Version changes/man pages for the release

changelog and thanks for the preceding fix
Fix sieve filter to use correct option
2014-08-19 16:23:33 -04:00 · 2014-07-28 12:46:52 -04:00 · 2014-07-28 12:44:42 -04:00 · 2014-04-24 12:24:57 -04:00 · 2014-04-18 23:00:46 +01:00 · 2014-04-18 10:11:57 -04:00
548 changed files with 13033 additions and 45076 deletions
@@ -1,12 +1,4 @@

 [run]
 branch = True
-source =
-    config
-    fail2ban
-
-[report]
-exclude_lines =
-    pragma: ?no ?cover
-    pragma: ?${F2B_PY}.x no ?cover
-    pragma: ?systemd no ?cover
+omit = /usr*
@@ -1 +0,0 @@
-ChangeLog linguist-language=Markdown
@@ -1,70 +0,0 @@
---
-name: Bug report
-about: Report a bug within the fail2ban engines (not filters or jails)
-title: '[BR]: '
-labels: bug
-assignees: ''
-
---
-
-<!--
-  - Before reporting, please make sure to search the open and closed issues for any reports in the past.
-  - Use this issue template to report a bug in the fail2ban engine (not in a filter or jail).
-  - If you want to request a feature or a new filter, please use "Feature request" or "Filter request" instead.
-  - If you have rather some question, please open or join to some discussion.
-
-  We will be very grateful, if your problem was described as completely as possible,
-  enclosing excerpts from logs (if possible within DEBUG mode, if no errors evident
-  within INFO mode), and configuration in particular of effected relevant settings
-  (e.g., with ` fail2ban-client -d | grep 'affected-jail-name' ` for a particular
-  jail troubleshooting).
-  Thank you in advance for the details, because such issues like "It does not work" 
-  alone could not help to resolve anything!
-  Thanks! 
-  (you can remove this paragraph and other comments upon reading)
-->
-
-### Environment:
-
-<!--
-  Fill out and check (`[x]`) the boxes which apply. If your Fail2Ban version is outdated, 
-  and you can't verify that the issue persists in the recent release, better seek support 
-  from the distribution you obtained Fail2Ban from
-->
-
- Fail2Ban version <!-- including any possible distribution suffixes --> : 
- OS, including release name/version : 
- [ ] Fail2Ban installed via OS/distribution mechanisms
- [ ] You have not applied any additional foreign patches to the codebase
- [ ] Some customizations were done to the configuration (provide details below is so)
-
-### The issue:
-
-<!-- summary here -->
-
-#### Steps to reproduce
-
-#### Expected behavior
-
-#### Observed behavior
-
-#### Any additional information
-
-
-### Configuration, dump and another helpful excerpts
-
-#### Any customizations done to /etc/fail2ban/ configuration
-<!-- put your configuration excerpts between next 2 lines -->
-```
-```
-
-#### Relevant parts of /var/log/fail2ban.log file:
-<!-- preferably obtained while running fail2ban with `loglevel = 4` -->
-<!-- put your log excerpt between next 2 lines -->
-```
-```
-
-#### Relevant lines from monitored log files:
-<!-- put your log excerpt between next 2 lines -->
-```
-```
@@ -1,35 +0,0 @@
---
-name: Feature request
-about: Suggest an idea or an enhancement for this project
-title: '[RFE]: '
-labels: enhancement
-assignees: ''
-
---
-
-<!--
-  - Before requesting, please make sure to search the open and closed issues for any requests in the past.
-  - Use this issue template to request a feature in the fail2ban engine (not a new filter or jail).
-  - If you want to request a new filter or failregex, please use "Filter request" instead.
-  - If you have rather some question, please open or join to some discussion.
-->
-
-#### Feature request type
-<!--
-  Please provide a summary description of the feature request.
-->
-
-#### Description
-<!--
-  Please describe the feature in more detail.
-->
-
-#### Considered alternatives
-<!--
-  A clear and concise description of any alternative solutions or features you've considered.
-->
-
-#### Any additional information
-<!--
-  Add any other context or screenshots about the feature request here.
-->
@@ -1,59 +0,0 @@
---
-name: Filter request
-about: Request a new jail or filter to be supported or existing filter extended with new failregex
-title: '[FR]: '
-labels: filter-request
-assignees: ''
-
---
-
-<!--
-  - Before requesting, please make sure to search the open and closed issues for any requests in the past.
-  - Sometimes failregex have been already requested before but are not implemented yet due to various reasons.
-  - If there are no hits for your concerns, please proceed otherwise add a comment to the related issue (also if it is closed).
-  - If you want to request a new feature, please use "Feature request" instead.
-  - If you have rather some question, please open or join to some discussion.
-->
-
-### Environment:
-
-<!--
-  Fill out and check (`[x]`) the boxes which apply.
-->
-
- Fail2Ban version <!-- including any possible distribution suffixes --> : 
- OS, including release name/version : 
-
-#### Service, project or product which log or journal should be monitored
-
- Name of filter or jail in Fail2Ban (if already exists) : 
- Service, project or product name, including release name/version : 
- Repository or URL (if known) : 
- Service type : 
- Ports and protocols the service is listening : 
-
-#### Log or journal information
-<!-- Delete unrelated group -->
-
-<!-- Log file -->
-
- Log file name(s) : 
-
-<!-- Systemd journal -->
-
- Journal identifier or unit name : 
-
-#### Any additional information
-
-
-### Relevant lines from monitored log files:
-
-#### failures in sense of fail2ban filter (fail2ban must match):
-<!-- put your log excerpt between next 2 lines -->
-```
-```
-
-#### legitimate messages (fail2ban should not consider as failures):
-<!-- put your log excerpt between next 2 lines -->
-```
-```
@@ -1,12 +0,0 @@
-Before submitting your PR, please review the following checklist:
-
- [ ] **CHOOSE CORRECT BRANCH**: if filing a bugfix/enhancement
-      against certain release version, choose `0.9`, `0.10` or `0.11` branch,
-      for dev-edition use `master` branch
- [ ] **CONSIDER adding a unit test** if your PR resolves an issue
- [ ] **LIST ISSUES** this PR resolves
- [ ] **MAKE SURE** this PR doesn't break existing tests
- [ ] **KEEP PR small** so it could be easily reviewed.
- [ ] **AVOID** making unnecessary stylistic changes in unrelated code
- [ ] **ACCOMPANY** each new `failregex` for filter `X` with sample log lines
-      within `fail2ban/tests/files/logs/X` file
@@ -1,98 +0,0 @@
-name: CI
-
-# Controls when the action will run. Triggers the workflow on push or pull request
-# events but only for the master branch
-on:
-  push:
-    paths-ignore:
-    - 'doc/**'
-    - 'files/**'
-    - 'man/**'
-  pull_request:
-    paths-ignore:
-    - 'doc/**'
-    - 'files/**'
-    - 'man/**'
-
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
-jobs:
-  # This workflow contains a single job called "build"
-  build:
-    # The type of runner that the job will run on
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        python-version: [2.7, 3.5, 3.6, 3.7, 3.8, 3.9, '3.10', '3.11.0-alpha.1', pypy2, pypy3]
-      fail-fast: false
-    # Steps represent a sequence of tasks that will be executed as part of the job
-    steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
-
-      - name: Set up Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      - name: Grant systemd-journal access
-        run: sudo usermod -a -G systemd-journal "$USER" || echo 'no systemd-journal access'
-
-      - name: Python version
-        run: |
-          F2B_PY=$(python -c "import sys; print(sys.version)")
-          echo "Python: ${{ matrix.python-version }} -- ${F2B_PY/$'\n'/ }"
-          F2B_PYV=$(echo "${F2B_PY}" | grep -oP '^\d+(?:\.\d+)')
-          F2B_PY=${F2B_PY:0:1}
-          echo "Set F2B_PY=$F2B_PY, F2B_PYV=$F2B_PYV"
-          echo "F2B_PY=$F2B_PY" >> $GITHUB_ENV
-          echo "F2B_PYV=$F2B_PYV" >> $GITHUB_ENV
-          # for GHA we need to monitor all journals, since it cannot be found using SYSTEM_ONLY(4):
-          echo "F2B_SYSTEMD_DEFAULT_FLAGS=0" >> $GITHUB_ENV
-
-      - name: Install dependencies
-        run: |
-          if [[ "$F2B_PY" = 3 ]]; then python -m pip install --upgrade pip || echo "can't upgrade pip"; fi
-          if [[ "$F2B_PY" = 3 ]] && ! command -v 2to3x -v 2to3 > /dev/null; then
-            #pip install 2to3
-            sudo apt-get -y install 2to3
-          fi
-          #sudo apt-get -y install python${F2B_PY/2/}-pyinotify || echo 'inotify not available'
-          python -m pip install pyinotify || echo 'inotify not available'
-          #sudo apt-get -y install python${F2B_PY/2/}-systemd || echo 'systemd not available'
-          sudo apt-get -y install libsystemd-dev || echo 'systemd dependencies seems to be unavailable'
-          python -m pip install systemd-python || echo 'systemd not available'
-
-      - name: Before scripts
-        run: |
-          cd "$GITHUB_WORKSPACE"
-          # Manually execute 2to3 for now
-          if [[ "$F2B_PY" = 3 ]]; then echo "2to3 ..." && ./fail2ban-2to3; fi
-          _debug() { echo -n "$1 "; err=$("${@:2}" 2>&1) && echo 'OK' || echo -e "FAIL\n$err"; }
-          # (debug) output current preferred encoding:
-          _debug 'Encodings:' python -c 'import locale, sys; from fail2ban.helpers import PREFER_ENC; print(PREFER_ENC, locale.getpreferredencoding(), (sys.stdout and sys.stdout.encoding))'
-          # (debug) backend availabilities:
-          echo 'Backends:'
-          _debug '- systemd:' python -c 'from fail2ban.server.filtersystemd import FilterSystemd'
-          #_debug '- systemd (root): ' sudo python -c 'from fail2ban.server.filtersystemd import FilterSystemd'
-          _debug '- pyinotify:' python -c 'from fail2ban.server.filterpyinotify import FilterPyinotify'
-
-      - name: Test suite
-        run: |
-          if [[ "$F2B_PY" = 2 ]]; then
-            python setup.py test
-          elif dpkg --compare-versions "$F2B_PYV" lt 3.10; then 
-            python bin/fail2ban-testcases --verbosity=2
-          else
-            echo "Skip systemd backend since systemd-python module must be fixed for python >= v.3.10 in GHA ..."
-            python bin/fail2ban-testcases --verbosity=2 -i "[sS]ystemd|[jJ]ournal"
-          fi
-
-      #- name: Test suite (debug some systemd tests only)
-         #run: python bin/fail2ban-testcases --verbosity=2 "[sS]ystemd|[jJ]ournal"
-         #run: python bin/fail2ban-testcases --verbosity=2 -l 5 "test_WrongChar"
-
-      - name: Build
-        run: python setup.py build
-
-      #- name: Test initd scripts
-      #  run: shellcheck -s bash -e SC1090,SC1091 files/debian-initd
@@ -6,7 +6,3 @@ htmlcov
 .coverage
 *.orig
 *.rej
-*.bak
-__pycache__
-.vagrant/
-.idea/
@@ -1,5 +0,0 @@
-Lee Clemens <java@leeclemens.net>
-Serg G. Brester <info@sebres.de>
-Serg G. Brester <serg.brester@sebres.de>
-Serg G. Brester <sergey.brester@W7-DEHBG0189.wincor-nixdorf.com>
-Viktor Szépe <viktor@szepe.net>
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<?eclipse-pydev version="1.0"?>
+
+<pydev_project>
+<pydev_property name="org.python.pydev.PYTHON_PROJECT_VERSION">python 2.3</pydev_property>
+<pydev_pathproperty name="org.python.pydev.PROJECT_SOURCE_PATH">
+<path>/fail2ban-0.8/client</path>
+<path>/fail2ban-0.8/server</path>
+<path>/fail2ban-0.8/testcases</path>
+<path>/fail2ban-0.8</path>
+</pydev_pathproperty>
+</pydev_project>
@@ -1,81 +1,20 @@
 # vim ft=yaml
 # travis-ci.org definition for Fail2Ban build
-# https://travis-ci.org/fail2ban/fail2ban/
-
-#os: linux
-
 language: python
-dist: xenial
-
-matrix:
-  fast_finish: true
-  include:
-  - python: 2.7
-  #- python: pypy
-  - python:  3.4
-  - python:  3.5
-  - python:  3.6
-  - python:  3.7
-  - python:  3.8
-  - python:  3.9-dev
-  - python:  pypy3.5
+python:
+  - "2.6"
+  - "2.7"
+env:
+  - LOG_LEVEL=error
+  - LOG_LEVEL=heavydebug
 before_install:
-  - echo "running under $TRAVIS_PYTHON_VERSION"
-  - if [[ $TRAVIS_PYTHON_VERSION == 2* || $TRAVIS_PYTHON_VERSION == pypy* && $TRAVIS_PYTHON_VERSION != pypy3* ]]; then export F2B_PY=2; fi
-  - if [[ $TRAVIS_PYTHON_VERSION == 3* || $TRAVIS_PYTHON_VERSION == pypy3* ]]; then export F2B_PY=3; fi
-  - echo "Set F2B_PY=$F2B_PY"
-  - travis_retry sudo apt-get update -qq
-  # Set this so sudo executes the correct python binary
-  #   Anything not using sudo will already have the correct environment
-  - export VENV_BIN="$VIRTUAL_ENV/bin" && echo "VENV_BIN set to $VENV_BIN"
+  - sudo apt-get update -qq
 install:
-  # Install Python packages / dependencies
-  #   coverage
-  - travis_retry pip install coverage
-  #   coveralls (note coveralls doesn't support 2.6 now):
-  - if [[ $TRAVIS_PYTHON_VERSION != 2.6* ]]; then F2B_COV=1; else F2B_COV=0; fi
-  - if [[ "$F2B_COV" = 1 ]]; then travis_retry pip install coveralls; fi
-  #   codecov:
-  - travis_retry pip install codecov
-  #   dnspython or dnspython3
-  - if [[ "$F2B_PY" = 2 ]]; then travis_retry pip install dnspython || echo 'not installed'; fi
-  - if [[ "$F2B_PY" = 3 ]]; then travis_retry pip install dnspython3 || echo 'not installed'; fi
-  #   python systemd bindings:
-  - if [[ "$F2B_PY" = 2 ]]; then travis_retry sudo apt-get install -qq python-systemd || echo 'not installed'; fi
-  - if [[ "$F2B_PY" = 3 ]]; then travis_retry sudo apt-get install -qq python3-systemd || echo 'not installed'; fi
-  #   gamin - install manually (not in PyPI) - travis-ci system Python is 2.7
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then (travis_retry sudo apt-get install -qq python-gamin && cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/) || echo 'not installed'; fi
-  #   pyinotify
-  - travis_retry pip install pyinotify || echo 'not installed'
-  # Install helper tools
-  - sudo apt-get install shellcheck
-before_script:
-  # Manually execute 2to3 for now
-  - if [[ "$F2B_PY" = 3 ]]; then ./fail2ban-2to3; fi
-  # (debug) output current preferred encoding:
-  - python -c 'import locale, sys; from fail2ban.helpers import PREFER_ENC; print(PREFER_ENC, locale.getpreferredencoding(), (sys.stdout and sys.stdout.encoding))'
+  - pip install pyinotify
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get install -qq python-gamin; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then cd ..; pip install -q coveralls; cd -; fi
 script:
-  # Keep the legacy setup.py test approach of checking coverage for python2
-  - if [[ "$F2B_PY" = 2 ]]; then coverage run setup.py test; fi
-  # Coverage doesn't pick up setup.py test with python3, so run it directly (with same verbosity as from setup)
-  - if [[ "$F2B_PY" = 3 ]]; then coverage run bin/fail2ban-testcases --verbosity=2; fi
-  # Use $VENV_BIN (not python) or else sudo will always run the system's python (2.7)
-  - sudo $VENV_BIN/pip install .
-  # Doc files should get installed on Travis under Linux (some builds/python's seem to use another path segment)
-  - test -e /usr/share/doc/fail2ban/FILTERS && echo 'found' || echo 'not found'
-  # Test initd script
-  - shellcheck -s bash -e SC1090,SC1091 files/debian-initd
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then export PYTHONPATH="$PYTHONPATH:/usr/share/pyshared:/usr/lib/pyshared/python2.7"; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]] && [ $LOG_LEVEL == heavydebug ]; then coverage run --rcfile=.travis_coveragerc fail2ban-testcases -l $LOG_LEVEL; else python ./fail2ban-testcases -l $LOG_LEVEL; fi
 after_success:
-  - if [[ "$F2B_COV" = 1 ]]; then coveralls; fi
-  - codecov
-
-# Might be worth looking into
-#notifications:
-#  email: true
-#  irc:
-#    channels: "irc.freenode.org#fail2ban"
-#    template:
-#      - "%{repository}@%{branch}: %{message} (%{build_url})"
-#    on_success: change
-#    on_failure: change
-#    skip_join: true
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]] && [ $LOG_LEVEL == heavydebug ]; then coveralls; fi
@@ -0,0 +1,6 @@
+
+[run]
+branch = True
+omit =
+    /usr/*
+    /home/travis/virtualenv/*
@@ -1,27 +0,0 @@
-Guidelines on Fail2Ban contributions
-====================================
-
-### You found a severe security vulnerability in Fail2Ban?
-email details to fail2ban-vulnerabilities at lists dot sourceforge dot net .
-
-### You need some new features, you found bugs?
-visit [Issues](https://github.com/fail2ban/fail2ban/issues)
-and if your issue is not yet known -- file a bug report. See
-[Fail2Ban wiki](http://www.fail2ban.org/wiki/index.php/HOWTO_Seek_Help)
-on further instructions.
-
-### You would like to troubleshoot or discuss?
-join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
-
-### You would like to contribute (new filters/actions/code/documentation)?
-send a [pull request](https://github.com/fail2ban/fail2ban/pulls)
-
-Pull requests guidelines
-========================
-
- If there is an issue on github to be closed by the pull request, include
-  ```Closes #ISSUE``` (where ISSUE is issue's number)
-  
- Add a brief summary of the change to the ChangeLog file into a corresponding
-  section out of Fixes, New Features or Enhancements (improvements to existing
-  features)
@@ -1,4 +1,4 @@
-..                       __      _ _ ___ _
+                         __      _ _ ___ _
                        / _|__ _(_) |_  ) |__  __ _ _ _
                       |  _/ _` | | |/ /| '_ \/ _` | ' \
                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
@@ -25,7 +25,6 @@ Pull Requests
 =============

 When submitting pull requests on GitHub we ask you to:
-
 * Clearly describe the problem you're solving;
 * Don't introduce regressions that will make it hard for systems administrators
  to update;
@@ -40,9 +39,9 @@ If you are developing filters see the FILTERS file for documentation.
 Code Testing
 ============

-Existing tests can be run by executing `bin/fail2ban-testcases`. It has
-options like --log-level that will probably be useful.  Run
-`bin/fail2ban-testcases --help` for the full list of options.
+Existing tests can be run by executing `fail2ban-testcases`. This has options
+like --log-level that will probably be useful. `fail2ban-testcases --help` for
+full options.

 Test cases should cover all usual cases, all exception cases and all inside
 / outside boundary conditions.
@@ -53,49 +52,34 @@ for more details.

 Install the package python-coverage to visualise your test coverage. Run the
 following (note: on Debian-based systems, the script is called
-`python-coverage`)::
+`python-coverage`):

-  coverage run bin/fail2ban-testcases
-  coverage report
+coverage run fail2ban-testcases
+coverage html

-Optionally:
-  coverage html
-
-And then browse htmlcov/index.html and see how much coverage your test cases
+Then look at htmlcov/index.html and see how much coverage your test cases
 exert over the code base. Full coverage is a good thing however it may not be
 complete. Try to ensure tests cover as many independent paths through the
 code.

-Manual Execution. To run in a development environment do::
+Manual Execution. To run in a development environment do:

-  ./fail2ban-client -c config/ -s /tmp/f2b.sock -i start
+./fail2ban-client -c config/ -s /tmp/f2b.sock -i start

-some quick commands::
+some quick commands:

-  status
-  add test pyinotify
-  status test
-  set test addaction iptables
-  set test actionban iptables echo <ip> <cidr> >> /tmp/ban
-  set test actionunban iptables echo <ip> <cidr> >> /tmp/unban
-  get test actionban iptables
-  get test actionunban iptables
-  set test banip 192.168.2.2
-  status test
+status
+add test pyinotify
+status test
+set test addaction iptables
+set test actionban iptables echo <ip> <cidr> >> /tmp/ban
+set test actionunban iptables echo <ip> <cidr> >> /tmp/unban
+get test actionban iptables
+get test actionunban iptables
+set test banip 192.168.2.2
+status test


-Testing with vagrant
--------------------
-
-Testing can now be done inside a vagrant VM.  Vagrantfile provided in
-source code repository established two VMs:
-
- VM "secure" which can be used for testing fail2ban code.
- VM "attacker" which can be used to perform attack against our "secure" VM.
-
-Both VMs are sharing the 192.168.200/24 network. If you are using this network
-take a look into the Vagrantfile and change the IP.
-

 Coding Standards
 ================
@@ -120,15 +104,6 @@ older versions on python. For all other uses of "pragma: no cover" or
 "pragma: no branch" document the reason why its not covered. "I haven't written
 a test case" isn't a sufficient reason.

-pyflakes
--------
-
-pyflakes can be used to find unused imports, and unused, undefined and
-redefined variables. pyflakes should be run in any python code, including
-python based actions::
-
-  pyflakes bin/ config/ fail2ban/
-
 Documentation
 -------------

@@ -146,10 +121,10 @@ Git

 Use the following tags in your commit messages:

-* 'BF:' for bug fixes
-* 'DOC:' for documentation fixes
-* 'ENH:' for enhancements
-* 'TST:' for commits concerning tests only (thus not touching the main code-base)
+'BF:' for bug fixes
+'DOC:' for documentation fixes
+'ENH:' for enhancements
+'TST:' for commits concerning tests only (thus not touching the main code-base)

 Multiple tags could be joined with +, e.g. "BF+TST:".

@@ -262,16 +237,12 @@ FileContainer
    Keeps the position pointer


-ipdns.py
-~~~~~~~~
+dnsutils.py
+~~~~~~~~~~~

 DNSUtils

-  Utility class for DNS handling
-
-IPAddr
-
-  Object-class for IP address handling
+  Utility class for DNS and IP handling


 filter*.py
@@ -297,3 +268,158 @@ action.py

 Takes care about executing start/check/ban/unban/stop commands

+
+Releasing
+=========
+
+# Check distribution patches and see if they can be included
+
+  * https://apps.fedoraproject.org/packages/fail2ban/sources
+  * http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/
+  * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/
+  * https://build.opensuse.org/package/show?package=fail2ban&project=openSUSE%3AFactory
+  * http://sophie.zarb.org/sources/fail2ban (Mageia)
+  * https://trac.macports.org/browser/trunk/dports/security/fail2ban
+
+# Check distribution outstanding bugs
+
+  * https://github.com/fail2ban/fail2ban/issues?sort=updated&state=open
+  * http://bugs.debian.org/cgi-bin/pkgreport.cgi?dist=unstable;package=fail2ban
+  * https://bugs.launchpad.net/ubuntu/+source/fail2ban
+  * http://bugs.sabayon.org/buglist.cgi?quicksearch=net-analyzer%2Ffail2ban
+  * https://bugs.archlinux.org/?project=5&cat%5B%5D=33&string=fail2ban
+  * https://bugs.gentoo.org/buglist.cgi?query_format=advanced&short_desc=fail2ban&bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=IN_PROGRESS&short_desc_type=allwords
+  * https://bugzilla.redhat.com/buglist.cgi?query_format=advanced&bug_status=NEW&bug_status=ASSIGNED&component=fail2ban&classification=Red%20Hat&classification=Fedora
+  * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
+  * https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
+  * https://build.opensuse.org/package/requests/openSUSE:Factory/fail2ban
+
+# Make sure the tests pass
+
+  ./fail2ban-testcases-all
+
+# Ensure the version is correct
+
+  in:
+  * ./common/version.py
+  * top of ChangeLog
+  * README.md
+
+# Ensure the MANIFEST is complete
+
+Run:
+
+  python setup.py sdist
+
+Look for errors like:
+ 'testcases/files/logs/mysqld.log' not a regular file -- skipping
+
+Which indicates that testcases/files/logs/mysqld.log has been moved or is a directory
+
+  tar -C /tmp -jxf dist/fail2ban-0.8.14.tar.bz2
+
+# clean up current direcory
+
+  diff -rul --exclude \*.pyc . /tmp/fail2ban-0.8.14/
+
+  # Only differences should be files that you don't want distributed.
+
+# Ensure the tests work from the tarball
+
+  cd /tmp/fail2ban-0.8.14/ && ./fail2ban-testcases-all
+
+# Add/finalize the corresponding entry in the ChangeLog
+
+  To generate a list of committers use e.g.
+
+  git shortlog -sn 0.8.13.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
+
+  Ensure the top of the ChangeLog has the right version and current date.
+
+  Ensure the top entry of the ChangeLog has the right version and current date.
+
+# Update man pages
+
+  (cd man ; ./generate-man )
+  git commit -m 'DOC/ENH: update man pages for release' man/*
+
+# Prepare source and rpm binary distributions
+
+  python setup.py sdist
+  python setup.py bdist_rpm
+  python setup.py upload
+
+# Provide a release sample to distributors
+
+  * Arch Linux:
+            https://www.archlinux.org/packages/community/any/fail2ban/
+  * Debian: Yaroslav Halchenko <debian@onerussian.com>
+            http://packages.qa.debian.org/f/fail2ban.html
+  * FreeBSD: Christoph Theis theis@gmx.at>, Nick Hilliard <nick@foobar.org>
+            http://svnweb.freebsd.org/ports/head/security/py-fail2ban/Makefile?view=markup
+            http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
+  * Fedora: Axel Thimm <Axel.Thimm@atrpms.net>
+            https://apps.fedoraproject.org/packages/fail2ban
+            http://pkgs.fedoraproject.org/cgit/fail2ban.git
+            https://admin.fedoraproject.org/pkgdb/acls/bugs/fail2ban
+  * Gentoo: netmon@gentoo.org
+            http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/metadata.xml?view=markup
+            https://bugs.gentoo.org/buglist.cgi?quicksearch=fail2ban
+  * openSUSE: Stephan Kulow <coolo@suse.com>
+            https://build.opensuse.org/package/show/openSUSE:Factory/fail2ban
+  * Mac Ports: @Malbrouck on github (gh-49)
+            https://trac.macports.org/browser/trunk/dports/security/fail2ban/Portfile
+  * Mageia:
+            https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
+  An potentially to the fail2ban-users directory.
+
+# Wait for feedback from distributors
+
+# Prepare a release notice https://github.com/fail2ban/fail2ban/releases/new
+
+  Upload the source/binaries from the dist directory and tag the release using the URL
+
+# Upload source/binaries to sourceforge http://sourceforge.net/projects/fail2ban/
+
+# Run the following and update the wiki with output:
+  python -c 'import common.protocol; common.protocol.printWiki()'
+
+  page: http://www.fail2ban.org/wiki/index.php/Commands
+
+* Update:
+  http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_Versions&action=edit
+
+  http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_News&action=edit
+  move old bits to:
+  http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_OldNews&action=edit
+
+  http://www.fail2ban.org/wiki/index.php/ChangeLog
+  http://www.fail2ban.org/wiki/index.php/Requirements (Check requirement)
+  http://www.fail2ban.org/wiki/index.php/Features
+
+* See if any filters are upgraded:
+  http://www.fail2ban.org/wiki/index.php/Special:AllPages
+
+# Email users and development list of release
+
+# notify distributors
+
+Post Release
+============
+
+Add the following to the top of the ChangeLog
+
+ver. 0.8.15 (2014/XX/XXX) - wanna-be-released
+-----------
+
+- Fixes:
+
+- New Features:
+
+- Enhancements:
+
+Alter the git shortlog command in the previous section to refer to the just
+released version.
+
+and adjust common/version.py to carry .dev suffix to signal
+a version under development.
@@ -1,7 +0,0 @@
-FROM python:3.10-slim
-
-WORKDIR /root
-COPY setup.py fail2ban config bin ./
-RUN python setup.py install
-
-ENTRYPOINT ["/bin/fail2ban-server"]
@@ -1,4 +1,4 @@
-..                       __      _ _ ___ _
+                         __      _ _ ___ _
                        / _|__ _(_) |_  ) |__  __ _ _ _
                       |  _/ _` | | |/ /| '_ \/ _` | ' \
                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
@@ -7,8 +7,10 @@
 Developing Filters
 ================================================================================

-Filters are tricky. They need to:
+Filters
+=======

+Filters are tricky. They need to:
 * work with a variety of the versions of the software that generates the logs;
 * work with the range of logging configuration options available in the
  software;
@@ -29,11 +31,10 @@ what you have done, what is the hurdle, and we'll attempt to help (PR
 will be automagically updated with future commits you would push to
 complete it).

-Filter Test Cases
-=================
+Filter test cases
+-----------------

-Purpose
-------
+Purpose:

 Start by finding the log messages that the application generates related to
 some form of authentication failure. If you are adding to an existing filter
@@ -48,8 +49,7 @@ and exim-spam at log messages related to spam.
 Even if it is a new filter you may consider separating the log messages into
 different filters based on purpose.

-Cause
-----
+Cause:

 Are some of the log lines a result of the same action? For example, is a PAM
 failure log message, followed by an application specific failure message the
@@ -65,8 +65,7 @@ the log message be occurring due to the first step towards the application
 asking for authentication? Could the log messages occur often? If some of
 these are true make a note of this in the jail.conf example that you provide.

-Samples
-------
+Samples:

 It is important to include log file samples so any future change in the regular
 expression will still work with the log lines you have identified.
@@ -94,22 +93,21 @@ If the mechanism to create the log message isn't obvious provide a
 configuration and/or sample scripts testcases/files/config/{filtername} and
 reference these in the comments above the log line.

-FailJSON metadata
-----------------
+FailJSON metadata:

 A failJSON metadata is a comment immediately above the log message. It will
-look like::
+look like:

-  # failJSON: { "time": "2013-06-10T10:10:59", "match": true , "host": "93.184.216.119" }
+# failJSON: { "time": "2013-06-10T10:10:59", "match": true , "host": "93.184.216.119" }

 Time should match the time of the log message. It is in a specific format of
 Year-Month-Day'T'Hour:minute:Second.  If your log message does not include a
 year, like the example below, the year should be listed as 2005, if before Sun
 Aug 14 10am UTC, and 2004 if afterwards.  Here is an example failJSON
-line preceding a sample log line::
+line preceding a sample log line:

-  # failJSON: { "time": "2005-03-24T15:25:51", "match": true , "host": "198.51.100.87" }
-  Mar 24 15:25:51 buffalo1 dropbear[4092]: bad password attempt for 'root' from 198.51.100.87:5543
+# failJSON: { "time": "2005-03-24T15:25:51", "match": true , "host": "198.51.100.87" }
+Mar 24 15:25:51 buffalo1 dropbear[4092]: bad password attempt for 'root' from 198.51.100.87:5543

 The "host" in failJSON should contain the IP or domain that should be blocked.

@@ -118,28 +116,27 @@ attacks) and any log lines to be excluded (see "Cause" section above), set
 "match": false in the failJSON and describe the reason in the comment above.

 After developing regexes, the following command will test all failJSON metadata
-against the log lines in all sample log files::
+against the log lines in all sample log files

-  ./fail2ban-testcases testSampleRegex
+./fail2ban-testcases testSampleRegex

 Developing Filter Regular Expressions
-=====================================
+-------------------------------------

-Date/Time
---------
+Date/Time:

 At the moment, Fail2Ban depends on log lines to have time stamps.  That is why
 before starting to develop failregex, check if your log line format known to
 Fail2Ban.  Copy the time component from the log line and append an IP address to
-test with following command::
+test with following command:

-  ./fail2ban-regex "2013-09-19 02:46:12 1.2.3.4" "<HOST>"
+./fail2ban-regex "2013-09-19 02:46:12 1.2.3.4" "<HOST>"

-Output of such command should contain something like::
+Output of such command should contain something like:

-  Date template hits:
-  |- [# of hits] date format
-  |  [1] Year-Month-Day Hour:Minute:Second
+Date template hits:
+|- [# of hits] date format
+|  [1] Year-Month-Day Hour:Minute:Second

 Ensure that the template description matches time/date elements in your log line
 time stamp.  If there is no matched format then date template needs to be added
@@ -147,31 +144,29 @@ to server/datedetector.py.  Ensure that a new template is added in the order
 that more specific matches occur first and that there is no confusion between a
 Day and a Month.

-Filter file
-----------
+Filter file:

 The filter is specified in a config/filter.d/{filtername}.conf file. Filter file
-can have sections INCLUDES (optional) and Definition as follows::
+can have sections INCLUDES (optional) and Definition as follows:

-  [INCLUDES]
-  
-  before = common.conf
-  
-  after = filtername.local
-  
-  [Definition]
-  
-  failregex = ....
-  
-  ignoreregex = ....
+[INCLUDES]
+
+before = common.conf
+
+after = filtername.local
+
+[Definition]
+
+failregex = ....
+
+ignoreregex = ....

 This is also documented in the man page jail.conf (section 5). Other definitions
 can be added to make failregex's more readable and maintainable to be used
 through string Interpolations (see http://docs.python.org/2.7/library/configparser.html)


-General rules
-------------
+General rules:

 Use "before" if you need to include a common set of rules, like syslog or if
 there is a common set of regexes for multiple filters.
@@ -183,35 +178,33 @@ Try to avoid using ignoreregex mainly for performance reasons. The case when you
 would use it is if in trying to avoid using it, you end up with an unreadable
 failregex.

-Syslog
------
+Syslog:

 If your application logs to syslog you can take advantage of log line prefix
-definitions present in common.conf.  So as a base use::
+definitions present in common.conf.  So as a base use:

-  [INCLUDES]
-  
-  before = common.conf
-  
-  [Definition]
-  
-  _daemon = app
-  
-  failregex = ^%(__prefix_line)s
+[INCLUDES]
+
+before = common.conf
+
+[Definition]
+
+_daemon = app
+
+failregex = ^%(__prefix_line)s

 In this example common.conf defines __prefix_line which also contains the
 _daemon name (in syslog terms the service) you have just specified. _daemon
 can also be a regex.

-For example, to capture following line _daemon should be set to "dovecot"::
+For example, to capture following line _daemon should be set to "dovecot"

-  Dec 12 11:19:11 dunnart dovecot: pop3-login: Aborted login (tried to use disabled plaintext auth): rip=190.210.136.21, lip=113.212.99.193
+Dec 12 11:19:11 dunnart dovecot: pop3-login: Aborted login (tried to use disabled plaintext auth): rip=190.210.136.21, lip=113.212.99.193

-and then ``^%(__prefix_line)s`` would match "Dec 12 11:19:11 dunnart dovecot:
+and then ^%(__prefix_line)s would match "Dec 12 11:19:11 dunnart dovecot:
 ". Note it matches the trailing space(s) as well.

-Substitutions (AKA string interpolations)
-----------------------------------------
+Substitutions (AKA string interpolations):

 We have used string interpolations in above examples.  They are useful for
 making the regexes more readable, reuse generic patterns in multiple failregex
@@ -220,14 +213,13 @@ to the user.  General principle is that value of a _name variable replaces
 occurrences of %(_name)s within the same section or anywhere in the config file
 if defined in [DEFAULT] section.

-Regular Expressions
-------------------
+Regular Expressions:

 Regular expressions (failregex, ignoreregex) assume that the date/time has been
 removed from the log line (this is just how fail2ban works internally ATM).

 If the format is like '<date...> error 1.2.3.4 is evil' then you need to match
-the <> at the start so regex should be similar to '^<> error <HOST> is evil$' using
+the < at the start so regex should be similar to '^<> <HOST> is evil$' using
 <HOST> where the IP/domain name appears in the log line.

 The following general rules apply to regular expressions:
@@ -244,33 +236,29 @@ If you have only a basic knowledge of regular repressions we advise to read
 http://docs.python.org/2/library/re.html first.  It doesn't take long and would
 remind you e.g. which characters you need to escape and which you don't.

-Developing/testing a regex
--------------------------
+Developing/testing a regex:

 You can develop a regex in a file or using command line depending on your
 preference. You can also use samples you have already created in the test cases
 or test them one at a time.

 The general tool for testing Fail2Ban regexes is fail2ban-regex. To see how to
-use it run::
+use it run:

-  ./fail2ban-regex --help
+./fail2ban-regex --help

 Take note of  -l heavydebug  / -l debug  and -v as they might be very useful.

-.. TIP::
-     Take a look at the source code of the application you are developing
+TIP: Take a look at the source code of the application you are developing
     failregex for. You may see optional or extra log messages, or parts there
     of, that need to form part of your regex.  It may also reveal how some
     parts are constrained and different formats depending on configuration or
     less common usages.

-.. TIP::
-     For looking through source code - http://sourcecodebrowser.com/ . It has
+TIP: For looking through source code - http://sourcecodebrowser.com/ . It has
     call graphs and can browse different versions.

-.. TIP::
-     Some applications log spaces at the end. If you are not sure add \s*$ as
+TIP: Some applications log spaces at the end. If you are not sure add \s*$ as
     the end part of the regex.

 If your regex is not matching, http://www.debuggex.com/?flavor=python can help
@@ -278,7 +266,6 @@ to tune it.  fail2ban-regex -D ...  will present Debuggex URLs for the regexs
 and sample log files that you pass into it.

 In general use when using regex debuggers for generating fail2ban filters:
-
 * use regex from the ./fail2ban-regex output (to ensure all substitutions are
 done)
 * replace <HOST> with (?&.ipv4)
@@ -290,15 +277,13 @@ When you have fixed the regex put it back into your filter file.
 Please spread the good word about Debuggex - Serge Toarca is kindly continuing
 its free availability to Open Source developers.

-Finishing up
------------
+Finishing up:

 If you've added a new filter, add a new entry in config/jail.conf. The theory
 here is that a user will create a jail.local with [filtername]\nenable=true to
 enable your jail.

 So more specifically in the [filter] section in jail.conf:
-
 * ensure that you have "enabled = false" (users will enable as needed);
 * use "filter =" set to your filter name;
 * use a typical action to disable ports associated with the application;
@@ -310,7 +295,7 @@ Submit github pull request (See "Pull Requests" above) for
 github.com/fail2ban/fail2ban containing your great work.

 Filter Security
-===============
+---------------

 Poor filter regular expressions are susceptible to DoS attacks.

@@ -336,33 +321,33 @@ Examples of poor filters

 1. Too restrictive

-We find a log message::
+We find a log message:

    Apr-07-13 07:08:36 Invalid command fial2ban from 1.2.3.4

-We make a failregex::
+We make a failregex

    ^Invalid command \S+ from <HOST>

 Now think evil. The user does the command 'blah from 1.2.3.44'

-The program diligently logs::
+The program diligently logs:

    Apr-07-13 07:08:36 Invalid command blah from 1.2.3.44 from 1.2.3.4

 And fail2ban matches 1.2.3.44 as the IP that it ban. A DoS attack was successful.

-The fix here is that the command can be anything so .* is appropriate::
+The fix here is that the command can be anything so .* is appropriate.

    ^Invalid command .* from <HOST>

 Here the .* will match until the end of the string. Then realise it has more to
 match, i.e. "from <HOST>" and go back until it find this. Then it will ban
-1.2.3.4 correctly. Since the <HOST> is always at the end, end the regex with a $::
+1.2.3.4 correctly. Since the <HOST> is always at the end, end the regex with a $.

    ^Invalid command .* from <HOST>$

-Note if we'd just had the expression::
+Note if we'd just had the expression:

    ^Invalid command \S+ from <HOST>$

@@ -374,16 +359,16 @@ banned.
 From the Apache vulnerability CVE-2013-2178
 ( original ref: https://vndh.net/note:fail2ban-089-denial-service ).

-An example bad regex for Apache::
+An example bad regex for Apache:

    failregex = [[]client <HOST>[]] user .* not found

-Since the user can do a get request on::
+Since the user can do a get request on:

    GET /[client%20192.168.0.1]%20user%20root%20not%20found HTTP/1.0
-    Host: remote.site
+Host: remote.site

-Now the log line will be::
+Now the log line will be:

    [Sat Jun 01 02:17:42 2013] [error] [client 192.168.33.1] File does not exist: /srv/http/site/[client 192.168.0.1] user root not found

@@ -394,27 +379,27 @@ regex and blocks 192.168.33.1 as a denial of service from the HTTP requester.

 From: https://github.com/fail2ban/fail2ban/pull/426

-An example ssh log (simplified)::
+An example ssh log (simplified)

    Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser remoteuser

 As we assume username can include anything including spaces its prudent to put
-.* here. The remote user can also exist as anything so lets not make assumptions again::
+.* here. The remote user can also exist as anything so lets not make assumptions again.

    failregex = ^%(__prefix_line)sFailed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$

 So this works. The problem is if the .* after remote user is injected by the
-user to be 'from 1.2.3.4'. The resultant log line is::
+user to be 'from 1.2.3.4'. The resultant log line is.

    Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4

-Testing with::
+Testing with:

    fail2ban-regex -v 'Sep 29 17:15:02 Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4' '^ Failed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$'

-.. TIP:: I've removed the bit that matches __prefix_line from the regex and log.
+TIP: I've removed the bit that matches __prefix_line from the regex and log.

-Shows::
+Shows:

    1) [1] ^ Failed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
       1.2.3.4  Sun Sep 29 17:15:02 2013
@@ -427,14 +412,14 @@ The result was that 1.2.3.4 was matched, injected by the user, and the wrong IP
 was banned.

 The solution here is to make the first .* non-greedy with .*?. Here it matches
-as little as required and the fail2ban-regex tool shows the output::
+as little as required and the fail2ban-regex tool shows the output:

    fail2ban-regex -v 'Sep 29 17:15:02 Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4' '^ Failed \S+ for .*? from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$'

    1) [1] ^ Failed \S+ for .*? from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
       127.0.0.1  Sun Sep 29 17:15:02 2013

-So the general case here is a log line that contains::
+So the general case here is a log line that contains:

    (fixed_data_1)<HOST>(fixed_data_2)(user_injectable_data)

@@ -442,21 +427,20 @@ Where the regex that matches fixed_data_1 is gready and matches the entire
 string, before moving backwards and user_injectable_data can match the entire
 string.

-Another case
------------
+Another case:

 ref: https://www.debuggex.com/r/CtAbeKMa2sDBEfA2/0

-A webserver logs the following without URL escaping::
+A webserver logs the following without URL escaping:

    [error] 2865#0: *66647 user "xyz" was not found in "/file", client: 1.2.3.1, server: www.host.com, request: "GET ", client: 3.2.1.1, server: fake.com, request: "GET exploited HTTP/3.3", host: "injected.host", host: "www.myhost.com"

-regex::
+regex:

    failregex = ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (?:password mismatch|was not found in ".*"), client: <HOST>, server: \S+, request: "\S+ .+ HTTP/\d+\.\d+", host: "\S+"

 The .* matches to the end of the string. Finds that it can't continue to match
-", client ... so it moves from the back and find that the user injected web URL::
+", client ... so it moves from the back and find that the user injected web URL:

    ", client: 3.2.1.1, server: fake.com, request: "GET exploited HTTP/3.3", host: "injected.host

@@ -469,17 +453,15 @@ beyond <HOST>.
 4. Application generates two identical log messages with different meanings

 If the application generates the following two messages under different
-circumstances::
+circumstances:

    client <IP>: authentication failed
    client <USER>: authentication failed


-Then it's obvious that a regex of ``^client <HOST>: authentication
-failed$`` will still cause problems if the user can trigger the second
+Then it's obvious that a regex of "^client <HOST>: authentication
+failed$" will still cause problems if the user can trigger the second
 log message with a <USER> of 123.1.1.1.

 Here there's nothing to do except request/change the application so it logs
 messages differently.
-
-
@@ -1,433 +1,278 @@
-bin/fail2ban-client
-bin/fail2ban-regex
-bin/fail2ban-server
-bin/fail2ban-testcases
+README.md
+README.Solaris
 ChangeLog
-config/action.d/apprise.conf
-config/action.d/abuseipdb.conf
-config/action.d/apf.conf
-config/action.d/blocklist_de.conf
-config/action.d/bsd-ipfw.conf
-config/action.d/cloudflare.conf
-config/action.d/complain.conf
-config/action.d/dshield.conf
-config/action.d/dummy.conf
-config/action.d/firewallcmd-allports.conf
-config/action.d/firewallcmd-common.conf
-config/action.d/firewallcmd-ipset.conf
-config/action.d/firewallcmd-multiport.conf
-config/action.d/firewallcmd-new.conf
-config/action.d/firewallcmd-rich-logging.conf
-config/action.d/firewallcmd-rich-rules.conf
-config/action.d/helpers-common.conf
-config/action.d/hostsdeny.conf
-config/action.d/ipfilter.conf
-config/action.d/ipfw.conf
-config/action.d/iptables-allports.conf
-config/action.d/iptables-common.conf
-config/action.d/iptables.conf
-config/action.d/iptables-ipset-proto4.conf
-config/action.d/iptables-ipset-proto6-allports.conf
-config/action.d/iptables-ipset-proto6.conf
-config/action.d/iptables-multiport.conf
-config/action.d/iptables-multiport-log.conf
-config/action.d/iptables-new.conf
-config/action.d/iptables-xt_recent-echo.conf
-config/action.d/mail-buffered.conf
-config/action.d/mail.conf
-config/action.d/mail-whois-common.conf
-config/action.d/mail-whois.conf
-config/action.d/mail-whois-lines.conf
-config/action.d/mynetwatchman.conf
-config/action.d/netscaler.conf
-config/action.d/nftables-allports.conf
-config/action.d/nftables.conf
-config/action.d/nftables-multiport.conf
-config/action.d/nginx-block-map.conf
-config/action.d/npf.conf
-config/action.d/nsupdate.conf
-config/action.d/osx-afctl.conf
-config/action.d/osx-ipfw.conf
-config/action.d/pf.conf
-config/action.d/route.conf
-config/action.d/sendmail-buffered.conf
-config/action.d/sendmail-common.conf
-config/action.d/sendmail.conf
-config/action.d/sendmail-geoip-lines.conf
-config/action.d/sendmail-whois.conf
-config/action.d/sendmail-whois-ipjailmatches.conf
-config/action.d/sendmail-whois-ipmatches.conf
-config/action.d/sendmail-whois-lines.conf
-config/action.d/sendmail-whois-matches.conf
-config/action.d/shorewall.conf
-config/action.d/shorewall-ipset-proto6.conf
-config/action.d/smtp.py
-config/action.d/symbiosis-blacklist-allports.conf
-config/action.d/ufw.conf
-config/action.d/xarf-login-attack.conf
-config/fail2ban.conf
-config/filter.d/3proxy.conf
+TODO
+THANKS
+COPYING
+DEVELOP
+FILTERS
+fail2ban-client
+fail2ban-server
+fail2ban-testcases
+fail2ban-regex
+fail2ban-testcases-all
+setup.py
+setup.cfg
+kill-server
+client/configreader.py
+client/configparserinc.py
+client/jailreader.py
+client/fail2banreader.py
+client/jailsreader.py
+client/beautifier.py
+client/filterreader.py
+client/actionreader.py
+client/__init__.py
+client/configurator.py
+client/csocket.py
+server/asyncserver.py
+server/filter.py
+server/filterpyinotify.py
+server/filtergamin.py
+server/filterpoll.py
+server/iso8601.py
+server/server.py
+server/actions.py
+server/faildata.py
+server/failmanager.py
+server/datedetector.py
+server/jailthread.py
+server/transmitter.py
+server/action.py
+server/ticket.py
+server/jail.py
+server/jails.py
+server/__init__.py
+server/banmanager.py
+server/datetemplate.py
+server/mytime.py
+server/failregex.py
+testcases/actionstestcase.py
+testcases/dummyjail.py
+testcases/files/ignorecommand.py
+testcases/files/testcase-usedns.log
+testcases/files/logs/bsd/syslog-plain.txt
+testcases/files/logs/bsd/syslog-v.txt
+testcases/files/logs/bsd/syslog-vv.txt
+testcases/files/logs/apache-overflows
+testcases/files/logs/apache-modsecurity
+testcases/files/logs/assp
+testcases/files/logs/asterisk
+testcases/files/logs/dovecot
+testcases/files/logs/ejabberd-auth
+testcases/files/logs/exim
+testcases/files/logs/freeswitch
+testcases/files/logs/groupoffice
+testcases/files/logs/horde
+testcases/files/logs/suhosin
+testcases/files/logs/mysqld-auth
+testcases/files/logs/named-refused
+testcases/files/logs/nagios
+testcases/files/logs/nginx-http-auth
+testcases/files/logs/nsd
+testcases/files/logs/openwebmail
+testcases/files/logs/pam-generic
+testcases/files/logs/postfix
+testcases/files/logs/proftpd
+testcases/files/logs/pure-ftpd
+testcases/files/logs/roundcube-auth
+testcases/files/logs/postfix-sasl
+testcases/files/logs/sogo-auth
+testcases/files/logs/solid-pop3d
+testcases/files/logs/squid
+testcases/files/logs/sshd
+testcases/files/logs/sshd-ddos
+testcases/files/logs/vsftpd
+testcases/files/logs/webmin-auth
+testcases/files/logs/wuftpd
+testcases/files/logs/3proxy
+testcases/files/logs/apache-auth
+testcases/files/logs/apache-badbots
+testcases/files/logs/apache-nohome
+testcases/files/logs/apache-noscript
+testcases/files/logs/courierlogin
+testcases/files/logs/couriersmtp
+testcases/files/logs/cyrus-imap
+testcases/files/logs/dropbear
+testcases/files/logs/exim-spam
+testcases/files/logs/gssftpd
+testcases/files/logs/lighttpd-auth
+testcases/files/logs/mysqld-auth
+testcases/files/logs/perdition
+testcases/files/logs/php-url-fopen
+testcases/files/logs/qmail
+testcases/files/logs/recidive
+testcases/files/logs/sieve
+testcases/files/logs/selinux-ssh
+testcases/files/logs/sendmail-auth
+testcases/files/logs/sendmail-reject
+testcases/files/logs/suhosin
+testcases/files/logs/uwimap-auth
+testcases/files/logs/wuftpd
+testcases/files/logs/xinetd-fail
+testcases/files/config/apache-auth/digest/.htaccess
+testcases/files/config/apache-auth/digest/.htpasswd
+testcases/files/config/apache-auth/digest_time/.htaccess
+testcases/files/config/apache-auth/digest_time/.htpasswd
+testcases/files/config/apache-auth/basic/authz_owner/.htaccess
+testcases/files/config/apache-auth/basic/authz_owner/cant_get_me.html
+testcases/files/config/apache-auth/basic/authz_owner/.htpasswd
+testcases/files/config/apache-auth/basic/file/.htaccess
+testcases/files/config/apache-auth/basic/file/.htpasswd
+testcases/files/config/apache-auth/digest.py
+testcases/files/config/apache-auth/digest_wrongrelm/.htaccess
+testcases/files/config/apache-auth/digest_wrongrelm/.htpasswd
+testcases/files/config/apache-auth/digest_anon/.htaccess
+testcases/files/config/apache-auth/digest_anon/.htpasswd
+testcases/files/config/apache-auth/README
+testcases/files/config/apache-auth/noentry/.htaccess
+testcases/samplestestcase.py
+testcases/banmanagertestcase.py
+testcases/failmanagertestcase.py
+testcases/clientreadertestcase.py
+testcases/filtertestcase.py
+testcases/__init__.py
+testcases/datedetectortestcase.py
+testcases/actiontestcase.py
+testcases/servertestcase.py
+testcases/sockettestcase.py
+testcases/files/testcase01.log
+testcases/files/testcase02.log
+testcases/files/testcase03.log
+testcases/files/testcase04.log
+testcases/misctestcase.py
+testcases/utils.py
+common/__init__.py
+common/exceptions.py
+common/helpers.py
+common/version.py
+common/protocol.py
+config/jail.conf
+config/filter.d/common.conf
 config/filter.d/apache-auth.conf
 config/filter.d/apache-badbots.conf
-config/filter.d/apache-botsearch.conf
-config/filter.d/apache-common.conf
-config/filter.d/apache-fakegooglebot.conf
 config/filter.d/apache-modsecurity.conf
 config/filter.d/apache-nohome.conf
 config/filter.d/apache-noscript.conf
 config/filter.d/apache-overflows.conf
-config/filter.d/apache-pass.conf
-config/filter.d/apache-shellshock.conf
-config/filter.d/assp.conf
-config/filter.d/asterisk.conf
-config/filter.d/bitwarden.conf
-config/filter.d/botsearch-common.conf
-config/filter.d/centreon.conf
-config/filter.d/common.conf
-config/filter.d/counter-strike.conf
-config/filter.d/courier-auth.conf
-config/filter.d/courier-smtp.conf
+config/filter.d/nginx-http-auth.conf
+config/filter.d/courierlogin.conf
+config/filter.d/couriersmtp.conf
 config/filter.d/cyrus-imap.conf
-config/filter.d/directadmin.conf
-config/filter.d/domino-smtp.conf
-config/filter.d/dovecot.conf
-config/filter.d/dropbear.conf
-config/filter.d/drupal-auth.conf
 config/filter.d/ejabberd-auth.conf
-config/filter.d/exim-common.conf
 config/filter.d/exim.conf
-config/filter.d/exim-spam.conf
 config/filter.d/freeswitch.conf
-config/filter.d/froxlor-auth.conf
-config/filter.d/gitlab.conf
-config/filter.d/grafana.conf
-config/filter.d/groupoffice.conf
 config/filter.d/gssftpd.conf
-config/filter.d/guacamole.conf
-config/filter.d/haproxy-http-auth.conf
 config/filter.d/horde.conf
-config/filter.d/ignorecommands/apache-fakegooglebot
-config/filter.d/kerio.conf
-config/filter.d/lighttpd-auth.conf
-config/filter.d/mongodb-auth.conf
-config/filter.d/monit.conf
-config/filter.d/murmur.conf
-config/filter.d/mysqld-auth.conf
+config/filter.d/suhosin.conf
 config/filter.d/nagios.conf
 config/filter.d/named-refused.conf
-config/filter.d/nginx-botsearch.conf
-config/filter.d/nginx-http-auth.conf
-config/filter.d/nginx-limit-req.conf
 config/filter.d/nsd.conf
-config/filter.d/openhab.conf
 config/filter.d/openwebmail.conf
-config/filter.d/oracleims.conf
-config/filter.d/pam-generic.conf
-config/filter.d/perdition.conf
-config/filter.d/phpmyadmin-syslog.conf
-config/filter.d/php-url-fopen.conf
-config/filter.d/portsentry.conf
 config/filter.d/postfix.conf
 config/filter.d/proftpd.conf
 config/filter.d/pure-ftpd.conf
 config/filter.d/qmail.conf
-config/filter.d/recidive.conf
-config/filter.d/roundcube-auth.conf
-config/filter.d/screensharingd.conf
-config/filter.d/selinux-common.conf
-config/filter.d/selinux-ssh.conf
+config/filter.d/pam-generic.conf
+config/filter.d/php-url-fopen.conf
+config/filter.d/postfix-sasl.conf
 config/filter.d/sendmail-auth.conf
 config/filter.d/sendmail-reject.conf
 config/filter.d/sieve.conf
-config/filter.d/slapd.conf
-config/filter.d/softethervpn.conf
-config/filter.d/sogo-auth.conf
 config/filter.d/solid-pop3d.conf
 config/filter.d/squid.conf
-config/filter.d/squirrelmail.conf
 config/filter.d/sshd.conf
-config/filter.d/stunnel.conf
-config/filter.d/suhosin.conf
-config/filter.d/tine20.conf
-config/filter.d/traefik-auth.conf
-config/filter.d/uwimap-auth.conf
+config/filter.d/sshd-ddos.conf
 config/filter.d/vsftpd.conf
 config/filter.d/webmin-auth.conf
 config/filter.d/wuftpd.conf
 config/filter.d/xinetd-fail.conf
-config/filter.d/znc-adminlog.conf
-config/filter.d/zoneminder.conf
-config/jail.conf
-config/paths-arch.conf
-config/paths-common.conf
-config/paths-debian.conf
-config/paths-fedora.conf
-config/paths-freebsd.conf
-config/paths-opensuse.conf
-config/paths-osx.conf
-CONTRIBUTING.md
-COPYING
-.coveragerc
-DEVELOP
-fail2ban-2to3
-fail2ban/client/actionreader.py
-fail2ban/client/beautifier.py
-fail2ban/client/configparserinc.py
-fail2ban/client/configreader.py
-fail2ban/client/configurator.py
-fail2ban/client/csocket.py
-fail2ban/client/fail2banclient.py
-fail2ban/client/fail2bancmdline.py
-fail2ban/client/fail2banreader.py
-fail2ban/client/fail2banregex.py
-fail2ban/client/fail2banserver.py
-fail2ban/client/filterreader.py
-fail2ban/client/__init__.py
-fail2ban/client/jailreader.py
-fail2ban/client/jailsreader.py
-fail2ban/exceptions.py
-fail2ban/helpers.py
-fail2ban/__init__.py
-fail2ban/protocol.py
-fail2ban/server/action.py
-fail2ban/server/actions.py
-fail2ban/server/asyncserver.py
-fail2ban/server/banmanager.py
-fail2ban/server/database.py
-fail2ban/server/datedetector.py
-fail2ban/server/datetemplate.py
-fail2ban/server/failmanager.py
-fail2ban/server/failregex.py
-fail2ban/server/filtergamin.py
-fail2ban/server/filterpoll.py
-fail2ban/server/filter.py
-fail2ban/server/filterpyinotify.py
-fail2ban/server/filtersystemd.py
-fail2ban/server/__init__.py
-fail2ban/server/ipdns.py
-fail2ban/server/jail.py
-fail2ban/server/jails.py
-fail2ban/server/jailthread.py
-fail2ban/server/mytime.py
-fail2ban/server/observer.py
-fail2ban/server/server.py
-fail2ban/server/strptime.py
-fail2ban/server/ticket.py
-fail2ban/server/transmitter.py
-fail2ban/server/utils.py
-fail2ban/setup.py
-fail2ban-testcases-all
-fail2ban-testcases-all-python3
-fail2ban/tests/action_d/__init__.py
-fail2ban/tests/action_d/test_smtp.py
-fail2ban/tests/actionstestcase.py
-fail2ban/tests/actiontestcase.py
-fail2ban/tests/banmanagertestcase.py
-fail2ban/tests/clientbeautifiertestcase.py
-fail2ban/tests/clientreadertestcase.py
-fail2ban/tests/config/action.d/action.conf
-fail2ban/tests/config/action.d/brokenaction.conf
-fail2ban/tests/config/fail2ban.conf
-fail2ban/tests/config/filter.d/checklogtype.conf
-fail2ban/tests/config/filter.d/checklogtype_test.conf
-fail2ban/tests/config/filter.d/simple.conf
-fail2ban/tests/config/filter.d/test.conf
-fail2ban/tests/config/filter.d/test.local
-fail2ban/tests/config/filter.d/zzz-generic-example.conf
-fail2ban/tests/config/filter.d/zzz-sshd-obsolete-multiline.conf
-fail2ban/tests/config/jail.conf
-fail2ban/tests/databasetestcase.py
-fail2ban/tests/datedetectortestcase.py
-fail2ban/tests/dummyjail.py
-fail2ban/tests/fail2banclienttestcase.py
-fail2ban/tests/fail2banregextestcase.py
-fail2ban/tests/failmanagertestcase.py
-fail2ban/tests/files/action.d/action_checkainfo.py
-fail2ban/tests/files/action.d/action_errors.py
-fail2ban/tests/files/action.d/action_modifyainfo.py
-fail2ban/tests/files/action.d/action_noAction.py
-fail2ban/tests/files/action.d/action_nomethod.py
-fail2ban/tests/files/action.d/action.py
-fail2ban/tests/files/config/apache-auth/basic/authz_owner/cant_get_me.html
-fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htaccess
-fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htpasswd
-fail2ban/tests/files/config/apache-auth/basic/file/.htaccess
-fail2ban/tests/files/config/apache-auth/basic/file/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest_anon/.htaccess
-fail2ban/tests/files/config/apache-auth/digest_anon/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest/.htaccess
-fail2ban/tests/files/config/apache-auth/digest/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest.py
-fail2ban/tests/files/config/apache-auth/digest_time/.htaccess
-fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess
-fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd
-fail2ban/tests/files/config/apache-auth/noentry/.htaccess
-fail2ban/tests/files/config/apache-auth/README
-fail2ban/tests/files/database_v1.db
-fail2ban/tests/files/database_v2.db
-fail2ban/tests/files/filter.d/substition.conf
-fail2ban/tests/files/filter.d/testcase01.conf
-fail2ban/tests/files/filter.d/testcase02.conf
-fail2ban/tests/files/filter.d/testcase02.local
-fail2ban/tests/files/filter.d/testcase-common.conf
-fail2ban/tests/files/ignorecommand.py
-fail2ban/tests/files/logs/3proxy
-fail2ban/tests/files/logs/apache-auth
-fail2ban/tests/files/logs/apache-badbots
-fail2ban/tests/files/logs/apache-botsearch
-fail2ban/tests/files/logs/apache-fakegooglebot
-fail2ban/tests/files/logs/apache-modsecurity
-fail2ban/tests/files/logs/apache-nohome
-fail2ban/tests/files/logs/apache-noscript
-fail2ban/tests/files/logs/apache-overflows
-fail2ban/tests/files/logs/apache-pass
-fail2ban/tests/files/logs/apache-shellshock
-fail2ban/tests/files/logs/assp
-fail2ban/tests/files/logs/asterisk
-fail2ban/tests/files/logs/bitwarden
-fail2ban/tests/files/logs/bsd/syslog-plain.txt
-fail2ban/tests/files/logs/bsd/syslog-v.txt
-fail2ban/tests/files/logs/bsd/syslog-vv.txt
-fail2ban/tests/files/logs/centreon
-fail2ban/tests/files/logs/counter-strike
-fail2ban/tests/files/logs/courier-auth
-fail2ban/tests/files/logs/courier-smtp
-fail2ban/tests/files/logs/cyrus-imap
-fail2ban/tests/files/logs/directadmin
-fail2ban/tests/files/logs/domino-smtp
-fail2ban/tests/files/logs/dovecot
-fail2ban/tests/files/logs/dropbear
-fail2ban/tests/files/logs/drupal-auth
-fail2ban/tests/files/logs/ejabberd-auth
-fail2ban/tests/files/logs/exim
-fail2ban/tests/files/logs/exim-spam
-fail2ban/tests/files/logs/freeswitch
-fail2ban/tests/files/logs/froxlor-auth
-fail2ban/tests/files/logs/gitlab
-fail2ban/tests/files/logs/grafana
-fail2ban/tests/files/logs/groupoffice
-fail2ban/tests/files/logs/gssftpd
-fail2ban/tests/files/logs/guacamole
-fail2ban/tests/files/logs/haproxy-http-auth
-fail2ban/tests/files/logs/horde
-fail2ban/tests/files/logs/kerio
-fail2ban/tests/files/logs/lighttpd-auth
-fail2ban/tests/files/logs/mongodb-auth
-fail2ban/tests/files/logs/monit
-fail2ban/tests/files/logs/murmur
-fail2ban/tests/files/logs/mysqld-auth
-fail2ban/tests/files/logs/nagios
-fail2ban/tests/files/logs/named-refused
-fail2ban/tests/files/logs/nginx-botsearch
-fail2ban/tests/files/logs/nginx-http-auth
-fail2ban/tests/files/logs/nginx-limit-req
-fail2ban/tests/files/logs/nsd
-fail2ban/tests/files/logs/openhab
-fail2ban/tests/files/logs/openwebmail
-fail2ban/tests/files/logs/oracleims
-fail2ban/tests/files/logs/pam-generic
-fail2ban/tests/files/logs/perdition
-fail2ban/tests/files/logs/phpmyadmin-syslog
-fail2ban/tests/files/logs/php-url-fopen
-fail2ban/tests/files/logs/portsentry
-fail2ban/tests/files/logs/postfix
-fail2ban/tests/files/logs/proftpd
-fail2ban/tests/files/logs/pure-ftpd
-fail2ban/tests/files/logs/qmail
-fail2ban/tests/files/logs/recidive
-fail2ban/tests/files/logs/roundcube-auth
-fail2ban/tests/files/logs/screensharingd
-fail2ban/tests/files/logs/selinux-ssh
-fail2ban/tests/files/logs/sendmail-auth
-fail2ban/tests/files/logs/sendmail-reject
-fail2ban/tests/files/logs/sieve
-fail2ban/tests/files/logs/slapd
-fail2ban/tests/files/logs/softethervpn
-fail2ban/tests/files/logs/sogo-auth
-fail2ban/tests/files/logs/solid-pop3d
-fail2ban/tests/files/logs/squid
-fail2ban/tests/files/logs/squirrelmail
-fail2ban/tests/files/logs/sshd
-fail2ban/tests/files/logs/sshd-journal
-fail2ban/tests/files/logs/stunnel
-fail2ban/tests/files/logs/suhosin
-fail2ban/tests/files/logs/tine20
-fail2ban/tests/files/logs/traefik-auth
-fail2ban/tests/files/logs/uwimap-auth
-fail2ban/tests/files/logs/vsftpd
-fail2ban/tests/files/logs/webmin-auth
-fail2ban/tests/files/logs/wuftpd
-fail2ban/tests/files/logs/xinetd-fail
-fail2ban/tests/files/logs/znc-adminlog
-fail2ban/tests/files/logs/zoneminder
-fail2ban/tests/files/logs/zzz-generic-example
-fail2ban/tests/files/logs/zzz-sshd-obsolete-multiline
-fail2ban/tests/files/testcase01a.log
-fail2ban/tests/files/testcase01.log
-fail2ban/tests/files/testcase02.log
-fail2ban/tests/files/testcase03.log
-fail2ban/tests/files/testcase04.log
-fail2ban/tests/files/testcase-journal.log
-fail2ban/tests/files/testcase-multiline.log
-fail2ban/tests/files/testcase-usedns.log
-fail2ban/tests/files/testcase-wrong-char.log
-fail2ban/tests/files/zzz-sshd-obsolete-multiline.log
-fail2ban/tests/filtertestcase.py
-fail2ban/tests/__init__.py
-fail2ban/tests/misctestcase.py
-fail2ban/tests/observertestcase.py
-fail2ban/tests/samplestestcase.py
-fail2ban/tests/servertestcase.py
-fail2ban/tests/sockettestcase.py
-fail2ban/tests/tickettestcase.py
-fail2ban/tests/utils.py
-fail2ban/version.py
-files/bash-completion
-files/cacti/cacti_host_template_fail2ban.xml
-files/cacti/fail2ban_stats.sh
-files/cacti/README
-files/debian-initd
-files/fail2ban-logrotate
-files/fail2ban.service.in
-files/fail2ban-tmpfiles.conf
-files/fail2ban.upstart
-files/gen_badbots
-files/gentoo-confd
+config/filter.d/asterisk.conf
+config/filter.d/dovecot.conf
+config/filter.d/dropbear.conf
+config/filter.d/lighttpd-auth.conf
+config/filter.d/recidive.conf
+config/filter.d/roundcube-auth.conf
+config/filter.d/assp.conf
+config/filter.d/sogo-auth.conf
+config/filter.d/mysqld-auth.conf
+config/filter.d/selinux-common.conf
+config/filter.d/selinux-ssh.conf
+config/filter.d/3proxy.conf
+config/filter.d/apache-common.conf
+config/filter.d/exim-common.conf
+config/filter.d/exim-spam.conf
+config/filter.d/groupoffice.conf
+config/filter.d/perdition.conf
+config/filter.d/uwimap-auth.conf
+config/action.d/apf.conf
+config/action.d/blocklist_de.conf
+config/action.d/osx-afctl.conf
+config/action.d/osx-ipfw.conf
+config/action.d/sendmail-common.conf
+config/action.d/badips.conf
+config/action.d/bsd-ipfw.conf
+config/action.d/dummy.conf
+config/action.d/firewallcmd-new.conf
+config/action.d/firewallcmd-ipset.conf
+config/action.d/iptables-ipset-proto6-allports.conf
+config/action.d/iptables-blocktype.conf
+config/action.d/iptables-ipset-proto4.conf
+config/action.d/iptables-ipset-proto6.conf
+config/action.d/iptables-xt_recent-echo.conf
+config/action.d/route.conf
+config/action.d/complain.conf
+config/action.d/dshield.conf
+config/action.d/hostsdeny.conf
+config/action.d/ipfw.conf
+config/action.d/ipfilter.conf
+config/action.d/iptables.conf
+config/action.d/iptables-allports.conf
+config/action.d/iptables-multiport.conf
+config/action.d/iptables-multiport-log.conf
+config/action.d/iptables-new.conf
+config/action.d/mail.conf
+config/action.d/mail-buffered.conf
+config/action.d/mail-whois.conf
+config/action.d/mail-whois-lines.conf
+config/action.d/mynetwatchman.conf
+config/action.d/pf.conf
+config/action.d/sendmail.conf
+config/action.d/sendmail-buffered.conf
+config/action.d/sendmail-whois.conf
+config/action.d/sendmail-whois-lines.conf
+config/action.d/shorewall.conf
+config/action.d/ufw.conf
+config/fail2ban.conf
+doc/run-rootless.txt
+man/fail2ban-client.1
+man/fail2ban.1
+man/jail.conf.5
+man/fail2ban-client.h2m
+man/fail2ban-server.1
+man/fail2ban-server.h2m
+man/fail2ban-regex.1
+man/fail2ban-regex.h2m
+man/generate-man
 files/gentoo-initd
-files/ipmasq-ZZZzzz_fail2ban.rul
-files/logwatch/fail2ban
-files/logwatch/fail2ban-0.8.log
-files/logwatch/fail2ban-0.9.log
-files/macosx-initd
-files/monit/fail2ban
-files/nagios/check_fail2ban
-files/nagios/README
+files/gentoo-confd
 files/redhat-initd
+files/macosx-initd
 files/solaris-fail2ban.xml
 files/solaris-svc-fail2ban
 files/suse-initd
-FILTERS
-kill-server
-man/fail2ban.1
-man/fail2ban-client.1
-man/fail2ban-client.h2m
-man/fail2ban-python.1
-man/fail2ban-python.h2m
-man/fail2ban-regex.1
-man/fail2ban-regex.h2m
-man/fail2ban-server.1
-man/fail2ban-server.h2m
-man/fail2ban-testcases.1
-man/fail2ban-testcases.h2m
-man/generate-man
-man/jail.conf.5
-.pylintrc
-README.md
-README.Solaris
-RELEASE
-setup.cfg
-setup.py
-THANKS
-TODO
-Vagrantfile
+files/fail2ban-logrotate
+files/cacti/fail2ban_stats.sh
+files/cacti/cacti_host_template_fail2ban.xml
+files/cacti/README
+files/nagios/check_fail2ban
+files/nagios/README
+files/bash-completion
+files/fail2ban-tmpfiles.conf
+files/fail2ban.service
+files/ipmasq-ZZZzzz_fail2ban.rul
+files/gen_badbots
+testcases/config/jail.conf
+testcases/config/fail2ban.conf
+testcases/config/filter.d/simple.conf
+testcases/config/action.d/brokenaction.conf
@@ -1,5 +0,0 @@
-include ChangeLog COPYING DEVELOP FILTERS README.* THANKS TODO CONTRIBUTING* Vagrantfile
-graft doc
-graft files
-recursive-include config *.conf *.py
-recursive-include config/filter.d/ignorecommands *
@@ -1,5 +0,0 @@
-setup:
-	docker-compose -f docker-compose.yml up --build -d
-clean:
-	docker-compose down
-	docker image rm fail2ban
@@ -2,63 +2,40 @@
                        / _|__ _(_) |_  ) |__  __ _ _ _  
                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
-                       v1.0.1.dev1            20??/??/??
+                       v0.8.14                 2014/08/19

 ## Fail2Ban: ban hosts that cause multiple authentication errors

-Fail2Ban scans log files like `/var/log/auth.log` and bans IP addresses conducting
-too many failed login attempts. It does this by updating system firewall rules
-to reject new connections from those IP addresses, for a configurable amount
-of time. Fail2Ban comes out-of-the-box ready to read many standard log files,
-such as those for sshd and Apache, and is easily configured to read any log
-file of your choosing, for any error you wish.
+Fail2Ban scans log files like /var/log/pwdfail and bans IP that makes too many
+password failures. It updates firewall rules to reject the IP address. These
+rules can be defined by the user. Fail2Ban can read multiple log files such as
+sshd or Apache web server ones.

-Though Fail2Ban is able to reduce the rate of incorrect authentication
-attempts, it cannot eliminate the risk presented by weak authentication.
-Set up services to use only two factor, or public/private authentication
-mechanisms if you really want to protect services.
-     
-<img src="http://www.worldipv6launch.org/wp-content/themes/ipv6/downloads/World_IPv6_launch_logo.svg" height="52pt"/> | Since v0.10 fail2ban supports the matching of IPv6 addresses.
------|------
-
-This README is a quick introduction to Fail2Ban. More documentation, FAQ, and HOWTOs
-to be found on fail2ban(1) manpage, [Wiki](https://github.com/fail2ban/fail2ban/wiki),
-[Developers documentation](https://fail2ban.readthedocs.io/)
-and the website: https://www.fail2ban.org
+This README is a quick introduction to Fail2ban. More documentation, FAQ, HOWTOs
+are available in fail2ban(1) manpage and on the website http://www.fail2ban.org

 Installation:
 -------------

-**It is possible that Fail2Ban is already packaged for your distribution.  In
-this case, you should use that instead.**
+**It is possible that Fail2ban is already packaged for your distribution.  In
+this case, you should use it instead.**

 Required:
- [Python2 >= 2.6 or Python >= 3.2](https://www.python.org) or [PyPy](https://pypy.org)
- python-setuptools, python-distutils or python3-setuptools for installation from source
+- [Python >= 2.4](http://www.python.org)

 Optional:
- [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify), may require:
-  * Linux >= 2.6.13
+- [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify)
+  - Linux >= 2.6.13
 - [gamin >= 0.0.21](http://www.gnome.org/~veillard/gamin)
- [systemd >= 204](http://www.freedesktop.org/wiki/Software/systemd) and python bindings:
-  * [python-systemd package](https://www.freedesktop.org/software/systemd/python-systemd/index.html)
- [dnspython](http://www.dnspython.org/)

+To install, just do:

-To install:
+    tar xvfj fail2ban-0.8.12.tar.bz2
+    cd fail2ban-0.8.12
+    python setup.py install

-    tar xvfj fail2ban-1.0.1.tar.bz2
-    cd fail2ban-1.0.1
-    sudo python setup.py install
-   
-Alternatively, you can clone the source from GitHub to a directory of Your choice, and do the install from there. Pick the correct branch, for example, master or 0.11
-
-    git clone https://github.com/fail2ban/fail2ban.git
-    cd fail2ban
-    sudo python setup.py install 
-    
-This will install Fail2Ban into the python library directory. The executable
-scripts are placed into `/usr/bin`, and configuration in `/etc/fail2ban`.
+This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
+placed into /usr/bin, and configuration under /etc/fail2ban.

 Fail2Ban should be correctly installed now. Just type:

@@ -66,45 +43,44 @@ Fail2Ban should be correctly installed now. Just type:

 to see if everything is alright. You should always use fail2ban-client and
 never call fail2ban-server directly.
-You can verify that you have the correct version installed with 
-
-    fail2ban-client version
-
-Please note that the system init/service script is not automatically installed.
-To enable fail2ban as an automatic service, simply copy the script for your
-distro from the `files` directory to `/etc/init.d`. Example (on a Debian-based
-system):
-
-    cp files/debian-initd /etc/init.d/fail2ban
-    update-rc.d fail2ban defaults
-    service fail2ban start

 Configuration:
 --------------

-You can configure Fail2Ban using the files in `/etc/fail2ban`. It is possible to
-configure the server using commands sent to it by `fail2ban-client`. The
+You can configure Fail2Ban using the files in /etc/fail2ban. It is possible to
+configure the server using commands sent to it by fail2ban-client. The
 available commands are described in the fail2ban-client(1) manpage.  Also see
-fail2ban(1) and jail.conf(5)  manpages for further references.
+fail2ban(1) manpage for further references and find even more documentation on
+the website: http://www.fail2ban.org

 Code status:
 ------------

-* travis-ci.org: [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=master)](https://travis-ci.org/fail2ban/fail2ban?branch=master) / [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=0.11)](https://travis-ci.org/fail2ban/fail2ban?branch=0.11) (0.11 branch) / [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=0.10)](https://travis-ci.org/fail2ban/fail2ban?branch=0.10) (0.10 branch) 
+* [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.png?branch=master)](https://travis-ci.org/fail2ban/fail2ban) travis-ci.org (master branch)

-* coveralls.io: [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=master)](https://coveralls.io/github/fail2ban/fail2ban?branch=master) / [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=0.11)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.11) (0.11 branch) / [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=0.10)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.10) / (0.10 branch)
-
-* codecov.io: [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=master)](https://codecov.io/gh/fail2ban/fail2ban/branch/master) / [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.11)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.11) (0.11 branch) / [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.10)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.10) (0.10 branch)
+* [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.png?branch=master)](https://coveralls.io/r/fail2ban/fail2ban)

 Contact:
 --------

-### Bugs, feature requests, discussions?
-See [CONTRIBUTING.md](https://github.com/fail2ban/fail2ban/blob/master/CONTRIBUTING.md)
+### You found a severe security vulnerability in Fail2Ban?
+email details to fail2ban-vulnerabilities at lists dot sourceforge dot net .
+
+### You need some new features, you found bugs?
+visit [Issues](https://github.com/fail2ban/fail2ban/issues)
+and if your issue is not yet known -- file a bug report. See
+[Fail2Ban wiki](http://www.fail2ban.org/wiki/index.php/HOWTO_Seek_Help)
+on further instructions.
+
+### You would like to troubleshoot or discuss?
+join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
+
+### You would like to contribute (new filters/actions/code/documentation)?
+send a pull request

 ### You just appreciate this program:
-Send kudos to the original author ([Cyril Jaquier](mailto:cyril.jaquier@fail2ban.org))
-or *better* to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
+send kudos to the original author ([Cyril Jaquier](mailto: Cyril Jaquier <cyril.jaquier@fail2ban.org>)
+or better to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
 since Fail2Ban is "community-driven" for years now.

 Thanks:
@@ -1,206 +0,0 @@
-..                       __      _ _ ___ _
-                        / _|__ _(_) |_  ) |__  __ _ _ _
-                       |  _/ _` | | |/ /| '_ \/ _` | ' \
-                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
-
-================================================================================
-How to do a release for Fail2Ban
-================================================================================
-
-Preparation
-===========
-
-* Check distribution patches and see if they can be included
-
-  * https://apps.fedoraproject.org/packages/fail2ban/sources
-  * http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/
-  * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/
-  * https://build.opensuse.org/package/show?package=fail2ban&project=openSUSE%3AFactory
-  * http://sophie.zarb.org/sources/fail2ban (Mageia)
-  * https://trac.macports.org/browser/trunk/dports/security/fail2ban
-
-
-* Check distribution outstanding bugs
-
-  * https://github.com/fail2ban/fail2ban/issues?sort=updated&state=open
-  * http://bugs.debian.org/cgi-bin/pkgreport.cgi?dist=unstable;package=fail2ban
-  * https://bugs.launchpad.net/ubuntu/+source/fail2ban
-  * http://bugs.sabayon.org/buglist.cgi?quicksearch=net-analyzer%2Ffail2ban
-  * https://bugs.archlinux.org/?project=5&cat%5B%5D=33&string=fail2ban
-  * https://bugs.gentoo.org/buglist.cgi?query_format=advanced&short_desc=fail2ban&bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=IN_PROGRESS&short_desc_type=allwords
-  * https://bugzilla.redhat.com/buglist.cgi?query_format=advanced&bug_status=NEW&bug_status=ASSIGNED&component=fail2ban&classification=Red%20Hat&classification=Fedora
-  * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
-  * https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
-  * https://build.opensuse.org/package/requests/openSUSE:Factory/fail2ban
-
-
-* Make sure the tests pass::
-
-  ./fail2ban-testcases-all
-
-* Ensure the version is correct in:
-
-  * ./fail2ban/version.py
-  * top of ChangeLog
-  * README.md
-
-
-* Ensure the MANIFEST is complete
-
-  ad-hoc bash script to run in a clean clone:
-
-     find -type f | grep -v -e '\.git' -e '/doc/' -e '\.travis' -e MANIFEST | sed -e 's,^\./,,g' | while read f; do grep -ne "^$f\$" MANIFEST >/dev/null || echo "$f" ; done
-
-  or an alternative for comparison with previous release
-
-     git diff 0.10.0 | grep -B2 'index 0000000..' | grep -B1 'new file mode' | sed -n -e '/^diff /s,.* b/,,gp' >> MANIFEST
-     sort MANIFEST | uniq | sponge MANIFEST
-
-* Run::
-
-  python setup.py sdist
-
-* Look for errors like::
-
-   'testcases/files/logs/mysqld.log' not a regular file -- skipping
-
-  * Which indicates that testcases/files/logs/mysqld.log has been moved or is a directory::
-
-      tar -C /tmp -jxf dist/fail2ban-0.9.6.tar.bz2
-
-* clean up current directory::
-
-    diff -rul --exclude \*.pyc . /tmp/fail2ban-0.10.0/
-
-  * Only differences should be files that you don't want distributed.
-
-
-* Ensure the tests work from the tarball::
-
-    cd /tmp/fail2ban-0.9.6/ && bin/fail2ban-testcases
-
-* Add/finalize the corresponding entry in the ChangeLog
-
-  * To generate a list of committers use e.g.::
-
-      git shortlog -sn 0.10.0.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
-
-  * Ensure the top of the ChangeLog has the right version and current date.
-  * Ensure the top entry of the ChangeLog has the right version and current date.
-
-* Update man pages::
-
-    (cd man ; ./generate-man )
-    git commit -m 'DOC/ENH: update man pages for release' man/*
-
-* Cleanout TODO file with the finished stuff
-
-* Prepare source and rpm binary distributions::
-
-    python setup.py sdist
-
-  * Broken for now:  python setup.py bdist_rpm
-  * Broken for now:  python setup.py upload
-
-
-* Tag the release by using a signed (and annotated) tag.  Cut/paste
-  release ChangeLog entry as tag annotation::
-
-    git tag -s 0.10.0
-
-Pre Release
-===========
-
-* Provide a release sample to distributors
-
-  * Arch Linux:
-
-    * https://www.archlinux.org/packages/community/any/fail2ban/
-
-  * Debian: Yaroslav Halchenko <debian@onerussian.com>
-
-    * http://packages.qa.debian.org/f/fail2ban.html
-
-  * FreeBSD: Christoph Theis theis@gmx.at>
-
-    * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/Makefile?view=markup
-    * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
-
-  * Fedora: Axel Thimm <Axel.Thimm@atrpms.net>
-
-    * https://apps.fedoraproject.org/packages/fail2ban
-    * http://pkgs.fedoraproject.org/cgit/fail2ban.git
-    * https://admin.fedoraproject.org/pkgdb/acls/bugs/fail2ban
-
-  * Gentoo: netmon@gentoo.org
-
-    * http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/metadata.xml?view=markup
-    * https://bugs.gentoo.org/buglist.cgi?quicksearch=fail2ban
-
-  * openSUSE: Stephan Kulow <coolo@suse.com>
-
-    * https://build.opensuse.org/package/show/openSUSE:Factory/fail2ban
-
-  * Mac Ports: @Malbrouck on github (gh-49)
-
-    * https://trac.macports.org/browser/trunk/dports/security/fail2ban/Portfile
-
-  * Mageia:
-
-    * https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
-
-  * And potentially to the fail2ban-users email list.
-
-
-* Wait for feedback from distributors
-
-* Prepare a release notice https://github.com/fail2ban/fail2ban/releases/new
-
-* Upload the source/binaries from the dist directory and tag the release using the URL
-
-* Upload source/binaries to sourceforge http://sourceforge.net/projects/fail2ban/
-
-* Run the following and update the wiki with output::
-
-    python -c 'import fail2ban.protocol; fail2ban.protocol.printWiki()'
-
-  * page: http://www.fail2ban.org/wiki/index.php/Commands
-
-
-* Update:
-
-  * http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_Versions&action=edit
-
-  * http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_News&action=edit
-    * move old bits to http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_OldNews&action=edit
-
-  * http://www.fail2ban.org/wiki/index.php/ChangeLog
-  * http://www.fail2ban.org/wiki/index.php/Requirements (Check requirement)
-  * http://www.fail2ban.org/wiki/index.php/Features
-
-* See if any filters are upgraded:
-  http://www.fail2ban.org/wiki/index.php/Special:AllPages
-
-* Email users and development list of release
-
-* notify distributors
-
-Post Release
-============
-
-Add the following to the top of the ChangeLog::
-
-  ver. 0.10.0 (2016/XX/XXX) - wanna-be-released
-  -----------
-  
-  ### Fixes
-  
-  ### New Features
-  
-  ### Enhancements
-
-Alter the git shortlog command in the previous section to refer to the just
-released version.
-
-and adjust fail2ban/version.py to carry .dev0 suffix to signal
-a version under development.
@@ -6,18 +6,13 @@ the project.  If you have been left off, please let us know
 (preferably send a pull request on github with the "fix") and you will
 be added

-Aaron Brice
 Adam Tkac
 Adrien Clerc
 ache
 ag4ve (Shawn)
 Alasdair D. Campbell
-Alexander Koeppe (IPv6 support)
-Alexandre Perrin (kAworu)
 Amir Caspi
 Amy
-Andrew James Collett (ajcollett)
-Andrew St. Jean
 Andrey G. Grozin
 Andy Fragen
 Arturo 'Buanzo' Busleiman
@@ -31,39 +26,26 @@ Christian Rauch
 Christophe Carles
 Christoph Haas
 Christos Psonis
-craneworks
 Cyril Jaquier
 Daniel B. Cid
 Daniel B.
 Daniel Black
 David Nutter
-David Reagan (jerrac)
 Derek Atkins
-Donald Yandt
 Eric Gerbier
 Enrico Labedzki
-Eugene Hopkinson (SlowRiot)
 ftoppi
-Florian Robert (1technophile)
 François Boulogne
-Frantisek Sumsal
 Frédéric
 Georgiy Mernov
 Guilhem Lettron
 Guillaume Delvit
-Hank Leininger
 Hanno 'Rince' Wagner
-Helmut Grohne
 Iain Lea
-Ioan Indreias
 Ivo Truxa
-John Thoe
 Jacques Lav!gnotte
-Johannes Weberhofer
-Jason H Martin
-Jeaye Wilkerson
+Ioan Indreias
 Jisoo Park
-Joel M Snyder
 Jonathan Kamens
 Jonathan Lanning
 Jonathan Underwood
@@ -71,14 +53,10 @@ Joël Bertrand
 JP Espinosa
 jserrachinha
 Justin Shore
-Kevin Locke
 Kévin Drapel
 kjohnsonecl
 kojiro
-Lars Kneschke
 Lee Clemens
-leftyfb (Mike Rushton)
-M. Maraun
 Manuel Arostegui Ramirez
 Marcel Dopita
 Mark Edgington
@@ -91,16 +69,9 @@ mEDI
 Merijn Schering
 Michael C. Haller
 Michael Hanselmann
-Mika (mkl)
 Nick Munger
-onorua
-Orion Poplawski
-Pablo Rodriguez Fernandez
-Paul Marrapese
-Paul Traina
 Noel Butler
 Patrick Börjesson
-Pressy
 Raphaël Marichez
 RealRancor
 René Berber
@@ -108,33 +79,22 @@ Robert Edeker
 Rolf Fokkens
 Roman Gelfand
 Russell Odom
-SATO Kentaro
-Sean DuBois
 Sebastian Arcus
-Serg G. Brester (sebres)
-Sergey Safarov
-Shaun C.
 Sireyessire
 silviogarbes
 Stefan Tatschner
 Stephen Gildea
 Steven Hiscocks
-TESTOVIK
-Thomas Mayer
 Tom Pike
-Tom Hendrikx
 Tomas Pihl
-Thomas Skierlo (phaleas)
-Tony Lawrence
 Tomasz Ciolek
 Tyler
 Vaclav Misek
 Vincent Deffontaines
 Yaroslav Halchenko
 Winston Smith
-Yehuda Katz
 ykimon
-Yung-Chin Oei
+Yehuda Katz
 Zbigniew Jędrzejewski-Szmek
 zugeschmiert
 Zurd
@@ -7,12 +7,26 @@
 ToDo
 ================================================================================

+See https://github.com/fail2ban/fail2ban/issues?state=open for the list of
+current outstanding issues and wishlists.  They should also be sorted among
+milestones and tagged for filtering.  This file reflects possibly outdated
+plans but is kept for someone to move them into github's issues.
+
 Legend:
 - not yet done
 ? maybe
 # partially done
 * done

+* Removed relative imports
+
+* Cleanup fail2ban-client and fail2ban-server. Move code to server/ and client/
+
+- Add timeout to external commands (signal alarm, watchdog thread, etc)
+
+- Uniformize filters and actions name. Use the software name (openssh, postfix,
+  proftp) and possible qualifier (e.g. auth) after a '-'
+
 - Added <USER> tag for failregex. Add features using this information. Maybe add
  more tags

@@ -23,10 +37,23 @@ Legend:
 - Auto-enable function (search for log files), check modification date to see if
  service is still in use

+- Improve parsing of the action parameters in jailreader.py
+
 - Better handling of the protocol in transmitter.py

 - Add gettext support (I18N)

+- Multiline log reading
+
+- Improve execution of action. Why does subprocess.call deadlock with
+  multi-jails?
+
+# see Feature Request Tracking System at SourceForge.net
+
 # improve documentation and website for user

 # better return values in function
+
+# refactoring in server.py, actions.py, filter.py
+
+* New backend: pyinotify
@@ -1,30 +0,0 @@
-Vagrant.configure("2") do |config|
-
-    config.vm.define "secure" do |secure|
-        secure.vm.box = "ubuntu/trusty64"
-        secure.vm.hostname = "secure.dev.fail2ban.org"
-        secure.vm.network "private_network", ip: "192.168.200.100"
-
-#        secure.vm.synced_folder 'salt/roots', '/srv/salt'
-
-#        secure.vm.provision :salt do |salt|
-#            salt.minion_config = 'salt/minion'
-#            salt.run_highstate = true
-#            salt.verbose = true
-#        end
-    end
-
-    config.vm.define "attacker" do |attacker|
-        attacker.vm.box = "ubuntu/trusty64"
-        attacker.vm.hostname = "attacker.dev.fail2ban.org"
-        attacker.vm.network "private_network", ip: "192.168.200.150"
-
-#        attacker.vm.synced_folder 'salt/roots', '/srv/salt'
-
-#        attacker.vm.provision :salt do |salt|
-#            salt.minion_config = 'salt/minion'
-#            salt.run_highstate = true
-#            salt.verbose = true
-#        end
-    end
-end
@@ -1,37 +0,0 @@
-#!/usr/bin/env python
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-"""
-Fail2Ban reads log file that contains password failure report
-and bans the corresponding IP addresses using firewall rules.
-
-This tools starts/stops fail2ban server or does client/server communication,
-to change/read parameters of the server or jails.
-
-"""
-
-__author__ = "Fail2Ban Developers"
-__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko, 2014-2016 Serg G. Brester"
-__license__ = "GPL"
-
-from fail2ban.client.fail2banclient import exec_command_line, sys
-
-if __name__ == "__main__":
-	exec_command_line(sys.argv)
@@ -1,37 +0,0 @@
-#!/usr/bin/env python
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-"""
-Fail2Ban reads log file that contains password failure report
-and bans the corresponding IP addresses using firewall rules.
-
-This tool starts/stops fail2ban server or does client/server communication
-to change/read parameters of the server or jails.
-
-"""
-
-__author__ = "Fail2Ban Developers"
-__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko, 2014-2016 Serg G. Brester"
-__license__ = "GPL"
-
-from fail2ban.client.fail2banserver import exec_command_line, sys
-
-if __name__ == "__main__":
-	exec_command_line(sys.argv)
@@ -1,71 +0,0 @@
-#!/usr/bin/env python
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-"""Script to run Fail2Ban tests battery
-"""
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-__author__ = "Cyril Jaquier"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2012- Yaroslav Halchenko"
-__license__ = "GPL"
-
-import logging
-import os
-import sys
-import time
-import unittest
-
-# Check if local fail2ban module exists, and use if it exists by
-# modifying the path. This is done so that tests can be used in dev
-# environment.
-if os.path.exists("fail2ban/__init__.py"):
-	sys.path.insert(0, ".")
-from fail2ban.version import version
-
-from fail2ban.tests.utils import getOptParser, initProcess, gatherTests
-from fail2ban.setup import updatePyExec
-
-# Update fail2ban-python env to current python version (where f2b-modules located/installed)
-bindir = os.path.dirname(
-	# __file__ seems to be overwritten sometimes on some python versions (e.g. bug of 2.6 by running under cProfile, etc.):
-	sys.argv[0] if os.path.basename(sys.argv[0]) == 'fail2ban-testcases' else __file__
-)
-updatePyExec(bindir)
-
-(opts, regexps) = getOptParser(__doc__).parse_args()
-
-#
-# Process initialization corresponding options (logging, default options, etc.)
-#
-opts = initProcess(opts)
-verbosity = opts.verbosity
-
-#
-# Gather tests (and filter corresponding options)
-#
-tests = gatherTests(regexps, opts)
-
-#
-# Run the tests
-#
-testRunner = unittest.TextTestRunner(verbosity=verbosity)
-
-tests_results = testRunner.run(tests)
-
-if not tests_results.wasSuccessful(): # pragma: no cover
-	sys.exit(1)
@@ -0,0 +1,90 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Cyril Jaquier
+# 
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class ActionReader(ConfigReader):
+	
+	def __init__(self, action, name, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
+		self.__file = action[0]
+		self.__cInfo = action[1]
+		self.__name = name
+	
+	def setFile(self, fileName):
+		self.__file = fileName
+	
+	def getFile(self):
+		return self.__file
+	
+	def setName(self, name):
+		self.__name = name
+	
+	def getName(self):
+		return self.__name
+	
+	def read(self):
+		return ConfigReader.read(self, "action.d/" + self.__file)
+	
+	def getOptions(self, pOpts):
+		opts = [["string", "actionstart", ""],
+				["string", "actionstop", ""],
+				["string", "actioncheck", ""],
+				["string", "actionban", ""],
+				["string", "actionunban", ""]]
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
+		
+		if self.has_section("Init"):
+			for opt in self.options("Init"):
+				if not self.__cInfo.has_key(opt):
+					self.__cInfo[opt] = self.get("Init", opt)
+	
+	def convert(self):
+		head = ["set", self.__name]
+		stream = list()
+		stream.append(head + ["addaction", self.__file])
+		for opt in self.__opts:
+			if opt == "actionstart":
+				stream.append(head + ["actionstart", self.__file, self.__opts[opt]])
+			elif opt == "actionstop":
+				stream.append(head + ["actionstop", self.__file, self.__opts[opt]])
+			elif opt == "actioncheck":
+				stream.append(head + ["actioncheck", self.__file, self.__opts[opt]])
+			elif opt == "actionban":
+				stream.append(head + ["actionban", self.__file, self.__opts[opt]])
+			elif opt == "actionunban":
+				stream.append(head + ["actionunban", self.__file, self.__opts[opt]])
+		# cInfo
+		if self.__cInfo:
+			for p in self.__cInfo:
+				stream.append(head + ["setcinfo", self.__file, p, self.__cInfo[p]])
+
+		return stream
+		
@@ -0,0 +1,150 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2013- Yaroslav Halchenko"
+__license__ = "GPL"
+
+import logging
+
+from common.exceptions import UnknownJailException, DuplicateJailException
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+##
+# Beautify the output of the client.
+#
+# Fail2ban server only return unformatted return codes which need to be
+# converted into user readable messages.
+
+class Beautifier:
+	
+	def __init__(self, cmd = None):
+		self.__inputCmd = cmd
+
+	def setInputCmd(self, cmd):
+		self.__inputCmd = cmd
+		
+	def getInputCmd(self):
+		return self.__inputCmd
+		
+	def beautify(self, response):
+		logSys.debug("Beautify " + `response` + " with " + `self.__inputCmd`)
+		inC = self.__inputCmd
+		msg = response
+		try:
+			if inC[0] == "ping":
+				msg = "Server replied: " + response
+			elif inC[0] == "start":
+				msg = "Jail started"
+			elif inC[0] == "stop":
+				if len(inC) == 1:
+					if response is None:
+						msg = "Shutdown successful"
+				else:
+					if response is None:
+						msg = "Jail stopped"
+			elif inC[0] == "add":
+				msg = "Added jail " + response
+			elif inC[0] == "flushlogs":
+				msg = "logs: " + response
+			elif inC[0:1] == ['status']:
+				if len(inC) > 1:
+					# Create IP list
+					ipList = ""
+					for ip in response[1][1][2][1]:
+						ipList += ip + " "
+					# Creates file list.
+					fileList = ""
+					for f in response[0][1][2][1]:
+						fileList += f + " "
+					# Display information
+					msg = "Status for the jail: " + inC[1] + "\n"
+					msg = msg + "|- " + response[0][0] + "\n"
+					msg = msg + "|  |- " + response[0][1][2][0] + ":\t" + fileList + "\n"
+					msg = msg + "|  |- " + response[0][1][0][0] + ":\t" + `response[0][1][0][1]` + "\n"
+					msg = msg + "|  `- " + response[0][1][1][0] + ":\t" + `response[0][1][1][1]` + "\n"
+					msg = msg + "`- " + response[1][0] + "\n"
+					msg = msg + "   |- " + response[1][1][0][0] + ":\t" + `response[1][1][0][1]` + "\n"
+					msg = msg + "   |  `- " + response[1][1][2][0] + ":\t" + ipList + "\n"
+					msg = msg + "   `- " + response[1][1][1][0] + ":\t" + `response[1][1][1][1]`
+				else:
+					msg = "Status\n"
+					msg = msg + "|- " + response[0][0] + ":\t" + `response[0][1]` + "\n"
+					msg = msg + "`- " + response[1][0] + ":\t\t" + response[1][1]
+			elif inC[1] == "logtarget":
+				msg = "Current logging target is:\n"
+				msg = msg + "`- " + response
+			elif inC[1:2] == ['loglevel']:
+				msg = "Current logging level is "
+				if response == 1:
+					msg = msg + "ERROR"
+				elif response == 2:
+					msg = msg + "WARN"
+				elif response == 3:
+					msg = msg + "INFO"
+				elif response == 4:
+					msg = msg + "DEBUG"
+				else:
+					msg = msg + `response`
+			elif inC[2] in ("logpath", "addlogpath", "dellogpath"):
+				if len(response) == 0:
+					msg = "No file is currently monitored"
+				else:
+					msg = "Current monitored log file(s):\n"
+					for path in response[:-1]:
+						msg = msg + "|- " + path + "\n"
+					msg = msg + "`- " + response[len(response)-1]
+			elif inC[2] in ("ignoreip", "addignoreip", "delignoreip"):
+				if len(response) == 0:
+					msg = "No IP address/network is ignored"
+				else:
+					msg = "These IP addresses/networks are ignored:\n"
+					for ip in response[:-1]:
+						msg = msg + "|- " + ip + "\n"
+					msg = msg + "`- " + response[len(response)-1]
+			elif inC[2] in ("failregex", "addfailregex", "delfailregex",
+							"ignoreregex", "addignoreregex", "delignoreregex"):
+				if len(response) == 0:
+					msg = "No regular expression is defined"
+				else:
+					msg = "The following regular expression are defined:\n"
+					c = 0
+					for ip in response[:-1]:
+						msg = msg + "|- [" + str(c) + "]: " + ip + "\n"
+						c += 1
+					msg = msg + "`- [" + str(c) + "]: " + response[len(response)-1]
+		except Exception:
+			logSys.warn("Beautifier error. Please report the error")
+			logSys.error("Beautify " + `response` + " with " + `self.__inputCmd` +
+						 " failed")
+			msg = msg + `response`
+		return msg
+
+	def beautifyError(self, response):
+		logSys.debug("Beautify (error) " + `response` + " with " + `self.__inputCmd`)
+		msg = response
+		if isinstance(response, UnknownJailException):
+			msg = "Sorry but the jail '" + response[0] + "' does not exist"
+		elif isinstance(response, IndexError):
+			msg = "Sorry but the command is invalid"
+		elif isinstance(response, DuplicateJailException):
+			msg = "The jail '" + response[0] + "' already exists"
+		return msg
@@ -0,0 +1,108 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Yaroslav Halchenko
+# Modified: Cyril Jaquier
+
+__author__ = 'Yaroslav Halhenko'
+__copyright__ = 'Copyright (c) 2007 Yaroslav Halchenko'
+__license__ = 'GPL'
+
+import logging, os
+from ConfigParser import SafeConfigParser
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class SafeConfigParserWithIncludes(SafeConfigParser):
+	"""
+	Class adds functionality to SafeConfigParser to handle included
+	other configuration files (or may be urls, whatever in the future)
+
+	File should have section [includes] and only 2 options implemented
+	are 'files_before' and 'files_after' where files are listed 1 per
+	line.
+
+	Example:
+
+[INCLUDES]
+before = 1.conf
+         3.conf
+
+after = 1.conf
+
+	It is a simple implementation, so just basic care is taken about
+	recursion. Includes preserve right order, ie new files are
+	inserted to the list of read configs before original, and their
+	includes correspondingly so the list should follow the leaves of
+	the tree.
+
+	I wasn't sure what would be the right way to implement generic (aka c++
+	template) so we could base at any *configparser class... so I will
+	leave it for the future
+
+	"""
+
+	SECTION_NAME = "INCLUDES"
+
+	#@staticmethod
+	def getIncludes(resource, seen = []):
+		"""
+		Given 1 config resource returns list of included files
+		(recursively) with the original one as well
+		Simple loops are taken care about
+		"""
+		
+		# Use a short class name ;)
+		SCPWI = SafeConfigParserWithIncludes
+		
+		parser = SafeConfigParser()
+		parser.read(resource)
+		
+		resourceDir = os.path.dirname(resource)
+
+		newFiles = [ ('before', []), ('after', []) ]
+		if SCPWI.SECTION_NAME in parser.sections():
+			for option_name, option_list in newFiles:
+				if option_name in parser.options(SCPWI.SECTION_NAME):
+					newResources = parser.get(SCPWI.SECTION_NAME, option_name)
+					for newResource in newResources.split('\n'):
+						if os.path.isabs(newResource):
+							r = newResource
+						else:
+							r = os.path.join(resourceDir, newResource)
+						if r in seen:
+							continue
+						s = seen + [resource]
+						option_list += SCPWI.getIncludes(r, s)
+		# combine lists
+		return newFiles[0][1] + [resource] + newFiles[1][1]
+		#print "Includes list for " + resource + " is " + `resources`
+	getIncludes = staticmethod(getIncludes)
+
+
+	def read(self, filenames):
+		fileNamesFull = []
+		if not isinstance(filenames, list):
+			filenames = [ filenames ]
+		for filename in filenames:
+			fileNamesFull += SafeConfigParserWithIncludes.getIncludes(filename)
+		logSys.debug("Reading files: %s" % fileNamesFull)
+		return SafeConfigParser.read(self, fileNamesFull)
+
@@ -0,0 +1,125 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Cyril Jaquier
+# Modified by: Yaroslav Halchenko (SafeConfigParserWithIncludes)
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import glob, logging, os
+from configparserinc import SafeConfigParserWithIncludes
+from ConfigParser import NoOptionError, NoSectionError
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class ConfigReader(SafeConfigParserWithIncludes):
+
+	DEFAULT_BASEDIR = '/etc/fail2ban'
+	
+	def __init__(self, basedir=None):
+		SafeConfigParserWithIncludes.__init__(self)
+		self.setBaseDir(basedir)
+		self.__opts = None
+	
+	def setBaseDir(self, basedir):
+		if basedir is None:
+			basedir = ConfigReader.DEFAULT_BASEDIR	# stock system location
+		self._basedir = basedir.rstrip('/')
+	
+	def getBaseDir(self):
+		return self._basedir
+	
+	def read(self, filename):
+		if not os.path.exists(self._basedir):
+			raise ValueError("Base configuration directory %s does not exist "
+							  % self._basedir)
+		basename = os.path.join(self._basedir, filename)
+		logSys.debug("Reading configs for %s under %s "  % (basename, self._basedir))
+		config_files = [ basename + ".conf" ]
+
+		# possible further customizations under a .conf.d directory
+		config_dir = basename + '.d'
+		config_files += sorted(glob.glob('%s/*.conf' % config_dir))
+
+		config_files.append(basename + ".local")
+	
+		config_files += sorted(glob.glob('%s/*.local' % config_dir))
+
+		# choose only existing ones
+		config_files = filter(os.path.exists, config_files)
+
+		if len(config_files):
+			# at least one config exists and accessible
+			logSys.debug("Reading config files: " + ', '.join(config_files))
+			config_files_read = SafeConfigParserWithIncludes.read(self, config_files)
+			missed = [ cf for cf in config_files if cf not in config_files_read ]
+			if missed:
+				logSys.error("Could not read config files: " + ', '.join(missed))
+			if config_files_read:
+				return True
+			logSys.error("Found no accessible config files for %r under %s" %
+						 ( filename, self.getBaseDir() ))
+			return False
+		else:
+			logSys.error("Found no accessible config files for %r " % filename
+						 + (["under %s" % self.getBaseDir(),
+							 "among existing ones: " + ', '.join(config_files)][bool(len(config_files))]))
+
+			return False
+
+	##
+	# Read the options.
+	#
+	# Read the given option in the configuration file. Default values
+	# are used...
+	# Each optionValues entry is composed of an array with:
+	# 0 -> the type of the option
+	# 1 -> the name of the option
+	# 2 -> the default value for the option
+	
+	def getOptions(self, sec, options, pOptions = None):
+		values = dict()
+		for option in options:
+			try:
+				if option[0] == "bool":
+					v = self.getboolean(sec, option[1])
+				elif option[0] == "int":
+					v = self.getint(sec, option[1])
+				else:
+					v = self.get(sec, option[1])
+				if not pOptions is None and option[1] in pOptions:
+					continue
+				values[option[1]] = v
+			except NoSectionError, e:
+				# No "Definition" section or wrong basedir
+				logSys.error(e)
+				return False
+			except NoOptionError:
+				if not option[2] is None:
+					logSys.warn("'%s' not defined in '%s'. Using default one: %r"
+								% (option[1], sec, option[2]))
+					values[option[1]] = option[2]
+			except ValueError:
+				logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +
+							"'. Using default one: '" + `option[2]` + "'")
+				values[option[1]] = option[2]
+		return values
@@ -24,30 +24,22 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

-from .fail2banreader import Fail2banReader
-from .jailsreader import JailsReader
-from ..helpers import getLogger
+import logging
+from configreader import ConfigReader
+from fail2banreader import Fail2banReader
+from jailsreader import JailsReader

 # Gets the instance of the logger.
-logSys = getLogger(__name__)
-
+logSys = logging.getLogger("fail2ban.client.config")

 class Configurator:
 	
-	def __init__(self, force_enable=False, share_config=None):
+	def __init__(self):
 		self.__settings = dict()
 		self.__streams = dict()
-		# always share all config readers:
-		if share_config is None:
-			share_config = dict()
-		self.__share_config = share_config
-		self.__fail2ban = Fail2banReader(share_config=share_config)
-		self.__jails = JailsReader(force_enable=force_enable, share_config=share_config)
-
-	def Reload(self):
-		# clear all shared handlers:
-		self.__share_config.clear()
-
+		self.__fail2ban = Fail2banReader()
+		self.__jails = JailsReader()
+	
 	def setBaseDir(self, folderName):
 		self.__fail2ban.setBaseDir(folderName)
 		self.__jails.setBaseDir(folderName)
@@ -72,13 +64,13 @@ class Configurator:
 	def getEarlyOptions(self):
 		return self.__fail2ban.getEarlyOptions()

-	def getOptions(self, jail=None, updateMainOpt=None, ignoreWrong=True):
-		self.__fail2ban.getOptions(updateMainOpt)
-		return self.__jails.getOptions(jail, ignoreWrong=ignoreWrong)
+	def getOptions(self, jail = None):
+		self.__fail2ban.getOptions()
+		return self.__jails.getOptions(jail)
 		
-	def convertToProtocol(self, allow_no_files=False):
+	def convertToProtocol(self):
 		self.__streams["general"] = self.__fail2ban.convert()
-		self.__streams["jails"] = self.__jails.convert(allow_no_files=allow_no_files)
+		self.__streams["jails"] = self.__jails.convert()
 	
 	def getConfigStream(self):
 		cmds = list()
@@ -0,0 +1,59 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Cyril Jaquier
+# 
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+#from cPickle import dumps, loads, HIGHEST_PROTOCOL
+from pickle import dumps, loads, HIGHEST_PROTOCOL
+import socket
+
+class CSocket:
+	
+	END_STRING = "<F2B_END_COMMAND>"
+	
+	def __init__(self, sock = "/var/run/fail2ban/fail2ban.sock"):
+		# Create an INET, STREAMing socket
+		#self.csock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+		self.__csock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+		#self.csock.connect(("localhost", 2222))
+		self.__csock.connect(sock)
+	
+	def send(self, msg):
+		# Convert every list member to string
+		obj = dumps([str(m) for m in msg], HIGHEST_PROTOCOL)
+		self.__csock.send(obj + CSocket.END_STRING)
+		ret = self.receive(self.__csock)
+		self.__csock.close()
+		return ret
+	
+	#@staticmethod
+	def receive(sock):
+		msg = ''
+		while msg.rfind(CSocket.END_STRING) == -1:
+			chunk = sock.recv(6)
+			if chunk == '':
+				raise RuntimeError, "socket connection broken"
+			msg = msg + chunk
+		return loads(msg)
+	receive = staticmethod(receive)
@@ -0,0 +1,59 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Cyril Jaquier
+# 
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class Fail2banReader(ConfigReader):
+	
+	def __init__(self, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
+	
+	def read(self):
+		ConfigReader.read(self, "fail2ban")
+	
+	def getEarlyOptions(self):
+		opts = [["string", "socket", "/var/run/fail2ban/fail2ban.sock"],
+				["string", "pidfile", "/var/run/fail2ban/fail2ban.pid"]]
+		return ConfigReader.getOptions(self, "Definition", opts)
+	
+	def getOptions(self):
+		opts = [["int", "loglevel", 1],
+				["string", "logtarget", "STDERR"]]
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts)
+	
+	def convert(self):
+		stream = list()
+		for opt in self.__opts:
+			if opt == "loglevel":
+				stream.append(["set", "loglevel", self.__opts[opt]])
+			elif opt == "logtarget":
+				stream.append(["set", "logtarget", self.__opts[opt]])
+		return stream
+	
@@ -0,0 +1,79 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Cyril Jaquier
+# 
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os
+import logging
+from configreader import ConfigReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class FilterReader(ConfigReader):
+	
+	def __init__(self, fileName, name, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
+		# Defer initialization to the set Methods
+		self.__file = self.__name = self.__opts = None
+		self.setFile(fileName)
+		self.setName(name)
+	
+	def setFile(self, fileName):
+		self.__file = fileName
+		self.__opts = None
+	
+	def getFile(self):
+		return self.__file
+	
+	def setName(self, name):
+		self.__name = name
+
+	def getName(self):
+		return self.__name
+	
+	def read(self):
+		return ConfigReader.read(self, os.path.join("filter.d", self.__file))
+	
+	def getOptions(self, pOpts):
+		opts = [["string", "ignoreregex", ""],
+				["string", "failregex", ""],
+				]
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
+	
+	def convert(self):
+		stream = list()
+		for opt in self.__opts:
+			if opt == "failregex":
+				for regex in self.__opts[opt].split('\n'):
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addfailregex", regex])
+			elif opt == "ignoreregex":
+				for regex in self.__opts[opt].split('\n'):
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addignoreregex", regex])		
+		return stream
+		
@@ -0,0 +1,234 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Cyril Jaquier
+# 
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging, re, glob, os.path
+
+from configreader import ConfigReader
+from filterreader import FilterReader
+from actionreader import ActionReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class JailReader(ConfigReader):
+	
+	actionCRE = re.compile("^([\w_.-]+)(?:\[(.*)\])?$")
+	
+	def __init__(self, name, force_enable=False, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
+		self.__name = name
+		self.__filter = None
+		self.__force_enable = force_enable
+		self.__actions = list()
+		self.__opts = None
+	
+	def getRawOptions(self):
+		return self.__opts
+
+	def setName(self, value):
+		self.__name = value
+	
+	def getName(self):
+		return self.__name
+	
+	def read(self):
+		return ConfigReader.read(self, "jail")
+	
+	def isEnabled(self):
+		return self.__force_enable or ( self.__opts and self.__opts["enabled"] )
+
+	@staticmethod
+	def _glob(path):
+		"""Given a path for glob return list of files to be passed to server.
+
+		Dangling symlinks are warned about and not returned
+		"""
+		pathList = []
+		for p in glob.glob(path):
+			if os.path.exists(p):
+				pathList.append(p)
+			else:
+				logSys.warning("File %s is a dangling link, thus cannot be monitored" % p)
+		return pathList
+
+	def getOptions(self):
+		opts = [["bool", "enabled", "false"],
+				["string", "logpath", "/var/log/messages"],
+				["string", "backend", "auto"],
+				["int", "maxretry", 3],
+				["int", "findtime", 600],
+				["int", "bantime", 600],
+				["string", "usedns", "warn"],
+				["string", "failregex", None],
+				["string", "ignoreregex", None],
+				["string", "ignorecommand", None],
+				["string", "ignoreip", None],
+				["string", "filter", ""],
+				["string", "action", ""]]
+		self.__opts = ConfigReader.getOptions(self, self.__name, opts)
+		if not self.__opts:
+			return False
+		
+		if self.isEnabled():
+			# Read filter
+			if self.__opts["filter"]:
+				self.__filter = FilterReader(self.__opts["filter"], self.__name,
+											 basedir=self.getBaseDir())
+				ret = self.__filter.read()
+				if ret:
+					self.__filter.getOptions(self.__opts)
+				else:
+					logSys.error("Unable to read the filter")
+					return False
+			else:
+				self.__filter = None
+				logSys.warn("No filter set for jail %s" % self.__name)
+		
+			# Read action
+			for act in self.__opts["action"].split('\n'):
+				try:
+					if not act:			  # skip empty actions
+						continue
+					splitAct = JailReader.splitAction(act)
+					action = ActionReader(splitAct, self.__name, basedir=self.getBaseDir())
+					ret = action.read()
+					if ret:
+						action.getOptions(self.__opts)
+						self.__actions.append(action)
+					else:
+						raise AttributeError("Unable to read action")
+				except Exception, e:
+					logSys.error("Error in action definition " + act)
+					logSys.debug("Caught exception: %s" % (e,))
+					return False
+			if not len(self.__actions):
+				logSys.warn("No actions were defined for %s" % self.__name)
+		return True
+	
+	def convert(self, allow_no_files=False):
+		"""Convert read before __opts to the commands stream
+
+		Parameters
+		----------
+		allow_missing : bool
+		  Either to allow log files to be missing entirely.  Primarily is
+		  used for testing
+		 """
+
+		stream = []
+		for opt in self.__opts:
+			if opt == "logpath":
+				found_files = 0
+				for path in self.__opts[opt].split("\n"):
+					pathList = JailReader._glob(path)
+					if len(pathList) == 0:
+						logSys.error("No file(s) found for glob %s" % path)
+					for p in pathList:
+						found_files += 1
+						stream.append(["set", self.__name, "addlogpath", p])
+				if not (found_files or allow_no_files):
+					raise ValueError(
+						"Have not found any log file for %s jail" % self.__name)
+			elif opt == "backend":
+				backend = self.__opts[opt]
+			elif opt == "maxretry":
+				stream.append(["set", self.__name, "maxretry", self.__opts[opt]])
+			elif opt == "ignoreip":
+				for ip in self.__opts[opt].split():
+					# Do not send a command if the rule is empty.
+					if ip != '':
+						stream.append(["set", self.__name, "addignoreip", ip])
+			elif opt == "findtime":
+				stream.append(["set", self.__name, "findtime", self.__opts[opt]])
+			elif opt == "bantime":
+				stream.append(["set", self.__name, "bantime", self.__opts[opt]])
+			elif opt == "usedns":
+				stream.append(["set", self.__name, "usedns", self.__opts[opt]])
+			elif opt == "failregex":
+				stream.append(["set", self.__name, "addfailregex", self.__opts[opt]])
+			elif opt == "ignorecommand":
+				stream.append(["set", self.__name, "ignorecommand", self.__opts[opt]])
+			elif opt == "ignoreregex":
+				for regex in self.__opts[opt].split('\n'):
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addignoreregex", regex])
+		if self.__filter:
+			stream.extend(self.__filter.convert())
+		for action in self.__actions:
+			stream.extend(action.convert())
+		stream.insert(0, ["add", self.__name, backend])
+		return stream
+	
+	#@staticmethod
+	def splitAction(action):
+		m = JailReader.actionCRE.match(action)
+		d = dict()
+		try:
+			mgroups = m.groups()
+		except AttributeError:
+			raise ValueError("While reading action %s we should have got 1 or "
+							 "2 groups. Got: 0" % action)
+		if len(mgroups) == 2:
+			action_name, action_opts = mgroups
+		elif len(mgroups) == 1: # pragma: nocover - unreachable - .* on second group always matches
+			action_name, action_opts = mgroups[0], None
+		else: # pragma: nocover - unreachable - regex only can capture 2 groups
+			raise ValueError("While reading action %s we should have got up to "
+							 "2 groups. Got: %r" % (action, mgroups))
+		if not action_opts is None:
+			# Huge bad hack :( This method really sucks. TODO Reimplement it.
+			actions = ""
+			escapeChar = None
+			allowComma = False
+			for c in action_opts:
+				if c in ('"', "'") and not allowComma:
+					# Start
+					escapeChar = c
+					allowComma = True
+				elif c == escapeChar:
+					# End
+					escapeChar = None
+					allowComma = False
+				else:
+					if c == ',' and allowComma:
+						actions += "<COMMA>"
+					else:
+						actions += c
+			
+			# Split using ,
+			actionsSplit = actions.split(',')
+			# Replace the tag <COMMA> with ,
+			actionsSplit = [n.replace("<COMMA>", ',') for n in actionsSplit]
+			
+			for param in actionsSplit:
+				p = param.split('=')
+				try:
+					d[p[0].strip()] = p[1].strip()
+				except IndexError:
+					logSys.error("Invalid argument %s in '%s'" % (p, action_opts))
+		return [action_name, d]
+	splitAction = staticmethod(splitAction)
@@ -24,13 +24,12 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

-from .configreader import ConfigReader
-from .jailreader import JailReader
-from ..helpers import getLogger
+import logging
+from configreader import ConfigReader
+from jailreader import JailReader

 # Gets the instance of the logger.
-logSys = getLogger(__name__)
-
+logSys = logging.getLogger("fail2ban.client.config")

 class JailsReader(ConfigReader):

@@ -46,15 +45,13 @@ class JailsReader(ConfigReader):
 		self.__jails = list()
 		self.__force_enable = force_enable

-	@property
-	def jails(self):
+	def getJails(self):
 		return self.__jails

 	def read(self):
-		self.__jails = list()
 		return ConfigReader.read(self, "jail")

-	def getOptions(self, section=None, ignoreWrong=True):
+	def getOptions(self, section=None):
 		"""Reads configuration for jail(s) and adds enabled jails to __jails
 		"""
 		opts = []
@@ -66,27 +63,20 @@ class JailsReader(ConfigReader):
 			sections = [ section ]

 		# Get the options of all jails.
-		parse_status = 0
+		parse_status = True
 		for sec in sections:
-			if sec == 'INCLUDES':
-				continue
-			# use the cfg_share for filter/action caching and the same config for all 
-			# jails (use_config=...), therefore don't read it here:
-			jail = JailReader(sec, force_enable=self.__force_enable, 
-				share_config=self.share_config, use_config=self._cfg)
+			jail = JailReader(sec, basedir=self.getBaseDir(),
+							  force_enable=self.__force_enable)
+			jail.read()
 			ret = jail.getOptions()
 			if ret:
 				if jail.isEnabled():
-					# at least one jail was successful:
-					parse_status |= 1
 					# We only add enabled jails
 					self.__jails.append(jail)
 			else:
-				logSys.error("Errors in jail %r.%s", sec, " Skipping..." if ignoreWrong else "")
-				self.__jails.append(jail)
-				# at least one jail was invalid:
-				parse_status |= 2
-		return ((ignoreWrong and parse_status & 1) or not (parse_status & 2))
+				logSys.error("Errors in jail %r. Skipping..." % sec)
+				parse_status = False
+		return parse_status

 	def convert(self, allow_no_files=False):
 		"""Convert read before __opts and jails to the commands stream
@@ -99,13 +89,15 @@ class JailsReader(ConfigReader):
 		"""

 		stream = list()
+		for opt in self.__opts:
+			if opt == "":
+				stream.append([])
 		# Convert jails
 		for jail in self.__jails:
 			stream.extend(jail.convert(allow_no_files=allow_no_files))
 		# Start jails
 		for jail in self.__jails:
-			if not jail.options.get('config-error'):
-				stream.append(["start", jail.getName()])
+			stream.append(["start", jail.getName()])

 		return stream

@@ -17,6 +17,14 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

-__author__ = "Steven Hiscocks"
-__copyright__ = "Copyright (c) 2014 Steven Hiscocks"
+# Author: Cyril Jaquier
+# 
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
+
+import logging
+
+# Custom debug level
+logging.HEAVYDEBUG = 5
@@ -23,15 +23,13 @@ __author__ = "Cyril Jaquier, Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav Halchenko"
 __license__ = "GPL"

-
 #
 # Jails
 #
 class DuplicateJailException(Exception):
 	pass

-
-class UnknownJailException(KeyError):
+class UnknownJailException(Exception):
 	pass


@@ -1,7 +1,6 @@
-#!/usr/bin/env python
 # emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
 # vi: set ft=python sts=4 ts=4 sw=4 noet :
-#
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -17,18 +16,13 @@
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-"""
-Fail2Ban  reads log file that contains password failure report
-and bans the corresponding IP addresses using firewall rules.

-This tools can test regular expressions for "fail2ban".
-
-"""
-
-__author__ = "Fail2Ban Developers"
-__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko"
+__author__ = "Cyril Jaquier, Arturo 'Buanzo' Busleiman, Yaroslav Halchenko"
 __license__ = "GPL"

-from fail2ban.client.fail2banregex import exec_command_line

-exec_command_line()
+def formatExceptionInfo():
+	""" Consistently format exception information """
+	import sys
+	cla, exc = sys.exc_info()[:2]
+	return (cla.__name__, str(exc))
@@ -0,0 +1,142 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Cyril Jaquier
+# 
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import textwrap
+
+##
+# Describes the protocol used to communicate with the server.
+
+protocol = [
+['', "BASIC", ""],
+["start", "starts the server and the jails"], 
+["reload", "reloads the configuration"], 
+["reload <JAIL>", "reloads the jail <JAIL>"], 
+["stop", "stops all jails and terminate the server"], 
+["status", "gets the current status of the server"], 
+["ping", "tests if the server is alive"], 
+["help", "return this output"], 
+['', "LOGGING", ""],
+["set loglevel <LEVEL>", "sets logging level to <LEVEL>. 0 is minimal, 4 is debug"], 
+["get loglevel", "gets the logging level"], 
+["set logtarget <TARGET>", "sets logging target to <TARGET>. Can be STDOUT, STDERR, SYSLOG or a file"], 
+["get logtarget", "gets logging target"], 
+["flushlogs", "flushes the logtarget if a file and reopens it. For log rotation."], 
+['', "JAIL CONTROL", ""],
+["add <JAIL> <BACKEND>", "creates <JAIL> using <BACKEND>"], 
+["start <JAIL>", "starts the jail <JAIL>"], 
+["stop <JAIL>", "stops the jail <JAIL>. The jail is removed"], 
+["status <JAIL>", "gets the current status of <JAIL>"],
+['', "JAIL CONFIGURATION", ""],
+["set <JAIL> idle on|off", "sets the idle state of <JAIL>"], 
+["set <JAIL> addignoreip <IP>", "adds <IP> to the ignore list of <JAIL>"], 
+["set <JAIL> delignoreip <IP>", "removes <IP> from the ignore list of <JAIL>"], 
+["set <JAIL> addlogpath <FILE>", "adds <FILE> to the monitoring list of <JAIL>"], 
+["set <JAIL> dellogpath <FILE>", "removes <FILE> from the monitoring list of <JAIL>"],
+["set <JAIL> addfailregex <REGEX>", "adds the regular expression <REGEX> which must match failures for <JAIL>"], 
+["set <JAIL> delfailregex <INDEX>", "removes the regular expression at <INDEX> for failregex"], 
+["set <JAIL> ignorecommand <VALUE>", "sets ignorecommand of <JAIL>"],
+["set <JAIL> addignoreregex <REGEX>", "adds the regular expression <REGEX> which should match pattern to exclude for <JAIL>"],
+["set <JAIL> delignoreregex <INDEX>", "removes the regular expression at <INDEX> for ignoreregex"], 
+["set <JAIL> findtime <TIME>", "sets the number of seconds <TIME> for which the filter will look back for <JAIL>"], 
+["set <JAIL> bantime <TIME>", "sets the number of seconds <TIME> a host will be banned for <JAIL>"], 
+["set <JAIL> usedns <VALUE>", "sets the usedns mode for <JAIL>"],
+["set <JAIL> banip <IP>", "manually Ban <IP> for <JAIL>"], 
+["set <JAIL> unbanip <IP>", "manually Unban <IP> in <JAIL>"], 
+["set <JAIL> maxretry <RETRY>", "sets the number of failures <RETRY> before banning the host for <JAIL>"], 
+["set <JAIL> addaction <ACT>", "adds a new action named <NAME> for <JAIL>"], 
+["set <JAIL> delaction <ACT>", "removes the action <NAME> from <JAIL>"], 
+["set <JAIL> setcinfo <ACT> <KEY> <VALUE>", "sets <VALUE> for <KEY> of the action <NAME> for <JAIL>"], 
+["set <JAIL> delcinfo <ACT> <KEY>", "removes <KEY> for the action <NAME> for <JAIL>"], 
+["set <JAIL> actionstart <ACT> <CMD>", "sets the start command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actionstop <ACT> <CMD>", "sets the stop command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actioncheck <ACT> <CMD>", "sets the check command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actionban <ACT> <CMD>", "sets the ban command <CMD> of the action <ACT> for <JAIL>"],
+["set <JAIL> actionunban <ACT> <CMD>", "sets the unban command <CMD> of the action <ACT> for <JAIL>"], 
+['', "JAIL INFORMATION", ""],
+["get <JAIL> logpath", "gets the list of the monitored files for <JAIL>"],
+["get <JAIL> ignoreip", "gets the list of ignored IP addresses for <JAIL>"],
+["get <JAIL> ignorecommand", "gets ignorecommand of <JAIL>"],
+["get <JAIL> failregex", "gets the list of regular expressions which matches the failures for <JAIL>"],
+["get <JAIL> ignoreregex", "gets the list of regular expressions which matches patterns to ignore for <JAIL>"],
+["get <JAIL> findtime", "gets the time for which the filter will look back for failures for <JAIL>"],
+["get <JAIL> bantime", "gets the time a host is banned for <JAIL>"],
+["get <JAIL> usedns", "gets the usedns setting for <JAIL>"],
+["get <JAIL> maxretry", "gets the number of failures allowed for <JAIL>"],
+["get <JAIL> addaction", "gets the last action which has been added for <JAIL>"],
+["get <JAIL> actionstart <ACT>", "gets the start command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionstop <ACT>", "gets the stop command for the action <ACT> for <JAIL>"],
+["get <JAIL> actioncheck <ACT>", "gets the check command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionban <ACT>", "gets the ban command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionunban <ACT>", "gets the unban command for the action <ACT> for <JAIL>"],
+["get <JAIL> cinfo <ACT> <KEY>", "gets the value for <KEY> for the action <ACT> for <JAIL>"],
+]
+
+##
+# Prints the protocol in a "man" format. This is used for the
+# "-h" output of fail2ban-client.
+
+def printFormatted():
+	INDENT=4
+	MARGIN=41
+	WIDTH=34
+	firstHeading = False
+	for m in protocol:
+		if m[0] == '' and firstHeading:
+			print
+		firstHeading = True
+		first = True
+		for n in textwrap.wrap(m[1], WIDTH):
+			if first:
+				line = ' ' * INDENT + m[0] + ' ' * (MARGIN - len(m[0])) + n
+				first = False
+			else:
+				line = ' ' * (INDENT + MARGIN) + n
+			print line
+
+##
+# Prints the protocol in a "mediawiki" format.
+
+def printWiki():
+	firstHeading = False
+	for m in protocol:
+		if m[0] == '':
+			if firstHeading:
+				print "|}"
+			__printWikiHeader(m[1], m[2])
+			firstHeading = True
+		else:
+			print "|-"
+			print "| <span style=\"white-space:nowrap;\"><tt>" + m[0] + "</tt></span> || || " + m[1]
+	print "|}"
+
+def __printWikiHeader(section, desc):
+	print
+	print "=== " + section + " ==="
+	print
+	print desc
+	print
+	print "{|"
+	print "| '''Command''' || || '''Description'''"
@@ -20,12 +20,8 @@
 # Author: Cyril Jaquier
 #

-__author__ = "Cyril Jaquier, Yaroslav Halchenko, Steven Hiscocks, Daniel Black"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2005-2016 Yaroslav Halchenko, 2013-2014 Steven Hiscocks, Daniel Black"
-__license__ = "GPL-v2+"
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2013 Yaroslav Halchenko"
+__license__ = "GPL"

-version = "1.0.1.dev1"
-
-def normVersion():
-  """ Returns fail2ban version in normalized machine-readable format"""
-  return version.replace('.fix', '').replace('.dev', '.')
+version = "0.8.14"
@@ -1,104 +0,0 @@
-# Fail2ban configuration file
-#
-# Action to report IP address to abuseipdb.com
-# You must sign up to obtain an API key from abuseipdb.com.
-#
-# NOTE: These reports may include sensitive Info.
-# If you want cleaner reports that ensure no user data see the helper script at the below website.
-#
-# IMPORTANT:
-#
-# Reporting an IP of abuse is a serious complaint. Make sure that it is
-# serious. Fail2ban developers and network owners recommend you only use this
-# action for:
-#   * The recidive where the IP has been banned multiple times
-#   * Where maxretry has been set quite high, beyond the normal user typing
-#     password incorrectly.
-#   * For filters that have a low likelihood of receiving human errors
-#
-# This action relies on a api_key being added to the above action conf,
-# and the appropriate categories set.
-#
-# Example, for ssh bruteforce (in section [sshd] of `jail.local`): 
-#   action = %(known/action)s
-#            abuseipdb[abuseipdb_apikey="my-api-key", abuseipdb_category="18,22"]
-#
-# See below for categories.
-#
-# Added to fail2ban by Andrew James Collett (ajcollett)
-
-## abuseIPDB Categories, `the abuseipdb_category` MUST be set in the jail.conf action call.
-# Example, for ssh bruteforce: action = %(action_abuseipdb)s[abuseipdb_category="18,22"]
-# ID	Title	Description
-# 3	  Fraud Orders
-# 4	  DDoS Attack
-# 9	  Open Proxy
-# 10	Web Spam
-# 11	Email Spam
-# 14	Port Scan
-# 18	Brute-Force
-# 19	Bad Web Bot
-# 20	Exploited Host
-# 21	Web App Attack
-# 22	SSH	Secure Shell (SSH) abuse. Use this category in combination with more specific categories.
-# 23	IoT Targeted
-# See https://abuseipdb.com/categories for more descriptions
-
-[Definition]
-
-# bypass action for restored tickets
-norestored = 1
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-#
-#          ** IMPORTANT! **
-#
-#          By default, this posts directly to AbuseIPDB's API, unfortunately
-#          this results in a lot of backslashes/escapes appearing in the
-#          reports. This also may include info like your hostname.
-#          If you have your own web server with PHP available, you can
-#          use my (Shaun's) helper PHP script by commenting out the first #actionban
-#          line below, uncommenting the second one, and pointing the URL at
-#          wherever you install the helper script. For the PHP helper script, see
-#          <https://wiki.shaunc.com/wikka.php?wakka=ReportingToAbuseIPDBWithFail2Ban>
-#
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = lgm=$(printf '%%.1000s\n...' "<matches>"); curl -sSf "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: <abuseipdb_apikey>" --data-urlencode "comment=$lgm" --data-urlencode "ip=<ip>" --data "categories=<abuseipdb_category>"
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
-[Init]
-# Option:  abuseipdb_apikey
-# Notes    Your API key from abuseipdb.com
-# Values:  STRING  Default: None
-# Register for abuseipdb [https://www.abuseipdb.com], get api key and set below.
-# You will need to set the category in the action call.
-abuseipdb_apikey =
@@ -1,49 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Chris Caron <lead2gold@gmail.com>
-#
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "The jail <name> as been started successfully." | <apprise> -t "[Fail2Ban] <name>: started on `uname -n`"
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "The jail <name> has been stopped." | <apprise> -t "[Fail2Ban] <name>: stopped on `uname -n`"
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "The IP <ip> has just been banned by Fail2Ban after <failures> attempts against <name>" | <apprise> -n "warning" -t "[Fail2Ban] <name>: banned <ip> from `uname -n`"
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
-[Init]
-
-# Define location of the default apprise configuration file to use
-#
-config = /etc/fail2ban/apprise.conf
-#
-apprise = apprise -c "<config>"
@@ -0,0 +1,19 @@
+# Fail2ban reporting to badips.com
+#
+# Note: This reports and IP only and does not actually ban traffic. Use 
+# another action in the same jail if you want bans to occur.
+#
+# Set the category to the appropriate value before use.
+#
+# To get see register and optional key to get personalised graphs see:
+# http://www.badips.com/blog/personalized-statistics-track-the-attackers-of-all-your-servers-with-one-key
+
+[Definition]
+
+actionban = curl --fail  --user-agent "fail2ban v0.8.12" http://www.badips.com/add/<category>/<ip>
+
+[Init]
+
+# Option: category
+# Notes.: Values are from the list here: http://www.badips.com/get/categories
+category = 
@@ -7,13 +7,13 @@
 # Action to report IP address to blocklist.de
 # Blocklist.de must be signed up to at www.blocklist.de
 # Once registered, one or more servers can be added.
-# This action requires the server 'email address' and the associated apikey.
+# This action requires the server 'email address' and the assoicate apikey.
 #
 # From blocklist.de:
 #   www.blocklist.de is a free and voluntary service provided by a
 #   Fraud/Abuse-specialist, whose servers are often attacked on SSH-,
 #   Mail-Login-, FTP-, Webserver- and other services.
-#   The mission is to report all attacks to the abuse departments of the
+#   The mission is to report all attacks to the abuse deparments of the
 #   infected PCs/servers to ensure that the responsible provider can inform
 #   the customer about the infection and disable them
 #
@@ -25,19 +25,19 @@
 #   * The recidive where the IP has been banned multiple times
 #   * Where maxretry has been set quite high, beyond the normal user typing
 #     password incorrectly.
-#   * For filters that have a low likelihood of receiving human errors
+#   * For filters that have a low likelyhood of receiving human errors
 #

 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =
@@ -54,7 +54,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = curl --fail --data-urlencode "server=<email>" --data "apikey=<apikey>" --data "service=<service>" --data "ip=<ip>" --data-urlencode "logs=<matches><br>" --data 'format=text' --user-agent "<agent>" "https://www.blocklist.de/en/httpreports.html"
+actionban = curl --fail --data-urlencode 'server=<email>' --data 'apikey=<apikey>' --data 'service=<service>' --data 'ip=<ip>' --data-urlencode 'logs=<matches>' --data 'format=text' --user-agent "fail2ban v0.8.12" "https://www.blocklist.de/en/httpreports.html"

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -64,8 +64,10 @@ actionban = curl --fail --data-urlencode "server=<email>" --data "apikey=<apikey
 #
 actionunban =

+[Init]
+
 # Option:  email
-# Notes    server email address, as per blocklist.de account
+# Notes    server email address, as per blocklise.de account
 # Values:  STRING  Default: None
 #
 #email =
@@ -11,17 +11,14 @@
 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipfw show | fgrep -c -m 1 -s 'table(<table>)' > /dev/null 2>&1 || (
-    num=$(ipfw show | awk 'BEGIN { b = <lowest_rule_num> } { if ($1 == b) { b = $1 + 1 } } END { print b }');
-    ipfw -q add "$num" <blocktype> <block> from table\(<table>\) to me <port>; echo "$num" > "<startstatefile>"
-  )
+actionstart = ipfw show | fgrep -q 'table(<table>)' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e <br> else exit b }'; num=$?; ipfw -q add $num <blocktype> <block> from table\(<table>\) to me <port>; echo $num > "<startstatefile>" )


 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =  [ ! -f <startstatefile> ] || ( read num < "<startstatefile>" <br> ipfw -q delete $num <br> rm "<startstatefile>" )
@@ -41,7 +38,7 @@ actioncheck =
 # Values:  CMD
 #
 # requires an ipfw rule like "deny ip from table(1) to me"
-actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || echo "$e" | grep -q "record already exists" || { echo "$e" 1>&2; exit $x; }
+actionban = ipfw table <table> add <ip>


 # Option:  actionunban
@@ -50,7 +47,7 @@ actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ip
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = e=`ipfw table <table> delete <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || echo "$e" | grep -q "record not found" || { echo "$e" 1>&2; exit $x; }
+actionunban = ipfw table <table> delete <ip>

 [Init]
 # Option:  table
@@ -84,11 +81,3 @@ block = ip
 # Values:  STRING
 #
 blocktype = unreach port
-
-# Option:  lowest_rule_num
-# Notes:   When fail2ban starts with action and there is no rule for the given table yet
-#          then fail2ban will start looking for an empty slot starting with this rule number.
-# Values:  NUM
-lowest_rule_num = 111
-
-
@@ -1,88 +0,0 @@
-#
-# Author: Mike Rushton
-#
-# IMPORTANT
-#
-# Please set jail.local's permission to 640 because it contains your CF API key.
-#
-# This action depends on curl (and optionally jq).
-# Referenced from http://www.normyee.net/blog/2012/02/02/adding-cloudflare-support-to-fail2ban by NORM YEE
-#
-# To get your CloudFlare API Key: https://www.cloudflare.com/a/account/my-account
-#
-# CloudFlare API error codes: https://www.cloudflare.com/docs/host-api.html#s4.2
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-# API v1
-#actionban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=ban' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
-# API v4
-actionban = curl -s -o /dev/null -X POST <_cf_api_prms> \
-            -d '{"mode":"block","configuration":{"target":"<cftarget>","value":"<ip>"},"notes":"Fail2Ban <name>"}' \
-            <_cf_api_url>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-# API v1
-#actionunban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=nul' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
-# API v4
-actionunban = id=$(curl -s -X GET <_cf_api_prms> \
-                   "<_cf_api_url>?mode=block&configuration_target=<cftarget>&configuration_value=<ip>&page=1&per_page=1&notes=Fail2Ban%%20<name>" \
-                   | { jq -r '.result[0].id' 2>/dev/null || tr -d '\n' | sed -nE 's/^.*"result"\s*:\s*\[\s*\{\s*"id"\s*:\s*"([^"]+)".*$/\1/p'; })
-              if [ -z "$id" ]; then echo "<name>: id for <ip> cannot be found"; exit 0; fi;
-              curl -s -o /dev/null -X DELETE <_cf_api_prms> "<_cf_api_url>/$id"
-
-_cf_api_url = https://api.cloudflare.com/client/v4/user/firewall/access_rules/rules
-_cf_api_prms = -H 'X-Auth-Email: <cfuser>' -H 'X-Auth-Key: <cftoken>' -H 'Content-Type: application/json'
-
-[Init]
-
-# If you like to use this action with mailing whois lines, you could use the composite action
-# action_cf_mwl predefined in jail.conf, just define in your jail:
-#
-# action = %(action_cf_mwl)s
-# # Your CF account e-mail
-# cfemail  = 
-# # Your CF API Key
-# cfapikey = 
-
-cftoken =
-
-cfuser =
-
-cftarget = ip
-
-[Init?family=inet6]
-cftarget = ip6
@@ -5,7 +5,7 @@
 # offending IP address.
 # This uses the https://abusix.com/contactdb.html to lookup abuse contacts.
 #
-# DEPENDENCIES:
+# DEPENDANCIES:
 # This requires the dig command from bind-utils
 #
 # You should provide the <logpath> in the jail config - lines from the log
@@ -28,26 +28,16 @@
 #


-[INCLUDES]
-
-before = helpers-common.conf
-
 [Definition]

-# Used in test cases for coverage internal transformations
-debug = 0
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =
@@ -64,18 +54,10 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = oifs=${IFS};
-            RESOLVER_ADDR="%(addr_resolver)s"
-            if [ "<debug>" -gt 0 ]; then echo "try to resolve $RESOLVER_ADDR"; fi
-            ADDRESSES=$(dig +short -t txt -q $RESOLVER_ADDR | tr -d '"')
-            IFS=,; ADDRESSES=$(echo $ADDRESSES)
-            IFS=${oifs}
-            IP=<ip>
+actionban = oifs=${IFS}; IFS=.;SEP_IP=( <ip> ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs}
+	    IP=<ip>
            if [ ! -z "$ADDRESSES" ]; then
-                ( printf %%b "<message>\n"; date '+Note: Local timezone is %%z (%%Z)'; 
-                  printf %%b "\nLines containing failures of <ip> (max <grepmax>)\n";
-                  %(_grep_logs)s;
-                ) | <mailcmd> "Abuse from <ip>" <mailargs> $ADDRESSES
+                (printf %%b "<message>\n"; date '+Note: Local timezone is %%z (%%Z)'; grep -E '(^|[^0-9])<ip>([^0-9]|$)' <logpath>) | <mailcmd> "Abuse from <ip>" <mailargs> ${ADDRESSES//,/\" \"}
            fi

 # Option:  actionunban
@@ -86,12 +68,7 @@ actionban = oifs=${IFS};
 #
 actionunban =

-# Server as resolver used in dig command
-#
-addr_resolver = <ip-rev>abuse-contacts.abusix.org
-
-# Default message used for abuse content
-#
+[Init]
 message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to a abusix.com is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process.)\n\n This mail was generated by Fail2Ban.\nThe recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here: https://abusix.com/global-reporting/abuse-contact-db\nabusix.com is neither responsible nor liable for the content or accuracy of this message.\n

 # Path to the log files which contain relevant lines for the abuser IP
@@ -102,7 +79,7 @@ logpath = /dev/null
 # Notes.:  Your system mail command. Is passed 2 args: subject and recipient
 # Values:  CMD
 #
-mailcmd = mail -E 'set escape' -s
+mailcmd = mail -s

 # Option:  mailargs
 # Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
@@ -115,7 +92,3 @@ mailcmd = mail -E 'set escape' -s
 #
 mailargs =

-# Number of log lines to include in the email
-#
-#grepmax = 1000
-#grepopts = -m <grepmax>
@@ -28,17 +28,14 @@

 [Definition]

-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile>.buffer ]; then
@@ -179,7 +176,7 @@ tcpflags =
 # Notes.:  Your system mail command. Is passed 2 args: subject and recipient
 # Values:  CMD
 #
-mailcmd = mail -E 'set escape' -s
+mailcmd = mail -s

 # Option:  mailargs
 # Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
@@ -7,26 +7,17 @@
 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = if [ ! -z '<target>' ]; then touch <target>; fi;
-              printf %%b "<init>\n" <to_target>
-              echo "%(debug)s started"
-
-# Option:  actionflush
-# Notes.:  command executed once to flush (clear) all IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = printf %%b "-*\n" <to_target>
-              echo "%(debug)s clear all"
+actionstart = touch /var/run/fail2ban/fail2ban.dummy
+              printf %%b "<init>\n" >> /var/run/fail2ban/fail2ban.dummy

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = if [ ! -z '<target>' ]; then rm -f <target>; fi;
-             echo "%(debug)s stopped"
+actionstop = rm -f /var/run/fail2ban/fail2ban.dummy

 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -40,8 +31,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "+<ip>\n" <to_target>
-            echo "%(debug)s banned <ip> (family: <family>)"
+actionban = printf %%b "+<ip>\n" >> /var/run/fail2ban/fail2ban.dummy

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -49,15 +39,9 @@ actionban = printf %%b "+<ip>\n" <to_target>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = printf %%b "-<ip>\n" <to_target>
-              echo "%(debug)s unbanned <ip> (family: <family>)"
-
-
-debug = [<name>] <actname> <target> --
+actionunban = printf %%b "-<ip>\n" >> /var/run/fail2ban/fail2ban.dummy

 [Init]

 init = 123

-target = /var/run/fail2ban/fail2ban.dummy
-to_target = >> <target>
@@ -1,45 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# Because of the --remove-rules in stop this action requires firewalld-0.3.8+
-
-
-[INCLUDES]
-
-before = firewallcmd-common.conf
-
-[Definition]
-
-actionstart = firewall-cmd --direct --add-chain <family> filter f2b-<name>
-              firewall-cmd --direct --add-rule <family> filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 -j f2b-<name>
-
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 -j f2b-<name>
-             firewall-cmd --direct --remove-rules <family> filter f2b-<name>
-             firewall-cmd --direct --remove-chain <family> filter f2b-<name>
-
-
-# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-recidive$'
-
-actioncheck = firewall-cmd --direct --get-chains <family> filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
-
-actionban = firewall-cmd --direct --add-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-actionunban = firewall-cmd --direct --remove-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-# DEV NOTES:
-#
-# Author: Donald Yandt 
-# Uses "FirewallD" instead of the "iptables daemon".
-#
-#
-# Output:
-
-# actionstart:
-# $ firewall-cmd --direct --add-chain ipv4 filter f2b-recidive
-# success
-# $ firewall-cmd --direct --add-rule ipv4 filter f2b-recidive 1000 -j RETURN
-# success
-# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-recidive
-# success
-
@@ -1,76 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt
-#
-
-[Init]
-
-# Option:  name
-# Notes    Default name of the chain
-# Values:  STRING
-name = default
-
-# Option   port
-# Notes    Can also use port numbers separated by a comma and in rich-rules comma and/or space.
-# Value    STRING Default: 1:65535
-port = 1:65535
-
-# Option:  protocol
-# Notes    [ tcp | udp | icmp | all ]
-# Values:  STRING Default: tcp
-protocol = tcp
-
-# Option:  family(ipv4)
-# Notes    specifies the socket address family type
-# Values:  STRING  
-family = ipv4
-
-# Option:  chain
-# Notes    specifies the firewalld chain to which the Fail2Ban rules should be
-#          added
-# Values:  STRING  Default: INPUT_direct
-chain = INPUT_direct
-
-# Option:  zone
-# Notes    use command firewall-cmd --get-active-zones to see a list of all active zones. See firewalld man pages for more information on zones
-# Values:  STRING  Default: public
-zone = public
-
-# Option:  service
-# Notes    use command firewall-cmd --get-services to see a list of services available
-#          Examples services: amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps 
-#          freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos 
-#          kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s 
-#          postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy 
-#          telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
-# Values:  STRING Default: ssh 
-service = ssh
-
-# Option:  rejecttype (ipv4)
-# Notes    See iptables/firewalld man pages for ipv4 reject types. 
-# Values:  STRING
-rejecttype = icmp-port-unreachable
-
-# Option:  blocktype (ipv4/ipv6)
-# Notes    See iptables/firewalld man pages for jump targets. Common values are REJECT, 
-#          REJECT --reject-with icmp-port-unreachable, DROP
-# Values:  STRING
-blocktype = REJECT --reject-with <rejecttype>
-
-# Option:  rich-blocktype (ipv4/ipv6)
-# Notes    See firewalld man pages for jump targets. Common values are reject, 
-#          reject type="icmp-port-unreachable", drop
-# Values:  STRING
-rich-blocktype = reject type='<rejecttype>'
-
-[Init?family=inet6]
-
-# Option:  family(ipv6)
-# Notes    specifies the socket address family type
-# Values:  STRING  
-family = ipv6
-
-# Option:  rejecttype (ipv6)
-# Note:    See iptables/firewalld man pages for ipv6 reject types. 
-# Values:  STRING
-rejecttype = icmp6-port-unreachable
@@ -14,52 +14,39 @@

 [INCLUDES]

-before = firewallcmd-common.conf
+before = iptables-blocktype.conf

 [Definition]

-actionstart = <ipstype_<ipsettype>/actionstart>
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
+actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>

-actionflush = <ipstype_<ipsettype>/actionflush>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
+             ipset flush fail2ban-<name>
+             ipset destroy fail2ban-<name>

-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
-             <actionflush>
-             <ipstype_<ipsettype>/actionstop>
+actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist

-actionban = <ipstype_<ipsettype>/actionban>
-
-# actionprolong = %(actionban)s
-
-actionunban = <ipstype_<ipsettype>/actionunban>
-
-[ipstype_ipset]
-
-actionstart = ipset create <ipmset> hash:ip timeout <default-ipsettime> <familyopt>
-
-actionflush = ipset flush <ipmset>
-
-actionstop = ipset destroy <ipmset>
-
-actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
-
-actionunban = ipset del <ipmset> <ip> -exist
-
-[ipstype_firewalld]
-
-actionstart = firewall-cmd --direct --new-ipset=<ipmset> --type=hash:ip --option=timeout=<default-ipsettime> <firewalld_familyopt>
-
-# TODO: there doesn't seem to be an explicit way to invoke the ipset flush function using firewall-cmd
-actionflush = 
-
-actionstop = firewall-cmd --direct --delete-ipset=<ipmset>
-
-actionban = firewall-cmd --ipset=<ipmset> --add-entry=<ip>
-
-actionunban = firewall-cmd --ipset=<ipmset> --remove-entry=<ip>
+actionunban = ipset del fail2ban-<name> <ip> -exist

 [Init]

+# Default name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ]
+#
+protocol = tcp
+
 # Option:  chain
 # Notes    specifies the iptables chain to which the fail2ban rules should be
 #          added
@@ -67,55 +54,14 @@ actionunban = firewall-cmd --ipset=<ipmset> --remove-entry=<ip>
 #
 chain = INPUT_direct

-# Option: default-ipsettime
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
-default-ipsettime = 0
+# Option: bantime
+# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
+# Values:  [ NUM ]  Default: 600

-# Option: ipsettime
-# Notes:  specifies ticket timeout (handled ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
-ipsettime = 0
-
-# expresion to caclulate timeout from bantime, example:
-# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
-timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
-
-# Option: ipsettype
-# Notes.: defines type of ipset used for match-set (firewalld or ipset)
-# Values: firewalld or ipset
-# Default: ipset
-ipsettype = ipset
-
-# Option: actiontype
-# Notes.: defines additions to the blocking rule
-# Values: leave empty to block all attempts from the host
-# Default: Value of the multiport
-actiontype = <multiport>
-
-# Option: allports
-# Notes.: default addition to block all ports
-# Usage.: use in jail config:  banaction = firewallcmd-ipset[actiontype=<allports>]
-#         for all protocols:   banaction = firewallcmd-ipset[actiontype=""]
-allports = -p <protocol>
-
-# Option: multiport
-# Notes.: addition to block access only to specific ports
-# Usage.: use in jail config:  banaction = firewallcmd-ipset[actiontype=<multiport>]
-multiport = -p <protocol> -m multiport --dports <port>
-
-ipmset = f2b-<name>
-familyopt =
-firewalld_familyopt =
-
-[Init?family=inet6]
-
-ipmset = f2b-<name>6
-familyopt = family inet6
-firewalld_familyopt = --option=family=inet6
+bantime = 600


 # DEV NOTES:
 #
-# Author: Edgar Hoch, Daniel Black, Sergey Brester and Mihail Politaev
+# Author: Edgar Hoch and Daniel Black
 # firewallcmd-new / iptables-ipset-proto6 combined for maximium goodness
@@ -1,26 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# Because of the --remove-rules in stop this action requires firewalld-0.3.8+
-
-[INCLUDES]
-
-before = firewallcmd-common.conf
-
-[Definition]
-
-actionstart = firewall-cmd --direct --add-chain <family> filter f2b-<name>
-              firewall-cmd --direct --add-rule <family> filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             firewall-cmd --direct --remove-rules <family> filter f2b-<name>
-             firewall-cmd --direct --remove-chain <family> filter f2b-<name>
-
-# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$'
-
-actioncheck = firewall-cmd --direct --get-chains <family> filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
-
-actionban = firewall-cmd --direct --add-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-actionunban = firewall-cmd --direct --remove-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
@@ -4,23 +4,48 @@

 [INCLUDES]

-before = firewallcmd-common.conf
+before = iptables-blocktype.conf

 [Definition]

-actionstart = firewall-cmd --direct --add-chain <family> filter f2b-<name>
-              firewall-cmd --direct --add-rule <family> filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+actionstart = firewall-cmd --direct --add-chain ipv4 filter fail2ban-<name>
+              firewall-cmd --direct --add-rule ipv4 filter fail2ban-<name> 1000 -j RETURN
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>

-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             firewall-cmd --direct --remove-rules <family> filter f2b-<name>
-             firewall-cmd --direct --remove-chain <family> filter f2b-<name>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+             firewall-cmd --direct --remove-rules ipv4 filter fail2ban-<name>
+             firewall-cmd --direct --remove-chain ipv4 filter fail2ban-<name>

-actioncheck = firewall-cmd --direct --get-chains <family> filter | sed -e 's, ,\n,g' | grep -q 'f2b-<name>$'
+actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q '^fail2ban-<name>$'

-actionban = firewall-cmd --direct --add-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionban = firewall-cmd --direct --add-rule ipv4 filter fail2ban-<name> 0 -s <ip> -j <blocktype>

-actionunban = firewall-cmd --direct --remove-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionunban = firewall-cmd --direct --remove-rule ipv4 filter fail2ban-<name> 0 -s <ip> -j <blocktype>
+
+[Init]
+
+# Default name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ]
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  [ STRING ]
+#
+chain = INPUT_direct

 # DEV NOTES:
 #
@@ -34,7 +59,7 @@ actionunban = firewall-cmd --direct --remove-rule <family> filter f2b-<name> 0 -
 # success
 # $ firewall-cmd --direct --add-rule ipv4 filter fail2ban-name 1000 -j RETURN
 # success
-# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 22 -j fail2ban-name
+# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp --dport 22 -j fail2ban-name
 # success
 # $ firewall-cmd --direct --get-chains ipv4 filter
 # fail2ban-name
@@ -1,29 +0,0 @@
-# Fail2Ban configuration file
-#
-# Authors: Donald Yandt, Sergey G. Brester
-# 
-# Because of the rich rule commands requires firewalld-0.3.1+
-# This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not
-# by chain. So for an example all deny rules will be listed under <zone>_deny and all log rules under <zone>_log. 
-#
-# Also this action logs banned access attempts so you can filter that and increase ban time for offenders.
-#
-# If you use the --permanent rule you get a xml file in /etc/firewalld/zones/<zone>.xml that can be shared and parsed easliy
-#
-# This is an derivative of firewallcmd-rich-rules.conf, see there for details and other parameters.
-
-[INCLUDES]
-
-before = firewallcmd-rich-rules.conf
-
-[Definition]
-
-rich-suffix = log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <rich-blocktype>
-
-[Init]
-
-# log levels are "emerg", "alert", "crit", "error", "warning", "notice", "info" or "debug"
-level = info
-
-# log rate per minute
-rate = 1
@@ -1,44 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# 
-# Because of the rich rule commands requires firewalld-0.3.1+
-# This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not
-# by chain. So for an example all deny rules will be listed under <zone>_deny. 
-#
-# If you use the --permanent rule you get a xml file in /etc/firewalld/zones/<zone>.xml that can be shared and parsed easliy
-#
-# Example commands to view rules:
-# firewall-cmd [--zone=<zone>] --list-rich-rules
-# firewall-cmd [--zone=<zone>] --list-all
-# firewall-cmd [--zone=zone] --query-rich-rule='rule'
-
-[INCLUDES]
-
-before = firewallcmd-common.conf
-
-[Definition]
-
-actionstart = 
-
-actionstop = 
-
-actioncheck = 
-
-#you can also use zones and/or service names. 
-#
-# zone example: 
-# firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' port port='<port>' protocol='<protocol>' <rich-blocktype>"
-#
-# service name example:
-# firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' service name='<service>' <rich-blocktype>"
-#
-# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges separated by a comma or space for an example: http, https, 22-60, 18 smtp 
-
-fwcmd_rich_rule = rule family='<family>' source address='<ip>' port port='$p' protocol='<protocol>' %(rich-suffix)s
-
-actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="%(fwcmd_rich_rule)s"; done
-	   
-actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="%(fwcmd_rich_rule)s"; done
-
-rich-suffix = <rich-blocktype>
@@ -1,17 +0,0 @@
-[DEFAULT]
-
-# Usage:
-#   _grep_logs_args = 'test'
-#   (printf %%b "Log-excerpt contains 'test':\n"; %(_grep_logs)s; printf %%b "Log-excerpt contains 'test':\n") | mail ...
-#
-_grep_logs = logpath="<logpath>"; grep <grepopts> %(_grep_logs_args)s $logpath | <greplimit>
-# options `-wF` used to match only whole words and fixed string (not as pattern)
-_grep_logs_args = -wF "<ip>"
-
-# Used for actions, that should not by executed if ticket was restored:
-_bypass_if_restored = if [ '<restored>' = '1' ]; then exit 0; fi;
-
-[Init]
-greplimit = tail -n <grepmax>
-grepmax = 1000
-grepopts = -m <grepmax>
@@ -8,13 +8,13 @@
 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = 
@@ -31,7 +31,8 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "<daemon_list>: <ip_value>\n" >> <file>
+actionban = IP=<ip> &&
+            printf %%b "<daemon_list>: $IP\n" >> <file>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -39,7 +40,7 @@ actionban = printf %%b "<daemon_list>: <ip_value>\n" >> <file>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = IP=$(echo "<ip_value>" | sed 's/[][\.]/\\\0/g') && sed -i "/^<daemon_list>: $IP$/d" <file>
+actionunban = echo "/^<daemon_list>: <ip>$/<br>d<br>w<br>q" | ed <file>

 [Init]

@@ -54,9 +55,3 @@ file = /etc/hosts.deny
 #          for hosts.deny/hosts_access. Default is all services.
 # Values:  STR  Default: ALL
 daemon_list = ALL
-
-# internal variable IP (to differentiate the IPv4 and IPv6 syntax, where it is enclosed in brackets):
-ip_value = <ip>
-
-[Init?family=inet6]
-ip_value = [<ip>]
@@ -9,7 +9,7 @@
 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 # enable IPF if not already enabled
@@ -17,7 +17,7 @@ actionstart = /sbin/ipf -E


 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 # don't disable IPF with "/sbin/ipf -D", there may be other filters in use
@@ -8,14 +8,14 @@
 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 


 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = 
@@ -8,32 +8,32 @@

 [INCLUDES]

-before = iptables-common.conf
+before = iptables-blocktype.conf


 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -p <protocol> -j f2b-<name>
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> -p <protocol> -j fail2ban-<name>

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -j f2b-<name>
-             <actionflush>
-             <iptables> -X f2b-<name>
+actionstop = iptables -D <chain> -p <protocol> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>

 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -41,7 +41,7 @@ actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -49,7 +49,22 @@ actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>

 [Init]

+# Default name of the chain
+#
+name = default
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT
@@ -0,0 +1,22 @@
+# Fail2Ban configuration file
+#
+# Author: Daniel Black
+#
+# This is a included configuration file and includes the defination for the blocktype
+# used in all iptables based actions by default.
+#
+# The user can override the default in iptables-blocktype.local
+
+[INCLUDES]
+
+after = iptables-blocktype.local
+
+[Init]
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+blocktype = REJECT --reject-with icmp-port-unreachable
+
@@ -1,92 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Daniel Black
-#
-# This is a included configuration file and includes the definitions for the iptables
-# used in all iptables based actions by default.
-#
-# The user can override the defaults in iptables-common.local
-#
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable (see new section Init?family=inet6)
-
-[INCLUDES]
-
-after = iptables-blocktype.local
-        iptables-common.local
-# iptables-blocktype.local is obsolete
-
-[Definition]
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = <iptables> -F f2b-<name>
-
-
-[Init]
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the Fail2Ban rules should be
-#          added
-# Values:  STRING  Default: INPUT
-chain = INPUT
-
-# Default name of the chain
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp-port-unreachable
-
-# Option:  returntype
-# Note:    This is the default rule on "actionstart". This should be RETURN
-#          in all (blocking) actions, except REJECT in allowing actions.
-# Values:  STRING
-returntype = RETURN
-
-# Option:  lockingopt
-# Notes.:  Option was introduced to iptables to prevent multiple instances from
-#          running concurrently and causing irratic behavior.  -w was introduced
-#          in iptables 1.4.20, so might be absent on older systems
-#          See https://github.com/fail2ban/fail2ban/issues/1122
-# Values:  STRING
-lockingopt = -w
-
-# Option:  iptables
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-iptables = iptables <lockingopt>
-
-
-[Init?family=inet6]
-
-# Option:  blocktype (ipv6)
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp6-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp6-port-unreachable
-
-# Option:  iptables (ipv6)
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-iptables = ip6tables <lockingopt>
-
@@ -19,31 +19,24 @@

 [INCLUDES]

-before = iptables-common.conf
+before = iptables-blocktype.conf

 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipset --create f2b-<name> iphash
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
-
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = ipset --flush f2b-<name>
+actionstart = ipset --create fail2ban-<name> iphash
+              iptables -I INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
-             <actionflush>
-             ipset --destroy f2b-<name>
+actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
+             ipset --flush fail2ban-<name>
+             ipset --destroy fail2ban-<name>

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -51,7 +44,7 @@ actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset --test f2b-<name> <ip> ||  ipset --add f2b-<name> <ip>
+actionban = ipset --test fail2ban-<name> <ip> ||  ipset --add fail2ban-<name> <ip>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -59,7 +52,22 @@ actionban = ipset --test f2b-<name> <ip> ||  ipset --add f2b-<name> <ip>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipset --test f2b-<name> <ip> && ipset --del f2b-<name> <ip>
+actionunban = ipset --test fail2ban-<name> <ip> && ipset --del fail2ban-<name> <ip>

 [Init]

+# Default name of the ipset
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default: ssh
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
@@ -12,36 +12,28 @@
 #
 # If you are running on an older kernel you make need to patch in external
 # modules which probably won't be protocol version 6.
-#
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable (see new section Init?family=inet6)

 [INCLUDES]

-before = iptables-common.conf
+before = iptables-blocktype.conf
+

 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipset create <ipmset> hash:ip timeout <default-ipsettime> <familyopt>
-              <iptables> -I <chain> -m set --match-set <ipmset> src -j <blocktype>
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = ipset flush <ipmset>
+actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
+              iptables -I INPUT -m set --match-set fail2ban-<name> src -j <blocktype>

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -m set --match-set <ipmset> src -j <blocktype>
-             <actionflush>
-             ipset destroy <ipmset>
+actionstop = iptables -D INPUT -m set --match-set fail2ban-<name> src -j <blocktype>
+             ipset flush fail2ban-<name>
+             ipset destroy fail2ban-<name>

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -49,9 +41,7 @@ actionstop = <iptables> -D <chain> -m set --match-set <ipmset> src -j <blocktype
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
-
-# actionprolong = %(actionban)s
+actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -59,29 +49,16 @@ actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipset del <ipmset> <ip> -exist
+actionunban = ipset del fail2ban-<name> <ip> -exist

 [Init]

-# Option: default-ipsettime
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
-default-ipsettime = 0
+# Default name of the ipset
+#
+name = default

-# Option: ipsettime
-# Notes:  specifies ticket timeout (handled ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
-ipsettime = 0
+# Option: bantime
+# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
+# Values:  [ NUM ]  Default: 600

-# expresion to caclulate timeout from bantime, example:
-# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
-timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
-
-ipmset = f2b-<name>
-familyopt =
-
-
-[Init?family=inet6]
-
-ipmset = f2b-<name>6
-familyopt = family inet6
+bantime = 600
@@ -12,36 +12,28 @@
 #
 # If you are running on an older kernel you make need to patch in external
 # modules.
-#
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable (see new section Init?family=inet6)

 [INCLUDES]

-before = iptables-common.conf
+before = iptables-blocktype.conf
+

 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipset create <ipmset> hash:ip timeout <default-ipsettime> <familyopt>
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = ipset flush <ipmset>
+actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
+              iptables -I INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>
-             <actionflush>
-             ipset destroy <ipmset>
+actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
+             ipset flush fail2ban-<name>
+             ipset destroy fail2ban-<name>

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -49,9 +41,7 @@ actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
-
-# actionprolong = %(actionban)s
+actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -59,29 +49,28 @@ actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipset del <ipmset> <ip> -exist
+actionunban = ipset del fail2ban-<name> <ip> -exist

 [Init]

-# Option: default-ipsettime
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
-default-ipsettime = 0
+# Default name of the ipset
+#
+name = default

-# Option: ipsettime
-# Notes:  specifies ticket timeout (handled ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
-ipsettime = 0
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default: ssh
+#
+port = ssh

-# expresion to caclulate timeout from bantime, example:
-# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
-timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp

-ipmset = f2b-<name>
-familyopt =
+# Option: bantime
+# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
+# Values:  [ NUM ]  Default: 600

-
-[Init?family=inet6]
-
-ipmset = f2b-<name>6
-familyopt = family inet6
+bantime = 600
@@ -3,50 +3,44 @@
 # Author: Guido Bozzetto
 # Modified: Cyril Jaquier
 #
-# make "f2b-<name>" chain to match drop IP
-# make "f2b-<name>-log" chain to log and drop
-# insert a jump to f2b-<name> from -I <chain> if proto/port match
+# make "fail2ban-<name>" chain to match drop IP
+# make "fail2ban-<name>-log" chain to log and drop
+# insert a jump to fail2ban-<name> from -I <chain> if proto/port match
 #
 #

 [INCLUDES]

-before = iptables-common.conf
+before = iptables-blocktype.conf

 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> 1 -p <protocol> -m multiport --dports <port> -j f2b-<name>
-              <iptables> -N f2b-<name>-log
-              <iptables> -I f2b-<name>-log -j LOG --log-prefix "$(expr f2b-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
-              <iptables> -A f2b-<name>-log -j <blocktype>
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = <iptables> -F f2b-<name>
-              <iptables> -F f2b-<name>-log
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> 1 -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+              iptables -N fail2ban-<name>-log
+              iptables -I fail2ban-<name>-log -j LOG --log-prefix "$(expr fail2ban-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
+              iptables -A fail2ban-<name>-log -j <blocktype>

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             <actionflush>
-             <iptables> -X f2b-<name>
-             <iptables> -X f2b-<name>-log
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -F fail2ban-<name>-log
+             iptables -X fail2ban-<name>
+             iptables -X fail2ban-<name>-log

 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L f2b-<name>-log >/dev/null
+actioncheck = iptables -n -L fail2ban-<name>-log >/dev/null

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -54,7 +48,7 @@ actioncheck = <iptables> -n -L f2b-<name>-log >/dev/null
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -62,7 +56,28 @@ actionban = <iptables> -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j f2b-<name>-log
+actionunban = iptables -D fail2ban-<name> -s <ip> -j fail2ban-<name>-log

 [Init]

+# Default name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT
@@ -6,31 +6,31 @@

 [INCLUDES]

-before = iptables-common.conf
+before = iptables-blocktype.conf

 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             <actionflush>
-             <iptables> -X f2b-<name>
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>

 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -38,7 +38,7 @@ actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -46,7 +46,28 @@ actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>

 [Init]

+# Default name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT
@@ -8,31 +8,32 @@

 [INCLUDES]

-before = iptables-common.conf
+before = iptables-blocktype.conf
+

 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
-             <actionflush>
-             <iptables> -X f2b-<name>
+actionstop = iptables -D <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>

 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -40,7 +41,7 @@ actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -48,7 +49,28 @@ actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>

 [Init]

+# Default name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT
@@ -2,17 +2,17 @@
 #
 # Author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
 #
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable
+#

 [INCLUDES]

-before = iptables-common.conf
+before = iptables-blocktype.conf
+

 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 # Changing iptables rules requires root privileges. If fail2ban is
@@ -23,36 +23,30 @@ before = iptables-common.conf
 # iptables-persistent package).
 # 
 # Explanation of the rule below:
-#    Check if any packets coming from an IP on the <iptname>
+#    Check if any packets coming from an IP on the fail2ban-<name>
 #    list have been seen in the last 3600 seconds. If yes, update the
 #    timestamp for this IP and drop the packet. If not, let the packet
 #    through.
 #
-#    Fail2ban inserts blacklisted hosts into the <iptname> list
+#    Fail2ban inserts blacklisted hosts into the fail2ban-<name> list
 #    and removes them from the list after some time, according to its
 #    own rules. The 3600 second timeout is independent and acts as a
 #    safeguard in case the fail2ban process dies unexpectedly. The
 #    shorter of the two timeouts actually matters.
-actionstart = if [ `id -u` -eq 0 ];then <iptables> -I <chain> -m recent --update --seconds 3600 --name <iptname> -j <blocktype>;fi
-
-# Option:  actionflush
-#
-# [TODO] Flushing is currently not implemented for xt_recent
-#
-actionflush = 
+actionstart = if [ `id -u` -eq 0 ];then iptables -I INPUT -m recent --update --seconds 3600 --name fail2ban-<name> -j <blocktype>;fi

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = echo / > /proc/net/xt_recent/<iptname>
-             if [ `id -u` -eq 0 ];then <iptables> -D <chain> -m recent --update --seconds 3600 --name <iptname> -j <blocktype>;fi
+actionstop = echo / > /proc/net/xt_recent/fail2ban-<name>
+             if [ `id -u` -eq 0 ];then iptables -D INPUT -m recent --update --seconds 3600 --name fail2ban-<name> -j <blocktype>;fi

 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = test -e /proc/net/xt_recent/<iptname>
+actioncheck = test -e /proc/net/xt_recent/fail2ban-<name>

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -60,7 +54,7 @@ actioncheck = test -e /proc/net/xt_recent/<iptname>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = echo +<ip> > /proc/net/xt_recent/<iptname>
+actionban = echo +<ip> > /proc/net/xt_recent/fail2ban-<name>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -68,12 +62,16 @@ actionban = echo +<ip> > /proc/net/xt_recent/<iptname>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = echo -<ip> > /proc/net/xt_recent/<iptname>
+actionunban = echo -<ip> > /proc/net/xt_recent/fail2ban-<name>

 [Init]

-iptname              = f2b-<name>
+# Default name of the chain
+#
+name = default

-[Init?family=inet6]
-
-iptname = f2b-<name>6
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
@@ -6,31 +6,31 @@

 [INCLUDES]

-before = iptables-common.conf
+before = iptables-blocktype.conf

 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -p <protocol> --dport <port> -j f2b-<name>
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> -p <protocol> --dport <port> -j fail2ban-<name>

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> --dport <port> -j f2b-<name>
-             <actionflush>
-             <iptables> -X f2b-<name>
+actionstop = iptables -D <chain> -p <protocol> --dport <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>

 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -38,7 +38,7 @@ actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -46,7 +46,28 @@ actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>

 [Init]

+# Default name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT
@@ -6,21 +6,18 @@

 [Definition]

-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = printf %%b "Hi,\n
              The jail <name> has been started successfully.\n
              Output will be buffered until <lines> lines are available.\n
              Regards,\n
-              Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started on `uname -n`" <dest>

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile> ]; then
@@ -28,13 +25,13 @@ actionstop = if [ -f <tmpfile> ]; then
                 These hosts have been banned by Fail2Ban.\n
                 `cat <tmpfile>`
                 Regards,\n
-                 Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: Summary from <fq-hostname>" <dest>
+                 Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary from `uname -n`" <dest>
                 rm <tmpfile>
             fi
             printf %%b "Hi,\n
             The jail <name> has been stopped.\n
             Regards,\n
-             Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>

 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -55,7 +52,7 @@ actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
                These hosts have been banned by Fail2Ban.\n
                `cat <tmpfile>`
                \nRegards,\n
-                Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: Summary" <dest>
+                Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest>
                rm <tmpfile>
            fi

@@ -1,28 +0,0 @@
-# Fail2Ban configuration file
-#
-# Common settings for mail actions
-#
-# Users can override the defaults in mail-whois-common.local
-
-[INCLUDES]
-
-# Load customizations if any available
-after = mail-whois-common.local
-
-[DEFAULT]
-#original character set of whois output will be sent to mail program
-_whois = whois <ip> || echo "missing whois program"
-
-# use heuristics to convert charset of whois output to a target
-# character set before sending it to a mail program
-# make sure you have 'file' and 'iconv' commands installed when opting for that
-_whois_target_charset = UTF-8
-_whois_convert_charset = (%(_whois)s) |
-                         { WHOIS_OUTPUT=$(cat) ; WHOIS_CHARSET=$(printf %%b "$WHOIS_OUTPUT" | file -b --mime-encoding -) ; printf %%b "$WHOIS_OUTPUT" | iconv -f $WHOIS_CHARSET -t %(_whois_target_charset)s//TRANSLIT - ; }
-
-# choose between _whois and _whois_convert_charset in mail-whois-common.local
-# or other *.local which include mail-whois-common.conf.
-_whois_command = %(_whois)s
-#_whois_command = %(_whois_convert_charset)s
-
-[Init]
@@ -4,33 +4,25 @@
 # Modified-By: Yaroslav Halchenko to include grepping on IP over log files
 #

-[INCLUDES]
-
-before = mail-whois-common.conf
-         helpers-common.conf
-
 [Definition]

-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = printf %%b "Hi,\n
              The jail <name> has been started successfully.\n
              Regards,\n
-              Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started on `uname -n`" <dest>

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = printf %%b "Hi,\n
             The jail <name> has been stopped.\n
             Regards,\n
-             Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>

 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -44,19 +36,15 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-
-_ban_mail_content = ( printf %%b "Hi,\n
+actionban = printf %%b "Hi,\n
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n"
-            %(_whois_command)s;
-            printf %%b "\nLines containing failures of <ip> (max <grepmax>)\n";
-            %(_grep_logs)s;
-            printf %%b "\n
+            Here is more information about <ip>:\n
+            `whois <ip> || echo missing whois program`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `grep -E '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
            Regards,\n
-            Fail2Ban" )
-
-actionban = %(_ban_mail_content)s | <mailcmd> "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
+            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from  `uname -n`" <dest>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -68,12 +56,6 @@ actionunban =

 [Init]

-# Option:  mailcmd
-# Notes.:  Your system mail command. Is passed 2 args: subject and recipient
-# Values:  CMD
-#
-mailcmd = mail -E 'set escape' -s
-
 # Default name of the chain
 #
 name = default
@@ -85,8 +67,3 @@ dest = root
 # Path to the log files which contain relevant lines for the abuser IP
 #
 logpath = /dev/null
-
-# Number of log lines to include in the email
-#
-#grepmax = 1000
-#grepopts = -m <grepmax>
@@ -4,32 +4,25 @@
 #
 #

-[INCLUDES]
-
-before = mail-whois-common.conf
-
 [Definition]

-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = printf %%b "Hi,\n
              The jail <name> has been started successfully.\n
              Regards,\n
-              Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started on `uname -n`" <dest>

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = printf %%b "Hi,\n
             The jail <name> has been stopped.\n
             Regards,\n
-             Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>

 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -46,10 +39,10 @@ actioncheck =
 actionban = printf %%b "Hi,\n
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n
+            Here is more information about <ip>:\n
+            `whois <ip> || echo missing whois program`\n
            Regards,\n
-            Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
+            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -6,26 +6,23 @@

 [Definition]

-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = printf %%b "Hi,\n
              The jail <name> has been started successfully.\n
              Regards,\n
-              Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started  on <fq-hostname>" <dest>
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started  on `uname -n`" <dest>

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = printf %%b "Hi,\n
             The jail <name> has been stopped.\n
             Regards,\n
-             Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>

 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -43,7 +40,7 @@ actionban = printf %%b "Hi,\n
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n
            Regards,\n
-            Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
+            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest>

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -28,13 +28,13 @@
 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =
@@ -111,17 +111,13 @@ myip = `ip -4 addr show dev eth0 | grep inet | head -n 1 | sed -r 's/.*inet ([0-
 #
 protocol = tcp

-# Option:  agent
-# Default: Fail2ban
-agent = Fail2ban
-
 # Option:  getcmd
 # Notes.:  A command to fetch a URL. Should output page to STDOUT
 # Values:  CMD  Default: wget
 #
-getcmd = wget --no-verbose --tries=3 --waitretry=10 --connect-timeout=10 --read-timeout=60 --retry-connrefused --output-document=- --user-agent=<agent>
+getcmd = wget --no-verbose --tries=3 --waitretry=10 --connect-timeout=10 --read-timeout=60 --retry-connrefused --output-document=- --user-agent=Fail2Ban
 # Alternative value:
-# getcmd = curl --silent --show-error --retry 3 --connect-timeout 10 --max-time 60 --user-agent <agent>
+# getcmd = curl --silent --show-error --retry 3 --connect-timeout 10 --max-time 60 --user-agent Fail2Ban

 # Option:  srcport
 # Notes.:  The source port of the attack. You're unlikely to have this info, so
@@ -1,33 +0,0 @@
-# Fail2ban Citrix Netscaler Action
-# by Juliano Jeziorny
-# juliano@jeziorny.eu
-#
-# The script will add offender IPs to a dataset on netscaler, the dataset can then be used to block the IPs at a cs/vserver or global level
-# This dataset is then used to block IPs using responder policies on the netscaler.
-# 
-# The script assumes using HTTPS with unsecure certificate to access the netscaler, 
-# if you have a valid certificate installed remove the -k from the curl lines, or if you want http change it accordingly (and remove the -k)
-# 
-# This action depends on curl
-#
-# You need to populate the 3 options inside Init
-#
-# ns_host: IP or hostname of netslcaer appliance
-# ns_auth: username:password, suggest base64 encoded for a little added security (echo -n "username:password" | base64)
-# ns_dataset:  Name of the netscaler dataset holding the IPs to be blocked.
-# 
-# For further details on how to use it please check http://blog.ckzone.eu/2017/01/fail2ban-action-for-citrix-netscaler.html
-
-[Init]
-ns_host = 
-ns_auth = 
-ns_dataset = 
-
-[Definition]
-actionstart = curl -kH 'Authorization: Basic <ns_auth>' https://<ns_host>/nitro/v1/config
-
-actioncheck = 
-
-actionban = curl -k -H 'Authorization: Basic <ns_auth>' -X PUT -d '{"policydataset_value_binding":{"name":"<ns_dataset>","value":"<ip>"}}' https://<ns_host>/nitro/v1/config/
-
-actionunban = curl -H 'Authorization: Basic <ns_auth>' -X DELETE -k "https://<ns_host>/nitro/v1/config/policydataset_value_binding/<ns_dataset>?args=value:<ip>"
@@ -1,17 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-# Obsolete: superseded by nftables[type=allports]
-
-[INCLUDES]
-
-before = nftables.conf
-
-[Definition]
-
-type = allports
@@ -1,17 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-# Obsolete: superseded by nftables[type=multiport]
-
-[INCLUDES]
-
-before = nftables.conf
-
-[Definition]
-
-type = multiport
@@ -1,203 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Daniel Black
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-# This is a included configuration file and includes the definitions for the nftables
-# used in all nftables based actions by default.
-#
-# The user can override the defaults in nftables-common.local
-# Example: redirect flow to honeypot
-#
-# [Init]
-# table_family = ip
-# chain_type = nat
-# chain_hook = prerouting
-# chain_priority = -50
-# blocktype = counter redirect to 2222
-
-[INCLUDES]
-
-after = nftables-common.local
-
-[Definition]
-
-# Option:  type
-# Notes.:  type of the action.
-# Values:  [ multiport | allports ]  Default: multiport
-#
-type = multiport
-
-rule_match-custom =
-rule_match-allports = meta l4proto \{ <protocol> \}
-rule_match-multiport = $proto dport \{ $(echo '<port>' | sed s/:/-/g) \}
-match = <rule_match-<type>>
-
-# Option:  rule_stat
-# Notes.:  statement for nftables filter rule.
-#          leaving it empty will block all (include udp and icmp)
-# Values:  nftables statement
-#
-rule_stat = %(match)s <addr_family> saddr @<addr_set> <blocktype>
-
-# optional interator over protocol's:
-_nft_for_proto-custom-iter =
-_nft_for_proto-custom-done =
-_nft_for_proto-allports-iter =
-_nft_for_proto-allports-done =
-_nft_for_proto-multiport-iter = for proto in $(echo '<protocol>' | sed 's/,/ /g'); do
-_nft_for_proto-multiport-done = done
-
-_nft_list = <nftables> -a list chain <table_family> <table> <chain>
-_nft_get_handle_id = grep -oP '@<addr_set>\s+.*\s+\Khandle\s+(\d+)$'
-
-_nft_add_set = <nftables> add set <table_family> <table> <addr_set> \{ type <addr_type>\; \}
-              <_nft_for_proto-<type>-iter>
-              <nftables> add rule <table_family> <table> <chain> %(rule_stat)s
-              <_nft_for_proto-<type>-done>
-_nft_del_set = { %(_nft_list)s | %(_nft_get_handle_id)s; } | while read -r hdl; do
-               <nftables> delete rule <table_family> <table> <chain> $hdl; done
-              <nftables> delete set <table_family> <table> <addr_set>
-
-# Option:  _nft_shutdown_table
-# Notes.:  command executed after the stop in order to delete table (it checks that no sets are available):
-# Values:  CMD
-#
-_nft_shutdown_table = { <nftables> list table <table_family> <table> | grep -qP '^\s+set\s+'; } || {
-                        <nftables> delete table <table_family> <table>
-                      }
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = <nftables> add table <table_family> <table>
-              <nftables> -- add chain <table_family> <table> <chain> \{ type <chain_type> hook <chain_hook> priority <chain_priority> \; \}
-              %(_nft_add_set)s
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action);
-#          uses `nft flush set ...` and as fallback (e. g. unsupported) recreates the set (with references)
-# Values:  CMD
-#
-actionflush = { <nftables> flush set <table_family> <table> <addr_set> 2> /dev/null; } || {
-              %(_nft_del_set)s
-              %(_nft_add_set)s
-              }
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = %(_nft_del_set)s
-             <_nft_shutdown_table>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <nftables> list chain <table_family> <table> <chain> | grep -q '@<addr_set>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <nftables> add element <table_family> <table> <addr_set> \{ <ip> \}
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <nftables> delete element <table_family> <table> <addr_set> \{ <ip> \}
-
-[Init]
-
-# Option:  table
-# Notes.:  main table to store chain and sets (automatically created on demand)
-# Values:  STRING  Default: f2b-table
-table = f2b-table
-
-# Option:  table_family
-# Notes.:  address family to work in
-# Values:  [ip | ip6 | inet]  Default: inet
-table_family = inet
-
-# Option:  chain
-# Notes.:  main chain to store rules
-# Values:  STRING  Default: f2b-chain
-chain = f2b-chain
-
-# Option:  chain_type
-# Notes.:  refers to the kind of chain to be created
-# Values:  [filter | route | nat]  Default: filter
-#
-chain_type = filter
-
-# Option:  chain_hook
-# Notes.:  refers to the kind of chain to be created
-# Values:  [ prerouting | input | forward | output | postrouting ]  Default: input
-#
-chain_hook = input
-
-# Option:  chain_priority
-# Notes.:  priority in the chain.
-# Values:  NUMBER  Default: -1
-#
-chain_priority = -1
-
-# Option:  addr_type
-# Notes.:  address type to work with
-# Values:  [ipv4_addr | ipv6_addr]  Default: ipv4_addr
-#
-addr_type = ipv4_addr
-
-# Default name of the filtering set
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp ] Default: tcp
-#
-protocol = tcp
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the nftables man page (section 8). Common values are drop,
-#          reject, reject with icmpx type host-unreachable, redirect to 2222
-# Values:  STRING
-blocktype = reject
-
-# Option:  nftables
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-nftables = nft
-
-# Option: addr_set
-# Notes.: The name of the nft set used to store banned addresses
-# Values: STRING
-addr_set = addr-set-<name>
-
-# Option: addr_family
-# Notes.: The family of the banned addresses
-# Values: [ ip | ip6 ]
-addr_family = ip
-
-[Init?family=inet6]
-addr_family = ip6
-addr_type = ipv6_addr
-addr_set = addr6-set-<name>
@@ -1,117 +0,0 @@
-# Fail2Ban configuration file for black-listing via nginx
-#
-# Author: Serg G. Brester (aka sebres)
-#
-# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration,
-# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban).
-#
-# Example (argument "token_id" resp. cookie "session_id" used here as unique identifier for user):
-#
-#   http {
-#     ...
-#     # maps to check user is blacklisted (banned in f2b):
-#     #map $arg_token_id      $blck_lst_tok { include blacklisted-tokens.map; }
-#     map  $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; }
-#     ...
-#     # special log-format to notify fail2ban about failures:
-#     log_format f2b_session_errors '$msec failure "$cookie_session_id" - $remote_addr - $remote_user '
-#      ;#                  '"$request" $status $bytes_sent '
-#       #                  '"$http_referer" "$http_user_agent"';
-#
-#     # location checking blacklisted values:
-#     location ... {
-#       # check banned sessionid:
-#       if ($blck_lst_ses != "") {
-#         try_files "" @f2b-banned;
-#       }
-#       ...
-#       # notify fail2ban about a failure inside nginx:
-#       error_page 401 = @notify-f2b;
-#       ...
-#     }
-#     ...
-#     # location for return with "403 Forbidden" if banned:
-#     location @f2b-banned {
-#       default_type text/html;
-#       return 403 "<br/><center>
-#         <b style=\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\">
-#         You are banned!</b></center>";
-#     }
-#     ...
-#     # location to notify fail2ban about a failure inside nginx:
-#     location @notify-f2b {
-#       access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;
-#     }
-#   }
-#   ...
-#
-# Note that quote-character (and possibly other special characters) are not allowed currently as session-id.
-# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service), 
-# like in example below:
-#
-#   location ... {
-#     if ($cookie_session_id !~ "^[\w\-]+$") {
-#       return  403 "Wrong session-id"
-#     }
-#     ...
-#   }
-#
-# The parameters for jail corresponding log-format (f2b_session_errors):
-#
-#   [nginx-blck-lst]
-#   filter =
-#   datepattern = ^Epoch
-#   failregex = ^ failure "<F-ID>[^"]+</F-ID>" - <ADDR>
-#   usedns = no
-#
-# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs):
-#
-#   [nginx-blck-ip]
-#   maxretry = 100
-#   filter =
-#   datepattern = ^Epoch
-#   failregex = ^ failure "[^"]+" - <ADDR>
-#   usedns = no
-#
-
-[Definition]
-
-# path to configuration of nginx (used to target nginx-instance in multi-instance system,
-# and as path for the blacklisted map):
-srv_cfg_path = /etc/nginx/
-
-# cmd-line arguments to supply to test/reload nginx:
-#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf
-srv_cmd = nginx
-
-# pid file (used to check nginx is running):
-srv_pid = /run/nginx.pid
-
-# command used to check whether nginx is running and configuration is valid:
-srv_is_running = [ -f "%(srv_pid)s" ]
-srv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt
-
-# first test nginx is running and configuration is correct, hereafter send reload signal:
-blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then
-                    %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;
-                  fi;
-
-# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file="/path/file.map"]`:
-blck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.map
-
-# Action definition:
-
-actionstart_on_demand = false
-actionstart = touch '%(blck_lst_file)s'
-
-actionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s
-
-actionstop = %(actionflush)s
-
-actioncheck = 
-
-_echo_blck_row = printf '\%%s 1;\n' "<fid>"
-
-actionban = %(_echo_blck_row)s >> '%(blck_lst_file)s'; %(blck_lst_reload)s
-
-actionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/^$id$/d" %(blck_lst_file)s; %(blck_lst_reload)s
@@ -1,61 +0,0 @@
-# Fail2Ban configuration file
-#
-# NetBSD npf ban/unban
-#
-# Author: Nils Ratusznik <nils@NetBSD.org>
-# Based on pf.conf action file
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-# we don't enable NPF automatically, as it will be enabled elsewhere
-actionstart = 
-
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-# we don't disable NPF automatically either
-actionstop = 
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = /sbin/npfctl table <tablename> add <ip>
-
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-# note -r option used to remove matching rule
-actionunban = /sbin/npfctl table <tablename> rem <ip>
-
-[Init]
-# Option:  tablename
-# Notes.:  The pf table name.
-# Values:  [ STRING ]
-#
-tablename = fail2ban
@@ -1,114 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Andrew St. Jean
-#
-# Use nsupdate to perform dynamic DNS updates on a BIND zone file.
-# One may want to do this to update a local RBL with banned IP addresses.
-#
-# Options
-#
-# domain	DNS domain that will appear in nsupdate add and delete
-#		commands.
-#
-# ttl		The time to live (TTL) in seconds of the TXT resource
-#		record.
-#
-# rdata		Data portion of the TXT resource record.
-#
-# nsupdatecmd	Full path to the nsupdate command.
-#
-# keyfile	Full path to TSIG key file used for authentication between
-#		nsupdate and BIND.
-#
-# Create an nsupdate.local to set at least the <domain> and <keyfile>
-# options as they don't have default values.
-#
-# The ban and unban commands assume nsupdate will authenticate to the BIND
-# server using a TSIG key. The full path to the key file must be specified
-# in the <keyfile> parameter. Use this command to generate your TSIG key.
-#
-# dnssec-keygen -a HMAC-MD5 -b 256 -n HOST <key_name>
-#
-# Replace <key_name> with some meaningful name.
-#
-# This command will generate two files. Specify the .private file in the
-# <keyfile> option. Note that the .key file must also be present in the same
-# directory for nsupdate to use the key.
-#
-# Don't forget to add the key and appropriate allow-update or update-policy
-# option to your named.conf file.
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart =
-
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop =
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = echo <ip> | awk -F. '{print "prereq nxrrset "$4"."$3"."$2"."$1".<domain> TXT"; print "update add "$4"."$3"."$2"."$1".<domain> <ttl> IN TXT \"<rdata>\""; print "send"}' | <nsupdatecmd> -k <keyfile>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = echo <ip> | awk -F. '{print "update delete "$4"."$3"."$2"."$1".<domain>"; print "send"}' | <nsupdatecmd> -k <keyfile>
-
-[Init]
-
-# Option:  domain
-# Notes.:  DNS domain that nsupdate will update.
-# Values:  STRING
-#
-domain = 
-
-# Option:  ttl
-# Notes.:  time to live (TTL) in seconds of TXT resource record
-#          added by nsupdate.
-# Values:  NUM
-#
-ttl = 60
-
-# Option:  rdata
-# Notes.:  data portion of the TXT resource record added by nsupdate.
-# Values:  STRING
-#
-rdata = Your IP has been banned
-
-# Option:  nsupdatecmd
-# Notes.:  specifies the full path to the nsupdate program that dynamically
-#          updates BIND zone files.
-# Values:  CMD
-#
-nsupdatecmd = /usr/bin/nsupdate
-
-# Option:  keyfile
-# Notes.:  specifies the full path to the file containing the
-#	   TSIG key for communicating with BIND.
-# Values:  STRING
-#
-keyfile = 
-
@@ -12,5 +12,5 @@ actioncheck =
 actionban = /usr/libexec/afctl -a <ip> -t <bantime>
 actionunban = /usr/libexec/afctl -r <ip>

-actionprolong = %(actionunban)s && %(actionban)s
-
+[Init]
+bantime = 2880
@@ -9,14 +9,14 @@
 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 


 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = 
@@ -3,59 +3,32 @@
 # OpenBSD pf ban/unban
 #
 # Author: Nick Hilliard <nick@foobar.org>
-# Modified by: Alexander Koeppe making PF work seamless and with IPv4 and IPv6
 #
 #

 [Definition]

 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-# we don't enable PF automatically; to enable run pfctl -e 
-# or add `pf_enable="YES"` to /etc/rc.conf (tested on FreeBSD)
-# also, these rulesets are loaded into (nested) anchors
-# to enable them, add as wildcard:
-#     anchor "f2b/*"
-# or using jail names:
-#     anchor f2b {
-#        anchor name1
-#        anchor name2
-#        ...
-#     }
-# to your main pf ruleset, where "namei" are the names of the jails
-# which invoke this action
-actionstart = echo "table <<tablename>-<name>> persist counters" | <pfctl> -f-
-              port="<port>"; if [ "$port" != "" ] && case "$port" in \{*) false;; esac; then port="{$port}"; fi
-              echo "<block> proto <protocol> from <<tablename>-<name>> to <actiontype>" | <pfctl> -f-
+# we don't enable PF automatically, as it will be enabled elsewhere
+actionstart = 

-# Option:  start_on_demand - to start action on demand
-# Example: `action=pf[actionstart_on_demand=true]`
-actionstart_on_demand = false

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-# we only disable PF rules we've installed prior
-actionstop = <pfctl> -sr 2>/dev/null | grep -v <tablename>-<name> | <pfctl> -f-
-             %(actionflush)s
-             <pfctl> -t <tablename>-<name> -T kill
-
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = <pfctl> -t <tablename>-<name> -T flush
+# we don't disable PF automatically either
+actionstop = 


 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <pfctl> -sr | grep -q <tablename>-<name>
+actioncheck = 


 # Option:  actionban
@@ -66,7 +39,7 @@ actioncheck = <pfctl> -sr | grep -q <tablename>-<name>
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = <pfctl> -t <tablename>-<name> -T add <ip>
+actionban = /sbin/pfctl -t <tablename> -T add <ip>/32


 # Option:  actionunban
@@ -78,47 +51,12 @@ actionban = <pfctl> -t <tablename>-<name> -T add <ip>
 # Values:  CMD
 #
 # note -r option used to remove matching rule
-actionunban = <pfctl> -t <tablename>-<name> -T delete <ip>
-
-# Option: pfctl
-#
-# Use anchor as jailname to manipulate affected rulesets only.
-# If more parameter expected it can be extended with `pf[pfctl="<known/pfctl> ..."]`
-# 
-pfctl = pfctl -a f2b/<name>
+actionunban = /sbin/pfctl -t <tablename> -T delete <ip>/32

 [Init]
 # Option:  tablename
 # Notes.:  The pf table name.
 # Values:  [ STRING ]
 #
-tablename = f2b
-
-# Option: block
-#
-# The action you want pf to take.
-# Probably, you want "block quick", but adjust as needed.
-block = block quick
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | ipv6-icmp ] Default: tcp
-#
-protocol = tcp
-
-# Option: actiontype
-# Notes.: defines additions to the blocking rule
-# Values: leave empty to block all attempts from the host
-# Default: Value of the multiport
-actiontype = <multiport>
-
-# Option: allports
-# Notes.: default addition to block all ports
-# Usage.: use in jail config: "banaction = pf[actiontype=<allports>]"
-allports = any
-
-# Option: multiport
-# Notes.: addition to block access only to specific ports
-# Usage.: use in jail config: "banaction = pf[actiontype=<multiport>]"
-multiport = any port $port
+tablename = fail2ban

@@ -17,9 +17,6 @@
 [Definition]
 actionban   = ip route add <blocktype> <ip>
 actionunban = ip route del <blocktype> <ip>
-actioncheck =
-actionstart =
-actionstop =

 [Init]

@@ -10,44 +10,41 @@ before = sendmail-common.conf

 [Definition]

-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on <fq-hostname>
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
              From: <sendername> <<sender>>
              To: <dest>\n
              Hi,\n
              The jail <name> has been started successfully.\n
              Output will be buffered until <lines> lines are available.\n
              Regards,\n
-              Fail2Ban" | <mailcmd>
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>

 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile> ]; then
-                 printf %%b "Subject: [Fail2Ban] <name>: summary from <fq-hostname>
+                 printf %%b "Subject: [Fail2Ban] <name>: summary from `uname -n`
                 From: <sendername> <<sender>>
                 To: <dest>\n
                 Hi,\n
                 These hosts have been banned by Fail2Ban.\n
                 `cat <tmpfile>`
                 Regards,\n
-                 Fail2Ban" | <mailcmd>
+                 Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
                 rm <tmpfile>
             fi
-             printf %%b "Subject: [Fail2Ban] <name>: stopped  on <fq-hostname>
+             printf %%b "Subject: [Fail2Ban] <name>: stopped  on `uname -n`
             From: Fail2Ban <<sender>>
             To: <dest>\n
             Hi,\n
             The jail <name> has been stopped.\n
             Regards,\n
-             Fail2Ban" | <mailcmd>
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>

 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -64,14 +61,14 @@ actioncheck =
 actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
            LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
            if [ $LINE -ge <lines> ]; then
-                printf %%b "Subject: [Fail2Ban] <name>: summary from <fq-hostname>
+                printf %%b "Subject: [Fail2Ban] <name>: summary from `uname -n`
                From: <sendername> <<sender>>
                To: <dest>\n
                Hi,\n
                These hosts have been banned by Fail2Ban.\n
                `cat <tmpfile>`
                Regards,\n
-                Fail2Ban" | <mailcmd>
+                Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
                rm <tmpfile>
            fi

@@ -8,62 +8,8 @@

 after = sendmail-common.local

-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on <fq-hostname>
-              Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-              From: <sendername> <<sender>>
-              To: <dest>\n
-              Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban" | <mailcmd>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on <fq-hostname>
-             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-             From: <sendername> <<sender>>
-             To: <dest>\n
-             Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban" | <mailcmd>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban =
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
 [Init]

-# Your system mail command
-#
-mailcmd = /usr/sbin/sendmail -f "<sender>" "<dest>"
-
 # Recipient mail address
 #
 dest = root
@@ -1,59 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Viktor Szépe
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-         helpers-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionban
-# Notes.:  Command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-#          You need to install geoiplookup and the GeoLite or GeoIP databases.
-#          (geoip-bin and geoip-database in Debian)
-#          The host command comes from bind9-host package.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            http://bgp.he.net/ip/<ip>
-            http://www.projecthoneypot.org/ip_<ip>
-            http://whois.domaintools.com/<ip>\n\n
-            Country:`geoiplookup -f /usr/share/GeoIP/GeoIP.dat "<ip>" | cut -d':' -f2-`
-            AS:`geoiplookup -f /usr/share/GeoIP/GeoIPASNum.dat "<ip>" | cut -d':' -f2-`
-            hostname: <ip-host>\n\n
-            Lines containing failures of <ip> (max <grepmax>)\n";
-            %(_grep_logs)s;
-            printf %%b "\n
-            Regards,\n
-            Fail2Ban" ) | <mailcmd>
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-
-# Path to the log files which contain relevant lines for the abuser IP
-#
-logpath = /dev/null
-
-# Number of log lines to include in the email
-#
-#grepmax = 1000
-#grepopts = -m <grepmax>
@@ -1,41 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-         mail-whois-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
-            Matches for <name> with <ipjailfailures> failures IP:<ip>\n
-            <ipjailmatches>\n\n
-            Regards,\n
-            Fail2Ban" | <mailcmd>
-
-[Init]
-
-# Default name of the chain
-#
-name = default
@@ -1,41 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-         mail-whois-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
-            Matches with <ipfailures> failures IP:<ip>\n
-            <ipmatches>\n\n
-            Regards,\n
-            Fail2Ban" | <mailcmd>
-
-[Init]
-
-# Default name of the chain
-#
-name = default
@@ -7,13 +7,40 @@
 [INCLUDES]

 before = sendmail-common.conf
-         mail-whois-common.conf
-         helpers-common.conf

 [Definition]

-# bypass ban/unban for restored tickets
-norestored = 1
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
+              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+              From: <sendername> <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
+             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+             From: <sendername> <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -21,20 +48,27 @@ norestored = 1
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
            From: <sendername> <<sender>>
            To: <dest>\n
            Hi,\n
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n"
-            %(_whois_command)s;
-            printf %%b "\nLines containing failures of <ip> (max <grepmax>)\n";
-            %(_grep_logs)s;
-            printf %%b "\n
+            Here is more information about <ip>:\n
+            `/usr/bin/whois <ip> || echo missing whois program`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `grep -E '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
            Regards,\n
-            Fail2Ban" ) | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = 

 [Init]

@@ -46,7 +80,3 @@ name = default
 #
 logpath = /dev/null

-# Number of log lines to include in the email
-#
-#grepmax = 1000
-#grepopts = -m <grepmax>
@@ -1,41 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-         mail-whois-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
-            Matches:\n
-            <matches>\n\n
-            Regards,\n
-            Fail2Ban" | <mailcmd>
-
-[Init]
-
-# Default name of the chain
-#
-name = default
@@ -7,12 +7,40 @@
 [INCLUDES]

 before = sendmail-common.conf
-         mail-whois-common.conf

 [Definition]

-# bypass ban/unban for restored tickets
-norestored = 1
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
+              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+              From: <sendername> <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
+             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+             From: <sendername> <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 

 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -20,17 +48,25 @@ norestored = 1
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
            From: <sendername> <<sender>>
            To: <dest>\n
            Hi,\n
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n
+            Here is more information about <ip>:\n
+            `/usr/bin/whois <ip> || echo missing whois program`\n
            Regards,\n
-            Fail2Ban" | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = 

 [Init]

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Yaroslav Halchenko	254b57e43b	Version changes/man pages for the release	2014-08-19 16:23:33 -04:00
Yaroslav Halchenko	f39c778a97	changelog and thanks for the preceding fix	2014-07-28 12:46:52 -04:00
Jisoo Park	094b0e651a	Fix sieve filter to use correct option	2014-07-28 12:44:42 -04:00
Steven Hiscocks	09b2016c05	TST: Skip SYSLOG log target test if '/dev/log' not present Conflicts: testcases/servertestcase.py -- probably jumped over another commit in this cherry-pick which resulted in conflict	2014-04-24 12:24:57 -04:00
Steven Hiscocks	3a1a1f3ad7	Merge branch 'yarikoptic/bf/recidive-mail' into 0.8 Conflicts: ChangeLog - Additions in both branches kept	2014-04-18 23:00:46 +01:00
Yaroslav Halchenko	5edc60934d	DOC: a note in TODO to refer to issues	2014-04-18 10:11:57 -04:00
Yaroslav Halchenko	4fea9dde8d	DOC: minor (just to trigger rebuild)	2014-04-17 23:22:17 -04:00
Yaroslav Halchenko	c82eb16f3d	DOC: minor changes just to trigger the build	2014-04-17 14:41:14 -04:00
yungchin	dbf6cff032	Update comments in shorewall.conf for new settings	2014-04-17 12:06:16 -04:00
Yaroslav Halchenko	30bc782b18	BF: grep in mail*-whois-lines.conf also matches beginning/end of line to work with the recidive filter (Debian #744774 ) Thanks James Bottomley for the report and tentative solutions	2014-04-16 22:20:22 -04:00
Steven Hiscocks	b89222b1d1	Merge pull request #696 from yarikoptic/bf/skip_apache_subsecond_resolution_on_2.5 BF(2.5): add minimal_python key to failJSON and skip some test lines.	2014-04-16 22:43:28 +01:00
Steven Hiscocks	2874399fed	Merge pull request #694 from yarikoptic/bf/fix_move_test a collection of fixes, including the one log rotation detection which "broke travis"	2014-04-16 22:28:42 +01:00
Yaroslav Halchenko	5bafc61e48	ENH(TST): relax test of sleep to "1" places from "2" The reason is that internally it does round, so even 1.005 then would not be equal to 1. Making it spaces==1 should be sufficient for up to 1.05 i.e. we would allow 50ms "drift"	2014-04-16 13:17:58 -04:00
Yaroslav Halchenko	d7087412bb	Add .dev suffix to the version to signal "development" build	2014-04-16 13:12:39 -04:00
Yaroslav Halchenko	c5a754411d	BF(2.5): add minimal_python key to failJSON and skip some test lines with date format which includes sub-seconds For tests to pass also duplicated representative ones just without subsec timing	2014-04-16 10:51:24 -04:00
Yaroslav Halchenko	8faff41d40	DOC: changelog entry on leaky file descriptors	2014-04-16 08:48:52 -04:00
Yaroslav Halchenko	6eb67899a5	BF: overcome problem with failed *_movefile test if file gets properly closed Discussion is in the comments on `7260403fdd` and fix consists of skipping first 3 lines while creating a "new" log file. This should be sufficient to make fail2ban detect "log rotation" and thus function properly	2014-04-16 08:43:54 -04:00
Yaroslav Halchenko	dfc7dd6dc9	ENH: use unique filename in LogFileFilterPoll on every setUp call	2014-04-16 08:26:39 -04:00
Yaroslav Halchenko	e19f9e1697	BF(?): stop/join notifier only if defined Somehow on that elderly squeeze Debian sparc box, I got error that self.__notifier was not defined. So first I did define it now in the constructor, but mystery remains how come it was not defined -- wasn"t run() then run (where it is defined)? Anyways -- conditioning on it being defined might be safer may be? Not sure (need to go to sleep) if with this change but on this box I also run from time to time either into stalling of fail2ban-testcases and refusing to exit normally or ====================================================================== ERROR: test_move_into_file_after_removed (testcases.filtertestcase.MonitorFailures<FilterPyinotify>(/tmp/monitorfailures_FilterPyinotifypcHmMJfail2ban)) ---------------------------------------------------------------------- Traceback (most recent call last): File "/home/yoh/deb/gits/fail2ban/testcases/filtertestcase.py", line 473, in tearDown self.filter.stop() File "/home/yoh/deb/gits/fail2ban/server/filterpyinotify.py", line 196, in stop self.__notifier.stop() File "/usr/lib/pymodules/python2.6/pyinotify.py", line 1315, in stop threading.Thread.join(self) File "/usr/lib/python2.6/threading.py", line 633, in join raise RuntimeError("cannot join thread before it is started") RuntimeError: cannot join thread before it is started that is with pyinotify 0.8.9-1 so could quite be "related" to its age.	2014-04-16 08:26:38 -04:00
Yaroslav Halchenko	cb9cbd754e	DOC: minor wording fix	2014-04-16 08:26:38 -04:00
Yaroslav Halchenko	f206c3d493	BF: give a custom prefix to a tempfile and close it upon tearDown in ExecuteActions tests	2014-04-16 08:26:38 -04:00
Yaroslav Halchenko	8cb6ec54ac	Merge pull request #691 from yarikoptic/enh/travis_multiple_log_levels ENH: run travis with both 'error' and 'heavydebug' levels to ease troubleshooting of failures	2014-04-16 00:50:54 -04:00
Yaroslav Halchenko	a45467ac91	ENH: run travis with both 'error' and 'heavydebug' levels to ease troubleshooting of failures	2014-04-15 23:40:09 -04:00
Steven Hiscocks	5c2730d7be	DOC: Update ChangeLog	2014-04-03 19:03:05 +01:00
Steven Hiscocks	7260403fdd	TST: Close file to allow proper removal in MonitorFailures	2014-03-31 19:02:28 +01:00
Daniel Black	2a31d45582	Merge pull request #669 from kwirk/inotify-watch-auto-remove BF: Handle case when inotify watch is auto deleted on file deletion	2014-03-31 18:37:01 +11:00
Steven Hiscocks	fdcded262d	BF: Handle case when inotify watch is auto deleted on file deletion When a file is deleted, the watcher for it is automatically removed. FilterPyinotify is detecting a new file being created with the same name, and in turn attempts to remove the watch for the deleted file (which has already been removed automatically). Also, IN_IGNORED events are generated when a file is deleted, but these weren't being caught, causing an non-existent file path to be passed to FilterPyinotify._process_file (which caught the exceptions in Filter.getFailures).	2014-03-29 16:38:39 +00:00