressions for various services
+ (sshd, apache, qmail, proftpd, sasl etc.) but configuration can be
+ easily extended for monitoring any other text file.  All filters and
+ actions are given in the config files, thus fail2ban can be adopted
+ to be used with a variety of files and firewalls.  Following recommends
+ are listed:
+ .
+  - iptables -- default installation uses iptables for banning. You most
+    probably need it
+  - whois -- used by a number of *mail-whois* actions to send notification
+    emails with whois information about attacker hosts. Unless you will use
+    those you don't need whois
+  - python3-pyinotify -- unless you monitor services logs via systemd, you
+    need pyinotify for efficient monitoring for log files changes
@@ -0,0 +1,31 @@
+This package was originally debianized by Yaroslav Halchenko
+<debian@onerussian.com> on Mon Jul  4 14:41:34 HST 2005
+
+It was downloaded from http://www.sourceforge.net/projects/fail2ban
+
+Author: Cyril Jaquier: <cyril.jaquier@fail2ban.org>
+        http://fail2ban.sourceforge.net
+
+Copyright: 2004-2009 Cyril Jaquier
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the
+Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+MA 02110-1301, USA.
+
+On Debian systems, the complete text of the GNU General Public
+License, version 2, can be found in /usr/share/common-licenses/GPL-2.
+
+The Debian packaging is (C) 2006-2011, Yaroslav Halchenko <debian@onerussian.com>
+and is licensed under the GPL, see above.
+
@@ -0,0 +1,2 @@
+[sshd]
+enabled = true
@@ -0,0 +1,3 @@
+README.md
+TODO
+doc/run-rootless.txt
@@ -0,0 +1,39 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+# Command line options for Fail2Ban. Refer to "fail2ban-client -h" for
+# valid options.
+FAIL2BAN_OPTS=""
+
+# Run fail2ban as a different user. If not set, fail2ban
+# will run as root.
+#
+# The user is not created automatically.
+# The user can be created e.g. with
+#    useradd --system --no-create-home --home-dir / --groups adm fail2ban
+# Log files are readable by group adm by default. Adding the fail2ban
+# user to this group allows it to read the logfiles.
+#
+# Another manual step that needs to be taken is to allow write access
+# for fail2ban user to fail2ban log files. The /etc/init.d/fail2ban
+# script will change the ownership when starting fail2ban. Logrotate
+# needs to be configured separately, see /etc/logrotate.d/fail2ban.
+#
+# FAIL2BAN_USER="fail2ban"
@@ -0,0 +1,17 @@
+/var/log/fail2ban.log {
+   
+    weekly
+    rotate 4
+    compress
+
+    delaycompress
+    missingok
+    postrotate
+	fail2ban-client flushlogs 1>/dev/null
+    endscript
+
+    # If fail2ban runs as non-root it still needs to have write access
+    # to logfiles.
+    # create 640 fail2ban adm
+    create 640 root adm
+}
@@ -0,0 +1,18 @@
+[DEFAULT]
+# the default branch for upstream sources:
+upstream-branch = upstream
+# the default branch for the debian patch:
+debian-branch = debian-releases/experimental
+# use pristine-tar
+# pristine-tar = True
+# the default tag formats used:
+upstream-tag = %(version)s
+debian-tag = debian/%(version)s
+
+
+# Options only affecting git-buildpackage
+[git-buildpackage]
+# use this for more svn-buildpackage like bahaviour:
+export-dir = ../build-area/
+tarball-dir = ../tarballs/
+
@@ -0,0 +1,34 @@
+From bd457781df3442b6721360a9f190428994292e15 Mon Sep 17 00:00:00 2001
+From: Yaroslav Halchenko <debian@onerussian.com>
+Date: Sun, 21 Jan 2018 22:01:24 -0500
+Subject: [PATCH] BF: RF test for "being a root" to check if actually can read
+ the file
+
+---
+ fail2ban/tests/filtertestcase.py | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fail2ban/tests/filtertestcase.py b/fail2ban/tests/filtertestcase.py
+index b707beb5..40cf51f9 100644
+--- a/fail2ban/tests/filtertestcase.py
+++ b/fail2ban/tests/filtertestcase.py
+@@ -675,7 +675,15 @@ class LogFileMonitor(LogCaptureTestCase):
+ 		os.chmod(self.name, 0)
+ 		self.filter.getFailures(self.name)
+ 		failure_was_logged = self._is_logged('Unable to open %s' % self.name)
+-		is_root = getpass.getuser() == 'root'
+		# verify that we cannot access the file. Checking by name of user is not
+		# sufficient since could be a fakeroot or some other super-user
+		try:
+			with open(self.name) as f:
+				f.read()
+			is_root = True
+		except IOError:
+			is_root = False
+
+ 		# If ran as root, those restrictive permissions would not
+ 		# forbid log to be read.
+ 		self.assertTrue(failure_was_logged != is_root)
+-- 
+2.15.1
+
@@ -0,0 +1,34 @@
+From 1200f6388a9602e0248171b1a6cb75e073cb96b2 Mon Sep 17 00:00:00 2001
+From: Yaroslav Halchenko <debian@onerussian.com>
+Date: Sun, 21 Jan 2018 20:15:56 -0500
+Subject: [PATCH 1/4] BF: use tests.utils.CONFIG_DIR instead of hardcoded
+ "config" in fail2banclienttestcase
+
+Since otherwise cannot provide custom path to the config via env var
+and thus cannot test in a build directory which is out of source
+---
+ fail2ban/tests/fail2banclienttestcase.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fail2ban/tests/fail2banclienttestcase.py b/fail2ban/tests/fail2banclienttestcase.py
+index 1e2d1b33..65653a8e 100644
+--- a/fail2ban/tests/fail2banclienttestcase.py
+++ b/fail2ban/tests/fail2banclienttestcase.py
+@@ -44,13 +44,13 @@ from ..server import server
+ from ..server.mytime import MyTime
+ from ..server.utils import Utils
+ from .utils import LogCaptureTestCase, logSys as DefLogSys, with_tmpdir, shutil, logging
+from .utils import CONFIG_DIR as STOCK_CONF_DIR
+ 
+ from ..helpers import getLogger
+ 
+ # Gets the instance of the logger.
+ logSys = getLogger(__name__)
+ 
+-STOCK_CONF_DIR = "config"
+ STOCK = exists(pjoin(STOCK_CONF_DIR, 'fail2ban.conf'))
+ 
+ CLIENT = "fail2ban-client"
+-- 
+2.15.1
+
@@ -0,0 +1,28 @@
+From d1afbb566f0304487b5d578b4aacef8e647ee74b Mon Sep 17 00:00:00 2001
+From: Yaroslav Halchenko <debian@onerussian.com>
+Date: Sun, 21 Jan 2018 20:16:43 -0500
+Subject: [PATCH 2/4] ENH: verify that use_stock_cfg was not provided while
+ overriding it
+
+Just found this possibly confusing to outside programmer aspect
+so decided to make it more explicit
+---
+ fail2ban/tests/fail2banclienttestcase.py | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fail2ban/tests/fail2banclienttestcase.py b/fail2ban/tests/fail2banclienttestcase.py
+index 65653a8e..94790b04 100644
+--- a/fail2ban/tests/fail2banclienttestcase.py
+++ b/fail2ban/tests/fail2banclienttestcase.py
+@@ -153,6 +153,8 @@ def _start_params(tmp, use_stock=False, use_stock_cfg=None,
+ 			"""Filters list of 'files' to contain only directories (under dir)"""
+ 			return [f for f in files if isdir(pjoin(dir, f))]
+ 		shutil.copytree(STOCK_CONF_DIR, cfg, ignore=ig_dirs)
+		assert use_stock_cfg is None, \
+			"We are about to overload use_stock_cfg from the one provided %s" % repr(use_stock_cfg)
+ 		use_stock_cfg = ('action.d', 'filter.d')
+ 		# replace fail2ban params (database with memory):
+ 		r = re.compile(r'^dbfile\s*=')
+-- 
+2.15.1
+
@@ -0,0 +1,46 @@
+From 1618356ad52fbc79e4f7b4d0759ef05bec0ae7f1 Mon Sep 17 00:00:00 2001
+From: Yaroslav Halchenko <debian@onerussian.com>
+Date: Sun, 21 Jan 2018 21:05:32 -0500
+Subject: [PATCH 3/4] BF: look for system.journal also under system-state-logs
+ (i.e. /var/log)
+
+as it happens on Debian systems
+---
+ fail2ban/tests/filtertestcase.py | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/fail2ban/tests/filtertestcase.py b/fail2ban/tests/filtertestcase.py
+index 1803974b..b707beb5 100644
+--- a/fail2ban/tests/filtertestcase.py
+++ b/fail2ban/tests/filtertestcase.py
+@@ -1173,11 +1173,22 @@ def get_monitor_failures_journal_testcase(Filter_): # pragma: systemd no cover
+ 			super(MonitorJournalFailures, self).tearDown()
+ 
+ 		def _getRuntimeJournal(self):
+-			# retrieve current system journal path
+-			tmp = Utils.executeCmd('find "$(systemd-path system-runtime-logs)" -name system.journal', 
+-				timeout=10, shell=True, output=True);
+-			self.assertTrue(tmp)
+-			return str(tmp[1].decode('utf-8')).split('\n')[0]
+			"""Retrieve current system journal path
+
+			If none found, None will be returned
+			"""
+			# Depending on the system, it could be found under /run or /var/log (e.g. Debian)
+			# which are pointed by different systemd-path variables.  We will
+			# check one at at time until the first hit
+			for systemd_var in 'system-runtime-logs', 'system-state-logs':
+				tmp = Utils.executeCmd(
+					'find "$(systemd-path %s)" -name system.journal' % systemd_var,
+					timeout=10, shell=True, output=True
+				)
+				self.assertTrue(tmp)
+				out = str(tmp[1].decode('utf-8')).split('\n')[0]
+				if out:
+					return out
+ 
+ 		def testJournalFilesArg(self):
+ 			# retrieve current system journal path
+-- 
+2.15.1
+
@@ -0,0 +1,34 @@
+From 4d2fdd72e7463a9f6ed7ded9b58f81f4fd7688dc Mon Sep 17 00:00:00 2001
+From: Yaroslav Halchenko <debian@onerussian.com>
+Date: Sun, 21 Jan 2018 21:23:02 -0500
+Subject: [PATCH 4/4] BF: use build_*_2to3 if in _2to3
+
+On Debian systems py helpers first do python setup.py build
+so conversion should happen then.  Manual invocation of
+./fail2ban-2to3 is least preferred since modifies in place
+and would require additional special handling to monitor
+changed files etc
+---
+ setup.py | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/setup.py b/setup.py
+index 8da29268..850f748f 100755
+--- a/setup.py
+++ b/setup.py
+@@ -208,8 +208,10 @@ setup(
+ 	license = "GPL",
+ 	platforms = "Posix",
+ 	cmdclass = {
+-		'build_py': build_py, 'build_scripts': build_scripts, 
+-		'install_scripts': install_scripts_f2b, 'install': install_command_f2b
+		'build_py': build_py_2to3 if _2to3 else build_py,
+		'build_scripts': build_scripts_2to3 if _2to3 else build_scripts,
+		'install_scripts': install_scripts_f2b,
+		'install': install_command_f2b
+ 	},
+ 	scripts = [
+ 		'bin/fail2ban-client',
+-- 
+2.15.1
+
@@ -0,0 +1,11 @@
+--- a/files/debian-initd
+++ b/files/debian-initd
+@@ -28,7 +28,7 @@ NAME=fail2ban
+ 
+ # fail2ban-client is not a daemon itself but starts a daemon and
+ # loads its with configuration
+-DAEMON=/usr/local/bin/$NAME-client
+DAEMON=/usr/bin/$NAME-client
+ SCRIPTNAME=/etc/init.d/$NAME
+ 
+ # Ad-hoc way to parse out socket file name
@@ -0,0 +1,26 @@
+From: Yaroslav Halchenko <debian@onerussian.com>
+Date: Fri, 8 Feb 2008 00:40:57 -0500
+Subject: tune ups in upstream manpages to direct users to use reportbug
+
+--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
+@@ -437,7 +437,7 @@ the action <ACT> for <JAIL>
+ .SH FILES
+ \fI/etc/fail2ban/*\fR
+ .SH "REPORTING BUGS"
+-Report bugs to https://github.com/fail2ban/fail2ban/issues
+Report bugs via Debian bug tracking system \fIhttp://www.debian.org/Bugs/\fR .
+ .SH COPYRIGHT
+ Copyright \(co 2004\-2008 Cyril Jaquier, 2008\- Fail2Ban Contributors
+ .br
+--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
+@@ -69,7 +69,7 @@ display this help message
+ \fB\-V\fR, \fB\-\-version\fR
+ print the version
+ .SH "REPORTING BUGS"
+-Report bugs to https://github.com/fail2ban/fail2ban/issues
+Report bugs via Debian bug tracking system \fIhttp://www.debian.org/Bugs/\fR .
+ .SH COPYRIGHT
+ Copyright \(co 2004\-2008 Cyril Jaquier, 2008\- Fail2Ban Contributors
+ .br
@@ -0,0 +1,22 @@
+--- a/fail2ban/tests/config/filter.d/zzz-generic-example.conf
+++ b/fail2ban/tests/config/filter.d/zzz-generic-example.conf
+@@ -8,7 +8,7 @@
+ # Read common prefixes. If any customizations available -- read them from
+ # common.local.  common.conf is a symlink to the original common.conf and
+ # should be copied (dereferenced) during installation
+-before = ../../../../config/filter.d/common.conf
+before = ../../../../../../../config/filter.d/common.conf
+ 
+ [Definition]
+ 
+--- a/fail2ban/tests/config/filter.d/zzz-sshd-obsolete-multiline.conf
+++ b/fail2ban/tests/config/filter.d/zzz-sshd-obsolete-multiline.conf
+@@ -5,7 +5,7 @@
+ 
+ # Read common prefixes. If any customizations available -- read them from
+ # common.local
+-before = ../../../../config/filter.d/common.conf
+before = ../../../../../../../config/filter.d/common.conf
+ 
+ [DEFAULT]
+ 
@@ -0,0 +1 @@
+neurodebian_use_python2
@@ -0,0 +1,62 @@
+--- a/debian/control
+++ b/debian/control
+@@ -5,9 +5,10 @@ Maintainer: Yaroslav Halchenko <debian@o
+ Build-Depends:
+  debhelper (>= 9)
+  , debhelper (>= 9.20160709) | dh-systemd
+- , python3
+- , python3-pyinotify
+ , python
+ , python-pyinotify
+  , sqlite3
+ , dh-python
+ Homepage: http://www.fail2ban.org
+ Vcs-Git: git://github.com/fail2ban/fail2ban.git -b debian
+ Vcs-Browser: http://github.com/fail2ban/fail2ban
+@@ -16,8 +17,8 @@ Standards-Version: 4.1.3
+ 
+ Package: fail2ban
+ Architecture: all
+-Depends: ${python3:Depends}, ${misc:Depends}, lsb-base (>=2.0-7)
+-Recommends: python, iptables, whois, python3-pyinotify, python3-systemd
+Depends: ${python:Depends}, ${misc:Depends}, lsb-base (>=2.0-7)
+Recommends: python, iptables, whois, python-pyinotify
+ Suggests: mailx, system-log-daemon, monit, sqlite3
+ Description: ban hosts that cause multiple authentication errors
+  Fail2ban monitors log files (e.g. /var/log/auth.log,
+@@ -39,5 +40,5 @@ Description: ban hosts that cause multip
+   - whois -- used by a number of *mail-whois* actions to send notification
+     emails with whois information about attacker hosts. Unless you will use
+     those you don't need whois
+-  - python3-pyinotify -- unless you monitor services logs via systemd, you
+  - python-pyinotify -- unless you monitor services logs via systemd, you
+     need pyinotify for efficient monitoring for log files changes
+--- a/debian/rules
+++ b/debian/rules
+@@ -9,13 +9,13 @@
+ # Uncomment this to turn on verbose mode.
+ export DH_VERBOSE=1
+ 
+-export PYBUILD_DISABLE_python2=1
+export PYBUILD_DISABLE_python3=1
+ 
+ %:
+-	dh $@ --with python3,systemd --buildsystem pybuild
+	dh $@ --with python2 --buildsystem pybuild
+ 
+ DESTDIR=$(CURDIR)/debian/fail2ban
+-PYVERSION=$(shell py3versions -dv)
+PYVERSION=$(shell pyversions -dv)
+ 
+ override_dh_clean:
+ 	rm -rf fail2ban.egg-info
+@@ -40,7 +40,8 @@ override_dh_install:
+ 	: # Install bash completion
+ 	install -d $(DESTDIR)/etc/bash_completion.d
+ 	install -m 644 files/bash-completion $(DESTDIR)/etc/bash_completion.d/fail2ban
+-	: # Install systemd files
+	: # Install systemd files, even in backport version just in case even though
+	: # other systemd preparation activities are not carried out
+ 	install -d $(DESTDIR)/lib/systemd/system
+ 	install -d $(DESTDIR)/usr/lib/tmpfiles.d
+ 	install -m 644 build/fail2ban.service $(DESTDIR)/lib/systemd/system
@@ -0,0 +1 @@
+neurodebian_use_python2
@@ -0,0 +1,8 @@
+deb_path_to_common
+deb_init_paths
+deb_manpages_reportbug
+0001-BF-use-tests.utils.CONFIG_DIR-instead-of-hardcoded-c.patch
+0002-ENH-verify-that-use_stock_cfg-was-not-provided-while.patch
+0003-BF-look-for-system.journal-also-under-system-state-l.patch
+0004-BF-use-build_-_2to3-if-in-_2to3.patch
+0001-BF-RF-test-for-being-a-root-to-check-if-actually-can.patch
@@ -0,0 +1 @@
+neurodebian_use_python2
@@ -0,0 +1 @@
+neurodebian_use_python2
@@ -0,0 +1 @@
+neurodebian_use_python2
@@ -0,0 +1,98 @@
+#! /bin/sh
+# postinst script for fail2ban
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+#
+preversion=$2
+
+case "$1" in
+    configure)
+       # To fix the bug in generated by previous version files permissions
+       # also closes #352053
+
+       LOG=/var/log/fail2ban.log
+       touch $LOG
+       chown root:adm ${LOG}*
+       chmod 640 ${LOG}*
+        
+       # Note regarding changed configuration file
+       # Note regarding changed configuration file
+		if [ ! -z $preversion ]; then
+			if dpkg --compare-versions $preversion lt 0.7.1-1; then
+			cat <<EOF
+WARNING!
+  
+  Fail2ban 0.7 is a complete rewrite of the 0.6 version, and if you
+  customized any of provided configuration or startup files
+  (/etc/default/fail2ban, /etc/fail2ban.conf, /etc/init.d/fail2ban), please
+  read relevant entry in /usr/share/doc/fail2ban/NEWS.Debian.gz.
+  
+EOF
+			fi
+			if dpkg --compare-versions $preversion lt 0.5.4-5.14; then
+			cat <<EOF
+WARNING!
+
+ Configuration file /etc/fail2ban.conf, failregex configuration
+ parameter specificly, were changed in 0.5.4-5 to close reported
+ security breach, and in 0.5.4-5.14 to close few other bugs.
+
+updating from <0.5.4-5
+ Unless configuration file (or corresponding failregex'es) gets updated,
+ security breach is not closed and corresponding warning will be reported
+ by the fail2ban (in the log files).
+
+updating from <0.5.4-5.14
+ Bugs #329163, #331695 dealing with changed iptables rules
+ outside of fail2ban were fixed in 0.5.4-5.14, and require upgrade of the
+ configuration file (fwcheck option was introduced) to take full
+ advantage of the problem solution (otherwise some problems might
+ persist)
+
+ Please review the configuration file and make appropriate changes.
+ENJOY!
+
+EOF
+			fi
+		fi
+		;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+if dpkg-maintscript-helper supports mv_conffile 2>/dev/null; then
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/action.d/firewall-cmd-direct-new.conf /etc/fail2ban/action.d/firewallcmd-new.conf 0.8.13-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/lighttpd-fastcgi.conf /etc/fail2ban/filter.d/suhosin.conf 0.8.13-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/sasl.conf /etc/fail2ban/filter.d/postfix-sasl.conf 0.8.13-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/couriersmtp.conf /etc/fail2ban/filter.d/courier-smtp.conf 0.9.0-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/courierlogin.conf /etc/fail2ban/filter.d/courier-auth.conf 0.9.0-1~ -- "$@"
+fi
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
+
+
@@ -0,0 +1,52 @@
+#! /bin/sh
+# postrm script for fail2ban
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see /usr/doc/packaging-manual/
+
+
+case "$1" in
+       purge|disappear)
+       				
+		# Remove configuration
+                rm -f /etc/fail2ban.conf
+		
+		# Remove logs
+		rm -f /var/log/fail2ban*
+		
+		# Remove sqlite db
+		rm -f /var/lib/fail2ban/fail2ban.sqlite3
+		;;
+       remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
+		# nothing
+		# We may not delete the user fail2ban, as there may be
+		# files owned by it in /var/log/ and /etc/.
+        	;;
+esac
+
+if dpkg-maintscript-helper supports mv_conffile 2>/dev/null; then
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/action.d/firewall-cmd-direct-new.conf /etc/fail2ban/action.d/firewallcmd-new.conf 0.8.13-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/lighttpd-fastcgi.conf /etc/fail2ban/filter.d/suhosin.conf 0.8.13-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/sasl.conf /etc/fail2ban/filter.d/postfix-sasl.conf 0.8.13-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/couriersmtp.conf /etc/fail2ban/filter.d/courier-smtp.conf 0.9.0-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/courierlogin.conf /etc/fail2ban/filter.d/courier-auth.conf 0.9.0-1~ -- "$@"
+fi
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+set -e
+
+if dpkg-maintscript-helper supports mv_conffile 2>/dev/null; then
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/action.d/firewall-cmd-direct-new.conf /etc/fail2ban/action.d/firewallcmd-new.conf 0.8.13-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/lighttpd-fastcgi.conf /etc/fail2ban/filter.d/suhosin.conf 0.8.13-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/sasl.conf /etc/fail2ban/filter.d/postfix-sasl.conf 0.8.13-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/couriersmtp.conf /etc/fail2ban/filter.d/courier-smtp.conf 0.9.0-1~ -- "$@"
+    dpkg-maintscript-helper mv_conffile /etc/fail2ban/filter.d/courierlogin.conf /etc/fail2ban/filter.d/courier-auth.conf 0.9.0-1~ -- "$@"
+fi
+
+#DEBHELPER#
+
+exit 0
@@ -0,0 +1,70 @@
+#!/usr/bin/make -f
+# -*- makefile -*-
+# Sample debian/rules that uses debhelper.
+# This file was originally written by Joey Hess and Craig Small.
+# As a special exception, when this file is copied by dh-make into a
+# dh-make output file, you may use that output file without restriction.
+# This special exception was added by Craig Small in version 0.37 of dh-make.
+
+# Uncomment this to turn on verbose mode.
+export DH_VERBOSE=1
+
+export PYBUILD_DISABLE_python2=1
+
+%:
+	dh $@ --with python3,systemd --buildsystem pybuild
+
+DESTDIR=$(CURDIR)/debian/fail2ban
+PYVERSION=$(shell py3versions -dv)
+
+override_dh_clean:
+	rm -rf fail2ban.egg-info
+	-rm debian/fail2ban.init
+	dh_clean
+	: # auto generated
+	-rm bin/fail2ban-python
+
+override_dh_install:
+	rm -f $(DESTDIR)/usr/share/doc/fail2ban/README.Solaris
+	rm -f $(DESTDIR)/etc/fail2ban/paths-fedora.conf
+	rm -f $(DESTDIR)/etc/fail2ban/paths-freebsd.conf
+	rm -f $(DESTDIR)/etc/fail2ban/paths-osx.conf
+	: # Remove explicitely created /var/run/fail2ban
+	: # just to please lintian since init file will
+	: # take care about it anyways
+	rm -rf $(DESTDIR)/var/run/ $(DESTDIR)/run/
+	: # Install monit configuration
+	install -d $(DESTDIR)/etc/monit/conf-available
+	install -d $(DESTDIR)/etc/monit/monitrc.d
+	install -m 644 files/monit/fail2ban $(DESTDIR)/etc/monit/monitrc.d/fail2ban
+	: # Install bash completion
+	install -d $(DESTDIR)/etc/bash_completion.d
+	install -m 644 files/bash-completion $(DESTDIR)/etc/bash_completion.d/fail2ban
+	: # Install systemd files
+	install -d $(DESTDIR)/lib/systemd/system
+	install -d $(DESTDIR)/usr/lib/tmpfiles.d
+	install -m 644 build/fail2ban.service $(DESTDIR)/lib/systemd/system
+	install -m 644 files/fail2ban-tmpfiles.conf $(DESTDIR)/usr/lib/tmpfiles.d
+	install -d $(DESTDIR)/lib/systemd/system
+	: # Install default jail enabler
+	install -m 644 debian/debian-files/jail.d_defaults-debian.conf $(DESTDIR)/etc/fail2ban/jail.d/defaults-debian.conf
+	dh_install
+
+override_dh_auto_test:
+ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
+	cd build && \
+	 LC_ALL=C.UTF-8 \
+	 FAIL2BAN_CONFIG_DIR="$(CURDIR)/config" \
+	 PYTHONPATH="$(CURDIR)/.pybuild/pythonX.Y_$(PYVERSION)/build/" \
+	  scripts-*/fail2ban-testcases --no-network --verbosity=2
+endif
+
+override_dh_installexamples:
+	dh_installexamples files/ipmasq-* files/nagios files/cacti
+
+override_dh_installinit:
+	cp -p files/debian-initd debian/fail2ban.init
+	dh_installinit -- defaults 99
+
+override_dh_installman:
+	dh_installman man/*.[15]
@@ -0,0 +1 @@
+3.0 (quilt)
@@ -0,0 +1,6 @@
+# watch control file for uscan
+# Run the "uscan" command to check for upstream updates and more.
+# Site		Directory		Pattern			Version	Script
+version=3
+opts="filenamemangle=s/.*\/(.*)/fail2ban-$1\.tar\.gz/" \
+ http://github.com/fail2ban/fail2ban/tags .*archive/(\d[\d\.]+).tar.gz