fixed Debian bugs 329722, 330311

added upstream README and TODO, patched with SYSLOG (160:166)

.coveragerc

@@ -1,12 +0,0 @@
-
-[run]
-branch = True
-source =
-    config
-    fail2ban
-
-[report]
-exclude_lines =
-    pragma: ?no ?cover
-    pragma: ?${F2B_PY}.x no ?cover
-    pragma: ?systemd no ?cover

.gitattributes

@@ -1 +0,0 @@
-ChangeLog linguist-language=Markdown

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,70 +0,0 @@
----
-name: Bug report
-about: Report a bug within the fail2ban engines (not filters or jails)
-title: '[BR]: '
-labels: bug
-assignees: ''
-
----
-
-<!--
-  - Before reporting, please make sure to search the open and closed issues for any reports in the past.
-  - Use this issue template to report a bug in the fail2ban engine (not in a filter or jail).
-  - If you want to request a feature or a new filter, please use "Feature request" or "Filter request" instead.
-  - If you have rather some question, please open or join to some discussion.
-
-  We will be very grateful, if your problem was described as completely as possible,
-  enclosing excerpts from logs (if possible within DEBUG mode, if no errors evident
-  within INFO mode), and configuration in particular of effected relevant settings
-  (e.g., with ` fail2ban-client -d | grep 'affected-jail-name' ` for a particular
-  jail troubleshooting).
-  Thank you in advance for the details, because such issues like "It does not work" 
-  alone could not help to resolve anything!
-  Thanks! 
-  (you can remove this paragraph and other comments upon reading)
--->
-
-### Environment:
-
-<!--
-  Fill out and check (`[x]`) the boxes which apply. If your Fail2Ban version is outdated, 
-  and you can't verify that the issue persists in the recent release, better seek support 
-  from the distribution you obtained Fail2Ban from
--->
-
-- Fail2Ban version <!-- including any possible distribution suffixes --> : 
-- OS, including release name/version : 
-- [ ] Fail2Ban installed via OS/distribution mechanisms
-- [ ] You have not applied any additional foreign patches to the codebase
-- [ ] Some customizations were done to the configuration (provide details below is so)
-
-### The issue:
-
-<!-- summary here -->
-
-#### Steps to reproduce
-
-#### Expected behavior
-
-#### Observed behavior
-
-#### Any additional information
-
-
-### Configuration, dump and another helpful excerpts
-
-#### Any customizations done to /etc/fail2ban/ configuration
-<!-- put your configuration excerpts between next 2 lines -->
-```
-```
-
-#### Relevant parts of /var/log/fail2ban.log file:
-<!-- preferably obtained while running fail2ban with `loglevel = 4` -->
-<!-- put your log excerpt between next 2 lines -->
-```
-```
-
-#### Relevant lines from monitored log files:
-<!-- put your log excerpt between next 2 lines -->
-```
-```

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,35 +0,0 @@
----
-name: Feature request
-about: Suggest an idea or an enhancement for this project
-title: '[RFE]: '
-labels: enhancement
-assignees: ''
-
----
-
-<!--
-  - Before requesting, please make sure to search the open and closed issues for any requests in the past.
-  - Use this issue template to request a feature in the fail2ban engine (not a new filter or jail).
-  - If you want to request a new filter or failregex, please use "Filter request" instead.
-  - If you have rather some question, please open or join to some discussion.
--->
-
-#### Feature request type
-<!--
-  Please provide a summary description of the feature request.
--->
-
-#### Description
-<!--
-  Please describe the feature in more detail.
--->
-
-#### Considered alternatives
-<!--
-  A clear and concise description of any alternative solutions or features you've considered.
--->
-
-#### Any additional information
-<!--
-  Add any other context or screenshots about the feature request here.
--->

.github/ISSUE_TEMPLATE/filter_request.md

@@ -1,59 +0,0 @@
----
-name: Filter request
-about: Request a new jail or filter to be supported or existing filter extended with new failregex
-title: '[FR]: '
-labels: filter-request
-assignees: ''
-
----
-
-<!--
-  - Before requesting, please make sure to search the open and closed issues for any requests in the past.
-  - Sometimes failregex have been already requested before but are not implemented yet due to various reasons.
-  - If there are no hits for your concerns, please proceed otherwise add a comment to the related issue (also if it is closed).
-  - If you want to request a new feature, please use "Feature request" instead.
-  - If you have rather some question, please open or join to some discussion.
--->
-
-### Environment:
-
-<!--
-  Fill out and check (`[x]`) the boxes which apply.
--->
-
-- Fail2Ban version <!-- including any possible distribution suffixes --> : 
-- OS, including release name/version : 
-
-#### Service, project or product which log or journal should be monitored
-
-- Name of filter or jail in Fail2Ban (if already exists) : 
-- Service, project or product name, including release name/version : 
-- Repository or URL (if known) : 
-- Service type : 
-- Ports and protocols the service is listening : 
-
-#### Log or journal information
-<!-- Delete unrelated group -->
-
-<!-- Log file -->
-
-- Log file name(s) : 
-
-<!-- Systemd journal -->
-
-- Journal identifier or unit name : 
-
-#### Any additional information
-
-
-### Relevant lines from monitored log files:
-
-#### failures in sense of fail2ban filter (fail2ban must match):
-<!-- put your log excerpt between next 2 lines -->
-```
-```
-
-#### legitimate messages (fail2ban should not consider as failures):
-<!-- put your log excerpt between next 2 lines -->
-```
-```

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,12 +0,0 @@
-Before submitting your PR, please review the following checklist:
-
-- [ ] **CHOOSE CORRECT BRANCH**: if filing a bugfix/enhancement
-      against certain release version, choose `0.9`, `0.10` or `0.11` branch,
-      for dev-edition use `master` branch
-- [ ] **CONSIDER adding a unit test** if your PR resolves an issue
-- [ ] **LIST ISSUES** this PR resolves
-- [ ] **MAKE SURE** this PR doesn't break existing tests
-- [ ] **KEEP PR small** so it could be easily reviewed.
-- [ ] **AVOID** making unnecessary stylistic changes in unrelated code
-- [ ] **ACCOMPANY** each new `failregex` for filter `X` with sample log lines
-      within `fail2ban/tests/files/logs/X` file

.github/workflows/main.yml

@@ -1,98 +0,0 @@
-name: CI
-
-# Controls when the action will run. Triggers the workflow on push or pull request
-# events but only for the master branch
-on:
-  push:
-    paths-ignore:
-    - 'doc/**'
-    - 'files/**'
-    - 'man/**'
-  pull_request:
-    paths-ignore:
-    - 'doc/**'
-    - 'files/**'
-    - 'man/**'
-
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
-jobs:
-  # This workflow contains a single job called "build"
-  build:
-    # The type of runner that the job will run on
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        python-version: [2.7, 3.5, 3.6, 3.7, 3.8, 3.9, '3.10', '3.11.0-alpha.1', pypy2, pypy3]
-      fail-fast: false
-    # Steps represent a sequence of tasks that will be executed as part of the job
-    steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
-
-      - name: Set up Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      - name: Grant systemd-journal access
-        run: sudo usermod -a -G systemd-journal "$USER" || echo 'no systemd-journal access'
-
-      - name: Python version
-        run: |
-          F2B_PY=$(python -c "import sys; print(sys.version)")
-          echo "Python: ${{ matrix.python-version }} -- ${F2B_PY/$'\n'/ }"
-          F2B_PYV=$(echo "${F2B_PY}" | grep -oP '^\d+(?:\.\d+)')
-          F2B_PY=${F2B_PY:0:1}
-          echo "Set F2B_PY=$F2B_PY, F2B_PYV=$F2B_PYV"
-          echo "F2B_PY=$F2B_PY" >> $GITHUB_ENV
-          echo "F2B_PYV=$F2B_PYV" >> $GITHUB_ENV
-          # for GHA we need to monitor all journals, since it cannot be found using SYSTEM_ONLY(4):
-          echo "F2B_SYSTEMD_DEFAULT_FLAGS=0" >> $GITHUB_ENV
-
-      - name: Install dependencies
-        run: |
-          if [[ "$F2B_PY" = 3 ]]; then python -m pip install --upgrade pip || echo "can't upgrade pip"; fi
-          if [[ "$F2B_PY" = 3 ]] && ! command -v 2to3x -v 2to3 > /dev/null; then
-            #pip install 2to3
-            sudo apt-get -y install 2to3
-          fi
-          #sudo apt-get -y install python${F2B_PY/2/}-pyinotify || echo 'inotify not available'
-          python -m pip install pyinotify || echo 'inotify not available'
-          #sudo apt-get -y install python${F2B_PY/2/}-systemd || echo 'systemd not available'
-          sudo apt-get -y install libsystemd-dev || echo 'systemd dependencies seems to be unavailable'
-          python -m pip install systemd-python || echo 'systemd not available'
-
-      - name: Before scripts
-        run: |
-          cd "$GITHUB_WORKSPACE"
-          # Manually execute 2to3 for now
-          if [[ "$F2B_PY" = 3 ]]; then echo "2to3 ..." && ./fail2ban-2to3; fi
-          _debug() { echo -n "$1 "; err=$("${@:2}" 2>&1) && echo 'OK' || echo -e "FAIL\n$err"; }
-          # (debug) output current preferred encoding:
-          _debug 'Encodings:' python -c 'import locale, sys; from fail2ban.helpers import PREFER_ENC; print(PREFER_ENC, locale.getpreferredencoding(), (sys.stdout and sys.stdout.encoding))'
-          # (debug) backend availabilities:
-          echo 'Backends:'
-          _debug '- systemd:' python -c 'from fail2ban.server.filtersystemd import FilterSystemd'
-          #_debug '- systemd (root): ' sudo python -c 'from fail2ban.server.filtersystemd import FilterSystemd'
-          _debug '- pyinotify:' python -c 'from fail2ban.server.filterpyinotify import FilterPyinotify'
-
-      - name: Test suite
-        run: |
-          if [[ "$F2B_PY" = 2 ]]; then
-            python setup.py test
-          elif dpkg --compare-versions "$F2B_PYV" lt 3.10; then 
-            python bin/fail2ban-testcases --verbosity=2
-          else
-            echo "Skip systemd backend since systemd-python module must be fixed for python >= v.3.10 in GHA ..."
-            python bin/fail2ban-testcases --verbosity=2 -i "[sS]ystemd|[jJ]ournal"
-          fi
-
-      #- name: Test suite (debug some systemd tests only)
-         #run: python bin/fail2ban-testcases --verbosity=2 "[sS]ystemd|[jJ]ournal"
-         #run: python bin/fail2ban-testcases --verbosity=2 -l 5 "test_WrongChar"
-
-      - name: Build
-        run: python setup.py build
-
-      #- name: Test initd scripts
-      #  run: shellcheck -s bash -e SC1090,SC1091 files/debian-initd

.gitignore

@@ -1,12 +0,0 @@
-*~
-build
-dist
-*.pyc
-htmlcov
-.coverage
-*.orig
-*.rej
-*.bak
-__pycache__
-.vagrant/
-.idea/

.mailmap

@@ -1,5 +0,0 @@
-Lee Clemens <java@leeclemens.net>
-Serg G. Brester <info@sebres.de>
-Serg G. Brester <serg.brester@sebres.de>
-Serg G. Brester <sergey.brester@W7-DEHBG0189.wincor-nixdorf.com>
-Viktor Szépe <viktor@szepe.net>

.project

@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<projectDescription>
-	<name>fail2ban-unstable</name>
-	<comment></comment>
-	<projects>
-	</projects>
-	<buildSpec>
-		<buildCommand>
-			<name>org.python.pydev.PyDevBuilder</name>
-			<arguments>
-			</arguments>
-		</buildCommand>
-	</buildSpec>
-	<natures>
-		<nature>org.python.pydev.pythonNature</nature>
-	</natures>
-</projectDescription>

.pylintrc

@@ -1,37 +0,0 @@
-# Custom pylint configuration for the Fail2Ban project
-#
-# Set your PYLINTRC environment variable to point to this file
-# e.g.
-#      export PYLINTRC=$PWD/.pylintrc
-
-[FORMAT]
-indent-string='\t'
-
-[BASIC]
-# Fail2Ban uses non-conventional to Python world camel-casing
-# These regexps were originally borrowed from 0.4.x series of
-# PyMVPA which had similar conventions.
-
-# Regular expression which should only match correct module names
-module-rgx=(([a-z][a-z0-9_]*)|([A-Z][a-zA-Z0-9_]+))$
-
-attr-rgx=[a-z_][a-zA-Z0-9_]{2,30}
-
-# Regular expression which should only match correct class names
-class-rgx=[A-Z_]+[a-zA-Z0-9]+$
-
-# Regular expression which should only match correct function names
-function-rgx=[a-z_]+[a-z_][a-zA-Z0-9]*$
-
-# Regular expression which should only match correct method names
-method-rgx=([a-z_]|__)[a-zA-Z0-9]*(__)?$
-
-# Regular expression which should only match correct argument names
-argument-rgx=[a-z][a-zA-Z0-9]*_*[a-zA-Z0-9]*_*[a-zA-Z0-9]*_?$
-
-# Regular expression which should only match correct variable names
-variable-rgx=([a-z_]+[a-zA-Z0-9]*_*[a-zA-Z0-9]*_*[a-zA-Z0-9]*_?||(__.*__))$||[A-Z]
-
-# Regular expression which should only match correct module level names
-# Default: (([A-Z_][A-Z1-9_]*)|(__.*__))$
-const-rgx=([a-z_]+[a-zA-Z0-9]*_*[a-zA-Z0-9]*_*[a-zA-Z0-9]*_?|__.*__)$||[A-Z]

.travis.yml

@@ -1,81 +0,0 @@
-# vim ft=yaml
-# travis-ci.org definition for Fail2Ban build
-# https://travis-ci.org/fail2ban/fail2ban/
-
-#os: linux
-
-language: python
-dist: xenial
-
-matrix:
-  fast_finish: true
-  include:
-  - python: 2.7
-  #- python: pypy
-  - python:  3.4
-  - python:  3.5
-  - python:  3.6
-  - python:  3.7
-  - python:  3.8
-  - python:  3.9-dev
-  - python:  pypy3.5
-before_install:
-  - echo "running under $TRAVIS_PYTHON_VERSION"
-  - if [[ $TRAVIS_PYTHON_VERSION == 2* || $TRAVIS_PYTHON_VERSION == pypy* && $TRAVIS_PYTHON_VERSION != pypy3* ]]; then export F2B_PY=2; fi
-  - if [[ $TRAVIS_PYTHON_VERSION == 3* || $TRAVIS_PYTHON_VERSION == pypy3* ]]; then export F2B_PY=3; fi
-  - echo "Set F2B_PY=$F2B_PY"
-  - travis_retry sudo apt-get update -qq
-  # Set this so sudo executes the correct python binary
-  #   Anything not using sudo will already have the correct environment
-  - export VENV_BIN="$VIRTUAL_ENV/bin" && echo "VENV_BIN set to $VENV_BIN"
-install:
-  # Install Python packages / dependencies
-  #   coverage
-  - travis_retry pip install coverage
-  #   coveralls (note coveralls doesn't support 2.6 now):
-  - if [[ $TRAVIS_PYTHON_VERSION != 2.6* ]]; then F2B_COV=1; else F2B_COV=0; fi
-  - if [[ "$F2B_COV" = 1 ]]; then travis_retry pip install coveralls; fi
-  #   codecov:
-  - travis_retry pip install codecov
-  #   dnspython or dnspython3
-  - if [[ "$F2B_PY" = 2 ]]; then travis_retry pip install dnspython || echo 'not installed'; fi
-  - if [[ "$F2B_PY" = 3 ]]; then travis_retry pip install dnspython3 || echo 'not installed'; fi
-  #   python systemd bindings:
-  - if [[ "$F2B_PY" = 2 ]]; then travis_retry sudo apt-get install -qq python-systemd || echo 'not installed'; fi
-  - if [[ "$F2B_PY" = 3 ]]; then travis_retry sudo apt-get install -qq python3-systemd || echo 'not installed'; fi
-  #   gamin - install manually (not in PyPI) - travis-ci system Python is 2.7
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then (travis_retry sudo apt-get install -qq python-gamin && cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/) || echo 'not installed'; fi
-  #   pyinotify
-  - travis_retry pip install pyinotify || echo 'not installed'
-  # Install helper tools
-  - sudo apt-get install shellcheck
-before_script:
-  # Manually execute 2to3 for now
-  - if [[ "$F2B_PY" = 3 ]]; then ./fail2ban-2to3; fi
-  # (debug) output current preferred encoding:
-  - python -c 'import locale, sys; from fail2ban.helpers import PREFER_ENC; print(PREFER_ENC, locale.getpreferredencoding(), (sys.stdout and sys.stdout.encoding))'
-script:
-  # Keep the legacy setup.py test approach of checking coverage for python2
-  - if [[ "$F2B_PY" = 2 ]]; then coverage run setup.py test; fi
-  # Coverage doesn't pick up setup.py test with python3, so run it directly (with same verbosity as from setup)
-  - if [[ "$F2B_PY" = 3 ]]; then coverage run bin/fail2ban-testcases --verbosity=2; fi
-  # Use $VENV_BIN (not python) or else sudo will always run the system's python (2.7)
-  - sudo $VENV_BIN/pip install .
-  # Doc files should get installed on Travis under Linux (some builds/python's seem to use another path segment)
-  - test -e /usr/share/doc/fail2ban/FILTERS && echo 'found' || echo 'not found'
-  # Test initd script
-  - shellcheck -s bash -e SC1090,SC1091 files/debian-initd
-after_success:
-  - if [[ "$F2B_COV" = 1 ]]; then coveralls; fi
-  - codecov
-
-# Might be worth looking into
-#notifications:
-#  email: true
-#  irc:
-#    channels: "irc.freenode.org#fail2ban"
-#    template:
-#      - "%{repository}@%{branch}: %{message} (%{build_url})"
-#    on_success: change
-#    on_failure: change
-#    skip_join: true

CHANGELOG

@@ -0,0 +1,131 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.5.4)                           2005/09/13
+=============================================================
+
+ver. 0.5.4 (2005/09/13) - beta
+----------
+- Fixed bug #1286222.
+- Propagated patches introduced by Debian maintainer 
+  (Yaroslav Halchenko):
+  * Fixed handling of SYSLOG logging target. Now it can log
+    to any SYSLOG target and facility as directed by the 
+    config
+  * Format of SYSLOG entries fixed to look closer to standard
+  * Fixed errata in config/gentoo-confd
+  * Introduced findtime configuration variable to control the
+    lifetime of caught "failed" log entries
+	
+ver. 0.5.3 (2005/09/08) - beta
+----------
+- Fixed a bug when overriding "maxfailures" or "bantime".
+  Thanks to Yaroslav Halchenko
+- Added more debug output if an error occurs when sending
+  mail. Thanks to Stephen Gildea
+- Renamed "maxretry" to "maxfailures" and changed default
+  value to 5. Thanks to Stephen Gildea
+- Hopefully fixed bug #1256075
+- Fixed bug #1262345
+- Fixed exception handling in PIDLock
+- Removed warning when using "-V" or "-h" with no config
+  file. Thanks to Yaroslav Halchenko
+- Removed "-i eth0" from config file. Thanks to Yaroslav
+  Halchenko
+
+ver. 0.5.2 (2005/08/06) - beta
+----------
+- Better PID lock file handling. Should close #1239562
+- Added man pages
+- Removed log4py dependency. Use logging module instead
+- "maxretry" and "bantime" can be overridden in each section
+- Fixed bug #1246278 (excessive memory usage)
+- Fixed crash on wrong option value in configuration file
+- Changed custom chains to lowercase
+
+ver. 0.5.1 (2005/07/23) - beta
+----------
+- Fixed bugs #1241756, #1239557
+- Added log targets in configuration file. Removed -l option
+- Changed iptables rules in order to create a separated chain
+  for each section
+- Fixed static banList in firewall.py
+- Added an initd script for Debian. Thanks to Yaroslav
+  Halchenko
+- Check for obsolete files after install
+
+ver. 0.5.0 (2005/07/12) - beta
+----------
+- Added support for CIDR mask in ignoreip
+- Added mail notification support
+- Fixed bug #1234699
+- Added tags replacement in rules definition. Should allow a
+  clean solution for Feature Request #1229479
+- Removed "interface" and "firewall" options
+- Added start and end commands in the configuration file.
+  Thanks to Yaroslav Halchenko
+- Added firewall rules definition in the configuration file
+- Cleaned fail2ban.py
+- Added an initd script for RedHat/Fedora. Thanks to Andrey
+  G. Grozin
+
+ver. 0.4.1 (2005/06/30) - stable
+----------
+- Fixed textToDNS method which generated wrong matches for
+  "rhost=12-xyz...". Thanks to Tom Pike
+- fail2ban.conf modified for readability. Thanks to Iain Lea
+- Added an initd script for Gentoo
+- Changed default PID lock file location from /tmp to
+  /var/run
+
+ver. 0.4.0 (2005/04/24) - stable
+----------
+- Fixed textToDNS which did not recognize strings like
+  "12-345-67-890.abcd.mnopqr.xyz"
+
+ver. 0.3.1 (2005/03/31) - beta
+----------
+- Corrected level of messages
+- Added DNS lookup support
+- Improved parsing speed. Only parse the new log messages
+- Added a second verbose level (-vv)
+
+ver. 0.3.0 (2005/02/24) - beta
+----------
+- Re-writting of parts of the code in order to handle several
+  log files with different rules
+- Removed sshd.py because it is no more needed
+- Fixed a bug when exiting with IP in the ban list
+- Added PID lock file
+- Improved some parts of the code
+- Added ipfw-start-rule option (thanks to Robert Edeker)
+- Added -k option which kills a currently running Fail2Ban
+
+ver. 0.1.2 (2004/11/21) - beta
+----------
+- Add ipfw and ipfwadm support. The rules are taken from
+  BlockIt. Thanks to Robert Edeker
+- Add -e option which allows to set the interface. Thanks to
+  Robert Edeker who reminded me this
+- Small code cleaning
+
+ver. 0.1.1 (2004/10/23) - beta
+----------
+- Add SIGTERM handler in order to exit nicely when in daemon
+  mode
+- Add -r option which allows to set the maximum number of
+  login failures
+- Remove the Metalog class as the log file are not so syslog
+  daemon specific
+- Rewrite log reader to be service centered. Sshd support
+  added. Match "Failed password" and "Illegal user"
+- Add /etc/fail2ban.conf configuration support
+- Code documentation
+
+
+ver. 0.1.0 (2004/10/12) - alpha
+----------
+- Initial release

CONTRIBUTING.md

@@ -1,27 +0,0 @@
-Guidelines on Fail2Ban contributions
-====================================
-
-### You found a severe security vulnerability in Fail2Ban?
-email details to fail2ban-vulnerabilities at lists dot sourceforge dot net .
-
-### You need some new features, you found bugs?
-visit [Issues](https://github.com/fail2ban/fail2ban/issues)
-and if your issue is not yet known -- file a bug report. See
-[Fail2Ban wiki](http://www.fail2ban.org/wiki/index.php/HOWTO_Seek_Help)
-on further instructions.
-
-### You would like to troubleshoot or discuss?
-join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
-
-### You would like to contribute (new filters/actions/code/documentation)?
-send a [pull request](https://github.com/fail2ban/fail2ban/pulls)
-
-Pull requests guidelines
-========================
-
-- If there is an issue on github to be closed by the pull request, include
-  ```Closes #ISSUE``` (where ISSUE is issue's number)
-  
-- Add a brief summary of the change to the ChangeLog file into a corresponding
-  section out of Fixes, New Features or Enhancements (improvements to existing
-  features)

COPYING

@@ -1,368 +0,0 @@
-The following copyright applies to all files present in the Fail2ban package,
-except if a different copyright is explicitly defined in this file.
-
-
-		    GNU GENERAL PUBLIC LICENSE
-		       Version 2, June 1991
-
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-			    Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Lesser General Public License instead.)  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
-
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-		    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
-
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
-
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-
-  8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
-
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
-			    NO WARRANTY
-
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
-		     END OF TERMS AND CONDITIONS
-
-	    How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) year name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.
-
----------------------------------
-The file server/iso8601.py is licensed under the following terms.
-
-
-Copyright (c) 2007 Michael Twomey
-
-Permission is hereby granted, free of charge, to any person obtaining a
-copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be included
-in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

DEVELOP

@@ -1,299 +0,0 @@
-..                       __      _ _ ___ _
-                        / _|__ _(_) |_  ) |__  __ _ _ _
-                       |  _/ _` | | |/ /| '_ \/ _` | ' \
-                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
-
-================================================================================
-How to develop for Fail2Ban
-================================================================================
-
-Fail2Ban uses GIT (http://git-scm.com/) distributed source control. This gives
-each developer their own complete copy of the entire repository. Developers can
-add and switch branches and commit changes when ever they want and then ask a
-maintainer to merge their changes.
-
-Fail2Ban uses GitHub (https://github.com/fail2ban/fail2ban) to manage access to
-the Git repository. GitHub provides free hosting for open-source projects as
-well as a web-based Git repository browser and an issue tracker.
-
-If you are familiar with Python and you have a bug fix or a feature that you
-would like to add to Fail2Ban, the best way to do so it to use the GitHub Pull
-Request feature. You can find more details on the Fail2Ban wiki
-(http://www.fail2ban.org/wiki/index.php/Get_Involved)
-
-Pull Requests
-=============
-
-When submitting pull requests on GitHub we ask you to:
-
-* Clearly describe the problem you're solving;
-* Don't introduce regressions that will make it hard for systems administrators
-  to update;
-* If adding a major feature rebase your changes on master and get to a single commit;
-* Include test cases (see below);
-* Include sample logs (if relevant);
-* Include a change to the relevant section of the ChangeLog; and
-* Include yourself in THANKS if not already there.
-
-If you are developing filters see the FILTERS file for documentation.
-
-Code Testing
-============
-
-Existing tests can be run by executing `bin/fail2ban-testcases`. It has
-options like --log-level that will probably be useful.  Run
-`bin/fail2ban-testcases --help` for the full list of options.
-
-Test cases should cover all usual cases, all exception cases and all inside
-/ outside boundary conditions.
-
-Test cases should cover all branches. The coverage tool will help identify
-missing branches. Also see http://nedbatchelder.com/code/coverage/branch.html
-for more details.
-
-Install the package python-coverage to visualise your test coverage. Run the
-following (note: on Debian-based systems, the script is called
-`python-coverage`)::
-
-  coverage run bin/fail2ban-testcases
-  coverage report
-
-Optionally:
-  coverage html
-
-And then browse htmlcov/index.html and see how much coverage your test cases
-exert over the code base. Full coverage is a good thing however it may not be
-complete. Try to ensure tests cover as many independent paths through the
-code.
-
-Manual Execution. To run in a development environment do::
-
-  ./fail2ban-client -c config/ -s /tmp/f2b.sock -i start
-
-some quick commands::
-
-  status
-  add test pyinotify
-  status test
-  set test addaction iptables
-  set test actionban iptables echo <ip> <cidr> >> /tmp/ban
-  set test actionunban iptables echo <ip> <cidr> >> /tmp/unban
-  get test actionban iptables
-  get test actionunban iptables
-  set test banip 192.168.2.2
-  status test
-
-
-Testing with vagrant
---------------------
-
-Testing can now be done inside a vagrant VM.  Vagrantfile provided in
-source code repository established two VMs:
-
-- VM "secure" which can be used for testing fail2ban code.
-- VM "attacker" which can be used to perform attack against our "secure" VM.
-
-Both VMs are sharing the 192.168.200/24 network. If you are using this network
-take a look into the Vagrantfile and change the IP.
-
-
-Coding Standards
-================
-
-Style
------
-
-Please use tabs for now. Keep to 80 columns, at least for readable text.
-
-Tests
------
-
-Add tests. They should test all the code you add in a meaning way.
-
-Coverage
---------
-
-Test coverage should always increase as you add code.
-
-You may use "# pragma: no cover" in the code for branches of code that support
-older versions on python. For all other uses of "pragma: no cover" or
-"pragma: no branch" document the reason why its not covered. "I haven't written
-a test case" isn't a sufficient reason.
-
-pyflakes
---------
-
-pyflakes can be used to find unused imports, and unused, undefined and
-redefined variables. pyflakes should be run in any python code, including
-python based actions::
-
-  pyflakes bin/ config/ fail2ban/
-
-Documentation
--------------
-
-Ensure this documentation is up to date after changes. Also ensure that the man
-pages still are accurate. Ensure that there is sufficient documentation for
-your new features to be used.
-
-Bugs
-----
-
-Remove them and don't add any more.
-
-Git
----
-
-Use the following tags in your commit messages:
-
-* 'BF:' for bug fixes
-* 'DOC:' for documentation fixes
-* 'ENH:' for enhancements
-* 'TST:' for commits concerning tests only (thus not touching the main code-base)
-
-Multiple tags could be joined with +, e.g. "BF+TST:".
-
-Use the text "closes #333"/"resolves #333 "/"fixes #333" where 333 represents
-an issue that is closed. Other text and details in link below.
-See: https://help.github.com/articles/closing-issues-via-commit-messages
-
-If merge resulted in conflicts, clarify what changes were done to
-corresponding files in the 'Conflicts:' section of the merge commit
-message.  See e.g. https://github.com/fail2ban/fail2ban/commit/f5a8a8ac
-
-Adding Actions
---------------
-
-If you add an action.d/*.conf file also add a example in config/jail.conf
-with enabled=false and maxretry=5 for ssh.
-
-
-Design
-======
-
-Fail2Ban was initially developed with Python 2.3 (IIRC). It should
-still be compatible with Python 2.4 and such compatibility assurance
-makes code ... old-fashioned in many places (RF-Note).  In 0.7 the
-design went through major re-factoring into client/server,
-a-thread-per-jail design which made it a bit difficult to follow.
-Below you can find a sketchy description of the main components of the
-system to orient yourself better.
-
-server/
-------
-
-Core classes hierarchy (feel welcome to draw a better/more complete
-one)::
-
- ->   inheritance
- +    delegation
- *    storage of multiple instances
-
- RF-Note   just a note which might be useful to address while doing RF
-
- JailThread -> Filter -> FileFilter -> {FilterPoll, FilterPyinotify, ...}
-               |         * FileContainer
-               + FailManager
-               + DateDetector
-			   + Jail (provided in __init__) which contains this Filter
-                 (used for passing tickets from FailManager to Jail's __queue)
- Server
-   + Jails
-      * Jail
-        + Filter  (in __filter)
-        * tickets (in __queue)
-        + Actions (in __action)
-          * Action
-          + BanManager
-
-
-failmanager.py
-~~~~~~~~~~~~~~
-
-FailManager
-
-  Keeps track of failures, recorded as 'tickets'.  All operations are
-  done via acquiring a lock
-
-FailManagerEmpty(Exception)
-
-  raised by FailManager.toBan after reaching the list of tickets
-  (RF-Note: asks to become a generator ;) )
-
-
-filter.py
-~~~~~~~~~~
-
-Filter(JailThread)
-
-  Wraps (non-threaded) FailManager (and proxies to it quite a bit),
-  and provides all primary logic for processing new lines, what IPs to
-  ignore, etc
-
-  .failManager  [FailManager]
-  .dateDetector [DateDetector]
-  .__failRegex  [list]
-  .__ignoreRegex [list]
-    Contains regular expressions for failures and ignores
-  .__findTime   [numeric]
-    Used in `processLineAndAdd` to skip old lines
-
-FileFilter(Filter):
-
-  Files-aware Filter
-
-  .__logPath [list]
-    keeps the tracked files (added 1-by-1 using addLogPath)
-    stored as FileContainer's
-  .getFailures
-    actually just returns
-    True
-      if managed to open and get lines (until empty)
-    False
-      if failed to open or absent container matching the filename
-
-FileContainer
-
-  Adapter for a file to deal with log rotation.
-
-  .open,.close,.readline
-     RF-Note: readline returns "" with handler absent... shouldn't it be None?
-  .__pos
-    Keeps the position pointer
-
-
-ipdns.py
-~~~~~~~~
-
-DNSUtils
-
-  Utility class for DNS handling
-
-IPAddr
-
-  Object-class for IP address handling
-
-
-filter*.py
-~~~~~~~~~~
-
-Implementations of FileFilter's for specific backends.  Derived
-classes should provide an implementation of `run` and usually
-override `addLogPath`, `delLogPath` methods.  In run() method they all
-one way or another provide
-
-		try:
-			while True:
-				ticket = self.failManager.toBan()
-				self.jail.putFailTicket(ticket)
-		except FailManagerEmpty:
-			self.failManager.cleanup(MyTime.time())
-
-thus channelling "ban tickets" from their failManager to the
-corresponding jail.
-
-action.py
-~~~~~~~~~
-
-Takes care about executing start/check/ban/unban/stop commands
-

Dockerfile

@@ -1,7 +0,0 @@
-FROM python:3.10-slim
-
-WORKDIR /root
-COPY setup.py fail2ban config bin ./
-RUN python setup.py install
-
-ENTRYPOINT ["/bin/fail2ban-server"]

FILTERS

@@ -1,485 +0,0 @@
-..                       __      _ _ ___ _
-                        / _|__ _(_) |_  ) |__  __ _ _ _
-                       |  _/ _` | | |/ /| '_ \/ _` | ' \
-                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
-
-================================================================================
-Developing Filters
-================================================================================
-
-Filters are tricky. They need to:
-
-* work with a variety of the versions of the software that generates the logs;
-* work with the range of logging configuration options available in the
-  software;
-* work with multiple operating systems;
-* not make assumptions about the log format in excess of the software
-  (e.g. do not assume a username doesn't contain spaces and use \S+ unless
-  you've checked the source code);
-* account for how future versions of the software will log messages
-  (e.g. guess what would happen to the log message if different authentication
-  types are added);
-* not be susceptible to DoS vulnerabilities (see Filter Security below); and
-* match intended log lines only.
-
-Please follow the steps from Filter Test Cases to Developing Filter Regular
-Expressions and submit a GitHub pull request (PR) afterwards. If you get stuck,
-you can push your unfinished changes and still submit a PR -- describe
-what you have done, what is the hurdle, and we'll attempt to help (PR
-will be automagically updated with future commits you would push to
-complete it).
-
-Filter Test Cases
-=================
-
-Purpose
--------
-
-Start by finding the log messages that the application generates related to
-some form of authentication failure. If you are adding to an existing filter
-think about whether the log messages are of a similar importance and purpose
-to the existing filter. If you were a user of Fail2Ban, and did a package
-update of Fail2Ban that started matching new log messages, would anything
-unexpected happen?  Would the bantime/findtime for the jail be appropriate for
-the new log messages?  If it doesn't, perhaps it needs to be in a separate
-filter definition, for example like exim filter aims at authentication failures
-and exim-spam at log messages related to spam.
-
-Even if it is a new filter you may consider separating the log messages into
-different filters based on purpose.
-
-Cause
------
-
-Are some of the log lines a result of the same action? For example, is a PAM
-failure log message, followed by an application specific failure message the
-result of the same user/script action?  If you add regular expressions for
-both you would end up with two failures for a single action.
-Therefore, select the most appropriate log message and document the other log
-message) with a test case not to match it and a description as to why you chose
-one over another.
-
-With the selected log lines consider what action has caused those log
-messages and whether they could have been generated by accident? Could
-the log message be occurring due to the first step towards the application
-asking for authentication? Could the log messages occur often? If some of
-these are true make a note of this in the jail.conf example that you provide.
-
-Samples
--------
-
-It is important to include log file samples so any future change in the regular
-expression will still work with the log lines you have identified.
-
-The sample log messages are provided in a file under testcases/files/logs/
-named identically as the corresponding filter (but without .conf extension).
-Each log line should be preceded by a line with failJSON metadata (so the logs
-lines are tested in the test suite) directly above the log line. If there is
-any specific information about the log message, such as version or an
-application configuration option that is needed for the message to occur,
-include this in a comment (line beginning with #) above the failJSON metadata.
-
-Log samples should include only one, definitely not more than 3, examples of
-log messages of the same form. If log messages are different in different
-versions of the application log messages that show this are encouraged.
-
-Also attempt to inject an IP into the application (e.g. by specifying
-it as a username) so that Fail2Ban possibly detects the IP
-from user input rather than the true origin. See the Filter Security section
-and the top example in testcases/files/logs/apache-auth as to how to do this.
-One you have discovered that this is possible, correct the regex so it doesn't
-match and provide this as a test case with "match": false (see failJSON below).
-
-If the mechanism to create the log message isn't obvious provide a
-configuration and/or sample scripts testcases/files/config/{filtername} and
-reference these in the comments above the log line.
-
-FailJSON metadata
------------------
-
-A failJSON metadata is a comment immediately above the log message. It will
-look like::
-
-  # failJSON: { "time": "2013-06-10T10:10:59", "match": true , "host": "93.184.216.119" }
-
-Time should match the time of the log message. It is in a specific format of
-Year-Month-Day'T'Hour:minute:Second.  If your log message does not include a
-year, like the example below, the year should be listed as 2005, if before Sun
-Aug 14 10am UTC, and 2004 if afterwards.  Here is an example failJSON
-line preceding a sample log line::
-
-  # failJSON: { "time": "2005-03-24T15:25:51", "match": true , "host": "198.51.100.87" }
-  Mar 24 15:25:51 buffalo1 dropbear[4092]: bad password attempt for 'root' from 198.51.100.87:5543
-
-The "host" in failJSON should contain the IP or domain that should be blocked.
-
-For long lines that you do not want to be matched (e.g. from log injection
-attacks) and any log lines to be excluded (see "Cause" section above), set
-"match": false in the failJSON and describe the reason in the comment above.
-
-After developing regexes, the following command will test all failJSON metadata
-against the log lines in all sample log files::
-
-  ./fail2ban-testcases testSampleRegex
-
-Developing Filter Regular Expressions
-=====================================
-
-Date/Time
----------
-
-At the moment, Fail2Ban depends on log lines to have time stamps.  That is why
-before starting to develop failregex, check if your log line format known to
-Fail2Ban.  Copy the time component from the log line and append an IP address to
-test with following command::
-
-  ./fail2ban-regex "2013-09-19 02:46:12 1.2.3.4" "<HOST>"
-
-Output of such command should contain something like::
-
-  Date template hits:
-  |- [# of hits] date format
-  |  [1] Year-Month-Day Hour:Minute:Second
-
-Ensure that the template description matches time/date elements in your log line
-time stamp.  If there is no matched format then date template needs to be added
-to server/datedetector.py.  Ensure that a new template is added in the order
-that more specific matches occur first and that there is no confusion between a
-Day and a Month.
-
-Filter file
------------
-
-The filter is specified in a config/filter.d/{filtername}.conf file. Filter file
-can have sections INCLUDES (optional) and Definition as follows::
-
-  [INCLUDES]
-  
-  before = common.conf
-  
-  after = filtername.local
-  
-  [Definition]
-  
-  failregex = ....
-  
-  ignoreregex = ....
-
-This is also documented in the man page jail.conf (section 5). Other definitions
-can be added to make failregex's more readable and maintainable to be used
-through string Interpolations (see http://docs.python.org/2.7/library/configparser.html)
-
-
-General rules
--------------
-
-Use "before" if you need to include a common set of rules, like syslog or if
-there is a common set of regexes for multiple filters.
-
-Use "after" if you wish to allow the user to overwrite a set of customisations
-of the current filter. This file doesn't need to exist.
-
-Try to avoid using ignoreregex mainly for performance reasons. The case when you
-would use it is if in trying to avoid using it, you end up with an unreadable
-failregex.
-
-Syslog
-------
-
-If your application logs to syslog you can take advantage of log line prefix
-definitions present in common.conf.  So as a base use::
-
-  [INCLUDES]
-  
-  before = common.conf
-  
-  [Definition]
-  
-  _daemon = app
-  
-  failregex = ^%(__prefix_line)s
-
-In this example common.conf defines __prefix_line which also contains the
-_daemon name (in syslog terms the service) you have just specified. _daemon
-can also be a regex.
-
-For example, to capture following line _daemon should be set to "dovecot"::
-
-  Dec 12 11:19:11 dunnart dovecot: pop3-login: Aborted login (tried to use disabled plaintext auth): rip=190.210.136.21, lip=113.212.99.193
-
-and then ``^%(__prefix_line)s`` would match "Dec 12 11:19:11 dunnart dovecot:
-". Note it matches the trailing space(s) as well.
-
-Substitutions (AKA string interpolations)
------------------------------------------
-
-We have used string interpolations in above examples.  They are useful for
-making the regexes more readable, reuse generic patterns in multiple failregex
-lines, and also to refer definition of regex parts to specific filters or even
-to the user.  General principle is that value of a _name variable replaces
-occurrences of %(_name)s within the same section or anywhere in the config file
-if defined in [DEFAULT] section.
-
-Regular Expressions
--------------------
-
-Regular expressions (failregex, ignoreregex) assume that the date/time has been
-removed from the log line (this is just how fail2ban works internally ATM).
-
-If the format is like '<date...> error 1.2.3.4 is evil' then you need to match
-the <> at the start so regex should be similar to '^<> error <HOST> is evil$' using
-<HOST> where the IP/domain name appears in the log line.
-
-The following general rules apply to regular expressions:
-
-* ensure regexes start with a ^ and are as restrictive as possible. E.g. do not
-  use .* if \d+ is sufficient;
-* use functionality of Python regexes defined in the standard Python re library
-  http://docs.python.org/2/library/re.html;
-* make regular expressions readable (as much as possible). E.g.
-  (?:...) represents a non-capturing regex but (...) is more readable, thus
-  preferred.
-
-If you have only a basic knowledge of regular repressions we advise to read
-http://docs.python.org/2/library/re.html first.  It doesn't take long and would
-remind you e.g. which characters you need to escape and which you don't.
-
-Developing/testing a regex
---------------------------
-
-You can develop a regex in a file or using command line depending on your
-preference. You can also use samples you have already created in the test cases
-or test them one at a time.
-
-The general tool for testing Fail2Ban regexes is fail2ban-regex. To see how to
-use it run::
-
-  ./fail2ban-regex --help
-
-Take note of  -l heavydebug  / -l debug  and -v as they might be very useful.
-
-.. TIP::
-     Take a look at the source code of the application you are developing
-     failregex for. You may see optional or extra log messages, or parts there
-     of, that need to form part of your regex.  It may also reveal how some
-     parts are constrained and different formats depending on configuration or
-     less common usages.
-
-.. TIP::
-     For looking through source code - http://sourcecodebrowser.com/ . It has
-     call graphs and can browse different versions.
-
-.. TIP::
-     Some applications log spaces at the end. If you are not sure add \s*$ as
-     the end part of the regex.
-
-If your regex is not matching, http://www.debuggex.com/?flavor=python can help
-to tune it.  fail2ban-regex -D ...  will present Debuggex URLs for the regexs
-and sample log files that you pass into it.
-
-In general use when using regex debuggers for generating fail2ban filters:
-
-* use regex from the ./fail2ban-regex output (to ensure all substitutions are
-done)
-* replace <HOST> with (?&.ipv4)
-* make sure that regex type set to Python
-* for the test data put your log output with the date/time removed
-
-When you have fixed the regex put it back into your filter file.
-
-Please spread the good word about Debuggex - Serge Toarca is kindly continuing
-its free availability to Open Source developers.
-
-Finishing up
-------------
-
-If you've added a new filter, add a new entry in config/jail.conf. The theory
-here is that a user will create a jail.local with [filtername]\nenable=true to
-enable your jail.
-
-So more specifically in the [filter] section in jail.conf:
-
-* ensure that you have "enabled = false" (users will enable as needed);
-* use "filter =" set to your filter name;
-* use a typical action to disable ports associated with the application;
-* set "logpath" to the usual location of application log file;
-* if the default findtime or bantime isn't appropriate to the filter, specify
-  more appropriate choices (possibly with a brief comment line).
-
-Submit github pull request (See "Pull Requests" above) for
-github.com/fail2ban/fail2ban containing your great work.
-
-Filter Security
-===============
-
-Poor filter regular expressions are susceptible to DoS attacks.
-
-When a remote user has the ability to introduce text that would match filter's
-failregex, while matching inserted text to the <HOST> part, they have the
-ability to deny any host they choose.
-
-So the <HOST> part must be anchored on text generated by the application, and
-not the user, to an extent sufficient to prevent user inserting the entire text
-matching this or any other failregex.
-
-Ideally filter regex should anchor at the beginning and at the end of log line.
-However as more applications log at the beginning than the end, anchoring the
-beginning is more important. If the log file used by the application is shared
-with other applications, like system logs, ensure the other application that use
-that log file do not log user generated text at the beginning of the line, or,
-if they do, ensure the regexes of the filter are sufficient to mitigate the risk
-of insertion.
-
-
-Examples of poor filters
-------------------------
-
-1. Too restrictive
-
-We find a log message::
-
-    Apr-07-13 07:08:36 Invalid command fial2ban from 1.2.3.4
-
-We make a failregex::
-
-    ^Invalid command \S+ from <HOST>
-
-Now think evil. The user does the command 'blah from 1.2.3.44'
-
-The program diligently logs::
-
-    Apr-07-13 07:08:36 Invalid command blah from 1.2.3.44 from 1.2.3.4
-
-And fail2ban matches 1.2.3.44 as the IP that it ban. A DoS attack was successful.
-
-The fix here is that the command can be anything so .* is appropriate::
-
-    ^Invalid command .* from <HOST>
-
-Here the .* will match until the end of the string. Then realise it has more to
-match, i.e. "from <HOST>" and go back until it find this. Then it will ban
-1.2.3.4 correctly. Since the <HOST> is always at the end, end the regex with a $::
-
-    ^Invalid command .* from <HOST>$
-
-Note if we'd just had the expression::
-
-    ^Invalid command \S+ from <HOST>$
-
-Then provided the user put a space in their command they would have never been
-banned.
-
-2. Unanchored regex can match other user injected data
-
-From the Apache vulnerability CVE-2013-2178
-( original ref: https://vndh.net/note:fail2ban-089-denial-service ).
-
-An example bad regex for Apache::
-
-    failregex = [[]client <HOST>[]] user .* not found
-
-Since the user can do a get request on::
-
-    GET /[client%20192.168.0.1]%20user%20root%20not%20found HTTP/1.0
-    Host: remote.site
-
-Now the log line will be::
-
-    [Sat Jun 01 02:17:42 2013] [error] [client 192.168.33.1] File does not exist: /srv/http/site/[client 192.168.0.1] user root not found
-
-As this log line doesn't match other expressions hence it matches the above
-regex and blocks 192.168.33.1 as a denial of service from the HTTP requester.
-
-3.  Over greedy pattern matching
-
-From: https://github.com/fail2ban/fail2ban/pull/426
-
-An example ssh log (simplified)::
-
-    Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser remoteuser
-
-As we assume username can include anything including spaces its prudent to put
-.* here. The remote user can also exist as anything so lets not make assumptions again::
-
-    failregex = ^%(__prefix_line)sFailed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
-
-So this works. The problem is if the .* after remote user is injected by the
-user to be 'from 1.2.3.4'. The resultant log line is::
-
-    Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4
-
-Testing with::
-
-    fail2ban-regex -v 'Sep 29 17:15:02 Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4' '^ Failed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$'
-
-.. TIP:: I've removed the bit that matches __prefix_line from the regex and log.
-
-Shows::
-
-    1) [1] ^ Failed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
-       1.2.3.4  Sun Sep 29 17:15:02 2013
-
-It should of matched 127.0.0.1. So the first greedy part of the greedy regex
-matched until the end of the string. The was no "from <HOST>" so the regex
-engine worked backwards from the end of the string until this was matched.
-
-The result was that 1.2.3.4 was matched, injected by the user, and the wrong IP
-was banned.
-
-The solution here is to make the first .* non-greedy with .*?. Here it matches
-as little as required and the fail2ban-regex tool shows the output::
-
-    fail2ban-regex -v 'Sep 29 17:15:02 Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4' '^ Failed \S+ for .*? from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$'
-
-    1) [1] ^ Failed \S+ for .*? from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
-       127.0.0.1  Sun Sep 29 17:15:02 2013
-
-So the general case here is a log line that contains::
-
-    (fixed_data_1)<HOST>(fixed_data_2)(user_injectable_data)
-
-Where the regex that matches fixed_data_1 is gready and matches the entire
-string, before moving backwards and user_injectable_data can match the entire
-string.
-
-Another case
-------------
-
-ref: https://www.debuggex.com/r/CtAbeKMa2sDBEfA2/0
-
-A webserver logs the following without URL escaping::
-
-    [error] 2865#0: *66647 user "xyz" was not found in "/file", client: 1.2.3.1, server: www.host.com, request: "GET ", client: 3.2.1.1, server: fake.com, request: "GET exploited HTTP/3.3", host: "injected.host", host: "www.myhost.com"
-
-regex::
-
-    failregex = ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (?:password mismatch|was not found in ".*"), client: <HOST>, server: \S+, request: "\S+ .+ HTTP/\d+\.\d+", host: "\S+"
-
-The .* matches to the end of the string. Finds that it can't continue to match
-", client ... so it moves from the back and find that the user injected web URL::
-
-    ", client: 3.2.1.1, server: fake.com, request: "GET exploited HTTP/3.3", host: "injected.host
-
-In this case there is a fixed host: "www.myhost.com" at the end so the solution
-is to anchor the regex at the end with a $.
-
-If this wasn't the case then first .* needed to be made so it didn't capture
-beyond <HOST>.
-
-4. Application generates two identical log messages with different meanings
-
-If the application generates the following two messages under different
-circumstances::
-
-    client <IP>: authentication failed
-    client <USER>: authentication failed
-
-
-Then it's obvious that a regex of ``^client <HOST>: authentication
-failed$`` will still cause problems if the user can trigger the second
-log message with a <USER> of 123.1.1.1.
-
-Here there's nothing to do except request/change the application so it logs
-messages differently.
-
-

MANIFEST

@@ -1,433 +0,0 @@
-bin/fail2ban-client
-bin/fail2ban-regex
-bin/fail2ban-server
-bin/fail2ban-testcases
-ChangeLog
-config/action.d/apprise.conf
-config/action.d/abuseipdb.conf
-config/action.d/apf.conf
-config/action.d/blocklist_de.conf
-config/action.d/bsd-ipfw.conf
-config/action.d/cloudflare.conf
-config/action.d/complain.conf
-config/action.d/dshield.conf
-config/action.d/dummy.conf
-config/action.d/firewallcmd-allports.conf
-config/action.d/firewallcmd-common.conf
-config/action.d/firewallcmd-ipset.conf
-config/action.d/firewallcmd-multiport.conf
-config/action.d/firewallcmd-new.conf
-config/action.d/firewallcmd-rich-logging.conf
-config/action.d/firewallcmd-rich-rules.conf
-config/action.d/helpers-common.conf
-config/action.d/hostsdeny.conf
-config/action.d/ipfilter.conf
-config/action.d/ipfw.conf
-config/action.d/iptables-allports.conf
-config/action.d/iptables-common.conf
-config/action.d/iptables.conf
-config/action.d/iptables-ipset-proto4.conf
-config/action.d/iptables-ipset-proto6-allports.conf
-config/action.d/iptables-ipset-proto6.conf
-config/action.d/iptables-multiport.conf
-config/action.d/iptables-multiport-log.conf
-config/action.d/iptables-new.conf
-config/action.d/iptables-xt_recent-echo.conf
-config/action.d/mail-buffered.conf
-config/action.d/mail.conf
-config/action.d/mail-whois-common.conf
-config/action.d/mail-whois.conf
-config/action.d/mail-whois-lines.conf
-config/action.d/mynetwatchman.conf
-config/action.d/netscaler.conf
-config/action.d/nftables-allports.conf
-config/action.d/nftables.conf
-config/action.d/nftables-multiport.conf
-config/action.d/nginx-block-map.conf
-config/action.d/npf.conf
-config/action.d/nsupdate.conf
-config/action.d/osx-afctl.conf
-config/action.d/osx-ipfw.conf
-config/action.d/pf.conf
-config/action.d/route.conf
-config/action.d/sendmail-buffered.conf
-config/action.d/sendmail-common.conf
-config/action.d/sendmail.conf
-config/action.d/sendmail-geoip-lines.conf
-config/action.d/sendmail-whois.conf
-config/action.d/sendmail-whois-ipjailmatches.conf
-config/action.d/sendmail-whois-ipmatches.conf
-config/action.d/sendmail-whois-lines.conf
-config/action.d/sendmail-whois-matches.conf
-config/action.d/shorewall.conf
-config/action.d/shorewall-ipset-proto6.conf
-config/action.d/smtp.py
-config/action.d/symbiosis-blacklist-allports.conf
-config/action.d/ufw.conf
-config/action.d/xarf-login-attack.conf
-config/fail2ban.conf
-config/filter.d/3proxy.conf
-config/filter.d/apache-auth.conf
-config/filter.d/apache-badbots.conf
-config/filter.d/apache-botsearch.conf
-config/filter.d/apache-common.conf
-config/filter.d/apache-fakegooglebot.conf
-config/filter.d/apache-modsecurity.conf
-config/filter.d/apache-nohome.conf
-config/filter.d/apache-noscript.conf
-config/filter.d/apache-overflows.conf
-config/filter.d/apache-pass.conf
-config/filter.d/apache-shellshock.conf
-config/filter.d/assp.conf
-config/filter.d/asterisk.conf
-config/filter.d/bitwarden.conf
-config/filter.d/botsearch-common.conf
-config/filter.d/centreon.conf
-config/filter.d/common.conf
-config/filter.d/counter-strike.conf
-config/filter.d/courier-auth.conf
-config/filter.d/courier-smtp.conf
-config/filter.d/cyrus-imap.conf
-config/filter.d/directadmin.conf
-config/filter.d/domino-smtp.conf
-config/filter.d/dovecot.conf
-config/filter.d/dropbear.conf
-config/filter.d/drupal-auth.conf
-config/filter.d/ejabberd-auth.conf
-config/filter.d/exim-common.conf
-config/filter.d/exim.conf
-config/filter.d/exim-spam.conf
-config/filter.d/freeswitch.conf
-config/filter.d/froxlor-auth.conf
-config/filter.d/gitlab.conf
-config/filter.d/grafana.conf
-config/filter.d/groupoffice.conf
-config/filter.d/gssftpd.conf
-config/filter.d/guacamole.conf
-config/filter.d/haproxy-http-auth.conf
-config/filter.d/horde.conf
-config/filter.d/ignorecommands/apache-fakegooglebot
-config/filter.d/kerio.conf
-config/filter.d/lighttpd-auth.conf
-config/filter.d/mongodb-auth.conf
-config/filter.d/monit.conf
-config/filter.d/murmur.conf
-config/filter.d/mysqld-auth.conf
-config/filter.d/nagios.conf
-config/filter.d/named-refused.conf
-config/filter.d/nginx-botsearch.conf
-config/filter.d/nginx-http-auth.conf
-config/filter.d/nginx-limit-req.conf
-config/filter.d/nsd.conf
-config/filter.d/openhab.conf
-config/filter.d/openwebmail.conf
-config/filter.d/oracleims.conf
-config/filter.d/pam-generic.conf
-config/filter.d/perdition.conf
-config/filter.d/phpmyadmin-syslog.conf
-config/filter.d/php-url-fopen.conf
-config/filter.d/portsentry.conf
-config/filter.d/postfix.conf
-config/filter.d/proftpd.conf
-config/filter.d/pure-ftpd.conf
-config/filter.d/qmail.conf
-config/filter.d/recidive.conf
-config/filter.d/roundcube-auth.conf
-config/filter.d/screensharingd.conf
-config/filter.d/selinux-common.conf
-config/filter.d/selinux-ssh.conf
-config/filter.d/sendmail-auth.conf
-config/filter.d/sendmail-reject.conf
-config/filter.d/sieve.conf
-config/filter.d/slapd.conf
-config/filter.d/softethervpn.conf
-config/filter.d/sogo-auth.conf
-config/filter.d/solid-pop3d.conf
-config/filter.d/squid.conf
-config/filter.d/squirrelmail.conf
-config/filter.d/sshd.conf
-config/filter.d/stunnel.conf
-config/filter.d/suhosin.conf
-config/filter.d/tine20.conf
-config/filter.d/traefik-auth.conf
-config/filter.d/uwimap-auth.conf
-config/filter.d/vsftpd.conf
-config/filter.d/webmin-auth.conf
-config/filter.d/wuftpd.conf
-config/filter.d/xinetd-fail.conf
-config/filter.d/znc-adminlog.conf
-config/filter.d/zoneminder.conf
-config/jail.conf
-config/paths-arch.conf
-config/paths-common.conf
-config/paths-debian.conf
-config/paths-fedora.conf
-config/paths-freebsd.conf
-config/paths-opensuse.conf
-config/paths-osx.conf
-CONTRIBUTING.md
-COPYING
-.coveragerc
-DEVELOP
-fail2ban-2to3
-fail2ban/client/actionreader.py
-fail2ban/client/beautifier.py
-fail2ban/client/configparserinc.py
-fail2ban/client/configreader.py
-fail2ban/client/configurator.py
-fail2ban/client/csocket.py
-fail2ban/client/fail2banclient.py
-fail2ban/client/fail2bancmdline.py
-fail2ban/client/fail2banreader.py
-fail2ban/client/fail2banregex.py
-fail2ban/client/fail2banserver.py
-fail2ban/client/filterreader.py
-fail2ban/client/__init__.py
-fail2ban/client/jailreader.py
-fail2ban/client/jailsreader.py
-fail2ban/exceptions.py
-fail2ban/helpers.py
-fail2ban/__init__.py
-fail2ban/protocol.py
-fail2ban/server/action.py
-fail2ban/server/actions.py
-fail2ban/server/asyncserver.py
-fail2ban/server/banmanager.py
-fail2ban/server/database.py
-fail2ban/server/datedetector.py
-fail2ban/server/datetemplate.py
-fail2ban/server/failmanager.py
-fail2ban/server/failregex.py
-fail2ban/server/filtergamin.py
-fail2ban/server/filterpoll.py
-fail2ban/server/filter.py
-fail2ban/server/filterpyinotify.py
-fail2ban/server/filtersystemd.py
-fail2ban/server/__init__.py
-fail2ban/server/ipdns.py
-fail2ban/server/jail.py
-fail2ban/server/jails.py
-fail2ban/server/jailthread.py
-fail2ban/server/mytime.py
-fail2ban/server/observer.py
-fail2ban/server/server.py
-fail2ban/server/strptime.py
-fail2ban/server/ticket.py
-fail2ban/server/transmitter.py
-fail2ban/server/utils.py
-fail2ban/setup.py
-fail2ban-testcases-all
-fail2ban-testcases-all-python3
-fail2ban/tests/action_d/__init__.py
-fail2ban/tests/action_d/test_smtp.py
-fail2ban/tests/actionstestcase.py
-fail2ban/tests/actiontestcase.py
-fail2ban/tests/banmanagertestcase.py
-fail2ban/tests/clientbeautifiertestcase.py
-fail2ban/tests/clientreadertestcase.py
-fail2ban/tests/config/action.d/action.conf
-fail2ban/tests/config/action.d/brokenaction.conf
-fail2ban/tests/config/fail2ban.conf
-fail2ban/tests/config/filter.d/checklogtype.conf
-fail2ban/tests/config/filter.d/checklogtype_test.conf
-fail2ban/tests/config/filter.d/simple.conf
-fail2ban/tests/config/filter.d/test.conf
-fail2ban/tests/config/filter.d/test.local
-fail2ban/tests/config/filter.d/zzz-generic-example.conf
-fail2ban/tests/config/filter.d/zzz-sshd-obsolete-multiline.conf
-fail2ban/tests/config/jail.conf
-fail2ban/tests/databasetestcase.py
-fail2ban/tests/datedetectortestcase.py
-fail2ban/tests/dummyjail.py
-fail2ban/tests/fail2banclienttestcase.py
-fail2ban/tests/fail2banregextestcase.py
-fail2ban/tests/failmanagertestcase.py
-fail2ban/tests/files/action.d/action_checkainfo.py
-fail2ban/tests/files/action.d/action_errors.py
-fail2ban/tests/files/action.d/action_modifyainfo.py
-fail2ban/tests/files/action.d/action_noAction.py
-fail2ban/tests/files/action.d/action_nomethod.py
-fail2ban/tests/files/action.d/action.py
-fail2ban/tests/files/config/apache-auth/basic/authz_owner/cant_get_me.html
-fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htaccess
-fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htpasswd
-fail2ban/tests/files/config/apache-auth/basic/file/.htaccess
-fail2ban/tests/files/config/apache-auth/basic/file/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest_anon/.htaccess
-fail2ban/tests/files/config/apache-auth/digest_anon/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest/.htaccess
-fail2ban/tests/files/config/apache-auth/digest/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest.py
-fail2ban/tests/files/config/apache-auth/digest_time/.htaccess
-fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess
-fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd
-fail2ban/tests/files/config/apache-auth/noentry/.htaccess
-fail2ban/tests/files/config/apache-auth/README
-fail2ban/tests/files/database_v1.db
-fail2ban/tests/files/database_v2.db
-fail2ban/tests/files/filter.d/substition.conf
-fail2ban/tests/files/filter.d/testcase01.conf
-fail2ban/tests/files/filter.d/testcase02.conf
-fail2ban/tests/files/filter.d/testcase02.local
-fail2ban/tests/files/filter.d/testcase-common.conf
-fail2ban/tests/files/ignorecommand.py
-fail2ban/tests/files/logs/3proxy
-fail2ban/tests/files/logs/apache-auth
-fail2ban/tests/files/logs/apache-badbots
-fail2ban/tests/files/logs/apache-botsearch
-fail2ban/tests/files/logs/apache-fakegooglebot
-fail2ban/tests/files/logs/apache-modsecurity
-fail2ban/tests/files/logs/apache-nohome
-fail2ban/tests/files/logs/apache-noscript
-fail2ban/tests/files/logs/apache-overflows
-fail2ban/tests/files/logs/apache-pass
-fail2ban/tests/files/logs/apache-shellshock
-fail2ban/tests/files/logs/assp
-fail2ban/tests/files/logs/asterisk
-fail2ban/tests/files/logs/bitwarden
-fail2ban/tests/files/logs/bsd/syslog-plain.txt
-fail2ban/tests/files/logs/bsd/syslog-v.txt
-fail2ban/tests/files/logs/bsd/syslog-vv.txt
-fail2ban/tests/files/logs/centreon
-fail2ban/tests/files/logs/counter-strike
-fail2ban/tests/files/logs/courier-auth
-fail2ban/tests/files/logs/courier-smtp
-fail2ban/tests/files/logs/cyrus-imap
-fail2ban/tests/files/logs/directadmin
-fail2ban/tests/files/logs/domino-smtp
-fail2ban/tests/files/logs/dovecot
-fail2ban/tests/files/logs/dropbear
-fail2ban/tests/files/logs/drupal-auth
-fail2ban/tests/files/logs/ejabberd-auth
-fail2ban/tests/files/logs/exim
-fail2ban/tests/files/logs/exim-spam
-fail2ban/tests/files/logs/freeswitch
-fail2ban/tests/files/logs/froxlor-auth
-fail2ban/tests/files/logs/gitlab
-fail2ban/tests/files/logs/grafana
-fail2ban/tests/files/logs/groupoffice
-fail2ban/tests/files/logs/gssftpd
-fail2ban/tests/files/logs/guacamole
-fail2ban/tests/files/logs/haproxy-http-auth
-fail2ban/tests/files/logs/horde
-fail2ban/tests/files/logs/kerio
-fail2ban/tests/files/logs/lighttpd-auth
-fail2ban/tests/files/logs/mongodb-auth
-fail2ban/tests/files/logs/monit
-fail2ban/tests/files/logs/murmur
-fail2ban/tests/files/logs/mysqld-auth
-fail2ban/tests/files/logs/nagios
-fail2ban/tests/files/logs/named-refused
-fail2ban/tests/files/logs/nginx-botsearch
-fail2ban/tests/files/logs/nginx-http-auth
-fail2ban/tests/files/logs/nginx-limit-req
-fail2ban/tests/files/logs/nsd
-fail2ban/tests/files/logs/openhab
-fail2ban/tests/files/logs/openwebmail
-fail2ban/tests/files/logs/oracleims
-fail2ban/tests/files/logs/pam-generic
-fail2ban/tests/files/logs/perdition
-fail2ban/tests/files/logs/phpmyadmin-syslog
-fail2ban/tests/files/logs/php-url-fopen
-fail2ban/tests/files/logs/portsentry
-fail2ban/tests/files/logs/postfix
-fail2ban/tests/files/logs/proftpd
-fail2ban/tests/files/logs/pure-ftpd
-fail2ban/tests/files/logs/qmail
-fail2ban/tests/files/logs/recidive
-fail2ban/tests/files/logs/roundcube-auth
-fail2ban/tests/files/logs/screensharingd
-fail2ban/tests/files/logs/selinux-ssh
-fail2ban/tests/files/logs/sendmail-auth
-fail2ban/tests/files/logs/sendmail-reject
-fail2ban/tests/files/logs/sieve
-fail2ban/tests/files/logs/slapd
-fail2ban/tests/files/logs/softethervpn
-fail2ban/tests/files/logs/sogo-auth
-fail2ban/tests/files/logs/solid-pop3d
-fail2ban/tests/files/logs/squid
-fail2ban/tests/files/logs/squirrelmail
-fail2ban/tests/files/logs/sshd
-fail2ban/tests/files/logs/sshd-journal
-fail2ban/tests/files/logs/stunnel
-fail2ban/tests/files/logs/suhosin
-fail2ban/tests/files/logs/tine20
-fail2ban/tests/files/logs/traefik-auth
-fail2ban/tests/files/logs/uwimap-auth
-fail2ban/tests/files/logs/vsftpd
-fail2ban/tests/files/logs/webmin-auth
-fail2ban/tests/files/logs/wuftpd
-fail2ban/tests/files/logs/xinetd-fail
-fail2ban/tests/files/logs/znc-adminlog
-fail2ban/tests/files/logs/zoneminder
-fail2ban/tests/files/logs/zzz-generic-example
-fail2ban/tests/files/logs/zzz-sshd-obsolete-multiline
-fail2ban/tests/files/testcase01a.log
-fail2ban/tests/files/testcase01.log
-fail2ban/tests/files/testcase02.log
-fail2ban/tests/files/testcase03.log
-fail2ban/tests/files/testcase04.log
-fail2ban/tests/files/testcase-journal.log
-fail2ban/tests/files/testcase-multiline.log
-fail2ban/tests/files/testcase-usedns.log
-fail2ban/tests/files/testcase-wrong-char.log
-fail2ban/tests/files/zzz-sshd-obsolete-multiline.log
-fail2ban/tests/filtertestcase.py
-fail2ban/tests/__init__.py
-fail2ban/tests/misctestcase.py
-fail2ban/tests/observertestcase.py
-fail2ban/tests/samplestestcase.py
-fail2ban/tests/servertestcase.py
-fail2ban/tests/sockettestcase.py
-fail2ban/tests/tickettestcase.py
-fail2ban/tests/utils.py
-fail2ban/version.py
-files/bash-completion
-files/cacti/cacti_host_template_fail2ban.xml
-files/cacti/fail2ban_stats.sh
-files/cacti/README
-files/debian-initd
-files/fail2ban-logrotate
-files/fail2ban.service.in
-files/fail2ban-tmpfiles.conf
-files/fail2ban.upstart
-files/gen_badbots
-files/gentoo-confd
-files/gentoo-initd
-files/ipmasq-ZZZzzz_fail2ban.rul
-files/logwatch/fail2ban
-files/logwatch/fail2ban-0.8.log
-files/logwatch/fail2ban-0.9.log
-files/macosx-initd
-files/monit/fail2ban
-files/nagios/check_fail2ban
-files/nagios/README
-files/redhat-initd
-files/solaris-fail2ban.xml
-files/solaris-svc-fail2ban
-files/suse-initd
-FILTERS
-kill-server
-man/fail2ban.1
-man/fail2ban-client.1
-man/fail2ban-client.h2m
-man/fail2ban-python.1
-man/fail2ban-python.h2m
-man/fail2ban-regex.1
-man/fail2ban-regex.h2m
-man/fail2ban-server.1
-man/fail2ban-server.h2m
-man/fail2ban-testcases.1
-man/fail2ban-testcases.h2m
-man/generate-man
-man/jail.conf.5
-.pylintrc
-README.md
-README.Solaris
-RELEASE
-setup.cfg
-setup.py
-THANKS
-TODO
-Vagrantfile

MANIFEST.in

@@ -1,5 +0,0 @@
-include ChangeLog COPYING DEVELOP FILTERS README.* THANKS TODO CONTRIBUTING* Vagrantfile
-graft doc
-graft files
-recursive-include config *.conf *.py
-recursive-include config/filter.d/ignorecommands *

Makefile

@@ -1,5 +1,17 @@
-setup:
-	docker-compose -f docker-compose.yml up --build -d
-clean:
-	docker-compose down
-	docker image rm fail2ban
+# quick dirty hacks
+#
+DESTDIR=debian/fail2ban
+MANPAGE=fail2ban.8
+all:: $(MANPAGE)
+
+
+$(MANPAGE): fail2ban fail2ban.h2m
+	help2man --include fail2ban.h2m --section=1x --no-info --output $@ ./fail2ban
+
+install:: all
+	python setup.py install --root=debian/fail2ban/
+	mkdir -p $(DESTDIR)/etc
+	cp config/fail2ban.conf.default $(DESTDIR)/etc/fail2ban.conf
+
+clean::
+	rm -rf changelog.gz $(MANPAGE) build* `find -iname '*.pyc' `

PKG-INFO

@@ -0,0 +1,15 @@
+Metadata-Version: 1.0
+Name: fail2ban
+Version: 0.5.4
+Summary: Ban IPs that make too many password failure
+Home-page: http://fail2ban.sourceforge.net
+Author: Cyril Jaquier
+Author-email: lostcontrol@users.sourceforge.net
+License: GPL
+Description: 
+        Fail2Ban scans log files like /var/log/pwdfail or
+        /var/log/apache/error_log and bans IP that makes
+        too many password failures. It updates firewall rules
+        to reject the IP address or executes user defined
+        commands.
+Platform: Posix

README

@@ -0,0 +1,146 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.5.4)                           2005/09/13
+=============================================================
+
+Fail2Ban scans log files like /var/log/pwdfail and bans IP
+that makes too many password failures. It updates firewall
+rules to reject the IP address. These rules can be defined by
+the user. Fail2Ban can read multiple log files such as sshd
+or Apache web server ones.
+
+This is my first Python program. Moreover, English is not my
+mother tongue...
+
+
+More details:
+-------------
+
+Fail2Ban is rather simple. I have a home server connected to
+the Internet which runs apache, samba, sshd, ... I see in my
+logs that people are trying to log into my box using "manual"
+brute force or scripts. They try 10, 20 and sometimes more
+user/password (without success anyway). In order to
+discourage these script kiddies, I wanted that sshd refuse
+login from a specific ip after 3 password failures. After
+some Google searches, I found that sshd was not able of that.
+So I search for a script or program that do it. I found
+nothing :-( So I decide to write mine and to learn Python :-)
+
+For each sections defined in the configuration file, Fail2Ban
+tries to find lines which match the failregex. Then it
+retrieves the message time using timeregex and timepattern.
+It finally gets the ip and if it has already done 3 or more
+password failures in the last banTime, the ip is banned for
+banTime using a firewall rule. This rule is set by the user
+in the configuration file. Thus, Fail2Ban can be adapted for
+lots of firewall. After banTime, the rule is deleted. Notice
+that if no "plain" ip is available, Fail2Ban try to do DNS
+lookup in order to found one or several ip's to ban.
+
+Sections can be freely added so it is possible to monitor
+several daemons at the same time.
+
+Runs on my server and does its job rather well :-) The idea
+is to make fail2ban usable with daemons and services that
+require a login (sshd, telnetd, ...) and with different
+firewalls.
+
+
+Installation:
+-------------
+
+Require: python-2.3 (http://www.python.org)
+
+To install, just do:
+
+> tar xvfj fail2ban-0.5.4.tar.bz2
+> cd fail2ban-0.5.4
+> python setup.py install
+
+This will install Fail2Ban into /usr/lib/fail2ban. The fail2ban
+executable is placed into /usr/bin.
+
+Gentoo: ebuilds are available on the website.
+Debian: Fail2Ban is in Debian unstable.
+RedHat: packages are available on the website.
+
+Fail2Ban should now be correctly installed. Just type:
+
+> fail2ban -h
+
+to see if everything is alright. You can configure fail2ban
+with a config file. Copy config/fail2ban.conf.default to
+/etc/fail2ban.conf.
+
+You can use the initd script available in config/. Copy
+<dist>-initd to /etc/init.d/fail2ban. Gentoo users must copy
+gentoo-confd to /etc/conf.d/fail2ban. You can start fail2ban:
+
+> /etc/init.d/fail2ban start
+
+Gentoo users can add it to the default runlevel:
+
+> rc-update add fail2ban default
+
+Configuration:
+--------------
+
+You can configure fail2ban using the file /etc/fail2ban.conf
+or using command line options. Command line options override
+the value stored in fail2ban.conf. Here are the command line
+options:
+
+  -b         start in background
+  -d         start in debug mode
+  -c <FILE>  read configuration file FILE
+  -p <FILE>  create PID lock in FILE
+  -h         display this help message
+  -i <IP(s)> IP(s) to ignore
+  -k         kill a currently running instance
+  -r <VALUE> allow a max of VALUE password failure
+  -t <TIME>  ban IP for TIME seconds
+  -v         verbose. Use twice for greater effect
+  -V         print software version
+
+Contact:
+--------
+
+You need some new features, you found bugs or you just
+appreciate this program, you can contact me at :
+
+Website: http://fail2ban.sourceforge.net
+
+Cyril Jaquier: <lostcontrol@users.sourceforge.net>
+
+
+Thanks:
+-------
+
+Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
+Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
+Jonathan Kamens, Stephen Gildea
+
+License:
+--------
+
+Fail2Ban is free software; you can redistribute it
+and/or modify it under the terms of the GNU General Public
+License as published by the Free Software Foundation; either
+version 2 of the License, or (at your option) any later
+version.
+
+Fail2Ban is distributed in the hope that it will be
+useful, but WITHOUT ANY WARRANTY; without even the implied
+warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public
+License along with Fail2Ban; if not, write to the Free
+Software Foundation, Inc., 59 Temple Place, Suite 330,
+Boston, MA  02111-1307  USA

README.Solaris

@@ -1,122 +0,0 @@
-# vim:tw=80:ft=txt
-
-README FOR SOLARIS INSTALLATIONS
-
-By Roy Sigurd Karlsbakk <roy@karlsbakk.net>
-
-ABOUT
-
-This README is meant for those wanting to install fail2ban on Solaris 10,
-OpenSolaris, OpenIndiana etc. To some degree it may as well be useful for
-users of older Solaris versions and Nexenta, but don't rely on it.
-
-READ ME FIRST
-
-If I use the term Solaris, I am talking about any Solaris dialect, that is, the
-official Sun/Oracle ones or derivatives. If I describe an OS as
-"OpenSolaris-based", it means it's either OpenSolaris, OpenIndiana or one of the
-other, but /not/ the Nexenta family, since this only uses the OpenSolaris/
-IllumOS kernel and not the userland. If I say Solaris 10, I mean Solaris 10 and
-perhaps, if you're lucky and have some good gods on your side, it may also apply
-to Solaris 9 or even 8 and hopefully in the new Solaris 11 whenever that may be
-released. Quoted lines of code, settings etc. are indented with two spaces.
-This does _not_ mean you should use that indentation, especially in config files
-where they can be harmful. Optional settings are prefixed with OPT: while
-required settings are prefixed with REQ:. If no prefix is found, regard it as a
-required setting.
-
-INSTALLATION ON SOLARIS
-
-The installation is straight forward on Solaris as well as on linux/bsd/etc.
-./setup.py install installs the general packages in /usr/bin on OpenSolaris-
-based distros or (at least on this box) under /usr/sfw/bin on Solaris 10. In
-the files/ directory you will find the file solaris-fail2ban.xml containing the
-Solaris service. To install this, run the following command as root (or with
-sudo):
-
-  svccfg import files/solaris-fail2ban.xml
-
-This should normally without giving an error. If you get an error, deal with it,
-and please post any relevant info (or fixes?) to the fail2ban mailing list.
-Next install the service handler - copy the script in and allow it to be executed:
-
-  cp files/solaris-svc-fail2ban /lib/svc/method/svc-fail2ban
-  chmod +x /lib/svc/method/svc-fail2ban
-
-CONFIGURE SYSLOG
-
-For some reason, a default Solaris installation does not log ssh login attempts,
-and since fail2ban works by monitoring logs, enabling this logging is rather
-important for it to work. To enable this, edit /etc/syslog.conf and add a line
-at the end:
-
-  auth.info					/var/adm/auth.log
-
-Save the file and exit, and run
-
-  touch /var/adm/auth.log
-
-The Solaris system logger will _not_ create a non-existing file. Now, restart
-the system logger.
-
-  svcadm restart system-log
-
-Try to ssh into localhost with ssh asdf@localhost and enter an invalid password.
-Make sure this is logged in the above file. When done, you may configure
-fail2ban.
-
-FAIL2BAN CONFIGURATION
-
-OPT: Create /etc/fail2ban/fail2ban.local containing:
-
-# Fail2Ban configuration file for logging fail2ban on Solaris
-#
-[Definition]
-
-logtarget = /var/adm/fail2ban.log
-
-
-REQ: Create /etc/fail2ban/jail.local containing:
-
-[ssh-tcpwrapper]
-
-enabled     = true
-filter      = sshd
-action      = hostsdeny[daemon_list=sshd]
-              sendmail-whois[name=SSH, dest=you@example.com]
-ignoreregex = for myuser from
-logpath     = /var/adm/auth.log
-
-Set the sendmail dest address to something useful or drop the line to stop it spamming you.
-Set 'myuser' to your username to avoid banning yourself or remove the line.
-
-START (OR RESTART) FAIL2BAN
-
-Enable the fail2ban service with
-
-  svcadm enable fail2ban
-
-When done, check that all services are running well
-
-  svcs -xv
-
-GOTCHAS AND FIXMES
-
-* It seems the installation may be starting fail2ban automatically. If this is
-  done, fail2ban will not start, but no errors will be returned from svcs
-  (above). Check if it's running with 'ps -ef | grep fail2ban' and manually kill
-  the PID if it is. Re-enable fail2ban and try again
-
-    svcadm disable fail2ban
-    svcadm enable fail2ban
-
-* If svcs -xv says that fail2ban failed to start or svcs says it's in maintenance mode
-  check /var/svc/log/network-fail2ban:default.log for clues.
-  Check permissions on /var/adm, /var/adm/auth.log /var/adm/fail2ban.log and /var/run/fail2ban
-  You may need to:
-
-  sudo mkdir /var/run/fail2ban
-
-* Fail2ban adds lines like these to /etc/hosts.deny:
-
-    sshd: 1.2.3.4

README.md

@@ -1,129 +0,0 @@
-                         __      _ _ ___ _               
-                        / _|__ _(_) |_  ) |__  __ _ _ _  
-                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
-                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
-                       v1.0.1.dev1            20??/??/??
-
-## Fail2Ban: ban hosts that cause multiple authentication errors
-
-Fail2Ban scans log files like `/var/log/auth.log` and bans IP addresses conducting
-too many failed login attempts. It does this by updating system firewall rules
-to reject new connections from those IP addresses, for a configurable amount
-of time. Fail2Ban comes out-of-the-box ready to read many standard log files,
-such as those for sshd and Apache, and is easily configured to read any log
-file of your choosing, for any error you wish.
-
-Though Fail2Ban is able to reduce the rate of incorrect authentication
-attempts, it cannot eliminate the risk presented by weak authentication.
-Set up services to use only two factor, or public/private authentication
-mechanisms if you really want to protect services.
-     
-<img src="http://www.worldipv6launch.org/wp-content/themes/ipv6/downloads/World_IPv6_launch_logo.svg" height="52pt"/> | Since v0.10 fail2ban supports the matching of IPv6 addresses.
-------|------
-
-This README is a quick introduction to Fail2Ban. More documentation, FAQ, and HOWTOs
-to be found on fail2ban(1) manpage, [Wiki](https://github.com/fail2ban/fail2ban/wiki),
-[Developers documentation](https://fail2ban.readthedocs.io/)
-and the website: https://www.fail2ban.org
-
-Installation:
--------------
-
-**It is possible that Fail2Ban is already packaged for your distribution.  In
-this case, you should use that instead.**
-
-Required:
-- [Python2 >= 2.6 or Python >= 3.2](https://www.python.org) or [PyPy](https://pypy.org)
-- python-setuptools, python-distutils or python3-setuptools for installation from source
-
-Optional:
-- [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify), may require:
-  * Linux >= 2.6.13
-- [gamin >= 0.0.21](http://www.gnome.org/~veillard/gamin)
-- [systemd >= 204](http://www.freedesktop.org/wiki/Software/systemd) and python bindings:
-  * [python-systemd package](https://www.freedesktop.org/software/systemd/python-systemd/index.html)
-- [dnspython](http://www.dnspython.org/)
-
-
-To install:
-
-    tar xvfj fail2ban-1.0.1.tar.bz2
-    cd fail2ban-1.0.1
-    sudo python setup.py install
-   
-Alternatively, you can clone the source from GitHub to a directory of Your choice, and do the install from there. Pick the correct branch, for example, master or 0.11
-
-    git clone https://github.com/fail2ban/fail2ban.git
-    cd fail2ban
-    sudo python setup.py install 
-    
-This will install Fail2Ban into the python library directory. The executable
-scripts are placed into `/usr/bin`, and configuration in `/etc/fail2ban`.
-
-Fail2Ban should be correctly installed now. Just type:
-
-    fail2ban-client -h
-
-to see if everything is alright. You should always use fail2ban-client and
-never call fail2ban-server directly.
-You can verify that you have the correct version installed with 
-
-    fail2ban-client version
-
-Please note that the system init/service script is not automatically installed.
-To enable fail2ban as an automatic service, simply copy the script for your
-distro from the `files` directory to `/etc/init.d`. Example (on a Debian-based
-system):
-
-    cp files/debian-initd /etc/init.d/fail2ban
-    update-rc.d fail2ban defaults
-    service fail2ban start
-
-Configuration:
---------------
-
-You can configure Fail2Ban using the files in `/etc/fail2ban`. It is possible to
-configure the server using commands sent to it by `fail2ban-client`. The
-available commands are described in the fail2ban-client(1) manpage.  Also see
-fail2ban(1) and jail.conf(5)  manpages for further references.
-
-Code status:
-------------
-
-* travis-ci.org: [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=master)](https://travis-ci.org/fail2ban/fail2ban?branch=master) / [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=0.11)](https://travis-ci.org/fail2ban/fail2ban?branch=0.11) (0.11 branch) / [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=0.10)](https://travis-ci.org/fail2ban/fail2ban?branch=0.10) (0.10 branch) 
-
-* coveralls.io: [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=master)](https://coveralls.io/github/fail2ban/fail2ban?branch=master) / [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=0.11)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.11) (0.11 branch) / [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=0.10)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.10) / (0.10 branch)
-
-* codecov.io: [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=master)](https://codecov.io/gh/fail2ban/fail2ban/branch/master) / [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.11)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.11) (0.11 branch) / [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.10)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.10) (0.10 branch)
-
-Contact:
---------
-
-### Bugs, feature requests, discussions?
-See [CONTRIBUTING.md](https://github.com/fail2ban/fail2ban/blob/master/CONTRIBUTING.md)
-
-### You just appreciate this program:
-Send kudos to the original author ([Cyril Jaquier](mailto:cyril.jaquier@fail2ban.org))
-or *better* to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
-since Fail2Ban is "community-driven" for years now.
-
-Thanks:
--------
-
-See [THANKS](https://github.com/fail2ban/fail2ban/blob/master/THANKS) file.
-
-License:
---------
-
-Fail2Ban is free software; you can redistribute it and/or modify it under the
-terms of the GNU General Public License as published by the Free Software
-Foundation; either version 2 of the License, or (at your option) any later
-version.
-
-Fail2Ban is distributed in the hope that it will be useful, but WITHOUT ANY
-WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
-PARTICULAR PURPOSE. See the GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License along with
-Fail2Ban; if not, write to the Free Software Foundation, Inc., 51 Franklin
-Street, Fifth Floor, Boston, MA 02110, USA

RELEASE

@@ -1,206 +0,0 @@
-..                       __      _ _ ___ _
-                        / _|__ _(_) |_  ) |__  __ _ _ _
-                       |  _/ _` | | |/ /| '_ \/ _` | ' \
-                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
-
-================================================================================
-How to do a release for Fail2Ban
-================================================================================
-
-Preparation
-===========
-
-* Check distribution patches and see if they can be included
-
-  * https://apps.fedoraproject.org/packages/fail2ban/sources
-  * http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/
-  * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/
-  * https://build.opensuse.org/package/show?package=fail2ban&project=openSUSE%3AFactory
-  * http://sophie.zarb.org/sources/fail2ban (Mageia)
-  * https://trac.macports.org/browser/trunk/dports/security/fail2ban
-
-
-* Check distribution outstanding bugs
-
-  * https://github.com/fail2ban/fail2ban/issues?sort=updated&state=open
-  * http://bugs.debian.org/cgi-bin/pkgreport.cgi?dist=unstable;package=fail2ban
-  * https://bugs.launchpad.net/ubuntu/+source/fail2ban
-  * http://bugs.sabayon.org/buglist.cgi?quicksearch=net-analyzer%2Ffail2ban
-  * https://bugs.archlinux.org/?project=5&cat%5B%5D=33&string=fail2ban
-  * https://bugs.gentoo.org/buglist.cgi?query_format=advanced&short_desc=fail2ban&bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=IN_PROGRESS&short_desc_type=allwords
-  * https://bugzilla.redhat.com/buglist.cgi?query_format=advanced&bug_status=NEW&bug_status=ASSIGNED&component=fail2ban&classification=Red%20Hat&classification=Fedora
-  * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
-  * https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
-  * https://build.opensuse.org/package/requests/openSUSE:Factory/fail2ban
-
-
-* Make sure the tests pass::
-
-  ./fail2ban-testcases-all
-
-* Ensure the version is correct in:
-
-  * ./fail2ban/version.py
-  * top of ChangeLog
-  * README.md
-
-
-* Ensure the MANIFEST is complete
-
-  ad-hoc bash script to run in a clean clone:
-
-     find -type f | grep -v -e '\.git' -e '/doc/' -e '\.travis' -e MANIFEST | sed -e 's,^\./,,g' | while read f; do grep -ne "^$f\$" MANIFEST >/dev/null || echo "$f" ; done
-
-  or an alternative for comparison with previous release
-
-     git diff 0.10.0 | grep -B2 'index 0000000..' | grep -B1 'new file mode' | sed -n -e '/^diff /s,.* b/,,gp' >> MANIFEST
-     sort MANIFEST | uniq | sponge MANIFEST
-
-* Run::
-
-  python setup.py sdist
-
-* Look for errors like::
-
-   'testcases/files/logs/mysqld.log' not a regular file -- skipping
-
-  * Which indicates that testcases/files/logs/mysqld.log has been moved or is a directory::
-
-      tar -C /tmp -jxf dist/fail2ban-0.9.6.tar.bz2
-
-* clean up current directory::
-
-    diff -rul --exclude \*.pyc . /tmp/fail2ban-0.10.0/
-
-  * Only differences should be files that you don't want distributed.
-
-
-* Ensure the tests work from the tarball::
-
-    cd /tmp/fail2ban-0.9.6/ && bin/fail2ban-testcases
-
-* Add/finalize the corresponding entry in the ChangeLog
-
-  * To generate a list of committers use e.g.::
-
-      git shortlog -sn 0.10.0.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
-
-  * Ensure the top of the ChangeLog has the right version and current date.
-  * Ensure the top entry of the ChangeLog has the right version and current date.
-
-* Update man pages::
-
-    (cd man ; ./generate-man )
-    git commit -m 'DOC/ENH: update man pages for release' man/*
-
-* Cleanout TODO file with the finished stuff
-
-* Prepare source and rpm binary distributions::
-
-    python setup.py sdist
-
-  * Broken for now:  python setup.py bdist_rpm
-  * Broken for now:  python setup.py upload
-
-
-* Tag the release by using a signed (and annotated) tag.  Cut/paste
-  release ChangeLog entry as tag annotation::
-
-    git tag -s 0.10.0
-
-Pre Release
-===========
-
-* Provide a release sample to distributors
-
-  * Arch Linux:
-
-    * https://www.archlinux.org/packages/community/any/fail2ban/
-
-  * Debian: Yaroslav Halchenko <debian@onerussian.com>
-
-    * http://packages.qa.debian.org/f/fail2ban.html
-
-  * FreeBSD: Christoph Theis theis@gmx.at>
-
-    * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/Makefile?view=markup
-    * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
-
-  * Fedora: Axel Thimm <Axel.Thimm@atrpms.net>
-
-    * https://apps.fedoraproject.org/packages/fail2ban
-    * http://pkgs.fedoraproject.org/cgit/fail2ban.git
-    * https://admin.fedoraproject.org/pkgdb/acls/bugs/fail2ban
-
-  * Gentoo: netmon@gentoo.org
-
-    * http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/metadata.xml?view=markup
-    * https://bugs.gentoo.org/buglist.cgi?quicksearch=fail2ban
-
-  * openSUSE: Stephan Kulow <coolo@suse.com>
-
-    * https://build.opensuse.org/package/show/openSUSE:Factory/fail2ban
-
-  * Mac Ports: @Malbrouck on github (gh-49)
-
-    * https://trac.macports.org/browser/trunk/dports/security/fail2ban/Portfile
-
-  * Mageia:
-
-    * https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
-
-  * And potentially to the fail2ban-users email list.
-
-
-* Wait for feedback from distributors
-
-* Prepare a release notice https://github.com/fail2ban/fail2ban/releases/new
-
-* Upload the source/binaries from the dist directory and tag the release using the URL
-
-* Upload source/binaries to sourceforge http://sourceforge.net/projects/fail2ban/
-
-* Run the following and update the wiki with output::
-
-    python -c 'import fail2ban.protocol; fail2ban.protocol.printWiki()'
-
-  * page: http://www.fail2ban.org/wiki/index.php/Commands
-
-
-* Update:
-
-  * http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_Versions&action=edit
-
-  * http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_News&action=edit
-    * move old bits to http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_OldNews&action=edit
-
-  * http://www.fail2ban.org/wiki/index.php/ChangeLog
-  * http://www.fail2ban.org/wiki/index.php/Requirements (Check requirement)
-  * http://www.fail2ban.org/wiki/index.php/Features
-
-* See if any filters are upgraded:
-  http://www.fail2ban.org/wiki/index.php/Special:AllPages
-
-* Email users and development list of release
-
-* notify distributors
-
-Post Release
-============
-
-Add the following to the top of the ChangeLog::
-
-  ver. 0.10.0 (2016/XX/XXX) - wanna-be-released
-  -----------
-  
-  ### Fixes
-  
-  ### New Features
-  
-  ### Enhancements
-
-Alter the git shortlog command in the previous section to refer to the just
-released version.
-
-and adjust fail2ban/version.py to carry .dev0 suffix to signal
-a version under development.

THANKS

@@ -1,140 +0,0 @@
-Fail2Ban is an open source project which was conceived and originally
-developed by Cyril Jaquier until 2010.  Since then Fail2Ban grew into
-a community-driven project with many contributions from its users.
-Below is an alphabetically sorted partial list of the contributors to
-the project.  If you have been left off, please let us know
-(preferably send a pull request on github with the "fix") and you will
-be added
-
-Aaron Brice
-Adam Tkac
-Adrien Clerc
-ache
-ag4ve (Shawn)
-Alasdair D. Campbell
-Alexander Koeppe (IPv6 support)
-Alexandre Perrin (kAworu)
-Amir Caspi
-Amy
-Andrew James Collett (ajcollett)
-Andrew St. Jean
-Andrey G. Grozin
-Andy Fragen
-Arturo 'Buanzo' Busleiman
-Axel Thimm
-Bas van den Dikkenberg
-Beau Raines
-Bill Heaton
-Carlos Alberto Lopez Perez
-cepheid666
-Christian Rauch
-Christophe Carles
-Christoph Haas
-Christos Psonis
-craneworks
-Cyril Jaquier
-Daniel B. Cid
-Daniel B.
-Daniel Black
-David Nutter
-David Reagan (jerrac)
-Derek Atkins
-Donald Yandt
-Eric Gerbier
-Enrico Labedzki
-Eugene Hopkinson (SlowRiot)
-ftoppi
-Florian Robert (1technophile)
-François Boulogne
-Frantisek Sumsal
-Frédéric
-Georgiy Mernov
-Guilhem Lettron
-Guillaume Delvit
-Hank Leininger
-Hanno 'Rince' Wagner
-Helmut Grohne
-Iain Lea
-Ioan Indreias
-Ivo Truxa
-John Thoe
-Jacques Lav!gnotte
-Johannes Weberhofer
-Jason H Martin
-Jeaye Wilkerson
-Jisoo Park
-Joel M Snyder
-Jonathan Kamens
-Jonathan Lanning
-Jonathan Underwood
-Joël Bertrand
-JP Espinosa
-jserrachinha
-Justin Shore
-Kevin Locke
-Kévin Drapel
-kjohnsonecl
-kojiro
-Lars Kneschke
-Lee Clemens
-leftyfb (Mike Rushton)
-M. Maraun
-Manuel Arostegui Ramirez
-Marcel Dopita
-Mark Edgington
-Mark McKinstry
-Mark White
-Markus Hoffmann
-Marvin Rouge
-mEDI
-Мернов Георгий
-Merijn Schering
-Michael C. Haller
-Michael Hanselmann
-Mika (mkl)
-Nick Munger
-onorua
-Orion Poplawski
-Pablo Rodriguez Fernandez
-Paul Marrapese
-Paul Traina
-Noel Butler
-Patrick Börjesson
-Pressy
-Raphaël Marichez
-RealRancor
-René Berber
-Robert Edeker
-Rolf Fokkens
-Roman Gelfand
-Russell Odom
-SATO Kentaro
-Sean DuBois
-Sebastian Arcus
-Serg G. Brester (sebres)
-Sergey Safarov
-Shaun C.
-Sireyessire
-silviogarbes
-Stefan Tatschner
-Stephen Gildea
-Steven Hiscocks
-TESTOVIK
-Thomas Mayer
-Tom Pike
-Tom Hendrikx
-Tomas Pihl
-Thomas Skierlo (phaleas)
-Tony Lawrence
-Tomasz Ciolek
-Tyler
-Vaclav Misek
-Vincent Deffontaines
-Yaroslav Halchenko
-Winston Smith
-Yehuda Katz
-ykimon
-Yung-Chin Oei
-Zbigniew Jędrzejewski-Szmek
-zugeschmiert
-Zurd

TODO

@@ -1,32 +1,14 @@
-                         __      _ _ ___ _               
-                        / _|__ _(_) |_  ) |__  __ _ _ _  
-                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
-                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
-================================================================================
+=============================================================
 ToDo
-================================================================================
+=============================================================
 
-Legend:
-- not yet done
-? maybe
-# partially done
-* done
+See Feature Request Tracking System at SourceForge.net
 
-- Added <USER> tag for failregex. Add features using this information. Maybe add
-  more tags
-
-- Look at the memory consumption. Decrease memory usage
-
-- More detailed statistics
-
-- Auto-enable function (search for log files), check modification date to see if
-  service is still in use
-
-- Better handling of the protocol in transmitter.py
-
-- Add gettext support (I18N)
-
-# improve documentation and website for user
-
-# better return values in function
+- improve installation process (better prefix support)
+- install Fail2ban into /usr/share
+- better configuration files

Vagrantfile

@@ -1,30 +0,0 @@
-Vagrant.configure("2") do |config|
-
-    config.vm.define "secure" do |secure|
-        secure.vm.box = "ubuntu/trusty64"
-        secure.vm.hostname = "secure.dev.fail2ban.org"
-        secure.vm.network "private_network", ip: "192.168.200.100"
-
-#        secure.vm.synced_folder 'salt/roots', '/srv/salt'
-
-#        secure.vm.provision :salt do |salt|
-#            salt.minion_config = 'salt/minion'
-#            salt.run_highstate = true
-#            salt.verbose = true
-#        end
-    end
-
-    config.vm.define "attacker" do |attacker|
-        attacker.vm.box = "ubuntu/trusty64"
-        attacker.vm.hostname = "attacker.dev.fail2ban.org"
-        attacker.vm.network "private_network", ip: "192.168.200.150"
-
-#        attacker.vm.synced_folder 'salt/roots', '/srv/salt'
-
-#        attacker.vm.provision :salt do |salt|
-#            salt.minion_config = 'salt/minion'
-#            salt.run_highstate = true
-#            salt.verbose = true
-#        end
-    end
-end

bin/fail2ban-client

@@ -1,37 +0,0 @@
-#!/usr/bin/env python
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-"""
-Fail2Ban reads log file that contains password failure report
-and bans the corresponding IP addresses using firewall rules.
-
-This tools starts/stops fail2ban server or does client/server communication,
-to change/read parameters of the server or jails.
-
-"""
-
-__author__ = "Fail2Ban Developers"
-__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko, 2014-2016 Serg G. Brester"
-__license__ = "GPL"
-
-from fail2ban.client.fail2banclient import exec_command_line, sys
-
-if __name__ == "__main__":
-	exec_command_line(sys.argv)

bin/fail2ban-regex

@@ -1,34 +0,0 @@
-#!/usr/bin/env python
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-#
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-"""
-Fail2Ban  reads log file that contains password failure report
-and bans the corresponding IP addresses using firewall rules.
-
-This tools can test regular expressions for "fail2ban".
-
-"""
-
-__author__ = "Fail2Ban Developers"
-__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko"
-__license__ = "GPL"
-
-from fail2ban.client.fail2banregex import exec_command_line
-
-exec_command_line()

bin/fail2ban-server

@@ -1,37 +0,0 @@
-#!/usr/bin/env python
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-"""
-Fail2Ban reads log file that contains password failure report
-and bans the corresponding IP addresses using firewall rules.
-
-This tool starts/stops fail2ban server or does client/server communication
-to change/read parameters of the server or jails.
-
-"""
-
-__author__ = "Fail2Ban Developers"
-__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko, 2014-2016 Serg G. Brester"
-__license__ = "GPL"
-
-from fail2ban.client.fail2banserver import exec_command_line, sys
-
-if __name__ == "__main__":
-	exec_command_line(sys.argv)

bin/fail2ban-testcases

@@ -1,71 +0,0 @@
-#!/usr/bin/env python
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-"""Script to run Fail2Ban tests battery
-"""
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-__author__ = "Cyril Jaquier"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2012- Yaroslav Halchenko"
-__license__ = "GPL"
-
-import logging
-import os
-import sys
-import time
-import unittest
-
-# Check if local fail2ban module exists, and use if it exists by
-# modifying the path. This is done so that tests can be used in dev
-# environment.
-if os.path.exists("fail2ban/__init__.py"):
-	sys.path.insert(0, ".")
-from fail2ban.version import version
-
-from fail2ban.tests.utils import getOptParser, initProcess, gatherTests
-from fail2ban.setup import updatePyExec
-
-# Update fail2ban-python env to current python version (where f2b-modules located/installed)
-bindir = os.path.dirname(
-	# __file__ seems to be overwritten sometimes on some python versions (e.g. bug of 2.6 by running under cProfile, etc.):
-	sys.argv[0] if os.path.basename(sys.argv[0]) == 'fail2ban-testcases' else __file__
-)
-updatePyExec(bindir)
-
-(opts, regexps) = getOptParser(__doc__).parse_args()
-
-#
-# Process initialization corresponding options (logging, default options, etc.)
-#
-opts = initProcess(opts)
-verbosity = opts.verbosity
-
-#
-# Gather tests (and filter corresponding options)
-#
-tests = gatherTests(regexps, opts)
-
-#
-# Run the tests
-#
-testRunner = unittest.TextTestRunner(verbosity=verbosity)
-
-tests_results = testRunner.run(tests)
-
-if not tests_results.wasSuccessful(): # pragma: no cover
-	sys.exit(1)

config/action.d/abuseipdb.conf

@@ -1,104 +0,0 @@
-# Fail2ban configuration file
-#
-# Action to report IP address to abuseipdb.com
-# You must sign up to obtain an API key from abuseipdb.com.
-#
-# NOTE: These reports may include sensitive Info.
-# If you want cleaner reports that ensure no user data see the helper script at the below website.
-#
-# IMPORTANT:
-#
-# Reporting an IP of abuse is a serious complaint. Make sure that it is
-# serious. Fail2ban developers and network owners recommend you only use this
-# action for:
-#   * The recidive where the IP has been banned multiple times
-#   * Where maxretry has been set quite high, beyond the normal user typing
-#     password incorrectly.
-#   * For filters that have a low likelihood of receiving human errors
-#
-# This action relies on a api_key being added to the above action conf,
-# and the appropriate categories set.
-#
-# Example, for ssh bruteforce (in section [sshd] of `jail.local`): 
-#   action = %(known/action)s
-#            abuseipdb[abuseipdb_apikey="my-api-key", abuseipdb_category="18,22"]
-#
-# See below for categories.
-#
-# Added to fail2ban by Andrew James Collett (ajcollett)
-
-## abuseIPDB Categories, `the abuseipdb_category` MUST be set in the jail.conf action call.
-# Example, for ssh bruteforce: action = %(action_abuseipdb)s[abuseipdb_category="18,22"]
-# ID	Title	Description
-# 3	  Fraud Orders
-# 4	  DDoS Attack
-# 9	  Open Proxy
-# 10	Web Spam
-# 11	Email Spam
-# 14	Port Scan
-# 18	Brute-Force
-# 19	Bad Web Bot
-# 20	Exploited Host
-# 21	Web App Attack
-# 22	SSH	Secure Shell (SSH) abuse. Use this category in combination with more specific categories.
-# 23	IoT Targeted
-# See https://abuseipdb.com/categories for more descriptions
-
-[Definition]
-
-# bypass action for restored tickets
-norestored = 1
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-#
-#          ** IMPORTANT! **
-#
-#          By default, this posts directly to AbuseIPDB's API, unfortunately
-#          this results in a lot of backslashes/escapes appearing in the
-#          reports. This also may include info like your hostname.
-#          If you have your own web server with PHP available, you can
-#          use my (Shaun's) helper PHP script by commenting out the first #actionban
-#          line below, uncommenting the second one, and pointing the URL at
-#          wherever you install the helper script. For the PHP helper script, see
-#          <https://wiki.shaunc.com/wikka.php?wakka=ReportingToAbuseIPDBWithFail2Ban>
-#
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = lgm=$(printf '%%.1000s\n...' "<matches>"); curl -sSf "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: <abuseipdb_apikey>" --data-urlencode "comment=$lgm" --data-urlencode "ip=<ip>" --data "categories=<abuseipdb_category>"
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
-[Init]
-# Option:  abuseipdb_apikey
-# Notes    Your API key from abuseipdb.com
-# Values:  STRING  Default: None
-# Register for abuseipdb [https://www.abuseipdb.com], get api key and set below.
-# You will need to set the category in the action call.
-abuseipdb_apikey =

config/action.d/apf.conf

@@ -1,25 +0,0 @@
-# Fail2Ban configuration file
-# https://www.rfxn.com/projects/advanced-policy-firewall/
-#
-# Note: APF doesn't play nicely with other actions. It has been observed to
-# remove bans created by other iptables based actions. If you are going to use
-# this action, use it for all of your jails.
-#
-# DON'T MIX APF and other IPTABLES based actions
-[Definition]
-
-actionstart = 
-actionstop = 
-actioncheck = 
-actionban = apf --deny <ip> "banned by Fail2Ban <name>"
-actionunban = apf --remove <ip>
-
-[Init]
-
-# Name used in APF configuration
-#
-name = default
-
-# DEV NOTES:
-#
-# Author: Mark McKinstry

config/action.d/apprise.conf

@@ -1,49 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Chris Caron <lead2gold@gmail.com>
-#
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "The jail <name> as been started successfully." | <apprise> -t "[Fail2Ban] <name>: started on `uname -n`"
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "The jail <name> has been stopped." | <apprise> -t "[Fail2Ban] <name>: stopped on `uname -n`"
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "The IP <ip> has just been banned by Fail2Ban after <failures> attempts against <name>" | <apprise> -n "warning" -t "[Fail2Ban] <name>: banned <ip> from `uname -n`"
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
-[Init]
-
-# Define location of the default apprise configuration file to use
-#
-config = /etc/fail2ban/apprise.conf
-#
-apprise = apprise -c "<config>"

config/action.d/blocklist_de.conf

@@ -1,84 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Steven Hiscocks
-#
-#
-
-# Action to report IP address to blocklist.de
-# Blocklist.de must be signed up to at www.blocklist.de
-# Once registered, one or more servers can be added.
-# This action requires the server 'email address' and the associated apikey.
-#
-# From blocklist.de:
-#   www.blocklist.de is a free and voluntary service provided by a
-#   Fraud/Abuse-specialist, whose servers are often attacked on SSH-,
-#   Mail-Login-, FTP-, Webserver- and other services.
-#   The mission is to report all attacks to the abuse departments of the
-#   infected PCs/servers to ensure that the responsible provider can inform
-#   the customer about the infection and disable them
-#
-# IMPORTANT: 
-# 
-# Reporting an IP of abuse is a serious complaint. Make sure that it is
-# serious. Fail2ban developers and network owners recommend you only use this
-# action for:
-#   * The recidive where the IP has been banned multiple times
-#   * Where maxretry has been set quite high, beyond the normal user typing
-#     password incorrectly.
-#   * For filters that have a low likelihood of receiving human errors
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = 
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = curl --fail --data-urlencode "server=<email>" --data "apikey=<apikey>" --data "service=<service>" --data "ip=<ip>" --data-urlencode "logs=<matches><br>" --data 'format=text' --user-agent "<agent>" "https://www.blocklist.de/en/httpreports.html"
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
-# Option:  email
-# Notes    server email address, as per blocklist.de account
-# Values:  STRING  Default: None
-#
-#email =
-
-# Option:  apikey
-# Notes    your user blocklist.de user account apikey
-# Values:  STRING  Default: None
-#
-#apikey =
-
-# Option:  service
-# Notes    service name you are reporting on, typically aligns with filter name
-#          see http://www.blocklist.de/en/httpreports.html for full list
-# Values:  STRING  Default: None
-#
-#service =

config/action.d/bsd-ipfw.conf

@@ -1,94 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Nick Munger
-# Modified by: Ken Menzel
-#              Daniel Black (start/stop)
-#              Fabian Wenk (many ideas as per fail2ban users list)
-#
-# Ensure firewall_enable="YES" in the top of /etc/rc.conf
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = ipfw show | fgrep -c -m 1 -s 'table(<table>)' > /dev/null 2>&1 || (
-    num=$(ipfw show | awk 'BEGIN { b = <lowest_rule_num> } { if ($1 == b) { b = $1 + 1 } } END { print b }');
-    ipfw -q add "$num" <blocktype> <block> from table\(<table>\) to me <port>; echo "$num" > "<startstatefile>"
-  )
-
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop =  [ ! -f <startstatefile> ] || ( read num < "<startstatefile>" <br> ipfw -q delete $num <br> rm "<startstatefile>" )
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-# requires an ipfw rule like "deny ip from table(1) to me"
-actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || echo "$e" | grep -q "record already exists" || { echo "$e" 1>&2; exit $x; }
-
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = e=`ipfw table <table> delete <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || echo "$e" | grep -q "record not found" || { echo "$e" 1>&2; exit $x; }
-
-[Init]
-# Option:  table
-# Notes:   The ipfw table to use. If a ipfw rule using this table already exists,
-#          this action will not create a ipfw rule to block it and the following
-#          options will have no effect.
-# Values:  NUM
-table = 1
-
-# Option:  port
-# Notes.:  Specifies port to monitor. Blank indicate block all ports.
-# Values:  [ NUM | STRING ]
-#
-port = 
-
-# Option:  startstatefile
-# Notes:   A file to indicate that the table rule that was added. Ensure it is unique per table.
-# Values:  STRING
-startstatefile = /var/run/fail2ban/ipfw-started-table_<table>
-
-# Option: block
-# Notes:  This is how much to block.
-#         Can be "ip", "tcp", "udp" or various other options.
-# Values: STRING
-block = ip
-
-# Option:  blocktype
-# Notes.:  How to block the traffic. Use a action from man 5 ipfw
-#          Common values: deny, unreach port, reset
-#          ACTION defination at the top of man ipfw for allowed values.
-# Values:  STRING
-#
-blocktype = unreach port
-
-# Option:  lowest_rule_num
-# Notes:   When fail2ban starts with action and there is no rule for the given table yet
-#          then fail2ban will start looking for an empty slot starting with this rule number.
-# Values:  NUM
-lowest_rule_num = 111
-
-

config/action.d/cloudflare.conf

@@ -1,88 +0,0 @@
-#
-# Author: Mike Rushton
-#
-# IMPORTANT
-#
-# Please set jail.local's permission to 640 because it contains your CF API key.
-#
-# This action depends on curl (and optionally jq).
-# Referenced from http://www.normyee.net/blog/2012/02/02/adding-cloudflare-support-to-fail2ban by NORM YEE
-#
-# To get your CloudFlare API Key: https://www.cloudflare.com/a/account/my-account
-#
-# CloudFlare API error codes: https://www.cloudflare.com/docs/host-api.html#s4.2
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-# API v1
-#actionban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=ban' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
-# API v4
-actionban = curl -s -o /dev/null -X POST <_cf_api_prms> \
-            -d '{"mode":"block","configuration":{"target":"<cftarget>","value":"<ip>"},"notes":"Fail2Ban <name>"}' \
-            <_cf_api_url>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-# API v1
-#actionunban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=nul' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
-# API v4
-actionunban = id=$(curl -s -X GET <_cf_api_prms> \
-                   "<_cf_api_url>?mode=block&configuration_target=<cftarget>&configuration_value=<ip>&page=1&per_page=1&notes=Fail2Ban%%20<name>" \
-                   | { jq -r '.result[0].id' 2>/dev/null || tr -d '\n' | sed -nE 's/^.*"result"\s*:\s*\[\s*\{\s*"id"\s*:\s*"([^"]+)".*$/\1/p'; })
-              if [ -z "$id" ]; then echo "<name>: id for <ip> cannot be found"; exit 0; fi;
-              curl -s -o /dev/null -X DELETE <_cf_api_prms> "<_cf_api_url>/$id"
-
-_cf_api_url = https://api.cloudflare.com/client/v4/user/firewall/access_rules/rules
-_cf_api_prms = -H 'X-Auth-Email: <cfuser>' -H 'X-Auth-Key: <cftoken>' -H 'Content-Type: application/json'
-
-[Init]
-
-# If you like to use this action with mailing whois lines, you could use the composite action
-# action_cf_mwl predefined in jail.conf, just define in your jail:
-#
-# action = %(action_cf_mwl)s
-# # Your CF account e-mail
-# cfemail  = 
-# # Your CF API Key
-# cfapikey = 
-
-cftoken =
-
-cfuser =
-
-cftarget = ip
-
-[Init?family=inet6]
-cftarget = ip6

config/action.d/complain.conf

@@ -1,121 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Russell Odom <russ@gloomytrousers.co.uk>, Daniel Black
-# Sends a complaint e-mail to addresses listed in the whois record for an
-# offending IP address.
-# This uses the https://abusix.com/contactdb.html to lookup abuse contacts.
-#
-# DEPENDENCIES:
-# This requires the dig command from bind-utils
-#
-# You should provide the <logpath> in the jail config - lines from the log
-# matching the given IP address will be provided in the complaint as evidence.
-#
-# WARNING
-# -------
-#
-# Please do not use this action unless you are certain that fail2ban
-# does not result in "false positives" for your deployment.  False
-# positive reports could serve a mis-favor to the original cause by
-# flooding corresponding contact addresses, and complicating the work
-# of administration personnel responsible for handling (verified) legit
-# complains.
-#
-# Please consider using e.g. sendmail-whois-lines.conf action which
-# would send the reports with relevant information to you, so the
-# report could be first reviewed and then forwarded to a corresponding
-# contact if legit.
-#
-
-
-[INCLUDES]
-
-before = helpers-common.conf
-
-[Definition]
-
-# Used in test cases for coverage internal transformations
-debug = 0
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = oifs=${IFS};
-            RESOLVER_ADDR="%(addr_resolver)s"
-            if [ "<debug>" -gt 0 ]; then echo "try to resolve $RESOLVER_ADDR"; fi
-            ADDRESSES=$(dig +short -t txt -q $RESOLVER_ADDR | tr -d '"')
-            IFS=,; ADDRESSES=$(echo $ADDRESSES)
-            IFS=${oifs}
-            IP=<ip>
-            if [ ! -z "$ADDRESSES" ]; then
-                ( printf %%b "<message>\n"; date '+Note: Local timezone is %%z (%%Z)'; 
-                  printf %%b "\nLines containing failures of <ip> (max <grepmax>)\n";
-                  %(_grep_logs)s;
-                ) | <mailcmd> "Abuse from <ip>" <mailargs> $ADDRESSES
-            fi
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
-# Server as resolver used in dig command
-#
-addr_resolver = <ip-rev>abuse-contacts.abusix.org
-
-# Default message used for abuse content
-#
-message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to a abusix.com is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process.)\n\n This mail was generated by Fail2Ban.\nThe recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here: https://abusix.com/global-reporting/abuse-contact-db\nabusix.com is neither responsible nor liable for the content or accuracy of this message.\n
-
-# Path to the log files which contain relevant lines for the abuser IP
-#
-logpath = /dev/null
-
-# Option:  mailcmd
-# Notes.:  Your system mail command. Is passed 2 args: subject and recipient
-# Values:  CMD
-#
-mailcmd = mail -E 'set escape' -s
-
-# Option:  mailargs
-# Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
-#          CC reports to another address:
-#              -c me@example.com
-#          Appear to come from a different address - the '--' indicates
-#          arguments to be passed to Sendmail:
-#              -- -f me@example.com
-# Values:  [ STRING ]
-#
-mailargs =
-
-# Number of log lines to include in the email
-#
-#grepmax = 1000
-#grepopts = -m <grepmax>

config/action.d/dshield.conf

@@ -1,207 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Russell Odom <russ@gloomytrousers.co.uk>
-# Submits attack reports to DShield (http://www.dshield.org/)
-#
-# You MUST configure at least:
-# <port> (the port that's being attacked - use number not name).
-#
-# You SHOULD also provide:
-# <myip> (your public IP address, if it's not the address of eth0)
-# <userid> (your DShield userID, if you have one - recommended, but reports will
-# be used anonymously if not)
-# <protocol> (the protocol in use - defaults to tcp)
-#
-# Best practice is to provide <port> and <protocol> in jail.conf like this:
-# action = dshield[port=1234,protocol=tcp]
-#
-# ...and create "dshield.local" with contents something like this:
-# [Init]
-# myip = 10.0.0.1
-# userid = 12345
-#
-# Other useful configuration values are <mailargs> (you can use for specifying
-# a different sender address for the report e-mails, which should match what is
-# configured at DShield), and <lines>/<minreportinterval>/<maxbufferage> (to
-# configure how often the buffer is flushed).
-#
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = if [ -f <tmpfile>.buffer ]; then
-                 cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" <mailargs> <dest>
-                 date +%%s > <tmpfile>.lastsent
-             fi
-             rm -f <tmpfile>.buffer <tmpfile>.first
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-# See http://www.dshield.org/specs.html for more on report format/notes
-#
-# Note: We are currently using <time> for the timestamp because no tag is
-# available to indicate the timestamp of the log message(s) which triggered the
-# ban. Therefore the timestamps we are using in the report, whilst often only a
-# few seconds out, are incorrect. See
-# http://sourceforge.net/tracker/index.php?func=detail&aid=2017795&group_id=121032&atid=689047
-#
-actionban = TZONE=`date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'`
-            DATETIME="`perl -e '@t=localtime(<time>);printf "%%4d-%%02d-%%02d %%02d:%%02d:%%02d",1900+$t[5],$t[4]+1,$t[3],$t[2],$t[1],$t[0]'` $TZONE"
-	    PROTOCOL=`awk '{IGNORECASE=1;if($1=="<protocol>"){print $2;exit}}' /etc/protocols`
-	    if [ -z "$PROTOCOL" ]; then PROTOCOL=<protocol>; fi
-            printf %%b "$DATETIME\t<userid>\t<failures>\t<ip>\t<srcport>\t<myip>\t<port>\t$PROTOCOL\t<tcpflags>\n" >> <tmpfile>.buffer
-            NOW=`date +%%s`
-            if [ ! -f <tmpfile>.first ]; then
-                echo <time> | cut -d. -f1 > <tmpfile>.first
-            fi
-            if [ ! -f <tmpfile>.lastsent ]; then
-                echo 0 > <tmpfile>.lastsent
-            fi
-            LOGAGE=$(($NOW - `cat <tmpfile>.first`))
-            LASTREPORT=$(($NOW - `cat <tmpfile>.lastsent`))
-            LINES=$( wc -l <tmpfile>.buffer | awk '{ print $1 }' )
-            if [ $LINES -ge <lines> && $LASTREPORT -gt <minreportinterval> ] || [ $LOGAGE -gt <maxbufferage> ]; then
-                cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ $TZONE Fail2Ban" <mailargs> <dest>
-                rm -f <tmpfile>.buffer <tmpfile>.first
-                echo $NOW > <tmpfile>.lastsent
-            fi
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = if [ -f <tmpfile>.first ]; then
-                  NOW=`date +%%s`
-                  LOGAGE=$(($NOW - `cat <tmpfile>.first`))
-                  if [ $LOGAGE -gt <maxbufferage> ]; then
-                      cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" <mailargs> <dest>
-                      rm -f <tmpfile>.buffer <tmpfile>.first
-                      echo $NOW > <tmpfile>.lastsent
-                  fi
-              fi
-
-
-[Init]
-# Option:  port
-# Notes.:  The target port for the attack (numerical). MUST be provided in the
-#          jail config, as it cannot be detected here.
-# Values:  [ NUM ]
-#
-port = ???
-
-# Option:  userid
-# Notes.:  Your DShield user ID. Should be provided either in the jail config or
-#          in a .local file.
-#          Register at https://secure.dshield.org/register.html
-# Values:  [ NUM ]
-#
-userid = 0
-
-# Option:  myip
-# Notes.:  The target IP for the attack (your public IP). Should be provided
-#          either in the jail config or in a .local file unless your PUBLIC IP
-#          is the first IP assigned to eth0
-# Values:  [ an IP address ]  Default: Tries to find the IP address of eth0,
-#          which in most cases will be a private IP, and therefore incorrect
-#
-myip = `ip -4 addr show dev eth0 | grep inet | head -n 1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`
-
-# Option:  protocol
-# Notes.:  The protocol over which the attack is happening
-# Values:  [ tcp | udp | icmp | (any other protocol name from /etc/protocols) | NUM ] Default: tcp
-#
-protocol = tcp
-
-# Option:  lines
-# Notes.:  How many lines to buffer before making a report. Regardless of this,
-#          reports are sent a minimum of <minreportinterval> apart, or if the
-#          buffer contains an event over <maxbufferage> old, or on shutdown
-# Values:  [ NUM ]
-#
-lines = 50
-
-# Option:  minreportinterval
-# Notes.:  Minimum period (in seconds) that must elapse before we submit another
-#          batch of reports. DShield request a minimum of 1 hour (3600 secs)
-#          between reports.
-# Values:  [ NUM ]
-#
-minreportinterval = 3600
-
-# Option:  maxbufferage
-# Notes.:  Maximum age (in seconds) of the oldest report in the buffer before we
-#          submit the batch, even if we haven't reached <lines> yet. Note that
-#          this is only checked on each ban/unban, and that we always send
-#          anything in the buffer on shutdown. Must be greater than
-# Values:  [ NUM ]
-#
-maxbufferage = 21600
-
-# Option:  srcport
-# Notes.:  The source port of the attack. You're unlikely to have this info, so
-#          you can leave the default
-# Values:  [ NUM ]
-#
-srcport = ???
-
-# Option:  tcpflags
-# Notes.:  TCP flags on attack. You're unlikely to have this info, so you can
-#          leave empty
-# Values:  [ STRING ]
-#
-tcpflags =
-
-# Option:  mailcmd
-# Notes.:  Your system mail command. Is passed 2 args: subject and recipient
-# Values:  CMD
-#
-mailcmd = mail -E 'set escape' -s
-
-# Option:  mailargs
-# Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
-#          CC reports to another address:
-#              -c me@example.com
-#          Appear to come from a different address (the From address must match
-#          the one configured at DShield - the '--' indicates arguments to be
-#          passed to Sendmail):
-#              -- -f me@example.com
-# Values:  [ STRING ]
-#
-mailargs =
-
-# Option:  dest
-# Notes.:  Destination e-mail address for reports
-# Values:  [ STRING ]
-#
-dest = reports@dshield.org
-
-# Option:  tmpfile
-# Notes.:  Base name of temporary files used for buffering
-# Values:  [ STRING ]
-#
-tmpfile = /var/run/fail2ban/tmp-dshield
-

config/action.d/dummy.conf

@@ -1,63 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = if [ ! -z '<target>' ]; then touch <target>; fi;
-              printf %%b "<init>\n" <to_target>
-              echo "%(debug)s started"
-
-# Option:  actionflush
-# Notes.:  command executed once to flush (clear) all IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = printf %%b "-*\n" <to_target>
-              echo "%(debug)s clear all"
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = if [ ! -z '<target>' ]; then rm -f <target>; fi;
-             echo "%(debug)s stopped"
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "+<ip>\n" <to_target>
-            echo "%(debug)s banned <ip> (family: <family>)"
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = printf %%b "-<ip>\n" <to_target>
-              echo "%(debug)s unbanned <ip> (family: <family>)"
-
-
-debug = [<name>] <actname> <target> --
-
-[Init]
-
-init = 123
-
-target = /var/run/fail2ban/fail2ban.dummy
-to_target = >> <target>

config/action.d/firewallcmd-allports.conf

@@ -1,45 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# Because of the --remove-rules in stop this action requires firewalld-0.3.8+
-
-
-[INCLUDES]
-
-before = firewallcmd-common.conf
-
-[Definition]
-
-actionstart = firewall-cmd --direct --add-chain <family> filter f2b-<name>
-              firewall-cmd --direct --add-rule <family> filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 -j f2b-<name>
-
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 -j f2b-<name>
-             firewall-cmd --direct --remove-rules <family> filter f2b-<name>
-             firewall-cmd --direct --remove-chain <family> filter f2b-<name>
-
-
-# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-recidive$'
-
-actioncheck = firewall-cmd --direct --get-chains <family> filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
-
-actionban = firewall-cmd --direct --add-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-actionunban = firewall-cmd --direct --remove-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-# DEV NOTES:
-#
-# Author: Donald Yandt 
-# Uses "FirewallD" instead of the "iptables daemon".
-#
-#
-# Output:
-
-# actionstart:
-# $ firewall-cmd --direct --add-chain ipv4 filter f2b-recidive
-# success
-# $ firewall-cmd --direct --add-rule ipv4 filter f2b-recidive 1000 -j RETURN
-# success
-# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-recidive
-# success
-

config/action.d/firewallcmd-common.conf

@@ -1,76 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt
-#
-
-[Init]
-
-# Option:  name
-# Notes    Default name of the chain
-# Values:  STRING
-name = default
-
-# Option   port
-# Notes    Can also use port numbers separated by a comma and in rich-rules comma and/or space.
-# Value    STRING Default: 1:65535
-port = 1:65535
-
-# Option:  protocol
-# Notes    [ tcp | udp | icmp | all ]
-# Values:  STRING Default: tcp
-protocol = tcp
-
-# Option:  family(ipv4)
-# Notes    specifies the socket address family type
-# Values:  STRING  
-family = ipv4
-
-# Option:  chain
-# Notes    specifies the firewalld chain to which the Fail2Ban rules should be
-#          added
-# Values:  STRING  Default: INPUT_direct
-chain = INPUT_direct
-
-# Option:  zone
-# Notes    use command firewall-cmd --get-active-zones to see a list of all active zones. See firewalld man pages for more information on zones
-# Values:  STRING  Default: public
-zone = public
-
-# Option:  service
-# Notes    use command firewall-cmd --get-services to see a list of services available
-#          Examples services: amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps 
-#          freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos 
-#          kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s 
-#          postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy 
-#          telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
-# Values:  STRING Default: ssh 
-service = ssh
-
-# Option:  rejecttype (ipv4)
-# Notes    See iptables/firewalld man pages for ipv4 reject types. 
-# Values:  STRING
-rejecttype = icmp-port-unreachable
-
-# Option:  blocktype (ipv4/ipv6)
-# Notes    See iptables/firewalld man pages for jump targets. Common values are REJECT, 
-#          REJECT --reject-with icmp-port-unreachable, DROP
-# Values:  STRING
-blocktype = REJECT --reject-with <rejecttype>
-
-# Option:  rich-blocktype (ipv4/ipv6)
-# Notes    See firewalld man pages for jump targets. Common values are reject, 
-#          reject type="icmp-port-unreachable", drop
-# Values:  STRING
-rich-blocktype = reject type='<rejecttype>'
-
-[Init?family=inet6]
-
-# Option:  family(ipv6)
-# Notes    specifies the socket address family type
-# Values:  STRING  
-family = ipv6
-
-# Option:  rejecttype (ipv6)
-# Note:    See iptables/firewalld man pages for ipv6 reject types. 
-# Values:  STRING
-rejecttype = icmp6-port-unreachable

config/action.d/firewallcmd-ipset.conf

@@ -1,121 +0,0 @@
-# Fail2Ban action file for firewall-cmd/ipset
-#
-# This requires:
-# ipset (package: ipset)
-# firewall-cmd (package: firewalld)
-#
-# This is for ipset protocol 6 (and hopefully later) (ipset v6.14).
-# Use ipset -V to see the protocol and version.
-#
-# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0 kernels.
-#
-# If you are running on an older kernel you make need to patch in external
-# modules.
-
-[INCLUDES]
-
-before = firewallcmd-common.conf
-
-[Definition]
-
-actionstart = <ipstype_<ipsettype>/actionstart>
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
-
-actionflush = <ipstype_<ipsettype>/actionflush>
-
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
-             <actionflush>
-             <ipstype_<ipsettype>/actionstop>
-
-actionban = <ipstype_<ipsettype>/actionban>
-
-# actionprolong = %(actionban)s
-
-actionunban = <ipstype_<ipsettype>/actionunban>
-
-[ipstype_ipset]
-
-actionstart = ipset create <ipmset> hash:ip timeout <default-ipsettime> <familyopt>
-
-actionflush = ipset flush <ipmset>
-
-actionstop = ipset destroy <ipmset>
-
-actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
-
-actionunban = ipset del <ipmset> <ip> -exist
-
-[ipstype_firewalld]
-
-actionstart = firewall-cmd --direct --new-ipset=<ipmset> --type=hash:ip --option=timeout=<default-ipsettime> <firewalld_familyopt>
-
-# TODO: there doesn't seem to be an explicit way to invoke the ipset flush function using firewall-cmd
-actionflush = 
-
-actionstop = firewall-cmd --direct --delete-ipset=<ipmset>
-
-actionban = firewall-cmd --ipset=<ipmset> --add-entry=<ip>
-
-actionunban = firewall-cmd --ipset=<ipmset> --remove-entry=<ip>
-
-[Init]
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
-#          added
-# Values:  [ STRING ]
-#
-chain = INPUT_direct
-
-# Option: default-ipsettime
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
-default-ipsettime = 0
-
-# Option: ipsettime
-# Notes:  specifies ticket timeout (handled ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
-ipsettime = 0
-
-# expresion to caclulate timeout from bantime, example:
-# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
-timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
-
-# Option: ipsettype
-# Notes.: defines type of ipset used for match-set (firewalld or ipset)
-# Values: firewalld or ipset
-# Default: ipset
-ipsettype = ipset
-
-# Option: actiontype
-# Notes.: defines additions to the blocking rule
-# Values: leave empty to block all attempts from the host
-# Default: Value of the multiport
-actiontype = <multiport>
-
-# Option: allports
-# Notes.: default addition to block all ports
-# Usage.: use in jail config:  banaction = firewallcmd-ipset[actiontype=<allports>]
-#         for all protocols:   banaction = firewallcmd-ipset[actiontype=""]
-allports = -p <protocol>
-
-# Option: multiport
-# Notes.: addition to block access only to specific ports
-# Usage.: use in jail config:  banaction = firewallcmd-ipset[actiontype=<multiport>]
-multiport = -p <protocol> -m multiport --dports <port>
-
-ipmset = f2b-<name>
-familyopt =
-firewalld_familyopt =
-
-[Init?family=inet6]
-
-ipmset = f2b-<name>6
-familyopt = family inet6
-firewalld_familyopt = --option=family=inet6
-
-
-# DEV NOTES:
-#
-# Author: Edgar Hoch, Daniel Black, Sergey Brester and Mihail Politaev
-# firewallcmd-new / iptables-ipset-proto6 combined for maximium goodness

config/action.d/firewallcmd-multiport.conf

@@ -1,26 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# Because of the --remove-rules in stop this action requires firewalld-0.3.8+
-
-[INCLUDES]
-
-before = firewallcmd-common.conf
-
-[Definition]
-
-actionstart = firewall-cmd --direct --add-chain <family> filter f2b-<name>
-              firewall-cmd --direct --add-rule <family> filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             firewall-cmd --direct --remove-rules <family> filter f2b-<name>
-             firewall-cmd --direct --remove-chain <family> filter f2b-<name>
-
-# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$'
-
-actioncheck = firewall-cmd --direct --get-chains <family> filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
-
-actionban = firewall-cmd --direct --add-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-actionunban = firewall-cmd --direct --remove-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>

config/action.d/firewallcmd-new.conf

@@ -1,47 +0,0 @@
-# Fail2Ban configuration file
-#
-# Because of the --remove-rules in stop this action requires firewalld-0.3.8+
-
-[INCLUDES]
-
-before = firewallcmd-common.conf
-
-[Definition]
-
-actionstart = firewall-cmd --direct --add-chain <family> filter f2b-<name>
-              firewall-cmd --direct --add-rule <family> filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             firewall-cmd --direct --remove-rules <family> filter f2b-<name>
-             firewall-cmd --direct --remove-chain <family> filter f2b-<name>
-
-actioncheck = firewall-cmd --direct --get-chains <family> filter | sed -e 's, ,\n,g' | grep -q 'f2b-<name>$'
-
-actionban = firewall-cmd --direct --add-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-actionunban = firewall-cmd --direct --remove-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-# DEV NOTES:
-#
-# Author: Edgar Hoch
-# Copied from iptables-new.conf and modified for use with firewalld by Edgar Hoch.
-#  It uses "firewall-cmd" instead of "iptables".
-#
-# Output:
-# 
-# $ firewall-cmd --direct --add-chain ipv4 filter fail2ban-name
-# success
-# $ firewall-cmd --direct --add-rule ipv4 filter fail2ban-name 1000 -j RETURN
-# success
-# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 22 -j fail2ban-name
-# success
-# $ firewall-cmd --direct --get-chains ipv4 filter
-# fail2ban-name
-# $ firewall-cmd --direct --get-chains ipv4 filter  | od -h
-# 0000000 6166 6c69 6232 6e61 6e2d 6d61 0a65
-# $ firewall-cmd --direct --get-chains ipv4 filter | grep -Eq 'fail2ban-name( |$)' ; echo $?
-# 0
-# $ firewall-cmd -V
-# 0.3.8
-

config/action.d/firewallcmd-rich-logging.conf

@@ -1,29 +0,0 @@
-# Fail2Ban configuration file
-#
-# Authors: Donald Yandt, Sergey G. Brester
-# 
-# Because of the rich rule commands requires firewalld-0.3.1+
-# This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not
-# by chain. So for an example all deny rules will be listed under <zone>_deny and all log rules under <zone>_log. 
-#
-# Also this action logs banned access attempts so you can filter that and increase ban time for offenders.
-#
-# If you use the --permanent rule you get a xml file in /etc/firewalld/zones/<zone>.xml that can be shared and parsed easliy
-#
-# This is an derivative of firewallcmd-rich-rules.conf, see there for details and other parameters.
-
-[INCLUDES]
-
-before = firewallcmd-rich-rules.conf
-
-[Definition]
-
-rich-suffix = log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <rich-blocktype>
-
-[Init]
-
-# log levels are "emerg", "alert", "crit", "error", "warning", "notice", "info" or "debug"
-level = info
-
-# log rate per minute
-rate = 1

config/action.d/firewallcmd-rich-rules.conf

@@ -1,44 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# 
-# Because of the rich rule commands requires firewalld-0.3.1+
-# This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not
-# by chain. So for an example all deny rules will be listed under <zone>_deny. 
-#
-# If you use the --permanent rule you get a xml file in /etc/firewalld/zones/<zone>.xml that can be shared and parsed easliy
-#
-# Example commands to view rules:
-# firewall-cmd [--zone=<zone>] --list-rich-rules
-# firewall-cmd [--zone=<zone>] --list-all
-# firewall-cmd [--zone=zone] --query-rich-rule='rule'
-
-[INCLUDES]
-
-before = firewallcmd-common.conf
-
-[Definition]
-
-actionstart = 
-
-actionstop = 
-
-actioncheck = 
-
-#you can also use zones and/or service names. 
-#
-# zone example: 
-# firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' port port='<port>' protocol='<protocol>' <rich-blocktype>"
-#
-# service name example:
-# firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' service name='<service>' <rich-blocktype>"
-#
-# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges separated by a comma or space for an example: http, https, 22-60, 18 smtp 
-
-fwcmd_rich_rule = rule family='<family>' source address='<ip>' port port='$p' protocol='<protocol>' %(rich-suffix)s
-
-actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="%(fwcmd_rich_rule)s"; done
-	   
-actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="%(fwcmd_rich_rule)s"; done
-
-rich-suffix = <rich-blocktype>

config/action.d/helpers-common.conf

@@ -1,17 +0,0 @@
-[DEFAULT]
-
-# Usage:
-#   _grep_logs_args = 'test'
-#   (printf %%b "Log-excerpt contains 'test':\n"; %(_grep_logs)s; printf %%b "Log-excerpt contains 'test':\n") | mail ...
-#
-_grep_logs = logpath="<logpath>"; grep <grepopts> %(_grep_logs_args)s $logpath | <greplimit>
-# options `-wF` used to match only whole words and fixed string (not as pattern)
-_grep_logs_args = -wF "<ip>"
-
-# Used for actions, that should not by executed if ticket was restored:
-_bypass_if_restored = if [ '<restored>' = '1' ]; then exit 0; fi;
-
-[Init]
-greplimit = tail -n <grepmax>
-grepmax = 1000
-grepopts = -m <grepmax>

config/action.d/hostsdeny.conf

@@ -1,62 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Edited for cross platform by: James Stout, Yaroslav Halchenko and Daniel Black
-#
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = 
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = 
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "<daemon_list>: <ip_value>\n" >> <file>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = IP=$(echo "<ip_value>" | sed 's/[][\.]/\\\0/g') && sed -i "/^<daemon_list>: $IP$/d" <file>
-
-[Init]
-
-# Option:  file
-# Notes.:  hosts.deny file path.
-# Values:  STR  Default:  /etc/hosts.deny
-#
-file = /etc/hosts.deny
-
-# Option:  daemon_list
-# Notes:   The list of services that this action will deny. See the man page
-#          for hosts.deny/hosts_access. Default is all services.
-# Values:  STR  Default: ALL
-daemon_list = ALL
-
-# internal variable IP (to differentiate the IPv4 and IPv6 syntax, where it is enclosed in brackets):
-ip_value = <ip>
-
-[Init?family=inet6]
-ip_value = [<ip>]

config/action.d/ipfilter.conf

@@ -1,58 +0,0 @@
-# Fail2Ban configuration file
-#
-# NetBSD ipfilter (ipf command) ban/unban
-#
-# Author: Ed Ravin <eravin@panix.com>
-#
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-# enable IPF if not already enabled
-actionstart = /sbin/ipf -E
-
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-# don't disable IPF with "/sbin/ipf -D", there may be other filters in use
-actionstop = 
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = echo block <blocktype> in quick from <ip>/32 | /sbin/ipf -f -
-
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-# note -r option used to remove matching rule
-actionunban = echo block <blocktype> in quick from <ip>/32 | /sbin/ipf -r -f -
-
-[Init]
-
-# Option: Blocktype
-# Notes : This is the return-icmp[return-code] mentioned in the ipf man page section 5. Keep this quoted to prevent
-#         Shell expansion. This should be blank (unquoted) to drop the packet.
-# Values: STRING
-blocktype = "return-icmp(port-unr)"

config/action.d/ipfw.conf

@@ -1,68 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Nick Munger
-# Modified by: Cyril Jaquier
-#
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = 
-
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = 
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = ipfw add <blocktype> tcp from <ip> to <localhost> <port>
-
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = ipfw delete `ipfw list | grep -i "[^0-9]<ip>[^0-9]" | awk '{print $1;}'`
-
-[Init]
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]
-#
-port = ssh
-
-# Option:  localhost
-# Notes.:  the local IP address of the network interface
-# Values:  IP
-#
-localhost = 127.0.0.1
-
-
-# Option:  blocktype
-# Notes.:  How to block the traffic. Use a action from man 5 ipfw
-#          Common values: deny, unreach port, reset
-# Values:  STRING
-#
-blocktype = unreach port

config/action.d/iptables-allports.conf

@@ -1,55 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-#
-#
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -p <protocol> -j f2b-<name>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = <iptables> -D <chain> -p <protocol> -j f2b-<name>
-             <actionflush>
-             <iptables> -X f2b-<name>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
-
-[Init]
-

config/action.d/iptables-common.conf

@@ -1,92 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Daniel Black
-#
-# This is a included configuration file and includes the definitions for the iptables
-# used in all iptables based actions by default.
-#
-# The user can override the defaults in iptables-common.local
-#
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable (see new section Init?family=inet6)
-
-[INCLUDES]
-
-after = iptables-blocktype.local
-        iptables-common.local
-# iptables-blocktype.local is obsolete
-
-[Definition]
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = <iptables> -F f2b-<name>
-
-
-[Init]
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the Fail2Ban rules should be
-#          added
-# Values:  STRING  Default: INPUT
-chain = INPUT
-
-# Default name of the chain
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp-port-unreachable
-
-# Option:  returntype
-# Note:    This is the default rule on "actionstart". This should be RETURN
-#          in all (blocking) actions, except REJECT in allowing actions.
-# Values:  STRING
-returntype = RETURN
-
-# Option:  lockingopt
-# Notes.:  Option was introduced to iptables to prevent multiple instances from
-#          running concurrently and causing irratic behavior.  -w was introduced
-#          in iptables 1.4.20, so might be absent on older systems
-#          See https://github.com/fail2ban/fail2ban/issues/1122
-# Values:  STRING
-lockingopt = -w
-
-# Option:  iptables
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-iptables = iptables <lockingopt>
-
-
-[Init?family=inet6]
-
-# Option:  blocktype (ipv6)
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp6-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp6-port-unreachable
-
-# Option:  iptables (ipv6)
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-iptables = ip6tables <lockingopt>
-

config/action.d/iptables-ipset-proto4.conf

@@ -1,65 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Daniel Black
-#
-# This is for ipset protocol 4 (ipset v4.2). If you have a later version
-# of ipset try to use the iptables-ipset-proto6.conf as it does some things
-# nicer.
-# 
-# This requires the program ipset which is normally in package called ipset.
-#
-# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0 kernels.
-#
-# If you are running on an older kernel you make need to patch in external
-# modules. Debian squeeze can do this with:
-#   apt-get install xtables-addons-source 
-#   module-assistant auto-install xtables-addons
-#
-# Debian wheezy and above uses protocol 6
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = ipset --create f2b-<name> iphash
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
-
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = ipset --flush f2b-<name>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
-             <actionflush>
-             ipset --destroy f2b-<name>
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = ipset --test f2b-<name> <ip> ||  ipset --add f2b-<name> <ip>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = ipset --test f2b-<name> <ip> && ipset --del f2b-<name> <ip>
-
-[Init]
-

config/action.d/iptables-ipset-proto6-allports.conf

@@ -1,87 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Daniel Black
-#
-# This is for ipset protocol 6 (and hopefully later) (ipset v6.14).
-# Use ipset -V to see the protocol and version. Version 4 should use
-# iptables-ipset-proto4.conf.
-#
-# This requires the program ipset which is normally in package called ipset.
-#
-# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0 kernels.
-#
-# If you are running on an older kernel you make need to patch in external
-# modules which probably won't be protocol version 6.
-#
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable (see new section Init?family=inet6)
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = ipset create <ipmset> hash:ip timeout <default-ipsettime> <familyopt>
-              <iptables> -I <chain> -m set --match-set <ipmset> src -j <blocktype>
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = ipset flush <ipmset>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = <iptables> -D <chain> -m set --match-set <ipmset> src -j <blocktype>
-             <actionflush>
-             ipset destroy <ipmset>
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
-
-# actionprolong = %(actionban)s
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = ipset del <ipmset> <ip> -exist
-
-[Init]
-
-# Option: default-ipsettime
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
-default-ipsettime = 0
-
-# Option: ipsettime
-# Notes:  specifies ticket timeout (handled ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
-ipsettime = 0
-
-# expresion to caclulate timeout from bantime, example:
-# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
-timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
-
-ipmset = f2b-<name>
-familyopt =
-
-
-[Init?family=inet6]
-
-ipmset = f2b-<name>6
-familyopt = family inet6

config/action.d/iptables-ipset-proto6.conf

@@ -1,87 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Daniel Black
-#
-# This is for ipset protocol 6 (and hopefully later) (ipset v6.14).
-# Use ipset -V to see the protocol and version. Version 4 should use
-# iptables-ipset-proto4.conf.
-#
-# This requires the program ipset which is normally in package called ipset.
-#
-# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0 kernels.
-#
-# If you are running on an older kernel you make need to patch in external
-# modules.
-#
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable (see new section Init?family=inet6)
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = ipset create <ipmset> hash:ip timeout <default-ipsettime> <familyopt>
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = ipset flush <ipmset>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>
-             <actionflush>
-             ipset destroy <ipmset>
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
-
-# actionprolong = %(actionban)s
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = ipset del <ipmset> <ip> -exist
-
-[Init]
-
-# Option: default-ipsettime
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
-default-ipsettime = 0
-
-# Option: ipsettime
-# Notes:  specifies ticket timeout (handled ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
-ipsettime = 0
-
-# expresion to caclulate timeout from bantime, example:
-# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
-timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
-
-ipmset = f2b-<name>
-familyopt =
-
-
-[Init?family=inet6]
-
-ipmset = f2b-<name>6
-familyopt = family inet6

config/action.d/iptables-multiport-log.conf

@@ -1,68 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Guido Bozzetto
-# Modified: Cyril Jaquier
-#
-# make "f2b-<name>" chain to match drop IP
-# make "f2b-<name>-log" chain to log and drop
-# insert a jump to f2b-<name> from -I <chain> if proto/port match
-#
-#
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> 1 -p <protocol> -m multiport --dports <port> -j f2b-<name>
-              <iptables> -N f2b-<name>-log
-              <iptables> -I f2b-<name>-log -j LOG --log-prefix "$(expr f2b-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
-              <iptables> -A f2b-<name>-log -j <blocktype>
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = <iptables> -F f2b-<name>
-              <iptables> -F f2b-<name>-log
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             <actionflush>
-             <iptables> -X f2b-<name>
-             <iptables> -X f2b-<name>-log
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <iptables> -n -L f2b-<name>-log >/dev/null
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <iptables> -D f2b-<name> -s <ip> -j f2b-<name>-log
-
-[Init]
-

config/action.d/iptables-multiport.conf

@@ -1,52 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified by Yaroslav Halchenko for multiport banning
-#
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             <actionflush>
-             <iptables> -X f2b-<name>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
-
-[Init]
-

config/action.d/iptables-new.conf

@@ -1,54 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Copied from iptables.conf and modified by Yaroslav Halchenko 
-#  to fulfill the needs of bugreporter dbts#350746.
-#
-#
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = <iptables> -D <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
-             <actionflush>
-             <iptables> -X f2b-<name>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
-
-[Init]
-

config/action.d/iptables-xt_recent-echo.conf

@@ -1,79 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
-#
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-# Changing iptables rules requires root privileges. If fail2ban is
-# configured to run as root, firewall setup can be performed by
-# fail2ban automatically. However, if fail2ban is configured to run as
-# a normal user, the configuration must be done by some other means
-# (e.g. using static firewall configuration with the
-# iptables-persistent package).
-# 
-# Explanation of the rule below:
-#    Check if any packets coming from an IP on the <iptname>
-#    list have been seen in the last 3600 seconds. If yes, update the
-#    timestamp for this IP and drop the packet. If not, let the packet
-#    through.
-#
-#    Fail2ban inserts blacklisted hosts into the <iptname> list
-#    and removes them from the list after some time, according to its
-#    own rules. The 3600 second timeout is independent and acts as a
-#    safeguard in case the fail2ban process dies unexpectedly. The
-#    shorter of the two timeouts actually matters.
-actionstart = if [ `id -u` -eq 0 ];then <iptables> -I <chain> -m recent --update --seconds 3600 --name <iptname> -j <blocktype>;fi
-
-# Option:  actionflush
-#
-# [TODO] Flushing is currently not implemented for xt_recent
-#
-actionflush = 
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = echo / > /proc/net/xt_recent/<iptname>
-             if [ `id -u` -eq 0 ];then <iptables> -D <chain> -m recent --update --seconds 3600 --name <iptname> -j <blocktype>;fi
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = test -e /proc/net/xt_recent/<iptname>
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = echo +<ip> > /proc/net/xt_recent/<iptname>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = echo -<ip> > /proc/net/xt_recent/<iptname>
-
-[Init]
-
-iptname              = f2b-<name>
-
-[Init?family=inet6]
-
-iptname = f2b-<name>6

config/action.d/iptables.conf

@@ -1,52 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -p <protocol> --dport <port> -j f2b-<name>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = <iptables> -D <chain> -p <protocol> --dport <port> -j f2b-<name>
-             <actionflush>
-             <iptables> -X f2b-<name>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
-
-[Init]
-

config/action.d/mail-buffered.conf

@@ -1,86 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = printf %%b "Hi,\n
-              The jail <name> has been started successfully.\n
-              Output will be buffered until <lines> lines are available.\n
-              Regards,\n
-              Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = if [ -f <tmpfile> ]; then
-                 printf %%b "Hi,\n
-                 These hosts have been banned by Fail2Ban.\n
-                 `cat <tmpfile>`
-                 Regards,\n
-                 Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: Summary from <fq-hostname>" <dest>
-                 rm <tmpfile>
-             fi
-             printf %%b "Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
-            LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
-            if [ $LINE -ge <lines> ]; then
-                printf %%b "Hi,\n
-                These hosts have been banned by Fail2Ban.\n
-                `cat <tmpfile>`
-                \nRegards,\n
-                Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: Summary" <dest>
-                rm <tmpfile>
-            fi
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = 
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-
-# Default number of lines that are buffered
-#
-lines = 5
-
-# Default temporary file
-#
-tmpfile = /var/run/fail2ban/tmp-mail.txt
-
-# Destination/Addressee of the mail
-#
-dest = root

config/action.d/mail-whois-common.conf

@@ -1,28 +0,0 @@
-# Fail2Ban configuration file
-#
-# Common settings for mail actions
-#
-# Users can override the defaults in mail-whois-common.local
-
-[INCLUDES]
-
-# Load customizations if any available
-after = mail-whois-common.local
-
-[DEFAULT]
-#original character set of whois output will be sent to mail program
-_whois = whois <ip> || echo "missing whois program"
-
-# use heuristics to convert charset of whois output to a target
-# character set before sending it to a mail program
-# make sure you have 'file' and 'iconv' commands installed when opting for that
-_whois_target_charset = UTF-8
-_whois_convert_charset = (%(_whois)s) |
-                         { WHOIS_OUTPUT=$(cat) ; WHOIS_CHARSET=$(printf %%b "$WHOIS_OUTPUT" | file -b --mime-encoding -) ; printf %%b "$WHOIS_OUTPUT" | iconv -f $WHOIS_CHARSET -t %(_whois_target_charset)s//TRANSLIT - ; }
-
-# choose between _whois and _whois_convert_charset in mail-whois-common.local
-# or other *.local which include mail-whois-common.conf.
-_whois_command = %(_whois)s
-#_whois_command = %(_whois_convert_charset)s
-
-[Init]

config/action.d/mail-whois-lines.conf

@@ -1,92 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified-By: Yaroslav Halchenko to include grepping on IP over log files
-#
-
-[INCLUDES]
-
-before = mail-whois-common.conf
-         helpers-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = printf %%b "Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = printf %%b "Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-
-_ban_mail_content = ( printf %%b "Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n"
-            %(_whois_command)s;
-            printf %%b "\nLines containing failures of <ip> (max <grepmax>)\n";
-            %(_grep_logs)s;
-            printf %%b "\n
-            Regards,\n
-            Fail2Ban" )
-
-actionban = %(_ban_mail_content)s | <mailcmd> "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = 
-
-[Init]
-
-# Option:  mailcmd
-# Notes.:  Your system mail command. Is passed 2 args: subject and recipient
-# Values:  CMD
-#
-mailcmd = mail -E 'set escape' -s
-
-# Default name of the chain
-#
-name = default
-
-# Destinataire of the mail
-#
-dest = root
-
-# Path to the log files which contain relevant lines for the abuser IP
-#
-logpath = /dev/null
-
-# Number of log lines to include in the email
-#
-#grepmax = 1000
-#grepopts = -m <grepmax>

config/action.d/mail-whois.conf

@@ -1,71 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = mail-whois-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = printf %%b "Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = printf %%b "Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n
-            Regards,\n
-            Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = 
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-
-# Destination/Addressee of the mail
-#
-dest = root
-

config/action.d/mail.conf

@@ -1,65 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = printf %%b "Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started  on <fq-hostname>" <dest>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = printf %%b "Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n
-            Regards,\n
-            Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = 
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-
-# Destination/Addressee of the mail
-#
-dest = root
-

config/action.d/mynetwatchman.conf

@@ -1,143 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Russell Odom <russ@gloomytrousers.co.uk>
-# Submits attack reports to myNetWatchman (http://www.mynetwatchman.com/)
-#
-# You MUST configure at least:
-# <port> (the port that's being attacked - use number not name).
-# <mnwlogin> (your mNW login).
-# <mnwpass> (your mNW password).
-#
-# You SHOULD also provide:
-# <myip> (your public IP address, if it's not the address of eth0)
-# <protocol> (the protocol in use - defaults to tcp)
-#
-# Best practice is to provide <port> and <protocol> in jail.conf like this:
-# action = mynetwatchman[port=1234,protocol=udp]
-#
-# ...and create "mynetwatchman.local" with contents something like this:
-# [Init]
-# mnwlogin = me@example.com
-# mnwpass = SECRET
-# myip = 10.0.0.1
-#
-# Another useful configuration value is <getcmd>, if you don't have wget
-# installed (an example config for curl is given below)
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-#
-# Note: We are currently using <time> for the timestamp because no tag is
-# available to indicate the timestamp of the log message(s) which triggered the
-# ban. Therefore the timestamps we are using in the report, whilst often only a
-# few seconds out, are incorrect. See
-# http://sourceforge.net/tracker/index.php?func=detail&aid=2017795&group_id=121032&atid=689047
-#
-actionban = MNWLOGIN=`perl -e '$s=shift;$s=~s/([\W])/"%%".uc(sprintf("%%2.2x",ord($1)))/eg;print $s' '<mnwlogin>'`
-            MNWPASS=`perl -e '$s=shift;$s=~s/([\W])/"%%".uc(sprintf("%%2.2x",ord($1)))/eg;print $s' '<mnwpass>'`
-	    PROTOCOL=`awk '{IGNORECASE=1;if($1=="<protocol>"){print $2;exit}}' /etc/protocols`
-	    if [ -z "$PROTOCOL" ]; then PROTOCOL=<protocol>; fi
-	    DATETIME=`perl -e '@t=gmtime(<time>);printf "%%4d-%%02d-%%02d+%%02d:%%02d:%%02d",1900+$t[5],$t[4]+1,$t[3],$t[2],$t[1],$t[0]'`
-            <getcmd> "<mnwurl>?AT=2&AV=0&AgentEmail=$MNWLOGIN&AgentPassword=$MNWPASS&AttackerIP=<ip>&SrcPort=<srcport>&ProtocolID=$PROTOCOL&DestPort=<port>&AttackCount=<failures>&VictimIP=<myip>&AttackDateTime=$DATETIME" 2>&1 >> <tmpfile>.out && grep -q 'Attack Report Insert Successful' <tmpfile>.out && rm -f <tmpfile>.out
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
-[Init]
-# Option:  port
-# Notes.:  The target port for the attack (numerical). MUST be provided in
-#          the jail config, as it cannot be detected here.
-# Values:  [ NUM ]  Default: ???
-#
-port = 0
-
-# Option:  mnwlogin
-# Notes.:  Your mNW login e-mail address. MUST be provided either in the jail
-#          config or in a .local file.
-#          Register at http://www.mynetwatchman.com/reg.asp
-# Values:  [ STRING ]  Default: (empty)
-#
-mnwlogin =
-
-# Option:  mnwpass
-# Notes.:  The password corresponding to your mNW login e-mail address. MUST be
-#          provided either in the jail config or in a .local file.
-# Values:  [ STRING ]  Default: (empty)
-#
-mnwpass =
-
-# Option:  myip
-# Notes.:  The target IP for the attack (your public IP). Should be overridden
-#          either in the jail config or in a .local file unless your PUBLIC IP
-#          is the first IP assigned to eth0
-# Values:  [ an IP address ]  Default: Tries to find the IP address of eth0,
-#          which in most cases will be a private IP, and therefore incorrect
-#
-myip = `ip -4 addr show dev eth0 | grep inet | head -n 1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`
-
-# Option:  protocol
-# Notes.:  The protocol over which the attack is happening
-# Values:  [ tcp | udp | icmp | (any other protocol name from /etc/protocols) | NUM ] Default: tcp
-#
-protocol = tcp
-
-# Option:  agent
-# Default: Fail2ban
-agent = Fail2ban
-
-# Option:  getcmd
-# Notes.:  A command to fetch a URL. Should output page to STDOUT
-# Values:  CMD  Default: wget
-#
-getcmd = wget --no-verbose --tries=3 --waitretry=10 --connect-timeout=10 --read-timeout=60 --retry-connrefused --output-document=- --user-agent=<agent>
-# Alternative value:
-# getcmd = curl --silent --show-error --retry 3 --connect-timeout 10 --max-time 60 --user-agent <agent>
-
-# Option:  srcport
-# Notes.:  The source port of the attack. You're unlikely to have this info, so
-#          you can leave the default
-# Values:  [ NUM ]  Default: 0
-#
-srcport = 0
-
-# Option:  mnwurl
-# Notes.:  The report service URL on the mNW site
-# Values:  STRING  Default: http://mynetwatchman.com/insertwebreport.asp
-#
-mnwurl = http://mynetwatchman.com/insertwebreport.asp
-
-# Option:  tmpfile
-# Notes.:  Base name of temporary files
-# Values:  [ STRING ]  Default: /var/run/fail2ban/tmp-mynetwatchman
-#
-tmpfile = /var/run/fail2ban/tmp-mynetwatchman

config/action.d/netscaler.conf

@@ -1,33 +0,0 @@
-# Fail2ban Citrix Netscaler Action
-# by Juliano Jeziorny
-# juliano@jeziorny.eu
-#
-# The script will add offender IPs to a dataset on netscaler, the dataset can then be used to block the IPs at a cs/vserver or global level
-# This dataset is then used to block IPs using responder policies on the netscaler.
-# 
-# The script assumes using HTTPS with unsecure certificate to access the netscaler, 
-# if you have a valid certificate installed remove the -k from the curl lines, or if you want http change it accordingly (and remove the -k)
-# 
-# This action depends on curl
-#
-# You need to populate the 3 options inside Init
-#
-# ns_host: IP or hostname of netslcaer appliance
-# ns_auth: username:password, suggest base64 encoded for a little added security (echo -n "username:password" | base64)
-# ns_dataset:  Name of the netscaler dataset holding the IPs to be blocked.
-# 
-# For further details on how to use it please check http://blog.ckzone.eu/2017/01/fail2ban-action-for-citrix-netscaler.html
-
-[Init]
-ns_host = 
-ns_auth = 
-ns_dataset = 
-
-[Definition]
-actionstart = curl -kH 'Authorization: Basic <ns_auth>' https://<ns_host>/nitro/v1/config
-
-actioncheck = 
-
-actionban = curl -k -H 'Authorization: Basic <ns_auth>' -X PUT -d '{"policydataset_value_binding":{"name":"<ns_dataset>","value":"<ip>"}}' https://<ns_host>/nitro/v1/config/
-
-actionunban = curl -H 'Authorization: Basic <ns_auth>' -X DELETE -k "https://<ns_host>/nitro/v1/config/policydataset_value_binding/<ns_dataset>?args=value:<ip>"

config/action.d/nftables-allports.conf

@@ -1,17 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-# Obsolete: superseded by nftables[type=allports]
-
-[INCLUDES]
-
-before = nftables.conf
-
-[Definition]
-
-type = allports

config/action.d/nftables-multiport.conf

@@ -1,17 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-# Obsolete: superseded by nftables[type=multiport]
-
-[INCLUDES]
-
-before = nftables.conf
-
-[Definition]
-
-type = multiport

config/action.d/nftables.conf

@@ -1,203 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Daniel Black
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-# This is a included configuration file and includes the definitions for the nftables
-# used in all nftables based actions by default.
-#
-# The user can override the defaults in nftables-common.local
-# Example: redirect flow to honeypot
-#
-# [Init]
-# table_family = ip
-# chain_type = nat
-# chain_hook = prerouting
-# chain_priority = -50
-# blocktype = counter redirect to 2222
-
-[INCLUDES]
-
-after = nftables-common.local
-
-[Definition]
-
-# Option:  type
-# Notes.:  type of the action.
-# Values:  [ multiport | allports ]  Default: multiport
-#
-type = multiport
-
-rule_match-custom =
-rule_match-allports = meta l4proto \{ <protocol> \}
-rule_match-multiport = $proto dport \{ $(echo '<port>' | sed s/:/-/g) \}
-match = <rule_match-<type>>
-
-# Option:  rule_stat
-# Notes.:  statement for nftables filter rule.
-#          leaving it empty will block all (include udp and icmp)
-# Values:  nftables statement
-#
-rule_stat = %(match)s <addr_family> saddr @<addr_set> <blocktype>
-
-# optional interator over protocol's:
-_nft_for_proto-custom-iter =
-_nft_for_proto-custom-done =
-_nft_for_proto-allports-iter =
-_nft_for_proto-allports-done =
-_nft_for_proto-multiport-iter = for proto in $(echo '<protocol>' | sed 's/,/ /g'); do
-_nft_for_proto-multiport-done = done
-
-_nft_list = <nftables> -a list chain <table_family> <table> <chain>
-_nft_get_handle_id = grep -oP '@<addr_set>\s+.*\s+\Khandle\s+(\d+)$'
-
-_nft_add_set = <nftables> add set <table_family> <table> <addr_set> \{ type <addr_type>\; \}
-              <_nft_for_proto-<type>-iter>
-              <nftables> add rule <table_family> <table> <chain> %(rule_stat)s
-              <_nft_for_proto-<type>-done>
-_nft_del_set = { %(_nft_list)s | %(_nft_get_handle_id)s; } | while read -r hdl; do
-               <nftables> delete rule <table_family> <table> <chain> $hdl; done
-              <nftables> delete set <table_family> <table> <addr_set>
-
-# Option:  _nft_shutdown_table
-# Notes.:  command executed after the stop in order to delete table (it checks that no sets are available):
-# Values:  CMD
-#
-_nft_shutdown_table = { <nftables> list table <table_family> <table> | grep -qP '^\s+set\s+'; } || {
-                        <nftables> delete table <table_family> <table>
-                      }
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = <nftables> add table <table_family> <table>
-              <nftables> -- add chain <table_family> <table> <chain> \{ type <chain_type> hook <chain_hook> priority <chain_priority> \; \}
-              %(_nft_add_set)s
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action);
-#          uses `nft flush set ...` and as fallback (e. g. unsupported) recreates the set (with references)
-# Values:  CMD
-#
-actionflush = { <nftables> flush set <table_family> <table> <addr_set> 2> /dev/null; } || {
-              %(_nft_del_set)s
-              %(_nft_add_set)s
-              }
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = %(_nft_del_set)s
-             <_nft_shutdown_table>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <nftables> list chain <table_family> <table> <chain> | grep -q '@<addr_set>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <nftables> add element <table_family> <table> <addr_set> \{ <ip> \}
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <nftables> delete element <table_family> <table> <addr_set> \{ <ip> \}
-
-[Init]
-
-# Option:  table
-# Notes.:  main table to store chain and sets (automatically created on demand)
-# Values:  STRING  Default: f2b-table
-table = f2b-table
-
-# Option:  table_family
-# Notes.:  address family to work in
-# Values:  [ip | ip6 | inet]  Default: inet
-table_family = inet
-
-# Option:  chain
-# Notes.:  main chain to store rules
-# Values:  STRING  Default: f2b-chain
-chain = f2b-chain
-
-# Option:  chain_type
-# Notes.:  refers to the kind of chain to be created
-# Values:  [filter | route | nat]  Default: filter
-#
-chain_type = filter
-
-# Option:  chain_hook
-# Notes.:  refers to the kind of chain to be created
-# Values:  [ prerouting | input | forward | output | postrouting ]  Default: input
-#
-chain_hook = input
-
-# Option:  chain_priority
-# Notes.:  priority in the chain.
-# Values:  NUMBER  Default: -1
-#
-chain_priority = -1
-
-# Option:  addr_type
-# Notes.:  address type to work with
-# Values:  [ipv4_addr | ipv6_addr]  Default: ipv4_addr
-#
-addr_type = ipv4_addr
-
-# Default name of the filtering set
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp ] Default: tcp
-#
-protocol = tcp
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the nftables man page (section 8). Common values are drop,
-#          reject, reject with icmpx type host-unreachable, redirect to 2222
-# Values:  STRING
-blocktype = reject
-
-# Option:  nftables
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-nftables = nft
-
-# Option: addr_set
-# Notes.: The name of the nft set used to store banned addresses
-# Values: STRING
-addr_set = addr-set-<name>
-
-# Option: addr_family
-# Notes.: The family of the banned addresses
-# Values: [ ip | ip6 ]
-addr_family = ip
-
-[Init?family=inet6]
-addr_family = ip6
-addr_type = ipv6_addr
-addr_set = addr6-set-<name>

config/action.d/nginx-block-map.conf

@@ -1,117 +0,0 @@
-# Fail2Ban configuration file for black-listing via nginx
-#
-# Author: Serg G. Brester (aka sebres)
-#
-# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration,
-# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban).
-#
-# Example (argument "token_id" resp. cookie "session_id" used here as unique identifier for user):
-#
-#   http {
-#     ...
-#     # maps to check user is blacklisted (banned in f2b):
-#     #map $arg_token_id      $blck_lst_tok { include blacklisted-tokens.map; }
-#     map  $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; }
-#     ...
-#     # special log-format to notify fail2ban about failures:
-#     log_format f2b_session_errors '$msec failure "$cookie_session_id" - $remote_addr - $remote_user '
-#      ;#                  '"$request" $status $bytes_sent '
-#       #                  '"$http_referer" "$http_user_agent"';
-#
-#     # location checking blacklisted values:
-#     location ... {
-#       # check banned sessionid:
-#       if ($blck_lst_ses != "") {
-#         try_files "" @f2b-banned;
-#       }
-#       ...
-#       # notify fail2ban about a failure inside nginx:
-#       error_page 401 = @notify-f2b;
-#       ...
-#     }
-#     ...
-#     # location for return with "403 Forbidden" if banned:
-#     location @f2b-banned {
-#       default_type text/html;
-#       return 403 "<br/><center>
-#         <b style=\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\">
-#         You are banned!</b></center>";
-#     }
-#     ...
-#     # location to notify fail2ban about a failure inside nginx:
-#     location @notify-f2b {
-#       access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;
-#     }
-#   }
-#   ...
-#
-# Note that quote-character (and possibly other special characters) are not allowed currently as session-id.
-# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service), 
-# like in example below:
-#
-#   location ... {
-#     if ($cookie_session_id !~ "^[\w\-]+$") {
-#       return  403 "Wrong session-id"
-#     }
-#     ...
-#   }
-#
-# The parameters for jail corresponding log-format (f2b_session_errors):
-#
-#   [nginx-blck-lst]
-#   filter =
-#   datepattern = ^Epoch
-#   failregex = ^ failure "<F-ID>[^"]+</F-ID>" - <ADDR>
-#   usedns = no
-#
-# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs):
-#
-#   [nginx-blck-ip]
-#   maxretry = 100
-#   filter =
-#   datepattern = ^Epoch
-#   failregex = ^ failure "[^"]+" - <ADDR>
-#   usedns = no
-#
-
-[Definition]
-
-# path to configuration of nginx (used to target nginx-instance in multi-instance system,
-# and as path for the blacklisted map):
-srv_cfg_path = /etc/nginx/
-
-# cmd-line arguments to supply to test/reload nginx:
-#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf
-srv_cmd = nginx
-
-# pid file (used to check nginx is running):
-srv_pid = /run/nginx.pid
-
-# command used to check whether nginx is running and configuration is valid:
-srv_is_running = [ -f "%(srv_pid)s" ]
-srv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt
-
-# first test nginx is running and configuration is correct, hereafter send reload signal:
-blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then
-                    %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;
-                  fi;
-
-# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file="/path/file.map"]`:
-blck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.map
-
-# Action definition:
-
-actionstart_on_demand = false
-actionstart = touch '%(blck_lst_file)s'
-
-actionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s
-
-actionstop = %(actionflush)s
-
-actioncheck = 
-
-_echo_blck_row = printf '\%%s 1;\n' "<fid>"
-
-actionban = %(_echo_blck_row)s >> '%(blck_lst_file)s'; %(blck_lst_reload)s
-
-actionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/^$id$/d" %(blck_lst_file)s; %(blck_lst_reload)s

config/action.d/npf.conf

@@ -1,61 +0,0 @@
-# Fail2Ban configuration file
-#
-# NetBSD npf ban/unban
-#
-# Author: Nils Ratusznik <nils@NetBSD.org>
-# Based on pf.conf action file
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-# we don't enable NPF automatically, as it will be enabled elsewhere
-actionstart = 
-
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-# we don't disable NPF automatically either
-actionstop = 
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = /sbin/npfctl table <tablename> add <ip>
-
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-# note -r option used to remove matching rule
-actionunban = /sbin/npfctl table <tablename> rem <ip>
-
-[Init]
-# Option:  tablename
-# Notes.:  The pf table name.
-# Values:  [ STRING ]
-#
-tablename = fail2ban

config/action.d/nsupdate.conf

@@ -1,114 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Andrew St. Jean
-#
-# Use nsupdate to perform dynamic DNS updates on a BIND zone file.
-# One may want to do this to update a local RBL with banned IP addresses.
-#
-# Options
-#
-# domain	DNS domain that will appear in nsupdate add and delete
-#		commands.
-#
-# ttl		The time to live (TTL) in seconds of the TXT resource
-#		record.
-#
-# rdata		Data portion of the TXT resource record.
-#
-# nsupdatecmd	Full path to the nsupdate command.
-#
-# keyfile	Full path to TSIG key file used for authentication between
-#		nsupdate and BIND.
-#
-# Create an nsupdate.local to set at least the <domain> and <keyfile>
-# options as they don't have default values.
-#
-# The ban and unban commands assume nsupdate will authenticate to the BIND
-# server using a TSIG key. The full path to the key file must be specified
-# in the <keyfile> parameter. Use this command to generate your TSIG key.
-#
-# dnssec-keygen -a HMAC-MD5 -b 256 -n HOST <key_name>
-#
-# Replace <key_name> with some meaningful name.
-#
-# This command will generate two files. Specify the .private file in the
-# <keyfile> option. Note that the .key file must also be present in the same
-# directory for nsupdate to use the key.
-#
-# Don't forget to add the key and appropriate allow-update or update-policy
-# option to your named.conf file.
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart =
-
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop =
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = echo <ip> | awk -F. '{print "prereq nxrrset "$4"."$3"."$2"."$1".<domain> TXT"; print "update add "$4"."$3"."$2"."$1".<domain> <ttl> IN TXT \"<rdata>\""; print "send"}' | <nsupdatecmd> -k <keyfile>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = echo <ip> | awk -F. '{print "update delete "$4"."$3"."$2"."$1".<domain>"; print "send"}' | <nsupdatecmd> -k <keyfile>
-
-[Init]
-
-# Option:  domain
-# Notes.:  DNS domain that nsupdate will update.
-# Values:  STRING
-#
-domain = 
-
-# Option:  ttl
-# Notes.:  time to live (TTL) in seconds of TXT resource record
-#          added by nsupdate.
-# Values:  NUM
-#
-ttl = 60
-
-# Option:  rdata
-# Notes.:  data portion of the TXT resource record added by nsupdate.
-# Values:  STRING
-#
-rdata = Your IP has been banned
-
-# Option:  nsupdatecmd
-# Notes.:  specifies the full path to the nsupdate program that dynamically
-#          updates BIND zone files.
-# Values:  CMD
-#
-nsupdatecmd = /usr/bin/nsupdate
-
-# Option:  keyfile
-# Notes.:  specifies the full path to the file containing the
-#	   TSIG key for communicating with BIND.
-# Values:  STRING
-#
-keyfile = 
-

config/action.d/osx-afctl.conf

@@ -1,16 +0,0 @@
-# Fail2Ban configuration file for using afctl on Mac OS X Server 10.5
-#
-# Anonymous author
-# http://www.fail2ban.org/wiki/index.php?title=HOWTO_Mac_OS_X_Server_(10.5)&diff=prev&oldid=4081
-#
-# Ref: https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man8/afctl.8.html
-
-[Definition]
-actionstart = 
-actionstop = 
-actioncheck = 
-actionban = /usr/libexec/afctl -a <ip> -t <bantime>
-actionunban = /usr/libexec/afctl -r <ip>
-
-actionprolong = %(actionunban)s && %(actionban)s
-

config/action.d/osx-ipfw.conf

@@ -1,87 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Nick Munger
-# Modified by: Andy Fragen and Daniel Black
-#
-# Mod for OS X, using random rulenum as OSX ipfw doesn't include tables
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = 
-
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = 
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-# Values:  CMD
-#
-actionban = ipfw add <rulenum> set <setnum> <blocktype> log <block> from <ip> to <dst> <port>
-
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-# Values:  CMD
-#
-actionunban = ipfw delete `ipfw -S list | grep -i 'set <setnum> <blocktype> log <block> from <ip> to <dst>' | awk '{print $1;}'`
-
-[Init]
-
-# Option:  port
-# Notes.:  specifies port to block. Can be blank however may require block="ip"
-# Values:  [ NUM | STRING ]
-#
-port = ssh
-
-# Option:  dst
-# Notes.:  the local IP address of the network interface
-# Values:  IP, any, me or anything support by ipfw as a dst
-#
-dst = me
-
-# Option: block
-# Notes:  This is how much to block.
-#         Can be "ip", "tcp", "udp" or various other options.
-# Values: STRING
-block = tcp
-
-# Option:  blocktype
-# Notes.:  How to block the traffic. Use a action from man 8 ipfw
-#          Common values: deny, unreach port, reset
-# Values:  STRING
-#
-blocktype = unreach port
-
-# Option:  set number
-# Notes.:  The ipset number this is added to.
-# Values:  0-31
-setnum = 10
-
-# Option:  number for ipfw rule
-# Notes:   This is meant to be automatically generated and not overwritten
-# Values:  Random value between 10000 and 12000
-rulenum="`echo $((RANDOM%%2000+10000))`"
-
-# Duplicate prevention mechanism
-#rulenum = "`a=$((RANDOM%%2000+10000)); while ipfw show | grep -q ^$a\ ; do a=$((RANDOM%%2000+10000)); done; echo $a`"

config/action.d/pf.conf

@@ -1,124 +0,0 @@
-# Fail2Ban configuration file
-#
-# OpenBSD pf ban/unban
-#
-# Author: Nick Hilliard <nick@foobar.org>
-# Modified by: Alexander Koeppe making PF work seamless and with IPv4 and IPv6
-#
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-# we don't enable PF automatically; to enable run pfctl -e 
-# or add `pf_enable="YES"` to /etc/rc.conf (tested on FreeBSD)
-# also, these rulesets are loaded into (nested) anchors
-# to enable them, add as wildcard:
-#     anchor "f2b/*"
-# or using jail names:
-#     anchor f2b {
-#        anchor name1
-#        anchor name2
-#        ...
-#     }
-# to your main pf ruleset, where "namei" are the names of the jails
-# which invoke this action
-actionstart = echo "table <<tablename>-<name>> persist counters" | <pfctl> -f-
-              port="<port>"; if [ "$port" != "" ] && case "$port" in \{*) false;; esac; then port="{$port}"; fi
-              echo "<block> proto <protocol> from <<tablename>-<name>> to <actiontype>" | <pfctl> -f-
-
-# Option:  start_on_demand - to start action on demand
-# Example: `action=pf[actionstart_on_demand=true]`
-actionstart_on_demand = false
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-# we only disable PF rules we've installed prior
-actionstop = <pfctl> -sr 2>/dev/null | grep -v <tablename>-<name> | <pfctl> -f-
-             %(actionflush)s
-             <pfctl> -t <tablename>-<name> -T kill
-
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = <pfctl> -t <tablename>-<name> -T flush
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <pfctl> -sr | grep -q <tablename>-<name>
-
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = <pfctl> -t <tablename>-<name> -T add <ip>
-
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-# note -r option used to remove matching rule
-actionunban = <pfctl> -t <tablename>-<name> -T delete <ip>
-
-# Option: pfctl
-#
-# Use anchor as jailname to manipulate affected rulesets only.
-# If more parameter expected it can be extended with `pf[pfctl="<known/pfctl> ..."]`
-# 
-pfctl = pfctl -a f2b/<name>
-
-[Init]
-# Option:  tablename
-# Notes.:  The pf table name.
-# Values:  [ STRING ]
-#
-tablename = f2b
-
-# Option: block
-#
-# The action you want pf to take.
-# Probably, you want "block quick", but adjust as needed.
-block = block quick
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | ipv6-icmp ] Default: tcp
-#
-protocol = tcp
-
-# Option: actiontype
-# Notes.: defines additions to the blocking rule
-# Values: leave empty to block all attempts from the host
-# Default: Value of the multiport
-actiontype = <multiport>
-
-# Option: allports
-# Notes.: default addition to block all ports
-# Usage.: use in jail config: "banaction = pf[actiontype=<allports>]"
-allports = any
-
-# Option: multiport
-# Notes.: addition to block access only to specific ports
-# Usage.: use in jail config: "banaction = pf[actiontype=<multiport>]"
-multiport = any port $port
-

config/action.d/route.conf

@@ -1,29 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Michael Gebetsroither
-#
-# This is for blocking whole hosts through blackhole routes.
-#
-# PRO:
-#   - Works on all kernel versions and as no compatibility problems (back to debian lenny and WAY further).
-#   - It's FAST for very large numbers of blocked ips.
-#   - It's FAST because it Blocks traffic before it enters common iptables chains used for filtering.
-#   - It's per host, ideal as action against ssh password bruteforcing to block further attack attempts.
-#   - No additional software required beside iproute/iproute2
-#
-# CON:
-#   - Blocking is per IP and NOT per service, but ideal as action against ssh password bruteforcing hosts
-
-[Definition]
-actionban   = ip route add <blocktype> <ip>
-actionunban = ip route del <blocktype> <ip>
-actioncheck =
-actionstart =
-actionstop =
-
-[Init]
-
-# Option:  blocktype
-# Note:    Type can be blackhole, unreachable and prohibit. Unreachable and prohibit correspond to the ICMP reject messages.
-# Values:  STRING
-blocktype = unreachable

config/action.d/sendmail-buffered.conf

@@ -1,99 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on <fq-hostname>
-              From: <sendername> <<sender>>
-              To: <dest>\n
-              Hi,\n
-              The jail <name> has been started successfully.\n
-              Output will be buffered until <lines> lines are available.\n
-              Regards,\n
-              Fail2Ban" | <mailcmd>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = if [ -f <tmpfile> ]; then
-                 printf %%b "Subject: [Fail2Ban] <name>: summary from <fq-hostname>
-                 From: <sendername> <<sender>>
-                 To: <dest>\n
-                 Hi,\n
-                 These hosts have been banned by Fail2Ban.\n
-                 `cat <tmpfile>`
-                 Regards,\n
-                 Fail2Ban" | <mailcmd>
-                 rm <tmpfile>
-             fi
-             printf %%b "Subject: [Fail2Ban] <name>: stopped  on <fq-hostname>
-             From: Fail2Ban <<sender>>
-             To: <dest>\n
-             Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban" | <mailcmd>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
-            LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
-            if [ $LINE -ge <lines> ]; then
-                printf %%b "Subject: [Fail2Ban] <name>: summary from <fq-hostname>
-                From: <sendername> <<sender>>
-                To: <dest>\n
-                Hi,\n
-                These hosts have been banned by Fail2Ban.\n
-                `cat <tmpfile>`
-                Regards,\n
-                Fail2Ban" | <mailcmd>
-                rm <tmpfile>
-            fi
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = 
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-
-# Default number of lines that are buffered
-#
-lines = 5
-
-# Default temporary file
-#
-tmpfile = /var/run/fail2ban/tmp-mail.txt
-

config/action.d/sendmail-common.conf

@@ -1,77 +0,0 @@
-# Fail2Ban configuration file
-#
-# Common settings for sendmail actions
-#
-# Users can override the defaults in sendmail-common.local
-
-[INCLUDES]
-
-after = sendmail-common.local
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on <fq-hostname>
-              Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-              From: <sendername> <<sender>>
-              To: <dest>\n
-              Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban" | <mailcmd>
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on <fq-hostname>
-             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-             From: <sendername> <<sender>>
-             To: <dest>\n
-             Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban" | <mailcmd>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban =
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
-[Init]
-
-# Your system mail command
-#
-mailcmd = /usr/sbin/sendmail -f "<sender>" "<dest>"
-
-# Recipient mail address
-#
-dest = root
-
-# Sender mail address
-#
-sender = fail2ban
-
-# Sender display name
-#
-sendername = Fail2Ban

config/action.d/sendmail-geoip-lines.conf

@@ -1,59 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Viktor Szépe
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-         helpers-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionban
-# Notes.:  Command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-#          You need to install geoiplookup and the GeoLite or GeoIP databases.
-#          (geoip-bin and geoip-database in Debian)
-#          The host command comes from bind9-host package.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            http://bgp.he.net/ip/<ip>
-            http://www.projecthoneypot.org/ip_<ip>
-            http://whois.domaintools.com/<ip>\n\n
-            Country:`geoiplookup -f /usr/share/GeoIP/GeoIP.dat "<ip>" | cut -d':' -f2-`
-            AS:`geoiplookup -f /usr/share/GeoIP/GeoIPASNum.dat "<ip>" | cut -d':' -f2-`
-            hostname: <ip-host>\n\n
-            Lines containing failures of <ip> (max <grepmax>)\n";
-            %(_grep_logs)s;
-            printf %%b "\n
-            Regards,\n
-            Fail2Ban" ) | <mailcmd>
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-
-# Path to the log files which contain relevant lines for the abuser IP
-#
-logpath = /dev/null
-
-# Number of log lines to include in the email
-#
-#grepmax = 1000
-#grepopts = -m <grepmax>

config/action.d/sendmail-whois-ipjailmatches.conf

@@ -1,41 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-         mail-whois-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
-            Matches for <name> with <ipjailfailures> failures IP:<ip>\n
-            <ipjailmatches>\n\n
-            Regards,\n
-            Fail2Ban" | <mailcmd>
-
-[Init]
-
-# Default name of the chain
-#
-name = default

config/action.d/sendmail-whois-ipmatches.conf

@@ -1,41 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-         mail-whois-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
-            Matches with <ipfailures> failures IP:<ip>\n
-            <ipmatches>\n\n
-            Regards,\n
-            Fail2Ban" | <mailcmd>
-
-[Init]
-
-# Default name of the chain
-#
-name = default

config/action.d/sendmail-whois-lines.conf

@@ -1,52 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-         mail-whois-common.conf
-         helpers-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n"
-            %(_whois_command)s;
-            printf %%b "\nLines containing failures of <ip> (max <grepmax>)\n";
-            %(_grep_logs)s;
-            printf %%b "\n
-            Regards,\n
-            Fail2Ban" ) | <mailcmd>
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-
-# Path to the log files which contain relevant lines for the abuser IP
-#
-logpath = /dev/null
-
-# Number of log lines to include in the email
-#
-#grepmax = 1000
-#grepopts = -m <grepmax>

config/action.d/sendmail-whois-matches.conf

@@ -1,41 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-         mail-whois-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
-            Matches:\n
-            <matches>\n\n
-            Regards,\n
-            Fail2Ban" | <mailcmd>
-
-[Init]
-
-# Default name of the chain
-#
-name = default

config/action.d/sendmail-whois.conf

@@ -1,40 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-         mail-whois-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n
-            Regards,\n
-            Fail2Ban" | <mailcmd>
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-

config/action.d/sendmail.conf

@@ -1,37 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n
-            Regards,\n
-            Fail2Ban" | <mailcmd>
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-

config/action.d/shorewall-ipset-proto6.conf

@@ -1,93 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Eduardo Diaz
-#
-# This is for ipset protocol 6 (and hopefully later) (ipset v6.14).
-# for shorewall
-#
-# Use this setting in jail.conf to modify use this action instead of a
-# default one
-#
-# banaction   = shorewall-ipset-proto6
-#
-# This requires the program ipset which is normally in package called ipset.
-#
-# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0
-# kernels, and you need Shorewall >= 4.5.5 to use this action.
-#
-# The default Shorewall configuration is with "BLACKLISTNEWONLY=Yes" (see
-# file /etc/shorewall/shorewall.conf). This means that when Fail2ban adds a
-# new shorewall rule to ban an IP address, that rule will affect only new
-# connections. So if the attacker goes on trying using the same connection
-# he could even log in. In order to get the same behavior of the iptable
-# action (so that the ban is immediate) the /etc/shorewall/shorewall.conf
-# file should me modified with "BLACKLISTNEWONLY=No".
-#
-#
-# Enable shorewall to use a blacklist using iptables creating a file
-# /etc/shorewall/blrules and adding "DROP net:+f2b-ssh all" and
-# similar lines for every jail.  To enable restoring you ipset you
-# must set SAVE_IPSETS=Yes in shorewall.conf .  You can read more
-# about ipsets handling in Shorewall at http://shorewall.net/ipsets.html
-#
-# To force creation of the ipset in the case that somebody deletes the
-# ipset create a file /etc/shorewall/initdone and add one line for
-# every ipset (this files are in Perl) and add 1 at the end of the file.
-# The example:
-# system("/usr/sbin/ipset -quiet -exist create f2b-ssh hash:ip timeout 600 ");
-# 1;
-#
-# To destroy the ipset in shorewall you must add to the file /etc/shorewall/stopped
-# # One line of every ipset
-# system("/usr/sbin/ipset -quiet destroy f2b-ssh ");
-# 1; # This must go to the end of the file if not shorewall compilation fails
-#
-
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = if ! ipset -quiet -name list f2b-<name> >/dev/null;
-              then ipset -quiet -exist create f2b-<name> hash:ip timeout <default-ipsettime>;
-              fi
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = ipset flush f2b-<name>
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = ipset add f2b-<name> <ip> timeout <ipsettime> -exist
-
-# actionprolong = %(actionban)s
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = ipset del f2b-<name> <ip> -exist
-
-# Option: default-ipsettime
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
-default-ipsettime = 0
-
-# Option: ipsettime
-# Notes:  specifies ticket timeout (handled ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
-ipsettime = 0
-
-# expresion to caclulate timeout from bantime, example:
-# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
-timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)

config/action.d/shorewall.conf

@@ -1,73 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-# The default Shorewall configuration is with "BLACKLISTNEWONLY=Yes" (see
-# file /etc/shorewall/shorewall.conf). This means that when Fail2ban adds a
-# new shorewall rule to ban an IP address, that rule will affect only new
-# connections. So if the attempter goes on trying using the same connection
-# he could even log in. In order to get the same behavior of the iptable
-# action (so that the ban is immediate) the /etc/shorewall/shorewall.conf
-# file should be modified with "BLACKLISTNEWONLY=No". Note that as of
-# Shorewall 4.5.13 BLACKLISTNEWONLY is deprecated; however the equivalent
-# of BLACKLISTNEWONLY=No can now be achieved by setting BLACKLIST="ALL".
-# 
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = 
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = 
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = shorewall<family> <blocktype> <ip>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = shorewall<family> allow <ip>
-
-
-[Init]
-
-# Option:  family
-# Note:    Control which version of command is executed
-# Values:  Empty or 6 in case of IPv6
-family = 
-
-# Option:  blocktype
-# Note:    This is what the action does with rules.
-#          See man page of shorewall for options that include drop, logdrop, reject, or logreject
-# Values:  STRING
-blocktype = reject
-
-[Init?family=inet6]
-
-# Option:  family
-# Note:    Control which version of command is executed
-# Values:  Empty or 6 in case of IPv6
-family = 6
-

config/action.d/smtp.py

@@ -1,230 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-import socket
-import smtplib
-from email.mime.text import MIMEText
-from email.utils import formatdate, formataddr
-
-from fail2ban.server.actions import ActionBase, CallingMap
-
-messages = {}
-messages['start'] = \
-"""Hi,
-
-The jail %(jailname)s has been started successfully.
-
-Regards,
-Fail2Ban"""
-
-messages['stop'] = \
-"""Hi,
-
-The jail %(jailname)s has been stopped.
-
-Regards,
-Fail2Ban"""
-
-messages['ban'] = {}
-messages['ban']['head'] = \
-"""Hi,
-
-The IP %(ip)s has just been banned for %(bantime)i seconds
-by Fail2Ban after %(failures)i attempts against %(jailname)s.
-"""
-messages['ban']['tail'] = \
-"""
-Regards,
-Fail2Ban"""
-messages['ban']['matches'] = \
-"""
-Matches for this ban:
-%(matches)s
-"""
-messages['ban']['ipmatches'] = \
-"""
-Matches for %(ip)s:
-%(ipmatches)s
-"""
-messages['ban']['ipjailmatches'] = \
-"""
-Matches for %(ip)s for jail %(jailname)s:
-%(ipjailmatches)s
-"""
-
-
-class SMTPAction(ActionBase):
-	"""Fail2Ban action which sends emails to inform on jail starting,
-	stopping and bans.
-	"""
-
-	def __init__(
-		self, jail, name, host="localhost", user=None, password=None,
-		sendername="Fail2Ban", sender="fail2ban", dest="root", matches=None):
-		"""Initialise action.
-
-		Parameters
-		----------
-		jail : Jail
-			The jail which the action belongs to.
-		name : str
-			Named assigned to the action.
-		host : str, optional
-			SMTP host, of host:port format. Default host "localhost" and
-			port "25"
-		user : str, optional
-			Username used for authentication with SMTP server.
-		password : str, optional
-			Password used for authentication with SMTP server.
-		sendername : str, optional
-			Name to use for from address in email. Default "Fail2Ban".
-		sender : str, optional
-			Email address to use for from address in email.
-			Default "fail2ban".
-		dest : str, optional
-			Email addresses of intended recipient(s) in comma space ", "
-			delimited format. Default "root".
-		matches : str, optional
-			Type of matches to be included from ban in email. Can be one
-			of "matches", "ipmatches" or "ipjailmatches". Default None
-			(see man jail.conf.5).
-		"""
-
-		super(SMTPAction, self).__init__(jail, name)
-
-		self.host = host
-		#TODO: self.ssl = ssl
-
-		self.user = user
-		self.password =password
-
-		self.fromname = sendername
-		self.fromaddr = sender
-		self.toaddr = dest
-
-		self.matches = matches
-
-		self.message_values = CallingMap(
-			jailname = self._jail.name,
-			hostname = socket.gethostname,
-			bantime = lambda: self._jail.actions.getBanTime(),
-			)
-
-		# bypass ban/unban for restored tickets
-		self.norestored = 1
-
-	def _sendMessage(self, subject, text):
-		"""Sends message based on arguments and instance's properties.
-
-		Parameters
-		----------
-		subject : str
-			Subject of the email.
-		text : str
-			Body of the email.
-
-		Raises
-		------
-		SMTPConnectionError
-			Error on connecting to host.
-		SMTPAuthenticationError
-			Error authenticating with SMTP server.
-		SMTPException
-			See Python `smtplib` for full list of other possible
-			exceptions.
-		"""
-		msg = MIMEText(text)
-		msg['Subject'] = subject
-		msg['From'] = formataddr((self.fromname, self.fromaddr))
-		msg['To'] = self.toaddr
-		msg['Date'] = formatdate()
-
-		smtp = smtplib.SMTP()
-		try:
-			self._logSys.debug("Connected to SMTP '%s', response: %i: %s",
-				self.host, *smtp.connect(self.host))
-			if self.user and self.password: # pragma: no cover (ATM no tests covering that)
-				smtp.login(self.user, self.password)
-			failed_recipients = smtp.sendmail(
-				self.fromaddr, self.toaddr.split(", "), msg.as_string())
-		except smtplib.SMTPConnectError: # pragma: no cover
-			self._logSys.error("Error connecting to host '%s'", self.host)
-			raise
-		except smtplib.SMTPAuthenticationError: # pragma: no cover
-			self._logSys.error(
-				"Failed to authenticate with host '%s' user '%s'",
-				self.host, self.user)
-			raise
-		except smtplib.SMTPException: # pragma: no cover
-			self._logSys.error(
-				"Error sending mail to host '%s' from '%s' to '%s'",
-				self.host, self.fromaddr, self.toaddr)
-			raise
-		else:
-			if failed_recipients: # pragma: no cover
-				self._logSys.warning(
-					"Email to '%s' failed to following recipients: %r",
-					self.toaddr, failed_recipients)
-			self._logSys.debug("Email '%s' successfully sent", subject)
-		finally:
-			try:
-				self._logSys.debug("Disconnected from '%s', response %i: %s",
-					self.host, *smtp.quit())
-			except smtplib.SMTPServerDisconnected: # pragma: no cover
-				pass # Not connected
-
-	def start(self):
-		"""Sends email to recipients informing that the jail has started.
-		"""
-		self._sendMessage(
-			"[Fail2Ban] %(jailname)s: started on %(hostname)s" %
-				self.message_values,
-			messages['start'] % self.message_values)
-
-	def stop(self):
-		"""Sends email to recipients informing that the jail has stopped.
-		"""
-		self._sendMessage(
-			"[Fail2Ban] %(jailname)s: stopped on %(hostname)s" %
-				self.message_values,
-			messages['stop'] % self.message_values)
-
-	def ban(self, aInfo):
-		"""Sends email to recipients informing that ban has occurred.
-
-		Parameters
-		----------
-		aInfo : dict
-			Dictionary which includes information in relation to
-			the ban.
-		"""
-		if aInfo.get('restored'):
-			return
-		aInfo.update(self.message_values)
-		message = "".join([
-			messages['ban']['head'],
-			messages['ban'].get(self.matches, ""),
-			messages['ban']['tail']
-			])
-		self._sendMessage(
-			"[Fail2Ban] %(jailname)s: banned %(ip)s from %(hostname)s" %
-				aInfo,
-			message % aInfo)
-
-Action = SMTPAction

config/action.d/symbiosis-blacklist-allports.conf

@@ -1,55 +0,0 @@
-# Fail2Ban configuration file for Bytemark Symbiosis firewall
-#
-# Author: Yaroslav Halchenko
-#
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <iptables> -n -L <chain>
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP.
-# Values:  CMD
-#
-actionban = echo 'all' >| /etc/symbiosis/firewall/blacklist.d/<ip>.auto
-            <iptables> -I <chain> 1 -s <ip> -j <blocktype>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP.
-# Values:  CMD
-#
-actionunban = rm -f /etc/symbiosis/firewall/blacklist.d/<ip>.auto
-              <iptables> -D <chain> -s <ip> -j <blocktype> || :
-
-[Init]
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
-#          added to.  blacklist is a chain initiated by symbiosis firewall.
-# Values:  STRING  Default: blacklist
-chain = blacklist
-
-# Option:  blocktype
-# Note:    This is to match default symbiosis firewall type for blacklisted IPs
-# Values:  STRING
-blocktype = DROP

config/action.d/ufw.conf

@@ -1,75 +0,0 @@
-# Fail2Ban action configuration file for ufw
-#
-# You are required to run "ufw enable" before this will have any effect.
-#
-# The insert position should be appropriate to block the required traffic.
-# A number after an allow rule to the application won't be of much use.
-
-[Definition]
-
-actionstart = 
-
-actionstop = 
-
-actioncheck = 
-
-# ufw does "quickly process packets for which we already have a connection" in before.rules,
-# therefore all related sockets should be closed
-# actionban is using `ss` to do so, this only handles IPv4 and IPv6.
-
-actionban = if [ -n "<application>" ] && ufw app info "<application>"
-            then
-              ufw <add> <blocktype> from <ip> to <destination> app "<application>" comment "<comment>"
-            else
-              ufw <add> <blocktype> from <ip> to <destination> comment "<comment>"
-            fi
-            <kill>
-
-actionunban = if [ -n "<application>" ] && ufw app info "<application>"
-              then
-                ufw delete <blocktype> from <ip> to <destination> app "<application>"
-              else
-                ufw delete <blocktype> from <ip> to <destination>
-              fi
-
-# Option: kill-mode
-# Notes.: can be set to ss or conntrack (may be extended later with other modes) to immediately drop all connections from banned IP, default empty (no kill)
-# Example: banaction = ufw[kill-mode=ss]
-kill-mode =
-
-# intern conditional parameter used to provide killing mode after ban:
-_kill_ =
-_kill_ss = ss -K dst "[<ip>]"
-_kill_conntrack = conntrack -D -s "<ip>"
-
-# Option: kill
-# Notes.: can be used to specify custom killing feature, by default depending on option kill-mode
-# Examples: banaction = ufw[kill='ss -K "( sport = :http || sport = :https )" dst "[<ip>]"']
-#           banaction = ufw[kill='cutter "<ip>"']
-kill = <_kill_<kill-mode>>
-
-[Init]
-# Option: add
-# Notes.: can be set to "insert 1" to insert a rule at certain position (here 1):
-add = prepend
-
-# Option: blocktype
-# Notes.: reject or deny
-blocktype = reject
-
-# Option: destination
-# Notes.: The destination address to block in the ufw rule
-destination = any
-
-# Option: application
-# Notes.: application from sudo ufw app list
-application = 
-
-# Option: comment
-# Notes.: comment for rule added by fail2ban
-comment = by Fail2Ban after <failures> attempts against <name>
-
-# DEV NOTES:
-# 
-# Author: Guilhem Lettron
-# Enhancements: Daniel Black

config/action.d/xarf-login-attack.conf

@@ -1,143 +0,0 @@
-# Fail2Ban action for sending xarf Login-Attack messages to IP owner
-#
-# IMPORTANT:
-#
-# Emailing a IP owner of abuse is a serious complain. Make sure that it is
-# serious. Fail2ban developers and network owners recommend you only use this
-# action for:
-#   * The recidive where the IP has been banned multiple times
-#   * Where maxretry has been set quite high, beyond the normal user typing
-#     password incorrectly.
-#   * For filters that have a low likelihood of receiving human errors
-#
-# DEPENDENCIES:
-#
-# This requires the dig command from bind-utils
-#
-# This uses the https://abusix.com/contactdb.html to lookup abuse contacts.
-#
-# XARF is a specification for sending a formatted response
-# for non-messaging based abuse including:
-#
-# Login-Attack, Malware-Attack, Fraud (Phishing, etc.), Info DNSBL
-#
-# For details see:
-# https://github.com/xarf/xarf-specification
-# http://www.x-arf.org/schemata.html
-#
-# Author: Daniel Black
-# Based on complain written by Russell Odom <russ@gloomytrousers.co.uk>
-#
-#
-
-[Definition]
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
-actionstart =
-
-actionstop =
-
-actioncheck =
-
-actionban = oifs=${IFS};
-            RESOLVER_ADDR="%(addr_resolver)s"
-            if [ "<debug>" -gt 0 ]; then echo "try to resolve $RESOLVER_ADDR"; fi
-            ADDRESSES=$(dig +short -t txt -q $RESOLVER_ADDR | tr -d '"')
-            IFS=,; ADDRESSES=$(echo $ADDRESSES)
-            IFS=${oifs}
-            IP=<ip>
-            FROM=<sender>
-            SERVICE=<service>
-            FAILURES=<failures>
-            REPORTID=<time>@<fq-hostname>
-            TLP=<tlp>
-            PORT=<port>
-            DATE=`LC_ALL=C date --date=@<time> +"%%a, %%d %%h %%Y %%T %%z"`
-            if [ ! -z "$ADDRESSES" ]; then
-                oifs=${IFS}; IFS=,; ADDRESSES=$(echo $ADDRESSES)
-                IFS=${oifs}
-                (printf -- %%b "<header>\n<message>\n<report>\n\n";
-                 date '+Note: Local timezone is %%z (%%Z)';
-                 printf -- %%b "\n<ipmatches>\n\n<footer>") | <mailcmd> <mailargs> $ADDRESSES
-            fi
-
-actionunban =
-
-# Server as resolver used in dig command
-#
-addr_resolver = <ip-rev>abuse-contacts.abusix.org
-
-# Option: boundary
-# Notes:  This can be overwritten to be safe for possible predictions
-boundary = bfbb0f920793ac03cb8634bde14d8a1e
-
-_boundary = Abuse<time>-<boundary>
-
-# Option: header
-# Notes:  This is really a fixed value
-header  = Subject: abuse report about $IP - $DATE\nAuto-Submitted: auto-generated\nX-XARF: PLAIN\nContent-Transfer-Encoding: 7bit\nContent-Type: multipart/mixed; charset=utf8;\n  boundary=%(_boundary)s;\n\n--%(_boundary)s\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8;\n
-
-# Option: footer
-# Notes:  This is really a fixed value and needs to match the report and header
-#         mime delimiters
-footer = \n\n--%(_boundary)s--
-
-# Option: report
-# Notes:  Intended to be fixed
-report =  --%(_boundary)s\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8; name=\"report.txt\";\n\n---\nReported-From: $FROM\nCategory: abuse\nReport-ID: $REPORTID\nReport-Type: login-attack\nService: $SERVICE\nVersion: 0.2\nUser-Agent: Fail2ban v0.9\nDate: $DATE\nSource-Type: ip-address\nSource: $IP\nPort: $PORT\nSchema-URL: http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json\nAttachment: text/plain\nOccurances: $FAILURES\nTLP: $TLP\n\n\n--%(_boundary)s\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf8; name=\"logfile.log\";
-
-# Option: Message
-# Notes:  This can be modified by the users
-message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to abusix.com is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process.)\n\n This mail was generated by Fail2Ban in a X-ARF format! You can find more information about x-arf at http://www.x-arf.org/specification.html.\n\nThe recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here: https://abusix.com/global-reporting/abuse-contact-db\nabusix.com is neither responsible nor liable for the content or accuracy of this message.\n
-
-# Option:  loglines
-# Notes.:  The number of log lines to search for the IP for the report
-loglines = 9000
-
-# Option:  mailcmd
-# Notes.:  Your system mail command. It is passed the recipient
-# Values:  CMD
-#
-mailcmd =  /usr/sbin/sendmail
-
-# Option:  mailargs
-# Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
-#          CC reports to another address:
-#              -c me@example.com
-#          Appear to come from a different address - the '--' indicates
-#          arguments to be passed to Sendmail:
-#              -- -f me@example.com
-# Values:  [ STRING ]
-#
-mailargs = -f <sender>
-
-# Option:  tlp
-# Notes.:  Traffic light protocol defining the sharing of this information.
-#          http://www.trusted-introducer.org/ISTLPv11.pdf
-#          green is share to those involved in network security but it is not
-#          to be released to the public.
-tlp = green
-
-# ALL of the following parameters should be set so the report contains
-# meaningful information
-
-# Option: service
-# Notes.: This is the service type that was attacked. e.g. ssh, pop3
-service = unspecified
-
-# Option:  logpath
-# Notes:   Path to the log files which contain relevant lines for the abuser IP
-# Values:  Filename(s) space separated and can contain wildcards (these are
-#          greped for the IP so make sure these aren't too long
-logpath = /dev/null
-
-# Option:  sender
-# Notes.:  This is the sender that is included in the XARF report
-sender = fail2ban@<fq-hostname>
-
-# Option:  port
-# Notes.:  This is the port number that received the login-attack
-port = 0
-

config/debian-initd

@@ -0,0 +1,72 @@
+#! /bin/sh
+#
+# Fail2Ban init.d file - to be launched on boot
+#
+#		Written by Miquel van Smoorenburg <miquels@cistron.nl>.
+#		Modified for Debian
+#		 by Ian Murdock <imurdock@gnu.ai.mit.edu>.
+#               Adjusted for Fail2Ban
+#                by Yaroslav Halchenko <debian@onerussian.com>.
+#
+# Version:	$Id$
+#
+export PATH="${PATH:+$PATH:}/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+DAEMON=/usr/bin/fail2ban
+NAME=fail2ban
+DESC=fail2ban
+PIDFILE=/var/run/$NAME.pid
+
+test -x $DAEMON || exit 0
+
+# Include fail2ban defaults if available
+if [ -f /etc/default/fail2ban ] ; then
+	. /etc/default/fail2ban
+fi
+DAEMON_OPTS=$FAIL2BAN_OPTS
+set -e
+
+case "$1" in
+	start)
+		echo -n "Starting $DESC: "
+		[ -f $PIDFILE ] && [ ! -d /proc/`cat $PIDFILE` ] && rm -f $PIDFILE
+		start-stop-daemon --start --quiet --pidfile $PIDFILE \
+			--exec $DAEMON -- $DAEMON_OPTS
+		echo "$NAME."
+		;;
+	stop)
+		echo -n "Stopping $DESC: "
+		start-stop-daemon --stop --quiet --pidfile $PIDFILE
+		echo "$NAME."
+		;;
+	restart|force-reload)
+		echo -n "Restarting $DESC: "
+		( $0 stop )
+		sleep 1
+		$0 start
+		;;
+    status)
+		echo -n "Status of $DESC: "
+		if [ ! -e "$PIDFILE" ]; then
+			echo "$NAME is not running."
+			exit 3
+		fi
+		if [ ! -r "$PIDFILE" ]; then
+			echo "$PIDFILE not readable, status of $NAME unknown."
+			exit 4
+		fi
+		if [ -d /proc/`cat "$PIDFILE"` ]; then
+			echo "$NAME is running."
+			exit 0
+		else
+			echo "$NAME is not running but $PIDFILE exists."
+			exit 1
+		fi
+	;;
+	*)
+		N=/etc/init.d/$NAME
+		echo "Usage: $N {start|stop|restart|force-reload|status}" >&2
+		exit 1
+		;;
+esac
+
+exit 0

config/fail2ban.conf

@@ -1,92 +0,0 @@
-# Fail2Ban main configuration file
-#
-# Comments: use '#' for comment lines and ';' (following a space) for inline comments
-#
-# Changes:  in most of the cases you should not modify this
-#           file, but provide customizations in fail2ban.local file, e.g.:
-#
-# [DEFAULT]
-# loglevel = DEBUG
-#
-
-[DEFAULT]
-
-# Option: loglevel
-# Notes.: Set the log level output.
-#         CRITICAL
-#         ERROR
-#         WARNING
-#         NOTICE
-#         INFO
-#         DEBUG
-# Values: [ LEVEL ]  Default: INFO
-#
-loglevel = INFO
-
-# Option: logtarget
-# Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
-#         Only one log target can be specified.
-#         If you change logtarget from the default value and you are
-#         using logrotate -- also adjust or disable rotation in the
-#         corresponding configuration file
-#         (e.g. /etc/logrotate.d/fail2ban on Debian systems)
-# Values: [ STDOUT | STDERR | SYSLOG | SYSOUT | FILE ]  Default: STDERR
-#
-logtarget = /var/log/fail2ban.log
-
-# Option: syslogsocket
-# Notes: Set the syslog socket file. Only used when logtarget is SYSLOG
-#        auto uses platform.system() to determine predefined paths
-# Values: [ auto | FILE ]  Default: auto
-syslogsocket = auto
-
-# Option: socket
-# Notes.: Set the socket file. This is used to communicate with the daemon. Do
-#         not remove this file when Fail2ban runs. It will not be possible to
-#         communicate with the server afterwards.
-# Values: [ FILE ]  Default: /var/run/fail2ban/fail2ban.sock
-#
-socket = /var/run/fail2ban/fail2ban.sock
-
-# Option: pidfile
-# Notes.: Set the PID file. This is used to store the process ID of the
-#         fail2ban server.
-# Values: [ FILE ]  Default: /var/run/fail2ban/fail2ban.pid
-#
-pidfile = /var/run/fail2ban/fail2ban.pid
-
-# Option: allowipv6
-# Notes.: Allows IPv6 interface:
-#         Default: auto
-# Values: [ auto yes (on, true, 1) no (off, false, 0) ] Default: auto
-#allowipv6 = auto
-
-# Options: dbfile
-# Notes.: Set the file for the fail2ban persistent data to be stored.
-#         A value of ":memory:" means database is only stored in memory 
-#         and data is lost when fail2ban is stopped.
-#         A value of "None" disables the database.
-# Values: [ None :memory: FILE ] Default: /var/lib/fail2ban/fail2ban.sqlite3
-dbfile = /var/lib/fail2ban/fail2ban.sqlite3
-
-# Options: dbpurgeage
-# Notes.: Sets age at which bans should be purged from the database
-# Values: [ SECONDS ] Default: 86400 (24hours)
-dbpurgeage = 1d
-
-# Options: dbmaxmatches
-# Notes.: Number of matches stored in database per ticket (resolvable via 
-#         tags <ipmatches>/<ipjailmatches> in actions)
-# Values: [ INT ] Default: 10
-dbmaxmatches = 10
-
-[Definition]
-
-
-[Thread]
-
-# Options: stacksize
-# Notes.: Specifies the stack size (in KiB) to be used for subsequently created threads,
-#         and must be 0 or a positive integer value of at least 32.
-# Values: [ SIZE ] Default: 0 (use platform or configured default)
-#stacksize = 0

config/fail2ban.conf.default

@@ -0,0 +1,293 @@
+# Fail2Ban configuration file
+#
+# $Revision: 1.8.2.13 $
+#
+# 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
+
+[DEFAULT]
+# Option:  background
+# Notes.:  start fail2ban as a daemon. Output is redirect to logfile.
+# Values:  [true | false]  Default:  false
+#
+background = true
+
+# Option:  debug
+# Notes.:  enable debug mode. More verbose output and bypass root user test.
+# Values:  [true | false]  Default:  false
+#
+debug = false
+
+# Option:  logtargets
+# Notes.:  log targets. Space separated list of logging targets.
+# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+#
+logtargets = /var/log/fail2ban.log
+
+# Option:  syslog-target
+# Notes.:  where to find syslog facility if logtarget SYSLOG.
+# Values:  SOCKET HOST HOST:PORT  Default: /dev/log
+#
+syslog-target = /dev/log
+
+# Option:  syslog-facility
+# Notes.:  which syslog facility to use if logtarget SYSLOG.
+# Values:  NUM  Default: 1
+#
+syslog-facility = 1
+
+# Option:  pidlock
+# Notes.:  path of the PID lock file (must be able to write to file).
+# Values:  FILE  Default:  /var/run/fail2ban.pid
+#
+pidlock = /var/run/fail2ban.pid
+
+# Option:  maxfailures
+# Notes.:  number of failures before IP gets banned.
+# Values:  NUM  Default:  5
+#
+maxfailures = 5
+
+# Option:  bantime
+# Notes.:  number of seconds an IP will be banned.
+# Values:  NUM  Default:  600
+#
+bantime = 600
+
+# Option:  findtime
+# Notes.:  lifetime in seconds of a "failed" log entry.
+# Values:  NUM  Default:  600
+#
+findtime = 600
+
+# Option:  ignoreip
+# Notes.:  space separated list of IP's to be ignored by fail2ban.
+#          You can use CIDR mask in order to specify a range.
+#          Example:  ignoreip = 192.168.0.1/24 123.45.235.65
+# Values:  IP  Default:  192.168.0.0/16
+#
+ignoreip = 192.168.0.0/16
+
+
+# Option:  cmdstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD  Default:
+#
+cmdstart = 
+
+# Option:  cmdend
+# Notes.:  command executed once at the end of Fail2Ban.
+# Values:  CMD  Default:
+#
+cmdend = 
+
+# Option:  polltime
+# Notes.:  number of seconds fail2ban sleeps between iterations.
+# Values:  NUM  Default:  1
+#
+polltime = 1
+
+[MAIL]
+# Option:  enabled
+# Notes.:  enable mail notification when banning an IP address.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  host
+# Notes.:  host running the mail server.
+# Values:  STR  Default:  localhost
+#
+host = localhost
+
+# Option:  port
+# Notes.:  port of the mail server.
+# Values:  INT  Default:  25
+#
+port = 25
+
+# Option:  from
+# Notes.:  e-mail address of the sender.
+# Values:  MAIL  Default:  fail2ban
+#
+from = fail2ban@localhost
+
+# Option:  to
+# Notes.:  e-mail addresses of the receiver. Addresses are space
+#          separated.
+# Values:  MAIL  Default:  root
+#
+to = root@localhost
+
+# Option:  subject
+# Notes.:  subject of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+# Values:  TEXT  Default:  [Fail2Ban:<section>] Banned <ip>
+#
+subject = [Fail2Ban:<section>] Banned <ip>
+
+# Option:  message
+# Notes.:  message of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <br>  new line
+# Values:  TEXT  Default:
+#
+message = Hi,<br>
+          The IP <ip> has just been banned by Fail2Ban after
+          <failures> attempts.<br>
+          Regards,<br>
+          Fail2Ban
+
+# You can define a new section for each log file to check for
+# password failure. Each section has to define the following
+# options: logfile, fwban, fwunban, timeregex, timepattern,
+# failregex.
+
+[Apache]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/apache/access.log
+#
+logfile = /var/log/apache/access.log
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD  Default:
+#
+fwstart = iptables -N fail2ban-http
+          iptables -I INPUT -p tcp --dport http -j fail2ban-http
+          iptables -A fail2ban-http -j RETURN
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD  Default:
+#
+fwend = iptables -D INPUT -p tcp --dport http -j fail2ban-http
+        iptables -D fail2ban-http -j RETURN
+        iptables -X fail2ban-http
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+fwban = iptables -I fail2ban-http 1 -s <ip> -j DROP
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+fwunban = iptables -D fail2ban-http -s <ip> -j DROP
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in Apache logfile.
+# Values:  [Wed Jan 05 15:08:01 2005]
+# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+#
+timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
+#
+timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile.
+# Values:  TEXT  Default:  authentication failure|user .* not found
+#
+failregex = authentication failure|user .* not found
+
+[SSH]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  true
+#
+enabled = true
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/auth.log
+#
+logfile = /var/log/auth.log
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD  Default:
+#
+fwstart = iptables -N fail2ban-ssh
+          iptables -I INPUT -p tcp --dport ssh -j fail2ban-ssh
+          iptables -A fail2ban-ssh -j RETURN
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD  Default:
+#
+fwend = iptables -D INPUT -p tcp --dport ssh -j fail2ban-ssh
+        iptables -D fail2ban-ssh -j RETURN
+        iptables -X fail2ban-ssh
+
+# Option:  fwbanrule
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+fwban = iptables -I fail2ban-ssh 1 -s <ip> -j DROP
+
+# Option:  fwunbanrule
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+fwunban = iptables -D fail2ban-ssh -s <ip> -j DROP
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in SSH logfile.
+# Values:  [Mar  7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile.
+# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+#
+failregex = Authentication failure|Failed password|Invalid user|Illegal user|Failed keyboard-interactive

config/filter.d/3proxy.conf

@@ -1,20 +0,0 @@
-# Fail2Ban filter for 3proxy
-#
-#
-
-[Definition]
-
-
-failregex = ^\s[+-]\d{4} \S+ \d{3}0[1-9] \S+ <HOST>:\d+ [\d.]+:\d+ \d+ \d+ \d+\s
-
-ignoreregex = 
-
-datepattern = {^LN-BEG}
-
-# DEV Notes:
-# http://www.3proxy.ru/howtoe.asp#ERRORS indicates that 01-09 are
-# all authentication problems (%E field)
-# Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T"
-#
-# Requested by ykimon in https://github.com/fail2ban/fail2ban/issues/246
-# Author: Daniel Black