test cases extended for verifying ipv4/ipv6, normalized pf-action with test case

- new readers logic (group some by multiple parameters 'set' -> 'multi-set';
- prevent to add 'known/' parameters twice (by merge section etc);
- test cases fixed;

.coveragerc

@@ -7,6 +7,5 @@ source =
 
 [report]
 exclude_lines =
-    pragma: ?no ?cover
-    pragma: ?${F2B_PY}.x no ?cover
-    pragma: ?systemd no ?cover
+    pragma: no cover
+    pragma: systemd no cover

.gitattributes

@@ -1 +0,0 @@
-ChangeLog linguist-language=Markdown

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,49 @@
+_We will be very grateful, if your problem was described as completely as possible,
+enclosing excerpts from logs (if possible within DEBUG mode, if no errors evident
+within INFO mode), and configuration in particular of effected relevant settings
+(e.g., with ` fail2ban-client -d | grep 'affected-jail-name' ` for a particular
+jail troubleshooting).
+Thank you in advance for the details, because such issues like "It does not work" 
+alone could not help to resolve anything!
+Thanks! (remove this paragraph and other comments upon reading)_
+
+### Environment:
+
+_Fill out and check (`[x]`) the boxes which apply. If your Fail2Ban version is outdated, 
+and you can't verify that the issue persists in the recent release, better seek support 
+from the distribution you obtained Fail2Ban from_
+
+- Fail2Ban version (including any possible distribution suffixes):
+- OS, including release name/version: 
+- [ ] Fail2Ban installed via OS/distribution mechanisms
+- [ ] You have not applied any additional foreign patches to the codebase
+- [ ] Some customizations were done to the configuration (provide details below is so)
+
+### The issue:
+
+_Summary here_
+
+#### Steps to reproduce
+
+#### Expected behavior
+
+#### Observed behavior
+
+#### Any additional information
+
+### Configuration, dump and another helpful excerpts
+
+#### Any customizations done to /etc/fail2ban/ configuration
+```
+```
+
+#### Relevant parts of /var/log/fail2ban.log file:
+_preferably obtained while running fail2ban with `loglevel = 4`_
+
+```
+```
+
+#### Relevant lines from monitored log files in question:
+
+```
+```

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,70 +0,0 @@
----
-name: Bug report
-about: Report a bug within the fail2ban engines (not filters or jails)
-title: '[BR]: '
-labels: bug
-assignees: ''
-
----
-
-<!--
-  - Before reporting, please make sure to search the open and closed issues for any reports in the past.
-  - Use this issue template to report a bug in the fail2ban engine (not in a filter or jail).
-  - If you want to request a feature or a new filter, please use "Feature request" or "Filter request" instead.
-  - If you have rather some question, please open or join to some discussion.
-
-  We will be very grateful, if your problem was described as completely as possible,
-  enclosing excerpts from logs (if possible within DEBUG mode, if no errors evident
-  within INFO mode), and configuration in particular of effected relevant settings
-  (e.g., with ` fail2ban-client -d | grep 'affected-jail-name' ` for a particular
-  jail troubleshooting).
-  Thank you in advance for the details, because such issues like "It does not work" 
-  alone could not help to resolve anything!
-  Thanks! 
-  (you can remove this paragraph and other comments upon reading)
--->
-
-### Environment:
-
-<!--
-  Fill out and check (`[x]`) the boxes which apply. If your Fail2Ban version is outdated, 
-  and you can't verify that the issue persists in the recent release, better seek support 
-  from the distribution you obtained Fail2Ban from
--->
-
-- Fail2Ban version <!-- including any possible distribution suffixes --> : 
-- OS, including release name/version : 
-- [ ] Fail2Ban installed via OS/distribution mechanisms
-- [ ] You have not applied any additional foreign patches to the codebase
-- [ ] Some customizations were done to the configuration (provide details below is so)
-
-### The issue:
-
-<!-- summary here -->
-
-#### Steps to reproduce
-
-#### Expected behavior
-
-#### Observed behavior
-
-#### Any additional information
-
-
-### Configuration, dump and another helpful excerpts
-
-#### Any customizations done to /etc/fail2ban/ configuration
-<!-- put your configuration excerpts between next 2 lines -->
-```
-```
-
-#### Relevant parts of /var/log/fail2ban.log file:
-<!-- preferably obtained while running fail2ban with `loglevel = 4` -->
-<!-- put your log excerpt between next 2 lines -->
-```
-```
-
-#### Relevant lines from monitored log files:
-<!-- put your log excerpt between next 2 lines -->
-```
-```

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,35 +0,0 @@
----
-name: Feature request
-about: Suggest an idea or an enhancement for this project
-title: '[RFE]: '
-labels: enhancement
-assignees: ''
-
----
-
-<!--
-  - Before requesting, please make sure to search the open and closed issues for any requests in the past.
-  - Use this issue template to request a feature in the fail2ban engine (not a new filter or jail).
-  - If you want to request a new filter or failregex, please use "Filter request" instead.
-  - If you have rather some question, please open or join to some discussion.
--->
-
-#### Feature request type
-<!--
-  Please provide a summary description of the feature request.
--->
-
-#### Description
-<!--
-  Please describe the feature in more detail.
--->
-
-#### Considered alternatives
-<!--
-  A clear and concise description of any alternative solutions or features you've considered.
--->
-
-#### Any additional information
-<!--
-  Add any other context or screenshots about the feature request here.
--->

.github/ISSUE_TEMPLATE/filter_request.md

@@ -1,59 +0,0 @@
----
-name: Filter request
-about: Request a new jail or filter to be supported or existing filter extended with new failregex
-title: '[FR]: '
-labels: filter-request
-assignees: ''
-
----
-
-<!--
-  - Before requesting, please make sure to search the open and closed issues for any requests in the past.
-  - Sometimes failregex have been already requested before but are not implemented yet due to various reasons.
-  - If there are no hits for your concerns, please proceed otherwise add a comment to the related issue (also if it is closed).
-  - If you want to request a new feature, please use "Feature request" instead.
-  - If you have rather some question, please open or join to some discussion.
--->
-
-### Environment:
-
-<!--
-  Fill out and check (`[x]`) the boxes which apply.
--->
-
-- Fail2Ban version <!-- including any possible distribution suffixes --> : 
-- OS, including release name/version : 
-
-#### Service, project or product which log or journal should be monitored
-
-- Name of filter or jail in Fail2Ban (if already exists) : 
-- Service, project or product name, including release name/version : 
-- Repository or URL (if known) : 
-- Service type : 
-- Ports and protocols the service is listening : 
-
-#### Log or journal information
-<!-- Delete unrelated group -->
-
-<!-- Log file -->
-
-- Log file name(s) : 
-
-<!-- Systemd journal -->
-
-- Journal identifier or unit name : 
-
-#### Any additional information
-
-
-### Relevant lines from monitored log files:
-
-#### failures in sense of fail2ban filter (fail2ban must match):
-<!-- put your log excerpt between next 2 lines -->
-```
-```
-
-#### legitimate messages (fail2ban should not consider as failures):
-<!-- put your log excerpt between next 2 lines -->
-```
-```

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,12 +1,9 @@
 Before submitting your PR, please review the following checklist:
 
-- [ ] **CHOOSE CORRECT BRANCH**: if filing a bugfix/enhancement
-      against certain release version, choose `0.9`, `0.10` or `0.11` branch,
-      for dev-edition use `master` branch
 - [ ] **CONSIDER adding a unit test** if your PR resolves an issue
 - [ ] **LIST ISSUES** this PR resolves
-- [ ] **MAKE SURE** this PR doesn't break existing tests
+- [ ] **MAKE SURE** this PR doesn't break existing tests 
 - [ ] **KEEP PR small** so it could be easily reviewed.
 - [ ] **AVOID** making unnecessary stylistic changes in unrelated code
-- [ ] **ACCOMPANY** each new `failregex` for filter `X` with sample log lines
-      within `fail2ban/tests/files/logs/X` file
+- [ ] **ACCOMPANY** each new `failregex` for filter `X` with sample log lines 
+      within `fail2ban/tests/files/logs/X` file

.github/workflows/main.yml

@@ -1,98 +0,0 @@
-name: CI
-
-# Controls when the action will run. Triggers the workflow on push or pull request
-# events but only for the master branch
-on:
-  push:
-    paths-ignore:
-    - 'doc/**'
-    - 'files/**'
-    - 'man/**'
-  pull_request:
-    paths-ignore:
-    - 'doc/**'
-    - 'files/**'
-    - 'man/**'
-
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
-jobs:
-  # This workflow contains a single job called "build"
-  build:
-    # The type of runner that the job will run on
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        python-version: [2.7, 3.5, 3.6, 3.7, 3.8, 3.9, '3.10', '3.11.0-alpha.1', pypy2, pypy3]
-      fail-fast: false
-    # Steps represent a sequence of tasks that will be executed as part of the job
-    steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
-
-      - name: Set up Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      - name: Grant systemd-journal access
-        run: sudo usermod -a -G systemd-journal "$USER" || echo 'no systemd-journal access'
-
-      - name: Python version
-        run: |
-          F2B_PY=$(python -c "import sys; print(sys.version)")
-          echo "Python: ${{ matrix.python-version }} -- ${F2B_PY/$'\n'/ }"
-          F2B_PYV=$(echo "${F2B_PY}" | grep -oP '^\d+(?:\.\d+)')
-          F2B_PY=${F2B_PY:0:1}
-          echo "Set F2B_PY=$F2B_PY, F2B_PYV=$F2B_PYV"
-          echo "F2B_PY=$F2B_PY" >> $GITHUB_ENV
-          echo "F2B_PYV=$F2B_PYV" >> $GITHUB_ENV
-          # for GHA we need to monitor all journals, since it cannot be found using SYSTEM_ONLY(4):
-          echo "F2B_SYSTEMD_DEFAULT_FLAGS=0" >> $GITHUB_ENV
-
-      - name: Install dependencies
-        run: |
-          if [[ "$F2B_PY" = 3 ]]; then python -m pip install --upgrade pip || echo "can't upgrade pip"; fi
-          if [[ "$F2B_PY" = 3 ]] && ! command -v 2to3x -v 2to3 > /dev/null; then
-            #pip install 2to3
-            sudo apt-get -y install 2to3
-          fi
-          #sudo apt-get -y install python${F2B_PY/2/}-pyinotify || echo 'inotify not available'
-          python -m pip install pyinotify || echo 'inotify not available'
-          #sudo apt-get -y install python${F2B_PY/2/}-systemd || echo 'systemd not available'
-          sudo apt-get -y install libsystemd-dev || echo 'systemd dependencies seems to be unavailable'
-          python -m pip install systemd-python || echo 'systemd not available'
-
-      - name: Before scripts
-        run: |
-          cd "$GITHUB_WORKSPACE"
-          # Manually execute 2to3 for now
-          if [[ "$F2B_PY" = 3 ]]; then echo "2to3 ..." && ./fail2ban-2to3; fi
-          _debug() { echo -n "$1 "; err=$("${@:2}" 2>&1) && echo 'OK' || echo -e "FAIL\n$err"; }
-          # (debug) output current preferred encoding:
-          _debug 'Encodings:' python -c 'import locale, sys; from fail2ban.helpers import PREFER_ENC; print(PREFER_ENC, locale.getpreferredencoding(), (sys.stdout and sys.stdout.encoding))'
-          # (debug) backend availabilities:
-          echo 'Backends:'
-          _debug '- systemd:' python -c 'from fail2ban.server.filtersystemd import FilterSystemd'
-          #_debug '- systemd (root): ' sudo python -c 'from fail2ban.server.filtersystemd import FilterSystemd'
-          _debug '- pyinotify:' python -c 'from fail2ban.server.filterpyinotify import FilterPyinotify'
-
-      - name: Test suite
-        run: |
-          if [[ "$F2B_PY" = 2 ]]; then
-            python setup.py test
-          elif dpkg --compare-versions "$F2B_PYV" lt 3.10; then 
-            python bin/fail2ban-testcases --verbosity=2
-          else
-            echo "Skip systemd backend since systemd-python module must be fixed for python >= v.3.10 in GHA ..."
-            python bin/fail2ban-testcases --verbosity=2 -i "[sS]ystemd|[jJ]ournal"
-          fi
-
-      #- name: Test suite (debug some systemd tests only)
-         #run: python bin/fail2ban-testcases --verbosity=2 "[sS]ystemd|[jJ]ournal"
-         #run: python bin/fail2ban-testcases --verbosity=2 -l 5 "test_WrongChar"
-
-      - name: Build
-        run: python setup.py build
-
-      #- name: Test initd scripts
-      #  run: shellcheck -s bash -e SC1090,SC1091 files/debian-initd

.travis.yml

@@ -1,29 +1,19 @@
 # vim ft=yaml
 # travis-ci.org definition for Fail2Ban build
 # https://travis-ci.org/fail2ban/fail2ban/
-
-#os: linux
-
 language: python
-dist: xenial
-
-matrix:
-  fast_finish: true
-  include:
-  - python: 2.7
-  #- python: pypy
-  - python:  3.4
-  - python:  3.5
-  - python:  3.6
-  - python:  3.7
-  - python:  3.8
-  - python:  3.9-dev
-  - python:  pypy3.5
+python:
+  - 2.6
+  - 2.7
+  - pypy
+  # disabled until coverage module fixes up compatibility issue
+  # - 3.2
+  - 3.3
+  - 3.4
+  - pypy3
 before_install:
-  - echo "running under $TRAVIS_PYTHON_VERSION"
-  - if [[ $TRAVIS_PYTHON_VERSION == 2* || $TRAVIS_PYTHON_VERSION == pypy* && $TRAVIS_PYTHON_VERSION != pypy3* ]]; then export F2B_PY=2; fi
-  - if [[ $TRAVIS_PYTHON_VERSION == 3* || $TRAVIS_PYTHON_VERSION == pypy3* ]]; then export F2B_PY=3; fi
-  - echo "Set F2B_PY=$F2B_PY"
+  - if [[ $TRAVIS_PYTHON_VERSION == 2* || $TRAVIS_PYTHON_VERSION == 'pypy' ]]; then export F2B_PY_2=true && echo "Set F2B_PY_2"; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 3* || $TRAVIS_PYTHON_VERSION == 'pypy3' ]]; then export F2B_PY_3=true && echo "Set F2B_PY_3"; fi
   - travis_retry sudo apt-get update -qq
   # Set this so sudo executes the correct python binary
   #   Anything not using sudo will already have the correct environment
@@ -32,43 +22,30 @@ install:
   # Install Python packages / dependencies
   #   coverage
   - travis_retry pip install coverage
-  #   coveralls (note coveralls doesn't support 2.6 now):
-  - if [[ $TRAVIS_PYTHON_VERSION != 2.6* ]]; then F2B_COV=1; else F2B_COV=0; fi
-  - if [[ "$F2B_COV" = 1 ]]; then travis_retry pip install coveralls; fi
-  #   codecov:
-  - travis_retry pip install codecov
+  #   coveralls
+  - travis_retry pip install coveralls codecov
   #   dnspython or dnspython3
-  - if [[ "$F2B_PY" = 2 ]]; then travis_retry pip install dnspython || echo 'not installed'; fi
-  - if [[ "$F2B_PY" = 3 ]]; then travis_retry pip install dnspython3 || echo 'not installed'; fi
-  #   python systemd bindings:
-  - if [[ "$F2B_PY" = 2 ]]; then travis_retry sudo apt-get install -qq python-systemd || echo 'not installed'; fi
-  - if [[ "$F2B_PY" = 3 ]]; then travis_retry sudo apt-get install -qq python3-systemd || echo 'not installed'; fi
+  - if [[ "$F2B_PY_2" ]]; then travis_retry pip install dnspython; fi
+  - if [[ "$F2B_PY_3" ]]; then travis_retry pip install dnspython3; fi
   #   gamin - install manually (not in PyPI) - travis-ci system Python is 2.7
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then (travis_retry sudo apt-get install -qq python-gamin && cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/) || echo 'not installed'; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then travis_retry sudo apt-get install -qq python-gamin && cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/; fi
   #   pyinotify
-  - travis_retry pip install pyinotify || echo 'not installed'
-  # Install helper tools
-  - sudo apt-get install shellcheck
+  - travis_retry pip install pyinotify
 before_script:
   # Manually execute 2to3 for now
-  - if [[ "$F2B_PY" = 3 ]]; then ./fail2ban-2to3; fi
-  # (debug) output current preferred encoding:
-  - python -c 'import locale, sys; from fail2ban.helpers import PREFER_ENC; print(PREFER_ENC, locale.getpreferredencoding(), (sys.stdout and sys.stdout.encoding))'
+  - if [[ "$F2B_PY_3" ]]; then ./fail2ban-2to3; fi
 script:
   # Keep the legacy setup.py test approach of checking coverage for python2
-  - if [[ "$F2B_PY" = 2 ]]; then coverage run setup.py test; fi
-  # Coverage doesn't pick up setup.py test with python3, so run it directly (with same verbosity as from setup)
-  - if [[ "$F2B_PY" = 3 ]]; then coverage run bin/fail2ban-testcases --verbosity=2; fi
+  - if [[ "$F2B_PY_2" ]]; then coverage run setup.py test; fi
+  # Coverage doesn't pick up setup.py test with python3, so run it directly
+  - if [[ "$F2B_PY_3" ]]; then coverage run bin/fail2ban-testcases; fi
   # Use $VENV_BIN (not python) or else sudo will always run the system's python (2.7)
   - sudo $VENV_BIN/pip install .
-  # Doc files should get installed on Travis under Linux (some builds/python's seem to use another path segment)
-  - test -e /usr/share/doc/fail2ban/FILTERS && echo 'found' || echo 'not found'
-  # Test initd script
-  - shellcheck -s bash -e SC1090,SC1091 files/debian-initd
 after_success:
-  - if [[ "$F2B_COV" = 1 ]]; then coveralls; fi
+  - coveralls
   - codecov
-
+matrix:
+  fast_finish: true
 # Might be worth looking into
 #notifications:
 #  email: true

DEVELOP

@@ -262,16 +262,12 @@ FileContainer
     Keeps the position pointer
 
 
-ipdns.py
-~~~~~~~~
+dnsutils.py
+~~~~~~~~~~~
 
 DNSUtils
 
-  Utility class for DNS handling
-
-IPAddr
-
-  Object-class for IP address handling
+  Utility class for DNS and IP handling
 
 
 filter*.py

Dockerfile

@@ -1,7 +0,0 @@
-FROM python:3.10-slim
-
-WORKDIR /root
-COPY setup.py fail2ban config bin ./
-RUN python setup.py install
-
-ENTRYPOINT ["/bin/fail2ban-server"]

FILTERS

@@ -227,7 +227,7 @@ Regular expressions (failregex, ignoreregex) assume that the date/time has been
 removed from the log line (this is just how fail2ban works internally ATM).
 
 If the format is like '<date...> error 1.2.3.4 is evil' then you need to match
-the <> at the start so regex should be similar to '^<> error <HOST> is evil$' using
+the < at the start so regex should be similar to '^<> <HOST> is evil$' using
 <HOST> where the IP/domain name appears in the log line.
 
 The following general rules apply to regular expressions:
@@ -278,7 +278,6 @@ to tune it.  fail2ban-regex -D ...  will present Debuggex URLs for the regexs
 and sample log files that you pass into it.
 
 In general use when using regex debuggers for generating fail2ban filters:
-
 * use regex from the ./fail2ban-regex output (to ensure all substitutions are
 done)
 * replace <HOST> with (?&.ipv4)

MANIFEST

@@ -3,9 +3,9 @@ bin/fail2ban-regex
 bin/fail2ban-server
 bin/fail2ban-testcases
 ChangeLog
-config/action.d/apprise.conf
-config/action.d/abuseipdb.conf
 config/action.d/apf.conf
+config/action.d/badips.conf
+config/action.d/badips.py
 config/action.d/blocklist_de.conf
 config/action.d/bsd-ipfw.conf
 config/action.d/cloudflare.conf
@@ -13,13 +13,9 @@ config/action.d/complain.conf
 config/action.d/dshield.conf
 config/action.d/dummy.conf
 config/action.d/firewallcmd-allports.conf
-config/action.d/firewallcmd-common.conf
 config/action.d/firewallcmd-ipset.conf
 config/action.d/firewallcmd-multiport.conf
 config/action.d/firewallcmd-new.conf
-config/action.d/firewallcmd-rich-logging.conf
-config/action.d/firewallcmd-rich-rules.conf
-config/action.d/helpers-common.conf
 config/action.d/hostsdeny.conf
 config/action.d/ipfilter.conf
 config/action.d/ipfw.conf
@@ -35,16 +31,12 @@ config/action.d/iptables-new.conf
 config/action.d/iptables-xt_recent-echo.conf
 config/action.d/mail-buffered.conf
 config/action.d/mail.conf
-config/action.d/mail-whois-common.conf
 config/action.d/mail-whois.conf
 config/action.d/mail-whois-lines.conf
 config/action.d/mynetwatchman.conf
-config/action.d/netscaler.conf
 config/action.d/nftables-allports.conf
-config/action.d/nftables.conf
+config/action.d/nftables-common.conf
 config/action.d/nftables-multiport.conf
-config/action.d/nginx-block-map.conf
-config/action.d/npf.conf
 config/action.d/nsupdate.conf
 config/action.d/osx-afctl.conf
 config/action.d/osx-ipfw.conf
@@ -60,7 +52,6 @@ config/action.d/sendmail-whois-ipmatches.conf
 config/action.d/sendmail-whois-lines.conf
 config/action.d/sendmail-whois-matches.conf
 config/action.d/shorewall.conf
-config/action.d/shorewall-ipset-proto6.conf
 config/action.d/smtp.py
 config/action.d/symbiosis-blacklist-allports.conf
 config/action.d/ufw.conf
@@ -76,40 +67,32 @@ config/filter.d/apache-modsecurity.conf
 config/filter.d/apache-nohome.conf
 config/filter.d/apache-noscript.conf
 config/filter.d/apache-overflows.conf
-config/filter.d/apache-pass.conf
 config/filter.d/apache-shellshock.conf
 config/filter.d/assp.conf
 config/filter.d/asterisk.conf
-config/filter.d/bitwarden.conf
 config/filter.d/botsearch-common.conf
-config/filter.d/centreon.conf
 config/filter.d/common.conf
 config/filter.d/counter-strike.conf
 config/filter.d/courier-auth.conf
 config/filter.d/courier-smtp.conf
 config/filter.d/cyrus-imap.conf
 config/filter.d/directadmin.conf
-config/filter.d/domino-smtp.conf
 config/filter.d/dovecot.conf
 config/filter.d/dropbear.conf
-config/filter.d/drupal-auth.conf
 config/filter.d/ejabberd-auth.conf
 config/filter.d/exim-common.conf
 config/filter.d/exim.conf
 config/filter.d/exim-spam.conf
 config/filter.d/freeswitch.conf
-config/filter.d/froxlor-auth.conf
-config/filter.d/gitlab.conf
-config/filter.d/grafana.conf
 config/filter.d/groupoffice.conf
 config/filter.d/gssftpd.conf
 config/filter.d/guacamole.conf
 config/filter.d/haproxy-http-auth.conf
 config/filter.d/horde.conf
+config/filter.d/ignorecommands
 config/filter.d/ignorecommands/apache-fakegooglebot
 config/filter.d/kerio.conf
 config/filter.d/lighttpd-auth.conf
-config/filter.d/mongodb-auth.conf
 config/filter.d/monit.conf
 config/filter.d/murmur.conf
 config/filter.d/mysqld-auth.conf
@@ -124,10 +107,11 @@ config/filter.d/openwebmail.conf
 config/filter.d/oracleims.conf
 config/filter.d/pam-generic.conf
 config/filter.d/perdition.conf
-config/filter.d/phpmyadmin-syslog.conf
 config/filter.d/php-url-fopen.conf
 config/filter.d/portsentry.conf
 config/filter.d/postfix.conf
+config/filter.d/postfix-rbl.conf
+config/filter.d/postfix-sasl.conf
 config/filter.d/proftpd.conf
 config/filter.d/pure-ftpd.conf
 config/filter.d/qmail.conf
@@ -138,27 +122,23 @@ config/filter.d/selinux-common.conf
 config/filter.d/selinux-ssh.conf
 config/filter.d/sendmail-auth.conf
 config/filter.d/sendmail-reject.conf
+config/filter.d/sendmail-spam.conf
 config/filter.d/sieve.conf
-config/filter.d/slapd.conf
-config/filter.d/softethervpn.conf
 config/filter.d/sogo-auth.conf
 config/filter.d/solid-pop3d.conf
 config/filter.d/squid.conf
 config/filter.d/squirrelmail.conf
 config/filter.d/sshd.conf
+config/filter.d/sshd-ddos.conf
 config/filter.d/stunnel.conf
 config/filter.d/suhosin.conf
 config/filter.d/tine20.conf
-config/filter.d/traefik-auth.conf
 config/filter.d/uwimap-auth.conf
 config/filter.d/vsftpd.conf
 config/filter.d/webmin-auth.conf
 config/filter.d/wuftpd.conf
 config/filter.d/xinetd-fail.conf
-config/filter.d/znc-adminlog.conf
-config/filter.d/zoneminder.conf
 config/jail.conf
-config/paths-arch.conf
 config/paths-common.conf
 config/paths-debian.conf
 config/paths-fedora.conf
@@ -167,8 +147,8 @@ config/paths-opensuse.conf
 config/paths-osx.conf
 CONTRIBUTING.md
 COPYING
-.coveragerc
 DEVELOP
+doc/run-rootless.txt
 fail2ban-2to3
 fail2ban/client/actionreader.py
 fail2ban/client/beautifier.py
@@ -176,16 +156,14 @@ fail2ban/client/configparserinc.py
 fail2ban/client/configreader.py
 fail2ban/client/configurator.py
 fail2ban/client/csocket.py
-fail2ban/client/fail2banclient.py
-fail2ban/client/fail2bancmdline.py
 fail2ban/client/fail2banreader.py
 fail2ban/client/fail2banregex.py
-fail2ban/client/fail2banserver.py
 fail2ban/client/filterreader.py
 fail2ban/client/__init__.py
 fail2ban/client/jailreader.py
 fail2ban/client/jailsreader.py
 fail2ban/exceptions.py
+fail2ban/ipaddr.py
 fail2ban/helpers.py
 fail2ban/__init__.py
 fail2ban/protocol.py
@@ -196,6 +174,7 @@ fail2ban/server/banmanager.py
 fail2ban/server/database.py
 fail2ban/server/datedetector.py
 fail2ban/server/datetemplate.py
+fail2ban/server/faildata.py
 fail2ban/server/failmanager.py
 fail2ban/server/failregex.py
 fail2ban/server/filtergamin.py
@@ -204,42 +183,38 @@ fail2ban/server/filter.py
 fail2ban/server/filterpyinotify.py
 fail2ban/server/filtersystemd.py
 fail2ban/server/__init__.py
-fail2ban/server/ipdns.py
+fail2ban/server/iso8601.py
 fail2ban/server/jail.py
 fail2ban/server/jails.py
 fail2ban/server/jailthread.py
 fail2ban/server/mytime.py
-fail2ban/server/observer.py
 fail2ban/server/server.py
 fail2ban/server/strptime.py
 fail2ban/server/ticket.py
 fail2ban/server/transmitter.py
-fail2ban/server/utils.py
-fail2ban/setup.py
 fail2ban-testcases-all
 fail2ban-testcases-all-python3
 fail2ban/tests/action_d/__init__.py
+fail2ban/tests/action_d/test_badips.py
 fail2ban/tests/action_d/test_smtp.py
 fail2ban/tests/actionstestcase.py
 fail2ban/tests/actiontestcase.py
 fail2ban/tests/banmanagertestcase.py
-fail2ban/tests/clientbeautifiertestcase.py
 fail2ban/tests/clientreadertestcase.py
-fail2ban/tests/config/action.d/action.conf
+fail2ban/tests/clientbeautifiertestcase.py
 fail2ban/tests/config/action.d/brokenaction.conf
 fail2ban/tests/config/fail2ban.conf
-fail2ban/tests/config/filter.d/checklogtype.conf
-fail2ban/tests/config/filter.d/checklogtype_test.conf
 fail2ban/tests/config/filter.d/simple.conf
 fail2ban/tests/config/filter.d/test.conf
 fail2ban/tests/config/filter.d/test.local
-fail2ban/tests/config/filter.d/zzz-generic-example.conf
-fail2ban/tests/config/filter.d/zzz-sshd-obsolete-multiline.conf
 fail2ban/tests/config/jail.conf
+fail2ban/tests/config/paths-common.conf
+fail2ban/tests/config/paths-debian.conf
+fail2ban/tests/config/paths-freebsd.conf
+fail2ban/tests/config/paths-osx.conf
 fail2ban/tests/databasetestcase.py
 fail2ban/tests/datedetectortestcase.py
 fail2ban/tests/dummyjail.py
-fail2ban/tests/fail2banclienttestcase.py
 fail2ban/tests/fail2banregextestcase.py
 fail2ban/tests/failmanagertestcase.py
 fail2ban/tests/files/action.d/action_checkainfo.py
@@ -265,47 +240,37 @@ fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd
 fail2ban/tests/files/config/apache-auth/noentry/.htaccess
 fail2ban/tests/files/config/apache-auth/README
 fail2ban/tests/files/database_v1.db
-fail2ban/tests/files/database_v2.db
 fail2ban/tests/files/filter.d/substition.conf
 fail2ban/tests/files/filter.d/testcase01.conf
-fail2ban/tests/files/filter.d/testcase02.conf
-fail2ban/tests/files/filter.d/testcase02.local
 fail2ban/tests/files/filter.d/testcase-common.conf
 fail2ban/tests/files/ignorecommand.py
 fail2ban/tests/files/logs/3proxy
 fail2ban/tests/files/logs/apache-auth
 fail2ban/tests/files/logs/apache-badbots
+fail2ban/tests/files/logs/apache-botscripts
 fail2ban/tests/files/logs/apache-botsearch
 fail2ban/tests/files/logs/apache-fakegooglebot
 fail2ban/tests/files/logs/apache-modsecurity
 fail2ban/tests/files/logs/apache-nohome
 fail2ban/tests/files/logs/apache-noscript
 fail2ban/tests/files/logs/apache-overflows
-fail2ban/tests/files/logs/apache-pass
 fail2ban/tests/files/logs/apache-shellshock
 fail2ban/tests/files/logs/assp
 fail2ban/tests/files/logs/asterisk
-fail2ban/tests/files/logs/bitwarden
 fail2ban/tests/files/logs/bsd/syslog-plain.txt
 fail2ban/tests/files/logs/bsd/syslog-v.txt
 fail2ban/tests/files/logs/bsd/syslog-vv.txt
-fail2ban/tests/files/logs/centreon
 fail2ban/tests/files/logs/counter-strike
 fail2ban/tests/files/logs/courier-auth
 fail2ban/tests/files/logs/courier-smtp
 fail2ban/tests/files/logs/cyrus-imap
 fail2ban/tests/files/logs/directadmin
-fail2ban/tests/files/logs/domino-smtp
 fail2ban/tests/files/logs/dovecot
 fail2ban/tests/files/logs/dropbear
-fail2ban/tests/files/logs/drupal-auth
 fail2ban/tests/files/logs/ejabberd-auth
 fail2ban/tests/files/logs/exim
 fail2ban/tests/files/logs/exim-spam
 fail2ban/tests/files/logs/freeswitch
-fail2ban/tests/files/logs/froxlor-auth
-fail2ban/tests/files/logs/gitlab
-fail2ban/tests/files/logs/grafana
 fail2ban/tests/files/logs/groupoffice
 fail2ban/tests/files/logs/gssftpd
 fail2ban/tests/files/logs/guacamole
@@ -313,7 +278,6 @@ fail2ban/tests/files/logs/haproxy-http-auth
 fail2ban/tests/files/logs/horde
 fail2ban/tests/files/logs/kerio
 fail2ban/tests/files/logs/lighttpd-auth
-fail2ban/tests/files/logs/mongodb-auth
 fail2ban/tests/files/logs/monit
 fail2ban/tests/files/logs/murmur
 fail2ban/tests/files/logs/mysqld-auth
@@ -328,10 +292,11 @@ fail2ban/tests/files/logs/openwebmail
 fail2ban/tests/files/logs/oracleims
 fail2ban/tests/files/logs/pam-generic
 fail2ban/tests/files/logs/perdition
-fail2ban/tests/files/logs/phpmyadmin-syslog
 fail2ban/tests/files/logs/php-url-fopen
 fail2ban/tests/files/logs/portsentry
 fail2ban/tests/files/logs/postfix
+fail2ban/tests/files/logs/postfix-rbl
+fail2ban/tests/files/logs/postfix-sasl
 fail2ban/tests/files/logs/proftpd
 fail2ban/tests/files/logs/pure-ftpd
 fail2ban/tests/files/logs/qmail
@@ -341,29 +306,22 @@ fail2ban/tests/files/logs/screensharingd
 fail2ban/tests/files/logs/selinux-ssh
 fail2ban/tests/files/logs/sendmail-auth
 fail2ban/tests/files/logs/sendmail-reject
+fail2ban/tests/files/logs/sendmail-spam
 fail2ban/tests/files/logs/sieve
-fail2ban/tests/files/logs/slapd
-fail2ban/tests/files/logs/softethervpn
 fail2ban/tests/files/logs/sogo-auth
 fail2ban/tests/files/logs/solid-pop3d
 fail2ban/tests/files/logs/squid
 fail2ban/tests/files/logs/squirrelmail
 fail2ban/tests/files/logs/sshd
-fail2ban/tests/files/logs/sshd-journal
+fail2ban/tests/files/logs/sshd-ddos
 fail2ban/tests/files/logs/stunnel
 fail2ban/tests/files/logs/suhosin
 fail2ban/tests/files/logs/tine20
-fail2ban/tests/files/logs/traefik-auth
 fail2ban/tests/files/logs/uwimap-auth
 fail2ban/tests/files/logs/vsftpd
 fail2ban/tests/files/logs/webmin-auth
 fail2ban/tests/files/logs/wuftpd
 fail2ban/tests/files/logs/xinetd-fail
-fail2ban/tests/files/logs/znc-adminlog
-fail2ban/tests/files/logs/zoneminder
-fail2ban/tests/files/logs/zzz-generic-example
-fail2ban/tests/files/logs/zzz-sshd-obsolete-multiline
-fail2ban/tests/files/testcase01a.log
 fail2ban/tests/files/testcase01.log
 fail2ban/tests/files/testcase02.log
 fail2ban/tests/files/testcase03.log
@@ -372,15 +330,12 @@ fail2ban/tests/files/testcase-journal.log
 fail2ban/tests/files/testcase-multiline.log
 fail2ban/tests/files/testcase-usedns.log
 fail2ban/tests/files/testcase-wrong-char.log
-fail2ban/tests/files/zzz-sshd-obsolete-multiline.log
 fail2ban/tests/filtertestcase.py
 fail2ban/tests/__init__.py
 fail2ban/tests/misctestcase.py
-fail2ban/tests/observertestcase.py
 fail2ban/tests/samplestestcase.py
 fail2ban/tests/servertestcase.py
 fail2ban/tests/sockettestcase.py
-fail2ban/tests/tickettestcase.py
 fail2ban/tests/utils.py
 fail2ban/version.py
 files/bash-completion
@@ -389,7 +344,7 @@ files/cacti/fail2ban_stats.sh
 files/cacti/README
 files/debian-initd
 files/fail2ban-logrotate
-files/fail2ban.service.in
+files/fail2ban.service
 files/fail2ban-tmpfiles.conf
 files/fail2ban.upstart
 files/gen_badbots
@@ -397,8 +352,6 @@ files/gentoo-confd
 files/gentoo-initd
 files/ipmasq-ZZZzzz_fail2ban.rul
 files/logwatch/fail2ban
-files/logwatch/fail2ban-0.8.log
-files/logwatch/fail2ban-0.9.log
 files/macosx-initd
 files/monit/fail2ban
 files/nagios/check_fail2ban
@@ -412,17 +365,12 @@ kill-server
 man/fail2ban.1
 man/fail2ban-client.1
 man/fail2ban-client.h2m
-man/fail2ban-python.1
-man/fail2ban-python.h2m
 man/fail2ban-regex.1
 man/fail2ban-regex.h2m
 man/fail2ban-server.1
 man/fail2ban-server.h2m
-man/fail2ban-testcases.1
-man/fail2ban-testcases.h2m
 man/generate-man
 man/jail.conf.5
-.pylintrc
 README.md
 README.Solaris
 RELEASE

Makefile

@@ -1,5 +0,0 @@
-setup:
-	docker-compose -f docker-compose.yml up --build -d
-clean:
-	docker-compose down
-	docker image rm fail2ban

README.md

@@ -2,63 +2,49 @@
                         / _|__ _(_) |_  ) |__  __ _ _ _  
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
-                       v1.0.1.dev1            20??/??/??
+                       v0.9.4.dev0             2016/??/??
 
 ## Fail2Ban: ban hosts that cause multiple authentication errors
 
-Fail2Ban scans log files like `/var/log/auth.log` and bans IP addresses conducting
+Fail2Ban scans log files like `/var/log/auth.log` and bans IP addresses having
 too many failed login attempts. It does this by updating system firewall rules
 to reject new connections from those IP addresses, for a configurable amount
 of time. Fail2Ban comes out-of-the-box ready to read many standard log files,
-such as those for sshd and Apache, and is easily configured to read any log
-file of your choosing, for any error you wish.
+such as those for sshd and Apache, and is easy to configure to read any log
+file you choose, for any error you choose.
 
-Though Fail2Ban is able to reduce the rate of incorrect authentication
-attempts, it cannot eliminate the risk presented by weak authentication.
-Set up services to use only two factor, or public/private authentication
+Though Fail2Ban is able to reduce the rate of incorrect authentications
+attempts, it cannot eliminate the risk that weak authentication presents.
+Configure services to use only two factor or public/private authentication
 mechanisms if you really want to protect services.
-     
-<img src="http://www.worldipv6launch.org/wp-content/themes/ipv6/downloads/World_IPv6_launch_logo.svg" height="52pt"/> | Since v0.10 fail2ban supports the matching of IPv6 addresses.
-------|------
 
-This README is a quick introduction to Fail2Ban. More documentation, FAQ, and HOWTOs
-to be found on fail2ban(1) manpage, [Wiki](https://github.com/fail2ban/fail2ban/wiki),
-[Developers documentation](https://fail2ban.readthedocs.io/)
-and the website: https://www.fail2ban.org
+This README is a quick introduction to Fail2ban. More documentation, FAQ, HOWTOs
+are available in fail2ban(1) manpage and on the website http://www.fail2ban.org
 
 Installation:
 -------------
 
-**It is possible that Fail2Ban is already packaged for your distribution.  In
-this case, you should use that instead.**
+**It is possible that Fail2ban is already packaged for your distribution.  In
+this case, you should use it instead.**
 
 Required:
-- [Python2 >= 2.6 or Python >= 3.2](https://www.python.org) or [PyPy](https://pypy.org)
-- python-setuptools, python-distutils or python3-setuptools for installation from source
+- [Python2 >= 2.6 or Python >= 3.2](http://www.python.org) or [PyPy](http://pypy.org)
 
 Optional:
-- [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify), may require:
-  * Linux >= 2.6.13
+- [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify)
+  - Linux >= 2.6.13
 - [gamin >= 0.0.21](http://www.gnome.org/~veillard/gamin)
-- [systemd >= 204](http://www.freedesktop.org/wiki/Software/systemd) and python bindings:
-  * [python-systemd package](https://www.freedesktop.org/software/systemd/python-systemd/index.html)
+- [systemd >= 204](http://www.freedesktop.org/wiki/Software/systemd)
 - [dnspython](http://www.dnspython.org/)
 
+To install, just do:
 
-To install:
+    tar xvfj fail2ban-0.9.4.tar.bz2
+    cd fail2ban-0.9.4
+    python setup.py install
 
-    tar xvfj fail2ban-1.0.1.tar.bz2
-    cd fail2ban-1.0.1
-    sudo python setup.py install
-   
-Alternatively, you can clone the source from GitHub to a directory of Your choice, and do the install from there. Pick the correct branch, for example, master or 0.11
-
-    git clone https://github.com/fail2ban/fail2ban.git
-    cd fail2ban
-    sudo python setup.py install 
-    
 This will install Fail2Ban into the python library directory. The executable
-scripts are placed into `/usr/bin`, and configuration in `/etc/fail2ban`.
+scripts are placed into `/usr/bin`, and configuration under `/etc/fail2ban`.
 
 Fail2Ban should be correctly installed now. Just type:
 
@@ -66,9 +52,6 @@ Fail2Ban should be correctly installed now. Just type:
 
 to see if everything is alright. You should always use fail2ban-client and
 never call fail2ban-server directly.
-You can verify that you have the correct version installed with 
-
-    fail2ban-client version
 
 Please note that the system init/service script is not automatically installed.
 To enable fail2ban as an automatic service, simply copy the script for your
@@ -90,11 +73,11 @@ fail2ban(1) and jail.conf(5)  manpages for further references.
 Code status:
 ------------
 
-* travis-ci.org: [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=master)](https://travis-ci.org/fail2ban/fail2ban?branch=master) / [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=0.11)](https://travis-ci.org/fail2ban/fail2ban?branch=0.11) (0.11 branch) / [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=0.10)](https://travis-ci.org/fail2ban/fail2ban?branch=0.10) (0.10 branch) 
+* [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.png?branch=master)](https://travis-ci.org/fail2ban/fail2ban) travis-ci.org (master branch)
 
-* coveralls.io: [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=master)](https://coveralls.io/github/fail2ban/fail2ban?branch=master) / [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=0.11)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.11) (0.11 branch) / [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=0.10)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.10) / (0.10 branch)
+* [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.png?branch=master)](https://coveralls.io/r/fail2ban/fail2ban)
 
-* codecov.io: [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=master)](https://codecov.io/gh/fail2ban/fail2ban/branch/master) / [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.11)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.11) (0.11 branch) / [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.10)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.10) (0.10 branch)
+* [![codecov.io](https://codecov.io/github/fail2ban/fail2ban/coverage.svg?branch=master)](https://codecov.io/github/fail2ban/fail2ban?branch=master)
 
 Contact:
 --------
@@ -103,7 +86,7 @@ Contact:
 See [CONTRIBUTING.md](https://github.com/fail2ban/fail2ban/blob/master/CONTRIBUTING.md)
 
 ### You just appreciate this program:
-Send kudos to the original author ([Cyril Jaquier](mailto:cyril.jaquier@fail2ban.org))
+send kudos to the original author ([Cyril Jaquier](mailto: Cyril Jaquier <cyril.jaquier@fail2ban.org>))
 or *better* to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
 since Fail2Ban is "community-driven" for years now.
 

RELEASE

@@ -53,7 +53,7 @@ Preparation
 
   or an alternative for comparison with previous release
 
-     git diff 0.10.0 | grep -B2 'index 0000000..' | grep -B1 'new file mode' | sed -n -e '/^diff /s,.* b/,,gp' >> MANIFEST
+     git diff 0.9.4 | grep -B2 'index 0000000..' | grep -B1 'new file mode' | sed -n -e '/^diff /s,.* b/,,gp' >> MANIFEST
      sort MANIFEST | uniq | sponge MANIFEST
 
 * Run::
@@ -66,24 +66,24 @@ Preparation
 
   * Which indicates that testcases/files/logs/mysqld.log has been moved or is a directory::
 
-      tar -C /tmp -jxf dist/fail2ban-0.9.6.tar.bz2
+      tar -C /tmp -jxf dist/fail2ban-0.9.4.tar.bz2
 
-* clean up current directory::
+* clean up current direcory::
 
-    diff -rul --exclude \*.pyc . /tmp/fail2ban-0.10.0/
+    diff -rul --exclude \*.pyc . /tmp/fail2ban-0.9.4/
 
   * Only differences should be files that you don't want distributed.
 
 
 * Ensure the tests work from the tarball::
 
-    cd /tmp/fail2ban-0.9.6/ && bin/fail2ban-testcases
+    cd /tmp/fail2ban-0.9.4/ && bin/fail2ban-testcases
 
 * Add/finalize the corresponding entry in the ChangeLog
 
   * To generate a list of committers use e.g.::
 
-      git shortlog -sn 0.10.0.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
+      git shortlog -sn 0.9.4.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
 
   * Ensure the top of the ChangeLog has the right version and current date.
   * Ensure the top entry of the ChangeLog has the right version and current date.
@@ -106,7 +106,7 @@ Preparation
 * Tag the release by using a signed (and annotated) tag.  Cut/paste
   release ChangeLog entry as tag annotation::
 
-    git tag -s 0.10.0
+    git tag -s 0.9.4
 
 Pre Release
 ===========
@@ -190,14 +190,14 @@ Post Release
 
 Add the following to the top of the ChangeLog::
 
-  ver. 0.10.0 (2016/XX/XXX) - wanna-be-released
+  ver. 0.9.6 (2016/XX/XXX) - wanna-be-released
   -----------
   
-  ### Fixes
+  - Fixes:
   
-  ### New Features
+  - New Features:
   
-  ### Enhancements
+  - Enhancements:
 
 Alter the git shortlog command in the previous section to refer to the just
 released version.

THANKS

@@ -16,7 +16,6 @@ Alexander Koeppe (IPv6 support)
 Alexandre Perrin (kAworu)
 Amir Caspi
 Amy
-Andrew James Collett (ajcollett)
 Andrew St. Jean
 Andrey G. Grozin
 Andy Fragen
@@ -61,7 +60,6 @@ John Thoe
 Jacques Lav!gnotte
 Johannes Weberhofer
 Jason H Martin
-Jeaye Wilkerson
 Jisoo Park
 Joel M Snyder
 Jonathan Kamens
@@ -111,9 +109,7 @@ Russell Odom
 SATO Kentaro
 Sean DuBois
 Sebastian Arcus
-Serg G. Brester (sebres)
-Sergey Safarov
-Shaun C.
+Serg G. Brester
 Sireyessire
 silviogarbes
 Stefan Tatschner
@@ -124,7 +120,6 @@ Thomas Mayer
 Tom Pike
 Tom Hendrikx
 Tomas Pihl
-Thomas Skierlo (phaleas)
 Tony Lawrence
 Tomasz Ciolek
 Tyler

bin/fail2ban-client

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
 # vi: set ft=python sts=4 ts=4 sw=4 noet :
 
@@ -18,20 +18,458 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-"""
-Fail2Ban reads log file that contains password failure report
-and bans the corresponding IP addresses using firewall rules.
-
-This tools starts/stops fail2ban server or does client/server communication,
-to change/read parameters of the server or jails.
-
-"""
-
-__author__ = "Fail2Ban Developers"
-__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko, 2014-2016 Serg G. Brester"
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from fail2ban.client.fail2banclient import exec_command_line, sys
+import getopt
+import logging
+import os
+import pickle
+import re
+import shlex
+import signal
+import socket
+import string
+import sys
+import time
 
-if __name__ == "__main__":
-	exec_command_line(sys.argv)
+from fail2ban.version import version
+from fail2ban.protocol import printFormatted
+from fail2ban.client.csocket import CSocket
+from fail2ban.client.configurator import Configurator
+from fail2ban.client.beautifier import Beautifier
+from fail2ban.helpers import getLogger
+
+# Gets the instance of the logger.
+logSys = getLogger("fail2ban")
+
+##
+#
+# @todo This class needs cleanup.
+
+class Fail2banClient:
+
+	SERVER = "fail2ban-server"
+	PROMPT = "fail2ban> "
+
+	def __init__(self):
+		self.__argv = None
+		self.__stream = None
+		self.__configurator = Configurator()
+		self.__conf = dict()
+		self.__conf["conf"] = "/etc/fail2ban"
+		self.__conf["dump"] = False
+		self.__conf["force"] = False
+		self.__conf["background"] = True
+		self.__conf["verbose"] = 1
+		self.__conf["interactive"] = False
+		self.__conf["socket"] = None
+		self.__conf["pidfile"] = None
+
+	def dispVersion(self):
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+
+	def dispUsage(self):
+		""" Prints Fail2Ban command line options and exits
+		"""
+		print "Usage: "+self.__argv[0]+" [OPTIONS] <COMMAND>"
+		print
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+		print "Options:"
+		print "    -c <DIR>                configuration directory"
+		print "    -s <FILE>               socket path"
+		print "    -p <FILE>               pidfile path"
+		print "    -d                      dump configuration. For debugging"
+		print "    -i                      interactive mode"
+		print "    -v                      increase verbosity"
+		print "    -q                      decrease verbosity"
+		print "    -x                      force execution of the server (remove socket file)"
+		print "    -b                      start server in background (default)"
+		print "    -f                      start server in foreground (note that the client forks once itself)"
+		print "    -h, --help              display this help message"
+		print "    -V, --version           print the version"
+		print
+		print "Command:"
+
+		# Prints the protocol
+		printFormatted()
+
+		print
+		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
+
+	def dispInteractive(self):
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+
+	def __sigTERMhandler(self, signum, frame):
+		# Print a new line because we probably come from wait
+		print
+		logSys.warning("Caught signal %d. Exiting" % signum)
+		sys.exit(-1)
+
+	def __getCmdLineOptions(self, optList):
+		""" Gets the command line options
+		"""
+		for opt in optList:
+			if opt[0] == "-c":
+				self.__conf["conf"] = opt[1]
+			elif opt[0] == "-s":
+				self.__conf["socket"] = opt[1]
+			elif opt[0] == "-p":
+				self.__conf["pidfile"] = opt[1]
+			elif opt[0] == "-d":
+				self.__conf["dump"] = True
+			elif opt[0] == "-v":
+				self.__conf["verbose"] = self.__conf["verbose"] + 1
+			elif opt[0] == "-q":
+				self.__conf["verbose"] = self.__conf["verbose"] - 1
+			elif opt[0] == "-x":
+				self.__conf["force"] = True
+			elif opt[0] == "-i":
+				self.__conf["interactive"] = True
+			elif opt[0] == "-b":
+				self.__conf["background"] = True
+			elif opt[0] == "-f":
+				self.__conf["background"] = False
+			elif opt[0] in ["-h", "--help"]:
+				self.dispUsage()
+				sys.exit(0)
+			elif opt[0] in ["-V", "--version"]:
+				self.dispVersion()
+				sys.exit(0)
+
+	def __ping(self):
+		return self.__processCmd([["ping"]], False)
+
+	def __processCmd(self, cmd, showRet = True):
+		client = None
+		try:
+			beautifier = Beautifier()
+			streamRet = True
+			for c in cmd:
+				beautifier.setInputCmd(c)
+				try:
+					if not client:
+						client = CSocket(self.__conf["socket"])
+					ret = client.send(c)
+					if ret[0] == 0:
+						logSys.debug("OK : " + `ret[1]`)
+						if showRet:
+							print beautifier.beautify(ret[1])
+					else:
+						logSys.error("NOK: " + `ret[1].args`)
+						if showRet:
+							print beautifier.beautifyError(ret[1])
+						streamRet = False
+				except socket.error:
+					if showRet:
+						self.__logSocketError()
+					return False
+				except Exception, e:
+					if showRet:
+						logSys.error(e)
+					return False
+		finally:
+			if client:
+				client.close()
+		return streamRet
+
+	def __logSocketError(self):
+		try:
+			if os.access(self.__conf["socket"], os.F_OK):
+				# This doesn't check if path is a socket,
+				#  but socket.error should be raised
+				if os.access(self.__conf["socket"], os.W_OK):
+					# Permissions look good, but socket.error was raised
+					logSys.error("Unable to contact server. Is it running?")
+				else:
+					logSys.error("Permission denied to socket: %s,"
+								 " (you must be root)", self.__conf["socket"])
+			else:
+				logSys.error("Failed to access socket path: %s."
+							 " Is fail2ban running?",
+							 self.__conf["socket"])
+		except Exception as e:
+			logSys.error("Exception while checking socket access: %s",
+						 self.__conf["socket"])
+			logSys.error(e)
+
+	##
+	# Process a command line.
+	#
+	# Process one command line and exit.
+	# @param cmd the command line
+
+	def __processCommand(self, cmd):
+		if len(cmd) == 1 and cmd[0] == "start":
+			if self.__ping():
+				logSys.error("Server already running")
+				return False
+			else:
+				# Read the config
+				ret = self.__readConfig()
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
+				# verify that directory for the socket file exists
+				socket_dir = os.path.dirname(self.__conf["socket"])
+				if not os.path.exists(socket_dir):
+					logSys.error(
+						"There is no directory %s to contain the socket file %s."
+						% (socket_dir, self.__conf["socket"]))
+					return False
+				if not os.access(socket_dir, os.W_OK | os.X_OK):
+					logSys.error(
+						"Directory %s exists but not accessible for writing"
+						% (socket_dir,))
+					return False
+				# Start the server
+				self.__startServerAsync(self.__conf["socket"],
+										self.__conf["pidfile"],
+										self.__conf["force"],
+										self.__conf["background"])
+				try:
+					# Wait for the server to start
+					self.__waitOnServer()
+					# Configure the server
+					self.__processCmd(self.__stream, False)
+					return True
+				except ServerExecutionException:
+					logSys.error("Could not start server. Maybe an old "
+								 "socket file is still present. Try to "
+								 "remove " + self.__conf["socket"] + ". If "
+								 "you used fail2ban-client to start the "
+								 "server, adding the -x option will do it")
+					return False
+		elif len(cmd) == 1 and cmd[0] == "reload":
+			if self.__ping():
+				ret = self.__readConfig()
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
+				self.__processCmd([['stop', 'all']], False)
+				# Configure the server
+				return self.__processCmd(self.__stream, False)
+			else:
+				logSys.error("Could not find server")
+				return False
+		elif len(cmd) == 2 and cmd[0] == "reload":
+			if self.__ping():
+				jail = cmd[1]
+				ret = self.__readConfig(jail)
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
+				self.__processCmd([['stop', jail]], False)
+				# Configure the server
+				return self.__processCmd(self.__stream, False)
+			else:
+				logSys.error("Could not find server")
+				return False
+		else:
+			return self.__processCmd([cmd])
+
+
+	##
+	# Start Fail2Ban server.
+	#
+	# Start the Fail2ban server in daemon mode.
+
+	def __startServerAsync(self, socket, pidfile, force = False, background = True):
+		# Forks the current process.
+		pid = os.fork()
+		if pid == 0:
+			args = list()
+			args.append(self.SERVER)
+			# Set the socket path.
+			args.append("-s")
+			args.append(socket)
+			# Set the pidfile
+			args.append("-p")
+			args.append(pidfile)
+			# Force the execution if needed.
+			if force:
+				args.append("-x")
+			# Start in foreground mode if requested.
+			if background:
+				args.append("-b")
+			else:
+				args.append("-f")
+			
+			try:
+				# Use the current directory.
+				exe = os.path.abspath(os.path.join(sys.path[0], self.SERVER))
+				logSys.debug("Starting %r with args %r" % (exe, args))
+				os.execv(exe, args)
+			except OSError:
+				try:
+					# Use the PATH env.
+					logSys.warning("Initial start attempt failed.  Starting %r with the same args" % (self.SERVER,))
+					os.execvp(self.SERVER, args)
+				except OSError:
+					logSys.error("Could not start %s" % self.SERVER)
+					os.exit(-1)
+
+	def __waitOnServer(self):
+		# Wait for the server to start
+		cnt = 0
+		if self.__conf["verbose"] > 1:
+			pos = 0
+			delta = 1
+			mask = "[          ]"
+		while not self.__ping():
+			# Wonderful visual :)
+			if self.__conf["verbose"] > 1:
+				pos += delta
+				sys.stdout.write("\rINFO   " + mask[:pos] + '#' + mask[pos+1:] +
+								 " Waiting on the server...")
+				sys.stdout.flush()
+				if pos > len(mask)-3:
+					delta = -1
+				elif pos < 2:
+					delta = 1
+			# The server has 30 seconds to start.
+			if cnt >= 300:
+				if self.__conf["verbose"] > 1:
+					sys.stdout.write('\n')
+				raise ServerExecutionException("Failed to start server")
+			time.sleep(0.1)
+			cnt += 1
+		if self.__conf["verbose"] > 1:
+			sys.stdout.write('\n')
+
+
+	def start(self, argv):
+		# Command line options
+		self.__argv = argv
+
+		# Install signal handlers
+		signal.signal(signal.SIGTERM, self.__sigTERMhandler)
+		signal.signal(signal.SIGINT, self.__sigTERMhandler)
+
+		# Reads the command line options.
+		try:
+			cmdOpts = 'hc:s:p:xfbdviqV'
+			cmdLongOpts = ['help', 'version']
+			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
+		except getopt.GetoptError:
+			self.dispUsage()
+			return False
+
+		self.__getCmdLineOptions(optList)
+
+		verbose = self.__conf["verbose"]
+		if verbose <= 0:
+			logSys.setLevel(logging.ERROR)
+		elif verbose == 1:
+			logSys.setLevel(logging.WARNING)
+		elif verbose == 2:
+			logSys.setLevel(logging.INFO)
+		elif verbose == 3:
+			logSys.setLevel(logging.DEBUG)
+		else:
+			logSys.setLevel(logging.HEAVYDEBUG)
+		# Add the default logging handler to dump to stderr
+		logout = logging.StreamHandler(sys.stderr)
+		# set a format which is simpler for console use
+		formatter = logging.Formatter('%(levelname)-6s %(message)s')
+		# tell the handler to use this format
+		logout.setFormatter(formatter)
+		logSys.addHandler(logout)
+
+		# Set the configuration path
+		self.__configurator.setBaseDir(self.__conf["conf"])
+
+		# Set socket path
+		self.__configurator.readEarly()
+		conf = self.__configurator.getEarlyOptions()
+		if self.__conf["socket"] is None:
+			self.__conf["socket"] = conf["socket"]
+		if self.__conf["pidfile"] is None:
+			self.__conf["pidfile"] = conf["pidfile"]
+		logSys.info("Using socket file " + self.__conf["socket"])
+
+		if self.__conf["dump"]:
+			ret = self.__readConfig()
+			self.dumpConfig(self.__stream)
+			return ret
+
+		# Interactive mode
+		if self.__conf["interactive"]:
+			try:
+				import readline
+			except ImportError:
+				logSys.error("Readline not available")
+				return False
+			try:
+				ret = True
+				if len(args) > 0:
+					ret = self.__processCommand(args)
+				if ret:
+					readline.parse_and_bind("tab: complete")
+					self.dispInteractive()
+					while True:
+						cmd = raw_input(self.PROMPT)
+						if cmd == "exit" or cmd == "quit":
+							# Exit
+							return True
+						if cmd == "help":
+							self.dispUsage()
+						elif not cmd == "":
+							try:
+								self.__processCommand(shlex.split(cmd))
+							except Exception, e:
+								logSys.error(e)
+			except (EOFError, KeyboardInterrupt):
+				print
+				return True
+		# Single command mode
+		else:
+			if len(args) < 1:
+				self.dispUsage()
+				return False
+			return self.__processCommand(args)
+
+	def __readConfig(self, jail=None):
+		# Read the configuration
+		# TODO: get away from stew of return codes and exception
+		# handling -- handle via exceptions
+		try:
+			self.__configurator.Reload()
+			self.__configurator.readAll()
+			ret = self.__configurator.getOptions(jail)
+			self.__configurator.convertToProtocol()
+			self.__stream = self.__configurator.getConfigStream()
+		except Exception, e:
+			logSys.error("Failed during configuration: %s" % e)
+			ret = False
+		return ret
+
+	@staticmethod
+	def dumpConfig(cmd):
+		for c in cmd:
+			print c
+		return True
+
+
+class ServerExecutionException(Exception):
+	pass
+
+if __name__ == "__main__": # pragma: no cover - can't test main
+	client = Fail2banClient()
+	# Exit with correct return value
+	if client.start(sys.argv):
+		sys.exit(0)
+	else:
+		sys.exit(-1)

bin/fail2ban-regex

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
 # vi: set ft=python sts=4 ts=4 sw=4 noet :
 #

bin/fail2ban-server

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
 # vi: set ft=python sts=4 ts=4 sw=4 noet :
 
@@ -18,20 +18,123 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-"""
-Fail2Ban reads log file that contains password failure report
-and bans the corresponding IP addresses using firewall rules.
-
-This tool starts/stops fail2ban server or does client/server communication
-to change/read parameters of the server or jails.
-
-"""
-
-__author__ = "Fail2Ban Developers"
-__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko, 2014-2016 Serg G. Brester"
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from fail2ban.client.fail2banserver import exec_command_line, sys
+import getopt
+import os
+import sys
+
+from fail2ban.version import version
+from fail2ban.server.server import Server
+from fail2ban.helpers import getLogger
+
+# Gets the instance of the logger.
+logSys = getLogger("fail2ban")
+
+##
+# \mainpage Fail2Ban
+#
+# \section Introduction
+#
+# Fail2ban is designed to protect your server against brute force attacks.
+# Its first goal was to protect a SSH server.
+
+class Fail2banServer:
+
+	def __init__(self):
+		self.__server = None
+		self.__argv = None
+		self.__conf = dict()
+		self.__conf["background"] = True
+		self.__conf["force"] = False
+		self.__conf["socket"] = "/var/run/fail2ban/fail2ban.sock"
+		self.__conf["pidfile"] = "/var/run/fail2ban/fail2ban.pid"
+
+	def dispVersion(self):
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+
+	def dispUsage(self):
+		""" Prints Fail2Ban command line options and exits
+		"""
+		print "Usage: "+self.__argv[0]+" [OPTIONS]"
+		print
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+		print "Only use this command for debugging purpose. Start the server with"
+		print "fail2ban-client instead. The default behaviour is to start the server"
+		print "in background."
+		print
+		print "Options:"
+		print "    -b                   start in background"
+		print "    -f                   start in foreground"
+		print "    -s <FILE>            socket path"
+		print "    -p <FILE>            pidfile path"
+		print "    -x                   force execution of the server (remove socket file)"
+		print "    -h, --help           display this help message"
+		print "    -V, --version        print the version"
+		print
+		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
+
+	def __getCmdLineOptions(self, optList):
+		""" Gets the command line options
+		"""
+		for opt in optList:
+			if opt[0] == "-b":
+				self.__conf["background"] = True
+			if opt[0] == "-f":
+				self.__conf["background"] = False
+			if opt[0] == "-s":
+				self.__conf["socket"] = opt[1]
+			if opt[0] == "-p":
+				self.__conf["pidfile"] = opt[1]
+			if opt[0] == "-x":
+				self.__conf["force"] = True
+			if opt[0] in ["-h", "--help"]:
+				self.dispUsage()
+				sys.exit(0)
+			if opt[0] in ["-V", "--version"]:
+				self.dispVersion()
+				sys.exit(0)
+
+	def start(self, argv):
+		# Command line options
+		self.__argv = argv
+
+		# Reads the command line options.
+		try:
+			cmdOpts = 'bfs:p:xhV'
+			cmdLongOpts = ['help', 'version']
+			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
+		except getopt.GetoptError:
+			self.dispUsage()
+			sys.exit(-1)
+
+		self.__getCmdLineOptions(optList)
+
+		try:
+			self.__server = Server(self.__conf["background"])
+			self.__server.start(self.__conf["socket"],
+								self.__conf["pidfile"],
+								self.__conf["force"])
+			return True
+		except Exception, e:
+			logSys.exception(e)
+			self.__server.quit()
+			return False
 
 if __name__ == "__main__":
-	exec_command_line(sys.argv)
+	server = Fail2banServer()
+	if server.start(sys.argv):
+		sys.exit(0)
+	else:
+		sys.exit(-1)

bin/fail2ban-testcases

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
 # vi: set ft=python sts=4 ts=4 sw=4 noet :
 """Script to run Fail2Ban tests battery
@@ -30,36 +30,97 @@ import sys
 import time
 import unittest
 
-# Check if local fail2ban module exists, and use if it exists by
-# modifying the path. This is done so that tests can be used in dev
+# Check if local fail2ban module exists, and use if it exists by 
+# modifying the path. This is such that tests can be used in dev
 # environment.
 if os.path.exists("fail2ban/__init__.py"):
 	sys.path.insert(0, ".")
 from fail2ban.version import version
 
-from fail2ban.tests.utils import getOptParser, initProcess, gatherTests
-from fail2ban.setup import updatePyExec
+from fail2ban.tests.utils import gatherTests
+from fail2ban.helpers import FormatterWithTraceBack, getLogger
+from fail2ban.server.mytime import MyTime
 
-# Update fail2ban-python env to current python version (where f2b-modules located/installed)
-bindir = os.path.dirname(
-	# __file__ seems to be overwritten sometimes on some python versions (e.g. bug of 2.6 by running under cProfile, etc.):
-	sys.argv[0] if os.path.basename(sys.argv[0]) == 'fail2ban-testcases' else __file__
-)
-updatePyExec(bindir)
+from optparse import OptionParser, Option
 
-(opts, regexps) = getOptParser(__doc__).parse_args()
+def get_opt_parser():
+	# use module docstring for help output
+	p = OptionParser(
+				usage="%s [OPTIONS] [regexps]\n" % sys.argv[0] + __doc__,
+				version="%prog " + version)
+
+	p.add_options([
+		Option('-l', "--log-level", type="choice",
+			   dest="log_level",
+			   choices=('heavydebug', 'debug', 'info', 'notice', 'warning', 'error', 'critical'),
+			   default=None,
+			   help="Log level for the logger to use during running tests"),
+		Option('-n', "--no-network", action="store_true",
+			   dest="no_network",
+			   help="Do not run tests that require the network"),
+		Option("-t", "--log-traceback", action='store_true',
+			   help="Enrich log-messages with compressed tracebacks"),
+		Option("--full-traceback", action='store_true',
+			   help="Either to make the tracebacks full, not compressed (as by default)"),
+
+		])
+
+	return p
+
+parser = get_opt_parser()
+(opts, regexps) = parser.parse_args()
 
 #
-# Process initialization corresponding options (logging, default options, etc.)
+# Logging
 #
-opts = initProcess(opts)
-verbosity = opts.verbosity
+logSys = getLogger("fail2ban")
+
+# Numerical level of verbosity corresponding to a log "level"
+verbosity = {'heavydebug': 4,
+			 'debug': 3,
+			 'info': 2,
+			 'notice': 2,
+			 'warning': 1,
+			 'error': 1,
+			 'critical': 0,
+			 None: 1}[opts.log_level]
+
+if opts.log_level is not None: # pragma: no cover
+	# so we had explicit settings
+	logSys.setLevel(getattr(logging, opts.log_level.upper()))
+else: # pragma: no cover
+	# suppress the logging but it would leave unittests' progress dots
+	# ticking, unless like with '-l critical' which would be silent
+	# unless error occurs
+	logSys.setLevel(getattr(logging, 'CRITICAL'))
+
+# Add the default logging handler
+stdout = logging.StreamHandler(sys.stdout)
+
+fmt = ' %(message)s'
+
+if opts.log_traceback:
+	Formatter = FormatterWithTraceBack
+	fmt = (opts.full_traceback and ' %(tb)s' or ' %(tbc)s') + fmt
+else:
+	Formatter = logging.Formatter
+
+# Custom log format for the verbose tests runs
+if verbosity > 1: # pragma: no cover
+	stdout.setFormatter(Formatter(' %(asctime)-15s %(thread)s' + fmt))
+else: # pragma: no cover
+	# just prefix with the space
+	stdout.setFormatter(Formatter(fmt))
+logSys.addHandler(stdout)
 
 #
-# Gather tests (and filter corresponding options)
+# Let know the version
 #
-tests = gatherTests(regexps, opts)
+if not opts.log_level or opts.log_level != 'critical': # pragma: no cover
+	print("Fail2ban %s test suite. Python %s. Please wait..." \
+	    % (version, str(sys.version).replace('\n', '')))
 
+tests = gatherTests(regexps, opts.no_network)
 #
 # Run the tests
 #

config/action.d/abuseipdb.conf

@@ -1,104 +0,0 @@
-# Fail2ban configuration file
-#
-# Action to report IP address to abuseipdb.com
-# You must sign up to obtain an API key from abuseipdb.com.
-#
-# NOTE: These reports may include sensitive Info.
-# If you want cleaner reports that ensure no user data see the helper script at the below website.
-#
-# IMPORTANT:
-#
-# Reporting an IP of abuse is a serious complaint. Make sure that it is
-# serious. Fail2ban developers and network owners recommend you only use this
-# action for:
-#   * The recidive where the IP has been banned multiple times
-#   * Where maxretry has been set quite high, beyond the normal user typing
-#     password incorrectly.
-#   * For filters that have a low likelihood of receiving human errors
-#
-# This action relies on a api_key being added to the above action conf,
-# and the appropriate categories set.
-#
-# Example, for ssh bruteforce (in section [sshd] of `jail.local`): 
-#   action = %(known/action)s
-#            abuseipdb[abuseipdb_apikey="my-api-key", abuseipdb_category="18,22"]
-#
-# See below for categories.
-#
-# Added to fail2ban by Andrew James Collett (ajcollett)
-
-## abuseIPDB Categories, `the abuseipdb_category` MUST be set in the jail.conf action call.
-# Example, for ssh bruteforce: action = %(action_abuseipdb)s[abuseipdb_category="18,22"]
-# ID	Title	Description
-# 3	  Fraud Orders
-# 4	  DDoS Attack
-# 9	  Open Proxy
-# 10	Web Spam
-# 11	Email Spam
-# 14	Port Scan
-# 18	Brute-Force
-# 19	Bad Web Bot
-# 20	Exploited Host
-# 21	Web App Attack
-# 22	SSH	Secure Shell (SSH) abuse. Use this category in combination with more specific categories.
-# 23	IoT Targeted
-# See https://abuseipdb.com/categories for more descriptions
-
-[Definition]
-
-# bypass action for restored tickets
-norestored = 1
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-#
-#          ** IMPORTANT! **
-#
-#          By default, this posts directly to AbuseIPDB's API, unfortunately
-#          this results in a lot of backslashes/escapes appearing in the
-#          reports. This also may include info like your hostname.
-#          If you have your own web server with PHP available, you can
-#          use my (Shaun's) helper PHP script by commenting out the first #actionban
-#          line below, uncommenting the second one, and pointing the URL at
-#          wherever you install the helper script. For the PHP helper script, see
-#          <https://wiki.shaunc.com/wikka.php?wakka=ReportingToAbuseIPDBWithFail2Ban>
-#
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = lgm=$(printf '%%.1000s\n...' "<matches>"); curl -sSf "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: <abuseipdb_apikey>" --data-urlencode "comment=$lgm" --data-urlencode "ip=<ip>" --data "categories=<abuseipdb_category>"
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
-[Init]
-# Option:  abuseipdb_apikey
-# Notes    Your API key from abuseipdb.com
-# Values:  STRING  Default: None
-# Register for abuseipdb [https://www.abuseipdb.com], get api key and set below.
-# You will need to set the category in the action call.
-abuseipdb_apikey =

config/action.d/apprise.conf

@@ -1,49 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Chris Caron <lead2gold@gmail.com>
-#
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "The jail <name> as been started successfully." | <apprise> -t "[Fail2Ban] <name>: started on `uname -n`"
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "The jail <name> has been stopped." | <apprise> -t "[Fail2Ban] <name>: stopped on `uname -n`"
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "The IP <ip> has just been banned by Fail2Ban after <failures> attempts against <name>" | <apprise> -n "warning" -t "[Fail2Ban] <name>: banned <ip> from `uname -n`"
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
-[Init]
-
-# Define location of the default apprise configuration file to use
-#
-config = /etc/fail2ban/apprise.conf
-#
-apprise = apprise -c "<config>"

config/action.d/badips.conf

@@ -0,0 +1,19 @@
+# Fail2ban reporting to badips.com
+#
+# Note: This reports and IP only and does not actually ban traffic. Use 
+# another action in the same jail if you want bans to occur.
+#
+# Set the category to the appropriate value before use.
+#
+# To get see register and optional key to get personalised graphs see:
+# http://www.badips.com/blog/personalized-statistics-track-the-attackers-of-all-your-servers-with-one-key
+
+[Definition]
+
+actionban = curl --fail  --user-agent "<agent>" http://www.badips.com/add/<category>/<ip>
+
+[Init]
+
+# Option: category
+# Notes.: Values are from the list here: http://www.badips.com/get/categories
+category = 

config/action.d/badips.py

@@ -0,0 +1,375 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+import sys
+if sys.version_info < (2, 7):
+	raise ImportError("badips.py action requires Python >= 2.7")
+import json
+import threading
+import logging
+if sys.version_info >= (3, ):
+	from urllib.request import Request, urlopen
+	from urllib.parse import urlencode
+	from urllib.error import HTTPError
+else:
+	from urllib2 import Request, urlopen, HTTPError
+	from urllib import urlencode
+
+from fail2ban.server.actions import ActionBase
+from fail2ban.server.filter import IPAddr
+
+
+class BadIPsAction(ActionBase):
+	"""Fail2Ban action which reports bans to badips.com, and also
+	blacklist bad IPs listed on badips.com by using another action's
+	ban method.
+
+	Parameters
+	----------
+	jail : Jail
+		The jail which the action belongs to.
+	name : str
+		Name assigned to the action.
+	category : str
+		Valid badips.com category for reporting failures.
+	score : int, optional
+		Minimum score for bad IPs. Default 3.
+	age : str, optional
+		Age of last report for bad IPs, per badips.com syntax.
+		Default "24h" (24 hours)
+	key : str, optional
+		Key issued by badips.com to report bans, for later retrieval
+		of personalised content.
+	banaction : str, optional
+		Name of banaction to use for blacklisting bad IPs. If `None`,
+		no blacklist of IPs will take place.
+		Default `None`.
+	bancategory : str, optional
+		Name of category to use for blacklisting, which can differ
+		from category used for reporting. e.g. may want to report
+		"postfix", but want to use whole "mail" category for blacklist.
+		Default `category`.
+	bankey : str, optional
+		Key issued by badips.com to blacklist IPs reported with the
+		associated key.
+	updateperiod : int, optional
+		Time in seconds between updating bad IPs blacklist.
+		Default 900 (15 minutes)
+	agent : str, optional
+		User agent transmitted to server.
+		Default `Fail2Ban/ver.`
+
+	Raises
+	------
+	ValueError
+		If invalid `category`, `score`, `banaction` or `updateperiod`.
+	"""
+
+	_badips = "http://www.badips.com"
+	def _Request(self, url, **argv):
+		return Request(url, headers={'User-Agent': self.agent}, **argv)
+
+	def __init__(self, jail, name, category, score=3, age="24h", key=None,
+		banaction=None, bancategory=None, bankey=None, updateperiod=900, agent="Fail2Ban"):
+		super(BadIPsAction, self).__init__(jail, name)
+
+		self.agent = agent
+		self.category = category
+		self.score = score
+		self.age = age
+		self.key = key
+		self.banaction = banaction
+		self.bancategory = bancategory or category
+		self.bankey = bankey
+		self.updateperiod = updateperiod
+
+		self._bannedips = set()
+		# Used later for threading.Timer for updating badips
+		self._timer = None
+
+	def getCategories(self, incParents=False):
+		"""Get badips.com categories.
+
+		Returns
+		-------
+		set
+			Set of categories.
+
+		Raises
+		------
+		HTTPError
+			Any issues with badips.com request.
+		ValueError
+			If badips.com response didn't contain necessary information
+		"""
+		try:
+			response = urlopen(
+				self._Request("/".join([self._badips, "get", "categories"])), None, 3)
+		except HTTPError as response:
+			messages = json.loads(response.read().decode('utf-8'))
+			self._logSys.error(
+				"Failed to fetch categories. badips.com response: '%s'",
+				messages['err'])
+			raise
+		else:
+			response_json = json.loads(response.read().decode('utf-8'))
+			if not 'categories' in response_json:
+				err = "badips.com response lacked categories specification. Response was: %s" \
+				  % (response_json,)
+				self._logSys.error(err)
+				raise ValueError(err)
+			categories = response_json['categories']
+			categories_names = set(
+				value['Name'] for value in categories)
+			if incParents:
+				categories_names.update(set(
+					value['Parent'] for value in categories
+					if "Parent" in value))
+			return categories_names
+
+	def getList(self, category, score, age, key=None):
+		"""Get badips.com list of bad IPs.
+
+		Parameters
+		----------
+		category : str
+			Valid badips.com category.
+		score : int
+			Minimum score for bad IPs.
+		age : str
+			Age of last report for bad IPs, per badips.com syntax.
+		key : str, optional
+			Key issued by badips.com to fetch IPs reported with the
+			associated key.
+
+		Returns
+		-------
+		set
+			Set of bad IPs.
+
+		Raises
+		------
+		HTTPError
+			Any issues with badips.com request.
+		"""
+		try:
+			url = "?".join([
+				"/".join([self._badips, "get", "list", category, str(score)]),
+				urlencode({'age': age})])
+			if key:
+				url = "&".join([url, urlencode({'key': key})])
+			response = urlopen(self._Request(url))
+		except HTTPError as response:
+			messages = json.loads(response.read().decode('utf-8'))
+			self._logSys.error(
+				"Failed to fetch bad IP list. badips.com response: '%s'",
+				messages['err'])
+			raise
+		else:
+			return set(response.read().decode('utf-8').split())
+
+	@property
+	def category(self):
+		"""badips.com category for reporting IPs.
+		"""
+		return self._category
+
+	@category.setter
+	def category(self, category):
+		if category not in self.getCategories():
+			self._logSys.error("Category name '%s' not valid. "
+				"see badips.com for list of valid categories",
+				category)
+			raise ValueError("Invalid category: %s" % category)
+		self._category = category
+
+	@property
+	def bancategory(self):
+		"""badips.com bancategory for fetching IPs.
+		"""
+		return self._bancategory
+
+	@bancategory.setter
+	def bancategory(self, bancategory):
+		if bancategory not in self.getCategories(incParents=True):
+			self._logSys.error("Category name '%s' not valid. "
+				"see badips.com for list of valid categories",
+				bancategory)
+			raise ValueError("Invalid bancategory: %s" % bancategory)
+		self._bancategory = bancategory
+
+	@property
+	def score(self):
+		"""badips.com minimum score for fetching IPs.
+		"""
+		return self._score
+
+	@score.setter
+	def score(self, score):
+		score = int(score)
+		if 0 <= score <= 5:
+			self._score = score
+		else:
+			raise ValueError("Score must be 0-5")
+
+	@property
+	def banaction(self):
+		"""Jail action to use for banning/unbanning.
+		"""
+		return self._banaction
+
+	@banaction.setter
+	def banaction(self, banaction):
+		if banaction is not None and banaction not in self._jail.actions:
+			self._logSys.error("Action name '%s' not in jail '%s'",
+				banaction, self._jail.name)
+			raise ValueError("Invalid banaction")
+		self._banaction = banaction
+
+	@property
+	def updateperiod(self):
+		"""Period in seconds between banned bad IPs will be updated.
+		"""
+		return self._updateperiod
+
+	@updateperiod.setter
+	def updateperiod(self, updateperiod):
+		updateperiod = int(updateperiod)
+		if updateperiod > 0:
+			self._updateperiod = updateperiod
+		else:
+			raise ValueError("Update period must be integer greater than 0")
+
+	def _banIPs(self, ips):
+		for ip in ips:
+			try:
+				self._jail.actions[self.banaction].ban({
+					'ip': IPAddr(ip),
+					'failures': 0,
+					'matches': "",
+					'ipmatches': "",
+					'ipjailmatches': "",
+				})
+			except Exception as e:
+				self._logSys.error(
+					"Error banning IP %s for jail '%s' with action '%s': %s",
+					ip, self._jail.name, self.banaction, e,
+					exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG)
+			else:
+				self._bannedips.add(ip)
+				self._logSys.info(
+					"Banned IP %s for jail '%s' with action '%s'",
+					ip, self._jail.name, self.banaction)
+
+	def _unbanIPs(self, ips):
+		for ip in ips:
+			try:
+				self._jail.actions[self.banaction].unban({
+					'ip': IPAddr(ip),
+					'failures': 0,
+					'matches': "",
+					'ipmatches': "",
+					'ipjailmatches': "",
+				})
+			except Exception as e:
+				self._logSys.info(
+					"Error unbanning IP %s for jail '%s' with action '%s': %s",
+					ip, self._jail.name, self.banaction, e,
+					exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG)
+			else:
+				self._logSys.info(
+					"Unbanned IP %s for jail '%s' with action '%s'",
+					ip, self._jail.name, self.banaction)
+			finally:
+				self._bannedips.remove(ip)
+
+	def start(self):
+		"""If `banaction` set, blacklists bad IPs.
+		"""
+		if self.banaction is not None:
+			self.update()
+
+	def update(self):
+		"""If `banaction` set, updates blacklisted IPs.
+
+		Queries badips.com for list of bad IPs, removing IPs from the
+		blacklist if no longer present, and adds new bad IPs to the
+		blacklist.
+		"""
+		if self.banaction is not None:
+			if self._timer:
+				self._timer.cancel()
+				self._timer = None
+
+			try:
+				ips = self.getList(
+					self.bancategory, self.score, self.age, self.bankey)
+				# Remove old IPs no longer listed
+				self._unbanIPs(self._bannedips - ips)
+				# Add new IPs which are now listed
+				self._banIPs(ips - self._bannedips)
+
+				self._logSys.info(
+					"Updated IPs for jail '%s'. Update again in %i seconds",
+					self._jail.name, self.updateperiod)
+			finally:
+				self._timer = threading.Timer(self.updateperiod, self.update)
+				self._timer.start()
+
+	def stop(self):
+		"""If `banaction` set, clears blacklisted IPs.
+		"""
+		if self.banaction is not None:
+			if self._timer:
+				self._timer.cancel()
+				self._timer = None
+			self._unbanIPs(self._bannedips.copy())
+
+	def ban(self, aInfo):
+		"""Reports banned IP to badips.com.
+
+		Parameters
+		----------
+		aInfo : dict
+			Dictionary which includes information in relation to
+			the ban.
+
+		Raises
+		------
+		HTTPError
+			Any issues with badips.com request.
+		"""
+		try:
+			url = "/".join([self._badips, "add", self.category, aInfo['ip']])
+			if self.key:
+				url = "?".join([url, urlencode({'key': self.key})])
+			response = urlopen(self._Request(url))
+		except HTTPError as response:
+			messages = json.loads(response.read().decode('utf-8'))
+			self._logSys.error(
+				"Response from badips.com report: '%s'",
+				messages['err'])
+			raise
+		else:
+			messages = json.loads(response.read().decode('utf-8'))
+			self._logSys.info(
+				"Response from badips.com report: '%s'",
+				messages['suc'])
+
+Action = BadIPsAction

config/action.d/blocklist_de.conf

@@ -31,13 +31,13 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =
@@ -54,7 +54,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = curl --fail --data-urlencode "server=<email>" --data "apikey=<apikey>" --data "service=<service>" --data "ip=<ip>" --data-urlencode "logs=<matches><br>" --data 'format=text' --user-agent "<agent>" "https://www.blocklist.de/en/httpreports.html"
+actionban = curl --fail --data-urlencode 'server=<email>' --data 'apikey=<apikey>' --data 'service=<service>' --data 'ip=<ip>' --data-urlencode 'logs=<matches>' --data 'format=text' --user-agent "<agent>" "https://www.blocklist.de/en/httpreports.html"
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -64,8 +64,10 @@ actionban = curl --fail --data-urlencode "server=<email>" --data "apikey=<apikey
 #
 actionunban =
 
+[Init]
+
 # Option:  email
-# Notes    server email address, as per blocklist.de account
+# Notes    server email address, as per blocklise.de account
 # Values:  STRING  Default: None
 #
 #email =

config/action.d/bsd-ipfw.conf

@@ -11,17 +11,14 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipfw show | fgrep -c -m 1 -s 'table(<table>)' > /dev/null 2>&1 || (
-    num=$(ipfw show | awk 'BEGIN { b = <lowest_rule_num> } { if ($1 == b) { b = $1 + 1 } } END { print b }');
-    ipfw -q add "$num" <blocktype> <block> from table\(<table>\) to me <port>; echo "$num" > "<startstatefile>"
-  )
+actionstart = ipfw show | fgrep -q 'table(<table>)' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e <br> else exit b }'; num=$?; ipfw -q add $num <blocktype> <block> from table\(<table>\) to me <port>; echo $num > "<startstatefile>" )
 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =  [ ! -f <startstatefile> ] || ( read num < "<startstatefile>" <br> ipfw -q delete $num <br> rm "<startstatefile>" )
@@ -41,7 +38,7 @@ actioncheck =
 # Values:  CMD
 #
 # requires an ipfw rule like "deny ip from table(1) to me"
-actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || echo "$e" | grep -q "record already exists" || { echo "$e" 1>&2; exit $x; }
+actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || { echo "$e" 1>&2; exit $x; }
 
 
 # Option:  actionunban
@@ -50,7 +47,7 @@ actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ip
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = e=`ipfw table <table> delete <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || echo "$e" | grep -q "record not found" || { echo "$e" 1>&2; exit $x; }
+actionunban = e=`ipfw table <table> delete <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || { echo "$e" 1>&2; exit $x; }
 
 [Init]
 # Option:  table
@@ -84,11 +81,3 @@ block = ip
 # Values:  STRING
 #
 blocktype = unreach port
-
-# Option:  lowest_rule_num
-# Notes:   When fail2ban starts with action and there is no rule for the given table yet
-#          then fail2ban will start looking for an empty slot starting with this rule number.
-# Values:  NUM
-lowest_rule_num = 111
-
-

config/action.d/cloudflare.conf

@@ -5,7 +5,7 @@
 #
 # Please set jail.local's permission to 640 because it contains your CF API key.
 #
-# This action depends on curl (and optionally jq).
+# This action depends on curl.
 # Referenced from http://www.normyee.net/blog/2012/02/02/adding-cloudflare-support-to-fail2ban by NORM YEE
 #
 # To get your CloudFlare API Key: https://www.cloudflare.com/a/account/my-account
@@ -15,13 +15,13 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =
@@ -40,12 +40,7 @@ actioncheck =
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-# API v1
-#actionban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=ban' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
-# API v4
-actionban = curl -s -o /dev/null -X POST <_cf_api_prms> \
-            -d '{"mode":"block","configuration":{"target":"<cftarget>","value":"<ip>"},"notes":"Fail2Ban <name>"}' \
-            <_cf_api_url>
+actionban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=ban' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -55,17 +50,7 @@ actionban = curl -s -o /dev/null -X POST <_cf_api_prms> \
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-# API v1
-#actionunban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=nul' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
-# API v4
-actionunban = id=$(curl -s -X GET <_cf_api_prms> \
-                   "<_cf_api_url>?mode=block&configuration_target=<cftarget>&configuration_value=<ip>&page=1&per_page=1&notes=Fail2Ban%%20<name>" \
-                   | { jq -r '.result[0].id' 2>/dev/null || tr -d '\n' | sed -nE 's/^.*"result"\s*:\s*\[\s*\{\s*"id"\s*:\s*"([^"]+)".*$/\1/p'; })
-              if [ -z "$id" ]; then echo "<name>: id for <ip> cannot be found"; exit 0; fi;
-              curl -s -o /dev/null -X DELETE <_cf_api_prms> "<_cf_api_url>/$id"
-
-_cf_api_url = https://api.cloudflare.com/client/v4/user/firewall/access_rules/rules
-_cf_api_prms = -H 'X-Auth-Email: <cfuser>' -H 'X-Auth-Key: <cftoken>' -H 'Content-Type: application/json'
+actionunban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=nul' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
 
 [Init]
 
@@ -81,8 +66,3 @@ _cf_api_prms = -H 'X-Auth-Email: <cfuser>' -H 'X-Auth-Key: <cftoken>' -H 'Conten
 cftoken =
 
 cfuser =
-
-cftarget = ip
-
-[Init?family=inet6]
-cftarget = ip6

config/action.d/complain.conf

@@ -28,26 +28,16 @@
 #
 
 
-[INCLUDES]
-
-before = helpers-common.conf
-
 [Definition]
 
-# Used in test cases for coverage internal transformations
-debug = 0
-
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =
@@ -64,18 +54,10 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = oifs=${IFS};
-            RESOLVER_ADDR="%(addr_resolver)s"
-            if [ "<debug>" -gt 0 ]; then echo "try to resolve $RESOLVER_ADDR"; fi
-            ADDRESSES=$(dig +short -t txt -q $RESOLVER_ADDR | tr -d '"')
-            IFS=,; ADDRESSES=$(echo $ADDRESSES)
-            IFS=${oifs}
-            IP=<ip>
+actionban = oifs=${IFS}; IFS=.;SEP_IP=( <ip> ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs}
+	    IP=<ip>
             if [ ! -z "$ADDRESSES" ]; then
-                ( printf %%b "<message>\n"; date '+Note: Local timezone is %%z (%%Z)'; 
-                  printf %%b "\nLines containing failures of <ip> (max <grepmax>)\n";
-                  %(_grep_logs)s;
-                ) | <mailcmd> "Abuse from <ip>" <mailargs> $ADDRESSES
+                (printf %%b "<message>\n"; date '+Note: Local timezone is %%z (%%Z)'; grep -E '(^|[^0-9])<ip>([^0-9]|$)' <logpath>) | <mailcmd> "Abuse from <ip>" <mailargs> ${ADDRESSES//,/\" \"}
             fi
 
 # Option:  actionunban
@@ -86,12 +68,7 @@ actionban = oifs=${IFS};
 #
 actionunban =
 
-# Server as resolver used in dig command
-#
-addr_resolver = <ip-rev>abuse-contacts.abusix.org
-
-# Default message used for abuse content
-#
+[Init]
 message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to a abusix.com is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process.)\n\n This mail was generated by Fail2Ban.\nThe recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here: https://abusix.com/global-reporting/abuse-contact-db\nabusix.com is neither responsible nor liable for the content or accuracy of this message.\n
 
 # Path to the log files which contain relevant lines for the abuser IP
@@ -102,7 +79,7 @@ logpath = /dev/null
 # Notes.:  Your system mail command. Is passed 2 args: subject and recipient
 # Values:  CMD
 #
-mailcmd = mail -E 'set escape' -s
+mailcmd = mail -s
 
 # Option:  mailargs
 # Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
@@ -115,7 +92,3 @@ mailcmd = mail -E 'set escape' -s
 #
 mailargs =
 
-# Number of log lines to include in the email
-#
-#grepmax = 1000
-#grepopts = -m <grepmax>

config/action.d/dshield.conf

@@ -28,17 +28,14 @@
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile>.buffer ]; then
@@ -179,7 +176,7 @@ tcpflags =
 # Notes.:  Your system mail command. Is passed 2 args: subject and recipient
 # Values:  CMD
 #
-mailcmd = mail -E 'set escape' -s
+mailcmd = mail -s
 
 # Option:  mailargs
 # Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:

config/action.d/dummy.conf

@@ -7,26 +7,17 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = if [ ! -z '<target>' ]; then touch <target>; fi;
-              printf %%b "<init>\n" <to_target>
-              echo "%(debug)s started"
-
-# Option:  actionflush
-# Notes.:  command executed once to flush (clear) all IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = printf %%b "-*\n" <to_target>
-              echo "%(debug)s clear all"
+actionstart = touch /var/run/fail2ban/fail2ban.dummy
+              printf %%b "<init>\n" >> /var/run/fail2ban/fail2ban.dummy
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = if [ ! -z '<target>' ]; then rm -f <target>; fi;
-             echo "%(debug)s stopped"
+actionstop = rm -f /var/run/fail2ban/fail2ban.dummy
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -40,8 +31,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "+<ip>\n" <to_target>
-            echo "%(debug)s banned <ip> (family: <family>)"
+actionban = printf %%b "+<ip>\n" >> /var/run/fail2ban/fail2ban.dummy
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -49,15 +39,9 @@ actionban = printf %%b "+<ip>\n" <to_target>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = printf %%b "-<ip>\n" <to_target>
-              echo "%(debug)s unbanned <ip> (family: <family>)"
-
-
-debug = [<name>] <actname> <target> --
+actionunban = printf %%b "-<ip>\n" >> /var/run/fail2ban/fail2ban.dummy
 
 [Init]
 
 init = 123
 
-target = /var/run/fail2ban/fail2ban.dummy
-to_target = >> <target>

config/action.d/firewallcmd-allports.conf

@@ -6,26 +6,34 @@
 
 [INCLUDES]
 
-before = firewallcmd-common.conf
+before = iptables-common.conf
 
 [Definition]
 
-actionstart = firewall-cmd --direct --add-chain <family> filter f2b-<name>
-              firewall-cmd --direct --add-rule <family> filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 -j f2b-<name>
+actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
+              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -j f2b-<name>
 
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 -j f2b-<name>
-             firewall-cmd --direct --remove-rules <family> filter f2b-<name>
-             firewall-cmd --direct --remove-chain <family> filter f2b-<name>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -j f2b-<name>
+             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
+             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
 
 
 # Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-recidive$'
 
-actioncheck = firewall-cmd --direct --get-chains <family> filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
+actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
 
-actionban = firewall-cmd --direct --add-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
 
-actionunban = firewall-cmd --direct --remove-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+
+[Init]
+
+# Default name of the chain
+#
+name = default
+
+chain = INPUT_direct
 
 # DEV NOTES:
 #

config/action.d/firewallcmd-common.conf

@@ -1,76 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt
-#
-
-[Init]
-
-# Option:  name
-# Notes    Default name of the chain
-# Values:  STRING
-name = default
-
-# Option   port
-# Notes    Can also use port numbers separated by a comma and in rich-rules comma and/or space.
-# Value    STRING Default: 1:65535
-port = 1:65535
-
-# Option:  protocol
-# Notes    [ tcp | udp | icmp | all ]
-# Values:  STRING Default: tcp
-protocol = tcp
-
-# Option:  family(ipv4)
-# Notes    specifies the socket address family type
-# Values:  STRING  
-family = ipv4
-
-# Option:  chain
-# Notes    specifies the firewalld chain to which the Fail2Ban rules should be
-#          added
-# Values:  STRING  Default: INPUT_direct
-chain = INPUT_direct
-
-# Option:  zone
-# Notes    use command firewall-cmd --get-active-zones to see a list of all active zones. See firewalld man pages for more information on zones
-# Values:  STRING  Default: public
-zone = public
-
-# Option:  service
-# Notes    use command firewall-cmd --get-services to see a list of services available
-#          Examples services: amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps 
-#          freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos 
-#          kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s 
-#          postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy 
-#          telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
-# Values:  STRING Default: ssh 
-service = ssh
-
-# Option:  rejecttype (ipv4)
-# Notes    See iptables/firewalld man pages for ipv4 reject types. 
-# Values:  STRING
-rejecttype = icmp-port-unreachable
-
-# Option:  blocktype (ipv4/ipv6)
-# Notes    See iptables/firewalld man pages for jump targets. Common values are REJECT, 
-#          REJECT --reject-with icmp-port-unreachable, DROP
-# Values:  STRING
-blocktype = REJECT --reject-with <rejecttype>
-
-# Option:  rich-blocktype (ipv4/ipv6)
-# Notes    See firewalld man pages for jump targets. Common values are reject, 
-#          reject type="icmp-port-unreachable", drop
-# Values:  STRING
-rich-blocktype = reject type='<rejecttype>'
-
-[Init?family=inet6]
-
-# Option:  family(ipv6)
-# Notes    specifies the socket address family type
-# Values:  STRING  
-family = ipv6
-
-# Option:  rejecttype (ipv6)
-# Note:    See iptables/firewalld man pages for ipv6 reject types. 
-# Values:  STRING
-rejecttype = icmp6-port-unreachable

config/action.d/firewallcmd-ipset.conf

@@ -14,49 +14,20 @@
 
 [INCLUDES]
 
-before = firewallcmd-common.conf
+before = iptables-common.conf
 
 [Definition]
 
-actionstart = <ipstype_<ipsettype>/actionstart>
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
+actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
 
-actionflush = <ipstype_<ipsettype>/actionflush>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
+             ipset flush fail2ban-<name>
+             ipset destroy fail2ban-<name>
 
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
-             <actionflush>
-             <ipstype_<ipsettype>/actionstop>
+actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist
 
-actionban = <ipstype_<ipsettype>/actionban>
-
-# actionprolong = %(actionban)s
-
-actionunban = <ipstype_<ipsettype>/actionunban>
-
-[ipstype_ipset]
-
-actionstart = ipset create <ipmset> hash:ip timeout <default-ipsettime> <familyopt>
-
-actionflush = ipset flush <ipmset>
-
-actionstop = ipset destroy <ipmset>
-
-actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
-
-actionunban = ipset del <ipmset> <ip> -exist
-
-[ipstype_firewalld]
-
-actionstart = firewall-cmd --direct --new-ipset=<ipmset> --type=hash:ip --option=timeout=<default-ipsettime> <firewalld_familyopt>
-
-# TODO: there doesn't seem to be an explicit way to invoke the ipset flush function using firewall-cmd
-actionflush = 
-
-actionstop = firewall-cmd --direct --delete-ipset=<ipmset>
-
-actionban = firewall-cmd --ipset=<ipmset> --add-entry=<ip>
-
-actionunban = firewall-cmd --ipset=<ipmset> --remove-entry=<ip>
+actionunban = ipset del fail2ban-<name> <ip> -exist
 
 [Init]
 
@@ -67,55 +38,14 @@ actionunban = firewall-cmd --ipset=<ipmset> --remove-entry=<ip>
 #
 chain = INPUT_direct
 
-# Option: default-ipsettime
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
-default-ipsettime = 0
+# Option: bantime
+# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
+# Values:  [ NUM ]  Default: 600
 
-# Option: ipsettime
-# Notes:  specifies ticket timeout (handled ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
-ipsettime = 0
-
-# expresion to caclulate timeout from bantime, example:
-# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
-timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
-
-# Option: ipsettype
-# Notes.: defines type of ipset used for match-set (firewalld or ipset)
-# Values: firewalld or ipset
-# Default: ipset
-ipsettype = ipset
-
-# Option: actiontype
-# Notes.: defines additions to the blocking rule
-# Values: leave empty to block all attempts from the host
-# Default: Value of the multiport
-actiontype = <multiport>
-
-# Option: allports
-# Notes.: default addition to block all ports
-# Usage.: use in jail config:  banaction = firewallcmd-ipset[actiontype=<allports>]
-#         for all protocols:   banaction = firewallcmd-ipset[actiontype=""]
-allports = -p <protocol>
-
-# Option: multiport
-# Notes.: addition to block access only to specific ports
-# Usage.: use in jail config:  banaction = firewallcmd-ipset[actiontype=<multiport>]
-multiport = -p <protocol> -m multiport --dports <port>
-
-ipmset = f2b-<name>
-familyopt =
-firewalld_familyopt =
-
-[Init?family=inet6]
-
-ipmset = f2b-<name>6
-familyopt = family inet6
-firewalld_familyopt = --option=family=inet6
+bantime = 600
 
 
 # DEV NOTES:
 #
-# Author: Edgar Hoch, Daniel Black, Sergey Brester and Mihail Politaev
+# Author: Edgar Hoch and Daniel Black
 # firewallcmd-new / iptables-ipset-proto6 combined for maximium goodness

config/action.d/firewallcmd-multiport.conf

@@ -5,22 +5,59 @@
 
 [INCLUDES]
 
-before = firewallcmd-common.conf
+before = iptables-common.conf
 
 [Definition]
 
-actionstart = firewall-cmd --direct --add-chain <family> filter f2b-<name>
-              firewall-cmd --direct --add-rule <family> filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
+              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
 
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             firewall-cmd --direct --remove-rules <family> filter f2b-<name>
-             firewall-cmd --direct --remove-chain <family> filter f2b-<name>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
+             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
 
 # Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$'
 
-actioncheck = firewall-cmd --direct --get-chains <family> filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
+actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
 
-actionban = firewall-cmd --direct --add-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+
+actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+
+[Init]
+
+# Default name of the chain
+name = default
+
+chain = INPUT_direct
+
+# Could also use port numbers separated by a comma. 
+port = 1:65535
+
+
+# Option:  protocol
+# Values:  [ tcp | udp | icmp | all ]
+
+protocol = tcp
+
+
+
+# DEV NOTES:
+#
+# Author: Donald Yandt 
+# Uses "FirewallD" instead of the "iptables daemon".
+#
+#
+# Output:
+# actionstart:
+# $ firewall-cmd --direct --add-chain ipv4 filter f2b-apache-modsecurity
+# success
+# $ firewall-cmd --direct --add-rule ipv4 filter f2b-apache-modsecurity 1000 -j RETURN
+# success
+# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 80,443 -j f2b-apache-modsecurity
+# success
+# actioncheck:
+# $ firewall-cmd --direct --get-chains ipv4 filter f2b-apache-modsecurity | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$'
+# f2b-apache-modsecurity
 
-actionunban = firewall-cmd --direct --remove-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>

config/action.d/firewallcmd-new.conf

@@ -4,23 +4,32 @@
 
 [INCLUDES]
 
-before = firewallcmd-common.conf
+before = iptables-common.conf
 
 [Definition]
 
-actionstart = firewall-cmd --direct --add-chain <family> filter f2b-<name>
-              firewall-cmd --direct --add-rule <family> filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
+              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
 
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             firewall-cmd --direct --remove-rules <family> filter f2b-<name>
-             firewall-cmd --direct --remove-chain <family> filter f2b-<name>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
+             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
 
-actioncheck = firewall-cmd --direct --get-chains <family> filter | sed -e 's, ,\n,g' | grep -q 'f2b-<name>$'
+actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q 'f2b-<name>$'
 
-actionban = firewall-cmd --direct --add-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
 
-actionunban = firewall-cmd --direct --remove-rule <family> filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+
+[Init]
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  [ STRING ]
+#
+chain = INPUT_direct
 
 # DEV NOTES:
 #

config/action.d/firewallcmd-rich-logging.conf

@@ -1,6 +1,6 @@
 # Fail2Ban configuration file
 #
-# Authors: Donald Yandt, Sergey G. Brester
+# Author: Donald Yandt 
 # 
 # Because of the rich rule commands requires firewalld-0.3.1+
 # This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not
@@ -10,20 +10,56 @@
 #
 # If you use the --permanent rule you get a xml file in /etc/firewalld/zones/<zone>.xml that can be shared and parsed easliy
 #
-# This is an derivative of firewallcmd-rich-rules.conf, see there for details and other parameters.
-
-[INCLUDES]
-
-before = firewallcmd-rich-rules.conf
+# Example commands to view rules:
+# firewall-cmd [--zone=<zone>] --list-rich-rules
+# firewall-cmd [--zone=<zone>] --list-all
+# firewall-cmd [--zone=zone] --query-rich-rule='rule'
 
 [Definition]
 
-rich-suffix = log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <rich-blocktype>
+actionstart = 
+
+actionstop = 
+
+actioncheck = 
+
+# you can also use zones and/or service names. 
+#
+# zone example: 
+# 	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' port port='<port>' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"
+# service name example:
+#	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' service name='<service>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"
+# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges seperated by a comma or space for an example: http, https, 22-60, 18 smtp 
+
+actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"; done
+	   
+actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"; done
 
 [Init]
 
+name = default
+
 # log levels are "emerg", "alert", "crit", "error", "warning", "notice", "info" or "debug"
 level = info
 
 # log rate per minute
 rate = 1
+
+zone = public
+
+# use command firewall-cmd --get-services to see a list of services available
+#
+# Examples:
+#
+# amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps 
+# freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos 
+# kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s 
+# postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy 
+# telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
+
+service = ssh
+
+# reject types: 'icmp-net-unreachable', 'icmp-host-unreachable', 'icmp-port-unreachable', 'icmp-proto-unreachable', 
+# 'icmp-net-prohibited', 'icmp-host-prohibited', 'icmp-admin-prohibited' or 'tcp-reset'
+
+blocktype = reject type='icmp-port-unreachable'

config/action.d/firewallcmd-rich-rules.conf

@@ -13,10 +13,6 @@
 # firewall-cmd [--zone=<zone>] --list-all
 # firewall-cmd [--zone=zone] --query-rich-rule='rule'
 
-[INCLUDES]
-
-before = firewallcmd-common.conf
-
 [Definition]
 
 actionstart = 
@@ -28,17 +24,34 @@ actioncheck =
 #you can also use zones and/or service names. 
 #
 # zone example: 
-# firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' port port='<port>' protocol='<protocol>' <rich-blocktype>"
-#
+# 	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' port port='<port>' protocol='<protocol>' <blocktype>"
 # service name example:
-# firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' service name='<service>' <rich-blocktype>"
-#
-# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges separated by a comma or space for an example: http, https, 22-60, 18 smtp 
+#	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' service name='<service>' <blocktype>"
+# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges seperated by a comma or space for an example: http, https, 22-60, 18 smtp 
 
-fwcmd_rich_rule = rule family='<family>' source address='<ip>' port port='$p' protocol='<protocol>' %(rich-suffix)s
-
-actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="%(fwcmd_rich_rule)s"; done
+actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' <blocktype>"; done
 	   
-actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="%(fwcmd_rich_rule)s"; done
+actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' <blocktype>"; done
 
-rich-suffix = <rich-blocktype>
+[Init]
+
+name = default
+
+zone = public
+
+# use command firewall-cmd --get-services to see a list of services available
+#
+# Examples:
+#
+# amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps 
+# freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos 
+# kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s 
+# postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy 
+# telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
+
+service = ssh
+
+# reject types: 'icmp-net-unreachable', 'icmp-host-unreachable', 'icmp-port-unreachable', 'icmp-proto-unreachable', 
+# 'icmp-net-prohibited', 'icmp-host-prohibited', 'icmp-admin-prohibited' or 'tcp-reset'
+
+blocktype = reject type='icmp-port-unreachable'

config/action.d/helpers-common.conf

@@ -1,17 +0,0 @@
-[DEFAULT]
-
-# Usage:
-#   _grep_logs_args = 'test'
-#   (printf %%b "Log-excerpt contains 'test':\n"; %(_grep_logs)s; printf %%b "Log-excerpt contains 'test':\n") | mail ...
-#
-_grep_logs = logpath="<logpath>"; grep <grepopts> %(_grep_logs_args)s $logpath | <greplimit>
-# options `-wF` used to match only whole words and fixed string (not as pattern)
-_grep_logs_args = -wF "<ip>"
-
-# Used for actions, that should not by executed if ticket was restored:
-_bypass_if_restored = if [ '<restored>' = '1' ]; then exit 0; fi;
-
-[Init]
-greplimit = tail -n <grepmax>
-grepmax = 1000
-grepopts = -m <grepmax>

config/action.d/hostsdeny.conf

@@ -8,13 +8,13 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = 
@@ -31,7 +31,8 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "<daemon_list>: <ip_value>\n" >> <file>
+actionban = IP=<ip> &&
+            printf %%b "<daemon_list>: $IP\n" >> <file>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -39,7 +40,7 @@ actionban = printf %%b "<daemon_list>: <ip_value>\n" >> <file>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = IP=$(echo "<ip_value>" | sed 's/[][\.]/\\\0/g') && sed -i "/^<daemon_list>: $IP$/d" <file>
+actionunban = echo "/^<daemon_list>: <ip>$/<br>d<br>w<br>q" | ed <file>
 
 [Init]
 
@@ -54,9 +55,3 @@ file = /etc/hosts.deny
 #          for hosts.deny/hosts_access. Default is all services.
 # Values:  STR  Default: ALL
 daemon_list = ALL
-
-# internal variable IP (to differentiate the IPv4 and IPv6 syntax, where it is enclosed in brackets):
-ip_value = <ip>
-
-[Init?family=inet6]
-ip_value = [<ip>]

config/action.d/ipfilter.conf

@@ -9,7 +9,7 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 # enable IPF if not already enabled
@@ -17,7 +17,7 @@ actionstart = /sbin/ipf -E
 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 # don't disable IPF with "/sbin/ipf -D", there may be other filters in use

config/action.d/ipfw.conf

@@ -8,14 +8,14 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 
 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = 

config/action.d/iptables-allports.conf

@@ -3,6 +3,8 @@
 # Author: Cyril Jaquier
 # Modified: Yaroslav O. Halchenko <debian@onerussian.com>
 # 			made active on all ports from original iptables.conf
+# Modified: Alexander Koeppe <format_c@online.de>
+#        make config file IPv6 capable
 #
 #
 
@@ -14,26 +16,35 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = <iptables> -N f2b-<name>
               <iptables> -A f2b-<name> -j <returntype>
               <iptables> -I <chain> -p <protocol> -j f2b-<name>
 
+actionstart6 = <ip6tables> -N f2b-<name>
+               <ip6tables> -A f2b-<name> -j <returntype>
+               <ip6tables> -I <chain> -p <protocol> -j f2b-<name>
+
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = <iptables> -D <chain> -p <protocol> -j f2b-<name>
-             <actionflush>
+             <iptables> -F f2b-<name>
              <iptables> -X f2b-<name>
 
+actionstop6 = <ip6tables> -D <chain> -p <protocol> -j f2b-<name>
+              <ip6tables> -F f2b-<name>
+              <ip6tables> -X f2b-<name>
+
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -42,6 +53,7 @@ actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Values:  CMD
 #
 actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
+actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -50,6 +62,8 @@ actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
 # Values:  CMD
 #
 actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
+actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j <blocktype6>
+
 
 [Init]
 

config/action.d/iptables-common.conf

@@ -7,8 +7,8 @@
 #
 # The user can override the defaults in iptables-common.local
 #
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable (see new section Init?family=inet6)
+# Modified: Alexander Koeppe <format_c@online.de>
+#       made config file IPv6 capable
 
 [INCLUDES]
 
@@ -16,15 +16,6 @@ after = iptables-blocktype.local
         iptables-common.local
 # iptables-blocktype.local is obsolete
 
-[Definition]
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = <iptables> -F f2b-<name>
-
-
 [Init]
 
 # Option:  chain
@@ -55,6 +46,7 @@ protocol = tcp
 #          REJECT, REJECT --reject-with icmp-port-unreachable
 # Values:  STRING
 blocktype = REJECT --reject-with icmp-port-unreachable
+blocktype6 = REJECT --reject-with icmp6-port-unreachable
 
 # Option:  returntype
 # Note:    This is the default rule on "actionstart". This should be RETURN
@@ -75,18 +67,7 @@ lockingopt = -w
 # Values:  STRING
 iptables = iptables <lockingopt>
 
-
-[Init?family=inet6]
-
-# Option:  blocktype (ipv6)
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp6-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp6-port-unreachable
-
-# Option:  iptables (ipv6)
+# Option:  ip6tables
 # Notes.:  Actual command to be executed, including common to all calls options
 # Values:  STRING
-iptables = ip6tables <lockingopt>
-
+ip6tables = ip6tables <lockingopt>

config/action.d/iptables-ipset-proto4.conf

@@ -24,25 +24,18 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = ipset --create f2b-<name> iphash
               <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
 
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = ipset --flush f2b-<name>
-
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
-             <actionflush>
+             ipset --flush f2b-<name>
              ipset --destroy f2b-<name>
 
 # Option:  actionban

config/action.d/iptables-ipset-proto6-allports.conf

@@ -13,8 +13,8 @@
 # If you are running on an older kernel you make need to patch in external
 # modules which probably won't be protocol version 6.
 #
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable (see new section Init?family=inet6)
+# Modified: Alexander Koeppe <format_c@online.de>
+#       made config file IPv6 capable
 
 [INCLUDES]
 
@@ -23,25 +23,26 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipset create <ipmset> hash:ip timeout <default-ipsettime> <familyopt>
-              <iptables> -I <chain> -m set --match-set <ipmset> src -j <blocktype>
+actionstart = ipset create f2b-<name> hash:ip timeout <bantime>
+              <iptables> -I <chain> -m set --match-set f2b-<name> src -j <blocktype>
 
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = ipset flush <ipmset>
+actionstart6 = ipset create f2b-<name>6 hash:ip timeout <bantime> family inet6
+               <ip6tables> -I <chain> -m set --match-set f2b-<name>6 src -j <blocktype6>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -m set --match-set <ipmset> src -j <blocktype>
-             <actionflush>
-             ipset destroy <ipmset>
+actionstop = <iptables> -D <chain> -m set --match-set f2b-<name> src -j <blocktype>
+             ipset flush f2b-<name>
+             ipset destroy f2b-<name>
+
+actionstop6 = <ip6tables> -D <chain> -m set --match-set f2b-<name>6 src -j <blocktype6>
+              ipset flush f2b-<name>6
+              ipset destroy f2b-<name>6
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -49,9 +50,8 @@ actionstop = <iptables> -D <chain> -m set --match-set <ipmset> src -j <blocktype
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
-
-# actionprolong = %(actionban)s
+actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
+actionban6 = ipset add f2b-<name>6 <ip> timeout <bantime> -exist
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -59,29 +59,13 @@ actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipset del <ipmset> <ip> -exist
+actionunban = ipset del f2b-<name> <ip> -exist
+actionunban6 = ipset del f2b-<name>6 <ip> -exist
 
 [Init]
 
-# Option: default-ipsettime
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
-default-ipsettime = 0
-
-# Option: ipsettime
-# Notes:  specifies ticket timeout (handled ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
-ipsettime = 0
-
-# expresion to caclulate timeout from bantime, example:
-# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
-timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
-
-ipmset = f2b-<name>
-familyopt =
-
-
-[Init?family=inet6]
-
-ipmset = f2b-<name>6
-familyopt = family inet6
+# Option: bantime
+# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
+# Values:  [ NUM ]  Default: 600
+#
+bantime = 600

config/action.d/iptables-ipset-proto6.conf

@@ -13,8 +13,8 @@
 # If you are running on an older kernel you make need to patch in external
 # modules.
 #
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
-#       made config file IPv6 capable (see new section Init?family=inet6)
+# Modified: Alexander Koeppe <format_c@online.de>
+#       made config file IPv6 capable
 
 [INCLUDES]
 
@@ -23,25 +23,26 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipset create <ipmset> hash:ip timeout <default-ipsettime> <familyopt>
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>
+actionstart = ipset create f2b-<name> hash:ip timeout <bantime>
+              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
 
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = ipset flush <ipmset>
+actionstart6 = ipset create f2b-<name>6 hash:ip timeout <bantime> family inet6
+               <ip6tables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name>6 src -j <blocktype6>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>
-             <actionflush>
-             ipset destroy <ipmset>
+actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
+             ipset flush f2b-<name>
+             ipset destroy f2b-<name>
+
+actionstop6 = <ip6tables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name>6 src -j <blocktype6>
+              ipset flush f2b-<name>6
+              ipset destroy f2b-<name>6
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -49,9 +50,8 @@ actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
-
-# actionprolong = %(actionban)s
+actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
+actionban6 = ipset add f2b-<name>6 <ip> timeout <bantime> -exist
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -59,29 +59,13 @@ actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipset del <ipmset> <ip> -exist
+actionunban = ipset del f2b-<name> <ip> -exist
+actionunban6 = ipset del f2b-<name>6 <ip> -exist
 
 [Init]
 
-# Option: default-ipsettime
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
-default-ipsettime = 0
-
-# Option: ipsettime
-# Notes:  specifies ticket timeout (handled ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
-ipsettime = 0
-
-# expresion to caclulate timeout from bantime, example:
-# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
-timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
-
-ipmset = f2b-<name>
-familyopt =
-
-
-[Init?family=inet6]
-
-ipmset = f2b-<name>6
-familyopt = family inet6
+# Option: bantime
+# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
+# Values:  [ NUM ]  Default: 600
+#
+bantime = 600

config/action.d/iptables-multiport-log.conf

@@ -7,6 +7,8 @@
 # make "f2b-<name>-log" chain to log and drop
 # insert a jump to f2b-<name> from -I <chain> if proto/port match
 #
+# Modified: Alexander Koeppe <format_c@online.de>
+#       made config file IPv6 capable
 #
 
 [INCLUDES]
@@ -16,7 +18,7 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = <iptables> -N f2b-<name>
@@ -26,27 +28,35 @@ actionstart = <iptables> -N f2b-<name>
               <iptables> -I f2b-<name>-log -j LOG --log-prefix "$(expr f2b-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
               <iptables> -A f2b-<name>-log -j <blocktype>
 
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = <iptables> -F f2b-<name>
-              <iptables> -F f2b-<name>-log
+actionstart6 = <ip6tables> -N f2b-<name>
+               <ip6tables> -A f2b-<name> -j <returntype>
+               <ip6tables> -I <chain> 1 -p <protocol> -m multiport --dports <port> -j f2b-<name>
+               <ip6tables> -N f2b-<name>-log
+               <ip6tables> -I f2b-<name>-log -j LOG --log-prefix "$(expr f2b-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
+               <ip6tables> -A f2b-<name>-log -j <blocktype6>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             <actionflush>
+             <iptables> -F f2b-<name>
+             <iptables> -F f2b-<name>-log
              <iptables> -X f2b-<name>
              <iptables> -X f2b-<name>-log
 
+actionstop6 = <ip6tables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
+              <ip6tables> -F f2b-<name>
+              <ip6tables> -F f2b-<name>-log
+              <ip6tables> -X f2b-<name>
+              <ip6tables> -X f2b-<name>-log
+
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = <iptables> -n -L f2b-<name>-log >/dev/null
+actioncheck6 = <ip6tables> -n -L f2b-<name>-log >/dev/null
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -55,6 +65,7 @@ actioncheck = <iptables> -n -L f2b-<name>-log >/dev/null
 # Values:  CMD
 #
 actionban = <iptables> -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
+actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -63,6 +74,7 @@ actionban = <iptables> -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
 # Values:  CMD
 #
 actionunban = <iptables> -D f2b-<name> -s <ip> -j f2b-<name>-log
+actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j f2b-<name>-log
 
 [Init]
 

config/action.d/iptables-multiport.conf

@@ -2,6 +2,8 @@
 #
 # Author: Cyril Jaquier
 # Modified by Yaroslav Halchenko for multiport banning
+# Modified: Alexander Koeppe <format_c@online.de>
+#       made config file IPv6 capable
 #
 
 [INCLUDES]
@@ -11,26 +13,35 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = <iptables> -N f2b-<name>
               <iptables> -A f2b-<name> -j <returntype>
               <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
 
+actionstart6 = <ip6tables> -N f2b-<name>
+               <ip6tables> -A f2b-<name> -j <returntype>
+               <ip6tables> -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
+
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             <actionflush>
+             <iptables> -F f2b-<name>
              <iptables> -X f2b-<name>
 
+actionstop6 = <ip6tables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
+              <ip6tables> -F f2b-<name>
+              <ip6tables> -X f2b-<name>
+
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -39,6 +50,7 @@ actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Values:  CMD
 #
 actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
+actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -47,6 +59,7 @@ actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
 # Values:  CMD
 #
 actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
+actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j <blocktype6>
 
 [Init]
 

config/action.d/iptables-new.conf

@@ -4,6 +4,8 @@
 # Copied from iptables.conf and modified by Yaroslav Halchenko 
 #  to fulfill the needs of bugreporter dbts#350746.
 #
+# Modified: Alexander Koeppe <format_c@online.de>
+#       made config file IPv6 capable
 #
 
 [INCLUDES]
@@ -13,26 +15,35 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = <iptables> -N f2b-<name>
               <iptables> -A f2b-<name> -j <returntype>
               <iptables> -I <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
 
+actionstart6 = <ip6tables> -N f2b-<name>
+               <ip6tables> -A f2b-<name> -j <returntype>
+               <ip6tables> -I <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
+
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = <iptables> -D <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
-             <actionflush>
+             <iptables> -F f2b-<name>
              <iptables> -X f2b-<name>
 
+actionstop6 = <ip6tables> -D <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
+              <ip6tables> -F f2b-<name>
+              <ip6tables> -X f2b-<name>
+
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -41,6 +52,7 @@ actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Values:  CMD
 #
 actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
+actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -49,6 +61,7 @@ actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
 # Values:  CMD
 #
 actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
+actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j <blocktype6>
 
 [Init]
 

config/action.d/iptables-xt_recent-echo.conf

@@ -2,8 +2,9 @@
 #
 # Author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
 #
-# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
+# Modified: Alexander Koeppe <format_c@online.de>
 #       made config file IPv6 capable
+#
 
 [INCLUDES]
 
@@ -12,7 +13,7 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 # Changing iptables rules requires root privileges. If fail2ban is
@@ -23,36 +24,34 @@ before = iptables-common.conf
 # iptables-persistent package).
 # 
 # Explanation of the rule below:
-#    Check if any packets coming from an IP on the <iptname>
+#    Check if any packets coming from an IP on the f2b-<name>
 #    list have been seen in the last 3600 seconds. If yes, update the
 #    timestamp for this IP and drop the packet. If not, let the packet
 #    through.
 #
-#    Fail2ban inserts blacklisted hosts into the <iptname> list
+#    Fail2ban inserts blacklisted hosts into the f2b-<name> list
 #    and removes them from the list after some time, according to its
 #    own rules. The 3600 second timeout is independent and acts as a
 #    safeguard in case the fail2ban process dies unexpectedly. The
 #    shorter of the two timeouts actually matters.
-actionstart = if [ `id -u` -eq 0 ];then <iptables> -I <chain> -m recent --update --seconds 3600 --name <iptname> -j <blocktype>;fi
-
-# Option:  actionflush
-#
-# [TODO] Flushing is currently not implemented for xt_recent
-#
-actionflush = 
+actionstart = if [ `id -u` -eq 0 ];then <iptables> -I <chain> -m recent --update --seconds 3600 --name f2b-<name> -j <blocktype>;fi
+actionstart6 = if [ `id -u` -eq 0 ];then <ip6tables> -I <chain> -m recent --update --seconds 3600 --name f2b-<name>6 -j <blocktype6>;fi
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = echo / > /proc/net/xt_recent/<iptname>
-             if [ `id -u` -eq 0 ];then <iptables> -D <chain> -m recent --update --seconds 3600 --name <iptname> -j <blocktype>;fi
+actionstop = echo / > /proc/net/xt_recent/f2b-<name>
+             if [ `id -u` -eq 0 ];then <iptables> -D <chain> -m recent --update --seconds 3600 --name f2b-<name> -j <blocktype>;fi
+actionstop6 = echo / > /proc/net/xt_recent/f2b-<name>6
+             if [ `id -u` -eq 0 ];then <ip6tables> -D <chain> -m recent --update --seconds 3600 --name f2b-<name>6 -j <blocktype6>;fi
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = test -e /proc/net/xt_recent/<iptname>
+actioncheck = test -e /proc/net/xt_recent/f2b-<name>
+actioncheck6 = test -e /proc/net/xt_recent/f2b-<name>6
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -60,7 +59,8 @@ actioncheck = test -e /proc/net/xt_recent/<iptname>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = echo +<ip> > /proc/net/xt_recent/<iptname>
+actionban = echo +<ip> > /proc/net/xt_recent/f2b-<name>
+actionban6 = echo +<ip> > /proc/net/xt_recent/f2b-<name>6
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -68,12 +68,8 @@ actionban = echo +<ip> > /proc/net/xt_recent/<iptname>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = echo -<ip> > /proc/net/xt_recent/<iptname>
+actionunban = echo -<ip> > /proc/net/xt_recent/f2b-<name>
+actionunban6 = echo -<ip> > /proc/net/xt_recent/f2b-<name>6
 
 [Init]
 
-iptname              = f2b-<name>
-
-[Init?family=inet6]
-
-iptname = f2b-<name>6

config/action.d/iptables.conf

@@ -2,6 +2,8 @@
 #
 # Author: Cyril Jaquier
 #
+# Modified: Alexander Koeppe <format_c@online.de>
+#       made config file IPv6 capable
 #
 
 [INCLUDES]
@@ -11,26 +13,35 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = <iptables> -N f2b-<name>
               <iptables> -A f2b-<name> -j <returntype>
               <iptables> -I <chain> -p <protocol> --dport <port> -j f2b-<name>
 
+actionstart6 = <ip6tables> -N f2b-<name>
+               <ip6tables> -A f2b-<name> -j <returntype>
+               <ip6tables> -I <chain> -p <protocol> --dport <port> -j f2b-<name>
+
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = <iptables> -D <chain> -p <protocol> --dport <port> -j f2b-<name>
-             <actionflush>
+             <iptables> -F f2b-<name>
              <iptables> -X f2b-<name>
 
+actionstop6 = <ip6tables> -D <chain> -p <protocol> --dport <port> -j f2b-<name>
+              <ip6tables> -F f2b-<name>
+              <ip6tables> -X f2b-<name>
+
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -39,6 +50,7 @@ actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Values:  CMD
 #
 actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
+actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -47,6 +59,7 @@ actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
 # Values:  CMD
 #
 actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
+actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j <blocktype6>
 
 [Init]
 

config/action.d/mail-buffered.conf

@@ -6,21 +6,18 @@
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = printf %%b "Hi,\n
               The jail <name> has been started successfully.\n
               Output will be buffered until <lines> lines are available.\n
               Regards,\n
-              Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started on `uname -n`" <dest>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile> ]; then
@@ -28,13 +25,13 @@ actionstop = if [ -f <tmpfile> ]; then
                  These hosts have been banned by Fail2Ban.\n
                  `cat <tmpfile>`
                  Regards,\n
-                 Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: Summary from <fq-hostname>" <dest>
+                 Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary from `uname -n`" <dest>
                  rm <tmpfile>
              fi
              printf %%b "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -55,7 +52,7 @@ actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
                 These hosts have been banned by Fail2Ban.\n
                 `cat <tmpfile>`
                 \nRegards,\n
-                Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: Summary" <dest>
+                Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest>
                 rm <tmpfile>
             fi
 

config/action.d/mail-whois-common.conf

@@ -17,7 +17,7 @@ _whois = whois <ip> || echo "missing whois program"
 # character set before sending it to a mail program
 # make sure you have 'file' and 'iconv' commands installed when opting for that
 _whois_target_charset = UTF-8
-_whois_convert_charset = (%(_whois)s) |
+_whois_convert_charset = whois <ip> |
                          { WHOIS_OUTPUT=$(cat) ; WHOIS_CHARSET=$(printf %%b "$WHOIS_OUTPUT" | file -b --mime-encoding -) ; printf %%b "$WHOIS_OUTPUT" | iconv -f $WHOIS_CHARSET -t %(_whois_target_charset)s//TRANSLIT - ; }
 
 # choose between _whois and _whois_convert_charset in mail-whois-common.local

config/action.d/mail-whois-lines.conf

@@ -7,30 +7,26 @@
 [INCLUDES]
 
 before = mail-whois-common.conf
-         helpers-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = printf %%b "Hi,\n
               The jail <name> has been started successfully.\n
               Regards,\n
-              Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started on `uname -n`" <dest>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = printf %%b "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -44,19 +40,15 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-
-_ban_mail_content = ( printf %%b "Hi,\n
+actionban = printf %%b "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n"
-            %(_whois_command)s;
-            printf %%b "\nLines containing failures of <ip> (max <grepmax>)\n";
-            %(_grep_logs)s;
-            printf %%b "\n
+            Here is more information about <ip> :\n
+            `%(_whois_command)s`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `grep -E <grepopts> '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
             Regards,\n
-            Fail2Ban" )
-
-actionban = %(_ban_mail_content)s | <mailcmd> "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
+            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from  `uname -n`" <dest>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -68,12 +60,6 @@ actionunban =
 
 [Init]
 
-# Option:  mailcmd
-# Notes.:  Your system mail command. Is passed 2 args: subject and recipient
-# Values:  CMD
-#
-mailcmd = mail -E 'set escape' -s
-
 # Default name of the chain
 #
 name = default
@@ -88,5 +74,4 @@ logpath = /dev/null
 
 # Number of log lines to include in the email
 #
-#grepmax = 1000
-#grepopts = -m <grepmax>
+grepopts = -m 1000

config/action.d/mail-whois.conf

@@ -10,26 +10,23 @@ before = mail-whois-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = printf %%b "Hi,\n
               The jail <name> has been started successfully.\n
               Regards,\n
-              Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started on `uname -n`" <dest>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = printf %%b "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -49,7 +46,7 @@ actionban = printf %%b "Hi,\n
             Here is more information about <ip> :\n
             `%(_whois_command)s`\n
             Regards,\n
-            Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
+            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the

config/action.d/mail.conf

@@ -6,26 +6,23 @@
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = printf %%b "Hi,\n
               The jail <name> has been started successfully.\n
               Regards,\n
-              Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started  on <fq-hostname>" <dest>
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started  on `uname -n`" <dest>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = printf %%b "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -43,7 +40,7 @@ actionban = printf %%b "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n
             Regards,\n
-            Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
+            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the

config/action.d/mynetwatchman.conf

@@ -28,13 +28,13 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =

config/action.d/netscaler.conf

@@ -1,33 +0,0 @@
-# Fail2ban Citrix Netscaler Action
-# by Juliano Jeziorny
-# juliano@jeziorny.eu
-#
-# The script will add offender IPs to a dataset on netscaler, the dataset can then be used to block the IPs at a cs/vserver or global level
-# This dataset is then used to block IPs using responder policies on the netscaler.
-# 
-# The script assumes using HTTPS with unsecure certificate to access the netscaler, 
-# if you have a valid certificate installed remove the -k from the curl lines, or if you want http change it accordingly (and remove the -k)
-# 
-# This action depends on curl
-#
-# You need to populate the 3 options inside Init
-#
-# ns_host: IP or hostname of netslcaer appliance
-# ns_auth: username:password, suggest base64 encoded for a little added security (echo -n "username:password" | base64)
-# ns_dataset:  Name of the netscaler dataset holding the IPs to be blocked.
-# 
-# For further details on how to use it please check http://blog.ckzone.eu/2017/01/fail2ban-action-for-citrix-netscaler.html
-
-[Init]
-ns_host = 
-ns_auth = 
-ns_dataset = 
-
-[Definition]
-actionstart = curl -kH 'Authorization: Basic <ns_auth>' https://<ns_host>/nitro/v1/config
-
-actioncheck = 
-
-actionban = curl -k -H 'Authorization: Basic <ns_auth>' -X PUT -d '{"policydataset_value_binding":{"name":"<ns_dataset>","value":"<ip>"}}' https://<ns_host>/nitro/v1/config/
-
-actionunban = curl -H 'Authorization: Basic <ns_auth>' -X DELETE -k "https://<ns_host>/nitro/v1/config/policydataset_value_binding/<ns_dataset>?args=value:<ip>"

config/action.d/nftables-allports.conf

@@ -6,12 +6,17 @@
 # Modified: Alexander Belykh <albel727@ngs.ru>
 #                       adapted for nftables
 #
-# Obsolete: superseded by nftables[type=allports]
 
 [INCLUDES]
 
-before = nftables.conf
+before = nftables-common.conf
 
 [Definition]
 
-type = allports
+# Option:  nftables_mode
+# Notes.:  additional expressions for nftables filter rule
+# Values:  nftables expressions
+#
+nftables_mode = ip protocol <protocol>
+
+[Init]

config/action.d/nftables-common.conf

@@ -0,0 +1,119 @@
+# Fail2Ban configuration file
+#
+# Author: Daniel Black
+# Author: Cyril Jaquier
+# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
+# 			made active on all ports from original iptables.conf
+# Modified: Alexander Belykh <albel727@ngs.ru>
+#                       adapted for nftables
+#
+# This is a included configuration file and includes the definitions for the nftables
+# used in all nftables based actions by default.
+#
+# The user can override the defaults in nftables-common.local
+
+[INCLUDES]
+
+after = nftables-common.local
+
+[Definition]
+
+# Option:  nftables_mode
+# Notes.:  additional expressions for nftables filter rule
+# Values:  nftables expressions
+#
+nftables_mode = <protocol> dport \{ <port> \}
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = <nftables> add set <nftables_family> <nftables_table> f2b-<name> \{ type <nftables_type>\; \}
+              <nftables> insert rule <nftables_family> <nftables_table> <chain> %(nftables_mode)s ip saddr @f2b-<name> <blocktype>
+
+_nft_list = <nftables> --handle --numeric list chain <nftables_family> <nftables_table> <chain>
+_nft_get_handle_id = grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep -oe ' handle [0-9]*'
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = HANDLE_ID=$(%(_nft_list)s | %(_nft_get_handle_id)s)
+             <nftables> delete rule <nftables_family> <nftables_table> <chain> $HANDLE_ID
+             <nftables> delete set <nftables_family> <nftables_table> f2b-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = <nftables> list chain <nftables_family> <nftables_table> <chain> | grep -q '@f2b-<name>[ \t]'
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = <nftables> add element <nftables_family> <nftables_table> f2b-<name> \{ <ip> \}
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = <nftables> delete element <nftables_family> <nftables_table> f2b-<name> \{ <ip> \}
+
+[Init]
+
+# Option:  nftables_type
+# Notes.:  address type to work with
+# Values:  [ipv4_addr | ipv6_addr]  Default: ipv4_addr
+#
+nftables_type = ipv4_addr
+
+# Option:  nftables_family
+# Notes.:  address family to work in
+# Values:  [ip | ip6 | inet]  Default: inet
+#
+nftables_family = inet
+
+# Option:  nftables_table
+# Notes.:  table in the address family to work in
+# Values:  STRING  Default: filter
+#
+nftables_table = filter
+
+# Option:  chain
+# Notes    specifies the nftables chain to which the Fail2Ban rules should be
+#          added
+# Values:  STRING  Default: input
+chain = input
+
+# Default name of the filtering set
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp ] Default: tcp
+#
+protocol = tcp
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the nftables man page (section 8). Common values are drop
+#          reject, reject with icmp type host-unreachable
+# Values:  STRING
+blocktype = reject
+
+# Option:  nftables
+# Notes.:  Actual command to be executed, including common to all calls options
+# Values:  STRING
+nftables = nft

config/action.d/nftables-multiport.conf

@@ -6,12 +6,17 @@
 # Modified: Alexander Belykh <albel727@ngs.ru>
 #                       adapted for nftables
 #
-# Obsolete: superseded by nftables[type=multiport]
 
 [INCLUDES]
 
-before = nftables.conf
+before = nftables-common.conf
 
 [Definition]
 
-type = multiport
+# Option:  nftables_mode
+# Notes.:  additional expressions for nftables filter rule
+# Values:  nftables expressions
+#
+nftables_mode = <protocol> dport \{ <port> \}
+
+[Init]

config/action.d/nftables.conf

@@ -1,203 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Daniel Black
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-# This is a included configuration file and includes the definitions for the nftables
-# used in all nftables based actions by default.
-#
-# The user can override the defaults in nftables-common.local
-# Example: redirect flow to honeypot
-#
-# [Init]
-# table_family = ip
-# chain_type = nat
-# chain_hook = prerouting
-# chain_priority = -50
-# blocktype = counter redirect to 2222
-
-[INCLUDES]
-
-after = nftables-common.local
-
-[Definition]
-
-# Option:  type
-# Notes.:  type of the action.
-# Values:  [ multiport | allports ]  Default: multiport
-#
-type = multiport
-
-rule_match-custom =
-rule_match-allports = meta l4proto \{ <protocol> \}
-rule_match-multiport = $proto dport \{ $(echo '<port>' | sed s/:/-/g) \}
-match = <rule_match-<type>>
-
-# Option:  rule_stat
-# Notes.:  statement for nftables filter rule.
-#          leaving it empty will block all (include udp and icmp)
-# Values:  nftables statement
-#
-rule_stat = %(match)s <addr_family> saddr @<addr_set> <blocktype>
-
-# optional interator over protocol's:
-_nft_for_proto-custom-iter =
-_nft_for_proto-custom-done =
-_nft_for_proto-allports-iter =
-_nft_for_proto-allports-done =
-_nft_for_proto-multiport-iter = for proto in $(echo '<protocol>' | sed 's/,/ /g'); do
-_nft_for_proto-multiport-done = done
-
-_nft_list = <nftables> -a list chain <table_family> <table> <chain>
-_nft_get_handle_id = grep -oP '@<addr_set>\s+.*\s+\Khandle\s+(\d+)$'
-
-_nft_add_set = <nftables> add set <table_family> <table> <addr_set> \{ type <addr_type>\; \}
-              <_nft_for_proto-<type>-iter>
-              <nftables> add rule <table_family> <table> <chain> %(rule_stat)s
-              <_nft_for_proto-<type>-done>
-_nft_del_set = { %(_nft_list)s | %(_nft_get_handle_id)s; } | while read -r hdl; do
-               <nftables> delete rule <table_family> <table> <chain> $hdl; done
-              <nftables> delete set <table_family> <table> <addr_set>
-
-# Option:  _nft_shutdown_table
-# Notes.:  command executed after the stop in order to delete table (it checks that no sets are available):
-# Values:  CMD
-#
-_nft_shutdown_table = { <nftables> list table <table_family> <table> | grep -qP '^\s+set\s+'; } || {
-                        <nftables> delete table <table_family> <table>
-                      }
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-actionstart = <nftables> add table <table_family> <table>
-              <nftables> -- add chain <table_family> <table> <chain> \{ type <chain_type> hook <chain_hook> priority <chain_priority> \; \}
-              %(_nft_add_set)s
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action);
-#          uses `nft flush set ...` and as fallback (e. g. unsupported) recreates the set (with references)
-# Values:  CMD
-#
-actionflush = { <nftables> flush set <table_family> <table> <addr_set> 2> /dev/null; } || {
-              %(_nft_del_set)s
-              %(_nft_add_set)s
-              }
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-actionstop = %(_nft_del_set)s
-             <_nft_shutdown_table>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <nftables> list chain <table_family> <table> <chain> | grep -q '@<addr_set>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <nftables> add element <table_family> <table> <addr_set> \{ <ip> \}
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <nftables> delete element <table_family> <table> <addr_set> \{ <ip> \}
-
-[Init]
-
-# Option:  table
-# Notes.:  main table to store chain and sets (automatically created on demand)
-# Values:  STRING  Default: f2b-table
-table = f2b-table
-
-# Option:  table_family
-# Notes.:  address family to work in
-# Values:  [ip | ip6 | inet]  Default: inet
-table_family = inet
-
-# Option:  chain
-# Notes.:  main chain to store rules
-# Values:  STRING  Default: f2b-chain
-chain = f2b-chain
-
-# Option:  chain_type
-# Notes.:  refers to the kind of chain to be created
-# Values:  [filter | route | nat]  Default: filter
-#
-chain_type = filter
-
-# Option:  chain_hook
-# Notes.:  refers to the kind of chain to be created
-# Values:  [ prerouting | input | forward | output | postrouting ]  Default: input
-#
-chain_hook = input
-
-# Option:  chain_priority
-# Notes.:  priority in the chain.
-# Values:  NUMBER  Default: -1
-#
-chain_priority = -1
-
-# Option:  addr_type
-# Notes.:  address type to work with
-# Values:  [ipv4_addr | ipv6_addr]  Default: ipv4_addr
-#
-addr_type = ipv4_addr
-
-# Default name of the filtering set
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp ] Default: tcp
-#
-protocol = tcp
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the nftables man page (section 8). Common values are drop,
-#          reject, reject with icmpx type host-unreachable, redirect to 2222
-# Values:  STRING
-blocktype = reject
-
-# Option:  nftables
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-nftables = nft
-
-# Option: addr_set
-# Notes.: The name of the nft set used to store banned addresses
-# Values: STRING
-addr_set = addr-set-<name>
-
-# Option: addr_family
-# Notes.: The family of the banned addresses
-# Values: [ ip | ip6 ]
-addr_family = ip
-
-[Init?family=inet6]
-addr_family = ip6
-addr_type = ipv6_addr
-addr_set = addr6-set-<name>

config/action.d/nginx-block-map.conf

@@ -1,117 +0,0 @@
-# Fail2Ban configuration file for black-listing via nginx
-#
-# Author: Serg G. Brester (aka sebres)
-#
-# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration,
-# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban).
-#
-# Example (argument "token_id" resp. cookie "session_id" used here as unique identifier for user):
-#
-#   http {
-#     ...
-#     # maps to check user is blacklisted (banned in f2b):
-#     #map $arg_token_id      $blck_lst_tok { include blacklisted-tokens.map; }
-#     map  $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; }
-#     ...
-#     # special log-format to notify fail2ban about failures:
-#     log_format f2b_session_errors '$msec failure "$cookie_session_id" - $remote_addr - $remote_user '
-#      ;#                  '"$request" $status $bytes_sent '
-#       #                  '"$http_referer" "$http_user_agent"';
-#
-#     # location checking blacklisted values:
-#     location ... {
-#       # check banned sessionid:
-#       if ($blck_lst_ses != "") {
-#         try_files "" @f2b-banned;
-#       }
-#       ...
-#       # notify fail2ban about a failure inside nginx:
-#       error_page 401 = @notify-f2b;
-#       ...
-#     }
-#     ...
-#     # location for return with "403 Forbidden" if banned:
-#     location @f2b-banned {
-#       default_type text/html;
-#       return 403 "<br/><center>
-#         <b style=\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\">
-#         You are banned!</b></center>";
-#     }
-#     ...
-#     # location to notify fail2ban about a failure inside nginx:
-#     location @notify-f2b {
-#       access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;
-#     }
-#   }
-#   ...
-#
-# Note that quote-character (and possibly other special characters) are not allowed currently as session-id.
-# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service), 
-# like in example below:
-#
-#   location ... {
-#     if ($cookie_session_id !~ "^[\w\-]+$") {
-#       return  403 "Wrong session-id"
-#     }
-#     ...
-#   }
-#
-# The parameters for jail corresponding log-format (f2b_session_errors):
-#
-#   [nginx-blck-lst]
-#   filter =
-#   datepattern = ^Epoch
-#   failregex = ^ failure "<F-ID>[^"]+</F-ID>" - <ADDR>
-#   usedns = no
-#
-# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs):
-#
-#   [nginx-blck-ip]
-#   maxretry = 100
-#   filter =
-#   datepattern = ^Epoch
-#   failregex = ^ failure "[^"]+" - <ADDR>
-#   usedns = no
-#
-
-[Definition]
-
-# path to configuration of nginx (used to target nginx-instance in multi-instance system,
-# and as path for the blacklisted map):
-srv_cfg_path = /etc/nginx/
-
-# cmd-line arguments to supply to test/reload nginx:
-#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf
-srv_cmd = nginx
-
-# pid file (used to check nginx is running):
-srv_pid = /run/nginx.pid
-
-# command used to check whether nginx is running and configuration is valid:
-srv_is_running = [ -f "%(srv_pid)s" ]
-srv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt
-
-# first test nginx is running and configuration is correct, hereafter send reload signal:
-blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then
-                    %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;
-                  fi;
-
-# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file="/path/file.map"]`:
-blck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.map
-
-# Action definition:
-
-actionstart_on_demand = false
-actionstart = touch '%(blck_lst_file)s'
-
-actionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s
-
-actionstop = %(actionflush)s
-
-actioncheck = 
-
-_echo_blck_row = printf '\%%s 1;\n' "<fid>"
-
-actionban = %(_echo_blck_row)s >> '%(blck_lst_file)s'; %(blck_lst_reload)s
-
-actionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/^$id$/d" %(blck_lst_file)s; %(blck_lst_reload)s

config/action.d/npf.conf

@@ -1,61 +0,0 @@
-# Fail2Ban configuration file
-#
-# NetBSD npf ban/unban
-#
-# Author: Nils Ratusznik <nils@NetBSD.org>
-# Based on pf.conf action file
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
-# Values:  CMD
-#
-# we don't enable NPF automatically, as it will be enabled elsewhere
-actionstart = 
-
-
-# Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
-# Values:  CMD
-#
-# we don't disable NPF automatically either
-actionstop = 
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = 
-
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = /sbin/npfctl table <tablename> add <ip>
-
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-# note -r option used to remove matching rule
-actionunban = /sbin/npfctl table <tablename> rem <ip>
-
-[Init]
-# Option:  tablename
-# Notes.:  The pf table name.
-# Values:  [ STRING ]
-#
-tablename = fail2ban

config/action.d/nsupdate.conf

@@ -42,14 +42,14 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =
 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =

config/action.d/osx-afctl.conf

@@ -12,5 +12,5 @@ actioncheck =
 actionban = /usr/libexec/afctl -a <ip> -t <bantime>
 actionunban = /usr/libexec/afctl -r <ip>
 
-actionprolong = %(actionunban)s && %(actionban)s
-
+[Init]
+bantime = 2880

config/action.d/osx-ipfw.conf

@@ -9,14 +9,14 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 
 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = 

config/action.d/pf.conf

@@ -10,52 +10,30 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 # we don't enable PF automatically; to enable run pfctl -e 
 # or add `pf_enable="YES"` to /etc/rc.conf (tested on FreeBSD)
-# also, these rulesets are loaded into (nested) anchors
-# to enable them, add as wildcard:
-#     anchor "f2b/*"
-# or using jail names:
-#     anchor f2b {
-#        anchor name1
-#        anchor name2
-#        ...
-#     }
-# to your main pf ruleset, where "namei" are the names of the jails
-# which invoke this action
-actionstart = echo "table <<tablename>-<name>> persist counters" | <pfctl> -f-
-              port="<port>"; if [ "$port" != "" ] && case "$port" in \{*) false;; esac; then port="{$port}"; fi
-              echo "<block> proto <protocol> from <<tablename>-<name>> to <actiontype>" | <pfctl> -f-
+actionstart = echo "table <<tablename>-<name>> persist counters" | pfctl -f- 
+              echo "block proto <protocol> from <<tablename>-<name>> to any port <port>" | pfctl -f-
 
-# Option:  start_on_demand - to start action on demand
-# Example: `action=pf[actionstart_on_demand=true]`
-actionstart_on_demand = false
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 # we only disable PF rules we've installed prior
-actionstop = <pfctl> -sr 2>/dev/null | grep -v <tablename>-<name> | <pfctl> -f-
-             %(actionflush)s
-             <pfctl> -t <tablename>-<name> -T kill
-
-
-# Option:  actionflush
-# Notes.:  command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
-# Values:  CMD
-#
-actionflush = <pfctl> -t <tablename>-<name> -T flush
+actionstop = pfctl -sr 2>/dev/null | grep -v <tablename>-<name> | pfctl -f-
+             pfctl -t <tablename>-<name> -T flush
+             pfctl -t <tablename>-<name> -T kill
 
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <pfctl> -sr | grep -q <tablename>-<name>
+actioncheck = pfctl -sr | grep -q <tablename>-<name>
 
 
 # Option:  actionban
@@ -66,7 +44,7 @@ actioncheck = <pfctl> -sr | grep -q <tablename>-<name>
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = <pfctl> -t <tablename>-<name> -T add <ip>
+actionban = pfctl -t <tablename>-<name> -T add <ip>
 
 
 # Option:  actionunban
@@ -78,14 +56,7 @@ actionban = <pfctl> -t <tablename>-<name> -T add <ip>
 # Values:  CMD
 #
 # note -r option used to remove matching rule
-actionunban = <pfctl> -t <tablename>-<name> -T delete <ip>
-
-# Option: pfctl
-#
-# Use anchor as jailname to manipulate affected rulesets only.
-# If more parameter expected it can be extended with `pf[pfctl="<known/pfctl> ..."]`
-# 
-pfctl = pfctl -a f2b/<name>
+actionunban = pfctl -t <tablename>-<name> -T delete <ip>
 
 [Init]
 # Option:  tablename
@@ -94,31 +65,15 @@ pfctl = pfctl -a f2b/<name>
 #
 tablename = f2b
 
-# Option: block
-#
-# The action you want pf to take.
-# Probably, you want "block quick", but adjust as needed.
-block = block quick
-
 # Option:  protocol
 # Notes.:  internally used by config reader for interpolations.
 # Values:  [ tcp | udp | icmp | ipv6-icmp ] Default: tcp
 #
 protocol = tcp
 
-# Option: actiontype
-# Notes.: defines additions to the blocking rule
-# Values: leave empty to block all attempts from the host
-# Default: Value of the multiport
-actiontype = <multiport>
-
-# Option: allports
-# Notes.: default addition to block all ports
-# Usage.: use in jail config: "banaction = pf[actiontype=<allports>]"
-allports = any
-
-# Option: multiport
-# Notes.: addition to block access only to specific ports
-# Usage.: use in jail config: "banaction = pf[actiontype=<multiport>]"
-multiport = any port $port
+# Option:  port
+# Notes.:  the port to block, defaults to any
+# Values:  [ STRING ]
+#
+port = any
 

config/action.d/sendmail-buffered.conf

@@ -10,44 +10,41 @@ before = sendmail-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on <fq-hostname>
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
               From: <sendername> <<sender>>
               To: <dest>\n
               Hi,\n
               The jail <name> has been started successfully.\n
               Output will be buffered until <lines> lines are available.\n
               Regards,\n
-              Fail2Ban" | <mailcmd>
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile> ]; then
-                 printf %%b "Subject: [Fail2Ban] <name>: summary from <fq-hostname>
+                 printf %%b "Subject: [Fail2Ban] <name>: summary from `uname -n`
                  From: <sendername> <<sender>>
                  To: <dest>\n
                  Hi,\n
                  These hosts have been banned by Fail2Ban.\n
                  `cat <tmpfile>`
                  Regards,\n
-                 Fail2Ban" | <mailcmd>
+                 Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
                  rm <tmpfile>
              fi
-             printf %%b "Subject: [Fail2Ban] <name>: stopped  on <fq-hostname>
+             printf %%b "Subject: [Fail2Ban] <name>: stopped  on `uname -n`
              From: Fail2Ban <<sender>>
              To: <dest>\n
              Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban" | <mailcmd>
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -64,14 +61,14 @@ actioncheck =
 actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
             LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
             if [ $LINE -ge <lines> ]; then
-                printf %%b "Subject: [Fail2Ban] <name>: summary from <fq-hostname>
+                printf %%b "Subject: [Fail2Ban] <name>: summary from `uname -n`
                 From: <sendername> <<sender>>
                 To: <dest>\n
                 Hi,\n
                 These hosts have been banned by Fail2Ban.\n
                 `cat <tmpfile>`
                 Regards,\n
-                Fail2Ban" | <mailcmd>
+                Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
                 rm <tmpfile>
             fi
 

config/action.d/sendmail-common.conf

@@ -11,30 +11,30 @@ after = sendmail-common.local
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on <fq-hostname>
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
               Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
               From: <sendername> <<sender>>
               To: <dest>\n
               Hi,\n
               The jail <name> has been started successfully.\n
               Regards,\n
-              Fail2Ban" | <mailcmd>
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on <fq-hostname>
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
              Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
              From: <sendername> <<sender>>
              To: <dest>\n
              Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban" | <mailcmd>
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -60,10 +60,6 @@ actionunban =
 
 [Init]
 
-# Your system mail command
-#
-mailcmd = /usr/sbin/sendmail -f "<sender>" "<dest>"
-
 # Recipient mail address
 #
 dest = root

config/action.d/sendmail-geoip-lines.conf

@@ -7,13 +7,9 @@
 [INCLUDES]
 
 before = sendmail-common.conf
-         helpers-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  Command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -23,7 +19,7 @@ norestored = 1
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
@@ -36,12 +32,11 @@ actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostn
             http://whois.domaintools.com/<ip>\n\n
             Country:`geoiplookup -f /usr/share/GeoIP/GeoIP.dat "<ip>" | cut -d':' -f2-`
             AS:`geoiplookup -f /usr/share/GeoIP/GeoIPASNum.dat "<ip>" | cut -d':' -f2-`
-            hostname: <ip-host>\n\n
-            Lines containing failures of <ip> (max <grepmax>)\n";
-            %(_grep_logs)s;
-            printf %%b "\n
+            hostname: `host -t A <ip> 2>&1`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `grep -E <grepopts> '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
             Regards,\n
-            Fail2Ban" ) | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 
@@ -55,5 +50,4 @@ logpath = /dev/null
 
 # Number of log lines to include in the email
 #
-#grepmax = 1000
-#grepopts = -m <grepmax>
+grepopts = -m 1000

config/action.d/sendmail-whois-ipjailmatches.conf

@@ -7,20 +7,16 @@
 [INCLUDES]
 
 before = sendmail-common.conf
-         mail-whois-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
@@ -28,11 +24,11 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostnam
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
             Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
+            `/usr/bin/whois <ip>`\n\n
             Matches for <name> with <ipjailfailures> failures IP:<ip>\n
             <ipjailmatches>\n\n
             Regards,\n
-            Fail2Ban" | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 

config/action.d/sendmail-whois-ipmatches.conf

@@ -7,20 +7,16 @@
 [INCLUDES]
 
 before = sendmail-common.conf
-         mail-whois-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
@@ -28,11 +24,11 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostnam
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
             Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
+            `/usr/bin/whois <ip>`\n\n
             Matches with <ipfailures> failures IP:<ip>\n
             <ipmatches>\n\n
             Regards,\n
-            Fail2Ban" | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 

config/action.d/sendmail-whois-lines.conf

@@ -7,34 +7,28 @@
 [INCLUDES]
 
 before = sendmail-common.conf
-         mail-whois-common.conf
-         helpers-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n"
-            %(_whois_command)s;
-            printf %%b "\nLines containing failures of <ip> (max <grepmax>)\n";
-            %(_grep_logs)s;
-            printf %%b "\n
+            Here is more information about <ip> :\n
+            `/usr/bin/whois <ip> || echo missing whois program`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `grep -E <grepopts> '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
             Regards,\n
-            Fail2Ban" ) | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 
@@ -48,5 +42,4 @@ logpath = /dev/null
 
 # Number of log lines to include in the email
 #
-#grepmax = 1000
-#grepopts = -m <grepmax>
+grepopts = -m 1000

config/action.d/sendmail-whois-matches.conf

@@ -7,20 +7,16 @@
 [INCLUDES]
 
 before = sendmail-common.conf
-         mail-whois-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
@@ -28,11 +24,11 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostnam
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
             Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
+            `/usr/bin/whois <ip>`\n\n
             Matches:\n
             <matches>\n\n
             Regards,\n
-            Fail2Ban" | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 

config/action.d/sendmail-whois.conf

@@ -7,20 +7,16 @@
 [INCLUDES]
 
 before = sendmail-common.conf
-         mail-whois-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
@@ -28,9 +24,9 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostnam
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
             Here is more information about <ip> :\n
-            `%(_whois_command)s`\n
+            `/usr/bin/whois <ip> || echo missing whois program`\n
             Regards,\n
-            Fail2Ban" | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 

config/action.d/sendmail.conf

@@ -10,16 +10,13 @@ before = sendmail-common.conf
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
             From: <sendername> <<sender>>
             To: <dest>\n
@@ -27,7 +24,7 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostnam
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n
             Regards,\n
-            Fail2Ban" | <mailcmd>
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
 [Init]
 

config/action.d/shorewall-ipset-proto6.conf

@@ -47,15 +47,15 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = if ! ipset -quiet -name list f2b-<name> >/dev/null;
-              then ipset -quiet -exist create f2b-<name> hash:ip timeout <default-ipsettime>;
+              then ipset -quiet -exist create f2b-<name> hash:ip timeout <bantime>;
               fi
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = ipset flush f2b-<name>
@@ -66,9 +66,7 @@ actionstop = ipset flush f2b-<name>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add f2b-<name> <ip> timeout <ipsettime> -exist
-
-# actionprolong = %(actionban)s
+actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -78,16 +76,10 @@ actionban = ipset add f2b-<name> <ip> timeout <ipsettime> -exist
 #
 actionunban = ipset del f2b-<name> <ip> -exist
 
-# Option: default-ipsettime
-# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
-default-ipsettime = 0
+[Init]
 
-# Option: ipsettime
-# Notes:  specifies ticket timeout (handled ipset timeout only)
-# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
-ipsettime = 0
-
-# expresion to caclulate timeout from bantime, example:
-# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
-timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
+# Option: bantime
+# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
+# Values:  [ NUM ]  Default: 600
+#
+bantime = 600

config/action.d/shorewall.conf

@@ -9,7 +9,7 @@
 # connections. So if the attempter goes on trying using the same connection
 # he could even log in. In order to get the same behavior of the iptable
 # action (so that the ban is immediate) the /etc/shorewall/shorewall.conf
-# file should be modified with "BLACKLISTNEWONLY=No". Note that as of
+# file should me modified with "BLACKLISTNEWONLY=No". Note that as of
 # Shorewall 4.5.13 BLACKLISTNEWONLY is deprecated; however the equivalent
 # of BLACKLISTNEWONLY=No can now be achieved by setting BLACKLIST="ALL".
 # 
@@ -17,13 +17,13 @@
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = 
@@ -40,7 +40,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = shorewall<family> <blocktype> <ip>
+actionban = shorewall <blocktype> <ip>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -48,26 +48,12 @@ actionban = shorewall<family> <blocktype> <ip>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = shorewall<family> allow <ip>
-
+actionunban = shorewall allow <ip>
 
 [Init]
 
-# Option:  family
-# Note:    Control which version of command is executed
-# Values:  Empty or 6 in case of IPv6
-family = 
-
 # Option:  blocktype
 # Note:    This is what the action does with rules.
 #          See man page of shorewall for options that include drop, logdrop, reject, or logreject
 # Values:  STRING
 blocktype = reject
-
-[Init?family=inet6]
-
-# Option:  family
-# Note:    Control which version of command is executed
-# Values:  Empty or 6 in case of IPv6
-family = 6
-

config/action.d/smtp.py

@@ -123,12 +123,9 @@ class SMTPAction(ActionBase):
 		self.message_values = CallingMap(
 			jailname = self._jail.name,
 			hostname = socket.gethostname,
-			bantime = lambda: self._jail.actions.getBanTime(),
+			bantime = self._jail.actions.getBanTime,
 			)
 
-		# bypass ban/unban for restored tickets
-		self.norestored = 1
-
 	def _sendMessage(self, subject, text):
 		"""Sends message based on arguments and instance's properties.
 
@@ -159,25 +156,25 @@ class SMTPAction(ActionBase):
 		try:
 			self._logSys.debug("Connected to SMTP '%s', response: %i: %s",
 				self.host, *smtp.connect(self.host))
-			if self.user and self.password: # pragma: no cover (ATM no tests covering that)
+			if self.user and self.password:
 				smtp.login(self.user, self.password)
 			failed_recipients = smtp.sendmail(
 				self.fromaddr, self.toaddr.split(", "), msg.as_string())
-		except smtplib.SMTPConnectError: # pragma: no cover
+		except smtplib.SMTPConnectError:
 			self._logSys.error("Error connecting to host '%s'", self.host)
 			raise
-		except smtplib.SMTPAuthenticationError: # pragma: no cover
+		except smtplib.SMTPAuthenticationError:
 			self._logSys.error(
 				"Failed to authenticate with host '%s' user '%s'",
 				self.host, self.user)
 			raise
-		except smtplib.SMTPException: # pragma: no cover
+		except smtplib.SMTPException:
 			self._logSys.error(
 				"Error sending mail to host '%s' from '%s' to '%s'",
 				self.host, self.fromaddr, self.toaddr)
 			raise
 		else:
-			if failed_recipients: # pragma: no cover
+			if failed_recipients:
 				self._logSys.warning(
 					"Email to '%s' failed to following recipients: %r",
 					self.toaddr, failed_recipients)
@@ -186,7 +183,7 @@ class SMTPAction(ActionBase):
 			try:
 				self._logSys.debug("Disconnected from '%s', response %i: %s",
 					self.host, *smtp.quit())
-			except smtplib.SMTPServerDisconnected: # pragma: no cover
+			except smtplib.SMTPServerDisconnected:
 				pass # Not connected
 
 	def start(self):
@@ -214,8 +211,6 @@ class SMTPAction(ActionBase):
 			Dictionary which includes information in relation to
 			the ban.
 		"""
-		if aInfo.get('restored'):
-			return
 		aInfo.update(self.message_values)
 		message = "".join([
 			messages['ban']['head'],

config/action.d/symbiosis-blacklist-allports.conf

@@ -10,13 +10,13 @@ before = iptables-common.conf
 [Definition]
 
 # Option:  actionstart
-# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
+# Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart =
 
 # Option:  actionstop
-# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
+# Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop =

config/action.d/ufw.conf

@@ -13,45 +13,16 @@ actionstop =
 
 actioncheck = 
 
-# ufw does "quickly process packets for which we already have a connection" in before.rules,
-# therefore all related sockets should be closed
-# actionban is using `ss` to do so, this only handles IPv4 and IPv6.
+actionban = [ -n "<application>" ] && app="app <application>"
+            ufw insert <insertpos> <blocktype> from <ip> to <destination> $app
 
-actionban = if [ -n "<application>" ] && ufw app info "<application>"
-            then
-              ufw <add> <blocktype> from <ip> to <destination> app "<application>" comment "<comment>"
-            else
-              ufw <add> <blocktype> from <ip> to <destination> comment "<comment>"
-            fi
-            <kill>
-
-actionunban = if [ -n "<application>" ] && ufw app info "<application>"
-              then
-                ufw delete <blocktype> from <ip> to <destination> app "<application>"
-              else
-                ufw delete <blocktype> from <ip> to <destination>
-              fi
-
-# Option: kill-mode
-# Notes.: can be set to ss or conntrack (may be extended later with other modes) to immediately drop all connections from banned IP, default empty (no kill)
-# Example: banaction = ufw[kill-mode=ss]
-kill-mode =
-
-# intern conditional parameter used to provide killing mode after ban:
-_kill_ =
-_kill_ss = ss -K dst "[<ip>]"
-_kill_conntrack = conntrack -D -s "<ip>"
-
-# Option: kill
-# Notes.: can be used to specify custom killing feature, by default depending on option kill-mode
-# Examples: banaction = ufw[kill='ss -K "( sport = :http || sport = :https )" dst "[<ip>]"']
-#           banaction = ufw[kill='cutter "<ip>"']
-kill = <_kill_<kill-mode>>
+actionunban = [ -n "<application>" ] && app="app <application>"
+              ufw delete <blocktype> from <ip> to <destination> $app
 
 [Init]
-# Option: add
-# Notes.: can be set to "insert 1" to insert a rule at certain position (here 1):
-add = prepend
+# Option: insertpos
+# Notes.:  The position number in the firewall list to insert the block rule
+insertpos = 1
 
 # Option: blocktype
 # Notes.: reject or deny
@@ -65,10 +36,6 @@ destination = any
 # Notes.: application from sudo ufw app list
 application = 
 
-# Option: comment
-# Notes.: comment for rule added by fail2ban
-comment = by Fail2Ban after <failures> attempts against <name>
-
 # DEV NOTES:
 # 
 # Author: Guilhem Lettron

config/action.d/xarf-login-attack.conf

@@ -22,7 +22,7 @@
 # Login-Attack, Malware-Attack, Fraud (Phishing, etc.), Info DNSBL
 #
 # For details see:
-# https://github.com/xarf/xarf-specification
+# https://github.com/abusix/xarf-specification
 # http://www.x-arf.org/schemata.html
 #
 # Author: Daniel Black
@@ -32,61 +32,42 @@
 
 [Definition]
 
-# bypass ban/unban for restored tickets
-norestored = 1
-
 actionstart =
 
 actionstop =
 
 actioncheck =
 
-actionban = oifs=${IFS};
-            RESOLVER_ADDR="%(addr_resolver)s"
-            if [ "<debug>" -gt 0 ]; then echo "try to resolve $RESOLVER_ADDR"; fi
-            ADDRESSES=$(dig +short -t txt -q $RESOLVER_ADDR | tr -d '"')
-            IFS=,; ADDRESSES=$(echo $ADDRESSES)
-            IFS=${oifs}
+actionban = oifs=${IFS}; IFS=.;SEP_IP=( <ip> ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs}
             IP=<ip>
             FROM=<sender>
             SERVICE=<service>
             FAILURES=<failures>
-            REPORTID=<time>@<fq-hostname>
+            REPORTID=<time>@`uname -n`
             TLP=<tlp>
             PORT=<port>
             DATE=`LC_ALL=C date --date=@<time> +"%%a, %%d %%h %%Y %%T %%z"`
             if [ ! -z "$ADDRESSES" ]; then
-                oifs=${IFS}; IFS=,; ADDRESSES=$(echo $ADDRESSES)
-                IFS=${oifs}
-                (printf -- %%b "<header>\n<message>\n<report>\n\n";
+                (printf -- %%b "<header>\n<message>\n<report>\n";
                  date '+Note: Local timezone is %%z (%%Z)';
-                 printf -- %%b "\n<ipmatches>\n\n<footer>") | <mailcmd> <mailargs> $ADDRESSES
+                 printf -- %%b "<ipmatches>\n\n<footer>") | <mailcmd> <mailargs> ${ADDRESSES//,/\" \"}
             fi
 
 actionunban =
 
-# Server as resolver used in dig command
-#
-addr_resolver = <ip-rev>abuse-contacts.abusix.org
-
-# Option: boundary
-# Notes:  This can be overwritten to be safe for possible predictions
-boundary = bfbb0f920793ac03cb8634bde14d8a1e
-
-_boundary = Abuse<time>-<boundary>
-
+[Init]
 # Option: header
 # Notes:  This is really a fixed value
-header  = Subject: abuse report about $IP - $DATE\nAuto-Submitted: auto-generated\nX-XARF: PLAIN\nContent-Transfer-Encoding: 7bit\nContent-Type: multipart/mixed; charset=utf8;\n  boundary=%(_boundary)s;\n\n--%(_boundary)s\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8;\n
+header  = Subject: abuse report about $IP - $DATE\nAuto-Submitted: auto-generated\nX-XARF: PLAIN\nContent-Transfer-Encoding: 7bit\nContent-Type: multipart/mixed; charset=utf8;\n  boundary=Abuse-bfbb0f920793ac03cb8634bde14d8a1e;\n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8;\n
 
 # Option: footer
 # Notes:  This is really a fixed value and needs to match the report and header
 #         mime delimiters
-footer = \n\n--%(_boundary)s--
+footer = \n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e--
 
 # Option: report
 # Notes:  Intended to be fixed
-report =  --%(_boundary)s\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8; name=\"report.txt\";\n\n---\nReported-From: $FROM\nCategory: abuse\nReport-ID: $REPORTID\nReport-Type: login-attack\nService: $SERVICE\nVersion: 0.2\nUser-Agent: Fail2ban v0.9\nDate: $DATE\nSource-Type: ip-address\nSource: $IP\nPort: $PORT\nSchema-URL: http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json\nAttachment: text/plain\nOccurances: $FAILURES\nTLP: $TLP\n\n\n--%(_boundary)s\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf8; name=\"logfile.log\";
+report =  --Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8; name=\"report.txt\";\n\n---\nReported-From: $FROM\nCategory: abuse\nReport-ID: $REPORTID\nReport-Type: login-attack\nService: $SERVICE\nVersion: 0.2\nUser-Agent: Fail2ban v0.9\nDate: $DATE\nSource-Type: ip-address\nSource: $IP\nPort: $PORT\nSchema-URL: http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json\nAttachment: text/plain\nOccurances: $FAILURES\nTLP: $TLP\n\n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf8; name=\"logfile.log\";
 
 # Option: Message
 # Notes:  This can be modified by the users
@@ -135,7 +116,7 @@ logpath = /dev/null
 
 # Option:  sender
 # Notes.:  This is the sender that is included in the XARF report
-sender = fail2ban@<fq-hostname>
+sender = fail2ban@`uname -n`
 
 # Option:  port
 # Notes.:  This is the port number that received the login-attack

config/fail2ban.conf

@@ -5,11 +5,11 @@
 # Changes:  in most of the cases you should not modify this
 #           file, but provide customizations in fail2ban.local file, e.g.:
 #
-# [DEFAULT]
+# [Definition]
 # loglevel = DEBUG
 #
 
-[DEFAULT]
+[Definition]
 
 # Option: loglevel
 # Notes.: Set the log level output.
@@ -19,7 +19,7 @@
 #         NOTICE
 #         INFO
 #         DEBUG
-# Values: [ LEVEL ]  Default: INFO
+# Values: [ LEVEL ]  Default: ERROR
 #
 loglevel = INFO
 
@@ -30,7 +30,7 @@ loglevel = INFO
 #         using logrotate -- also adjust or disable rotation in the
 #         corresponding configuration file
 #         (e.g. /etc/logrotate.d/fail2ban on Debian systems)
-# Values: [ STDOUT | STDERR | SYSLOG | SYSOUT | FILE ]  Default: STDERR
+# Values: [ STDOUT | STDERR | SYSLOG | FILE ]  Default: STDERR
 #
 logtarget = /var/log/fail2ban.log
 
@@ -55,12 +55,6 @@ socket = /var/run/fail2ban/fail2ban.sock
 #
 pidfile = /var/run/fail2ban/fail2ban.pid
 
-# Option: allowipv6
-# Notes.: Allows IPv6 interface:
-#         Default: auto
-# Values: [ auto yes (on, true, 1) no (off, false, 0) ] Default: auto
-#allowipv6 = auto
-
 # Options: dbfile
 # Notes.: Set the file for the fail2ban persistent data to be stored.
 #         A value of ":memory:" means database is only stored in memory 
@@ -72,21 +66,4 @@ dbfile = /var/lib/fail2ban/fail2ban.sqlite3
 # Options: dbpurgeage
 # Notes.: Sets age at which bans should be purged from the database
 # Values: [ SECONDS ] Default: 86400 (24hours)
-dbpurgeage = 1d
-
-# Options: dbmaxmatches
-# Notes.: Number of matches stored in database per ticket (resolvable via 
-#         tags <ipmatches>/<ipjailmatches> in actions)
-# Values: [ INT ] Default: 10
-dbmaxmatches = 10
-
-[Definition]
-
-
-[Thread]
-
-# Options: stacksize
-# Notes.: Specifies the stack size (in KiB) to be used for subsequently created threads,
-#         and must be 0 or a positive integer value of at least 32.
-# Values: [ SIZE ] Default: 0 (use platform or configured default)
-#stacksize = 0
+dbpurgeage = 86400

config/filter.d/3proxy.conf

@@ -9,8 +9,6 @@ failregex = ^\s[+-]\d{4} \S+ \d{3}0[1-9] \S+ <HOST>:\d+ [\d.]+:\d+ \d+ \d+ \d+\s
 
 ignoreregex = 
 
-datepattern = {^LN-BEG}
-
 # DEV Notes:
 # http://www.3proxy.ru/howtoe.asp#ERRORS indicates that 01-09 are
 # all authentication problems (%E field)

config/filter.d/apache-auth.conf

@@ -9,32 +9,20 @@ before = apache-common.conf
 
 [Definition]
 
-# Mode for filter: normal (default) and aggressive (allows DDoS & brute force detection of mod_evasive)
-mode = normal
 
-# ignore messages of mod_evasive module:
-apache-pref-ign-normal = (?!evasive)
-# allow "denied by server configuration" from all modules:
-apache-pref-ign-aggressive =
-# mode related ignore prefix for common _apache_error_client substitution:
-apache-pref-ignore = <apache-pref-ign-<mode>>
-
-prefregex = ^%(_apache_error_client)s (?:AH\d+: )?<F-CONTENT>.+</F-CONTENT>$
-
-# auth_type = ((?:Digest|Basic): )?
-auth_type = ([A-Z]\w+: )?
-
-failregex = ^client (?:denied by server configuration|used wrong authentication scheme)\b
-            ^user (?!`)<F-USER>(?:\S*|.*?)</F-USER> (?:auth(?:oriz|entic)ation failure|not found|denied by provider)\b
-            ^Authorization of user <F-USER>(?:\S*|.*?)</F-USER> to access .*? failed\b
-            ^%(auth_type)suser <F-USER>(?:\S*|.*?)</F-USER>: password mismatch\b
-            ^%(auth_type)suser `<F-USER>(?:[^']*|.*?)</F-USER>' in realm `.+' (auth(?:oriz|entic)ation failure|not found|denied by provider)\b
-            ^%(auth_type)sinvalid nonce .* received - length is not\b
-            ^%(auth_type)srealm mismatch - got `(?:[^']*|.*?)' but expected\b
-            ^%(auth_type)sunknown algorithm `(?:[^']*|.*?)' received\b
-            ^invalid qop `(?:[^']*|.*?)' received\b
-            ^%(auth_type)sinvalid nonce .*? received - user attempted time travel\b
-            ^(?:No h|H)ostname \S+ provided via SNI(?:, but no hostname provided| and hostname \S+ provided| for a name based virtual host)\b
+failregex = ^%(_apache_error_client)s (AH(01797|01630): )?client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01617: )?user .*? authentication failure for "\S*": Password Mismatch(, referer: \S+)?$
+            ^%(_apache_error_client)s (AH01618: )?user .*? not found(: )?\S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme: \S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH\d+: )?Authorization of user \S+ to access \S* failed, reason: .*$
+            ^%(_apache_error_client)s (AH0179[24]: )?(Digest: )?user .*?: password mismatch: \S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH0179[01]: |Digest: )user `.*?' in realm `.+' (not found|denied by provider): \S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01631: )?user .*?: authorization failure for "\S*":(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01775: )?(Digest: )?invalid nonce .* received - length is not \S+(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01788: )?(Digest: )?realm mismatch - got `.*?' but expected `.+'(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01789: )?(Digest: )?unknown algorithm `.*?' received: \S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01793: )?invalid qop `.*?' received: \S*(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01777: )?(Digest: )?invalid nonce .*? received - user attempted time travel(, referer: \S+)?\s*$
 
 ignoreregex = 
 
@@ -55,17 +43,14 @@ ignoreregex =
 # all of these expressions. Lots of submodules like mod_authz_* return back to mod_authz_core
 # to return the actual failure.
 #
-# Note that URI can contain spaces.
-#
 # See also: http://wiki.apache.org/httpd/ListOfErrors
 # Expressions that don't have tests and aren't common.
 # more be added with  https://issues.apache.org/bugzilla/show_bug.cgi?id=55284 
-#     ^user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
-#     ^user .*: one-time-nonce mismatch - sending new nonce\s*$
-#     ^realm mismatch - got `(?:[^']*|.*?)' but no realm specified\s*$
+#     ^%(_apache_error_client)s (AH01778: )?user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
+#     ^%(_apache_error_client)s (AH01779: )?user .*: one-time-nonce mismatch - sending new nonce\s*$
+#     ^%(_apache_error_client)s (AH02486: )?realm mismatch - got `.*' but no realm specified\s*$
 #
-# Because url/referer are foreign input, short form of regex used if long enough to idetify failure.
+# referer is always in error log messages if it exists added as per the log_error_core function in server/log.c
 # 
 # Author: Cyril Jaquier
-# Major edits by Daniel Black and Ben Rubson.
-# Rewritten for v.0.10 by Sergey Brester (sebres).
+# Major edits by Daniel Black

config/filter.d/apache-badbots.conf

@@ -7,16 +7,13 @@
 
 [Definition]
 
-badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider|(?:Mozilla/\d+\.\d+ )?Jorgee
+badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider
 badbots = Atomic_Email_Hunter/4\.0|atSpider/1\.0|autoemailspider|bwh3_user_agent|China Local Browse 2\.6|ContactBot/0\.2|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailSpider|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Guestbook Auto Submitter|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 \+http\://letscrawl\.com/|Lincoln State Web Browser|LMQueueBot/0\.2|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|MVAClient|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/3\.0 \(compatible; scan4mail \(advanced version\) http\://www\.peterspages\.net/?scan4mail\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|NameOfAgent \(CMS Spider\)|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|ShablastBot 1\.0|snap\.com beta crawler v0|Snapbot/1\.0|Snapbot/1\.0 \(Snap Shots, \+http\://www\.snap\.com\)|sogou develop spider|Sogou Orion spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sogou spider|Sogou web spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|VadixBot|WebVulnCrawl\.unknown/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
 
 failregex = ^<HOST> -.*"(GET|POST|HEAD).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
 
 ignoreregex =
 
-datepattern = ^[^\[]*\[({DATE})
-              {^LN-BEG}
-
 # DEV Notes:
 # List of bad bots fetched from http://www.user-agents.org
 # Generated on Thu Nov  7 14:23:35 PST 2013 by files/gen_badbots.

config/filter.d/apache-botsearch.conf

@@ -3,7 +3,7 @@
 # This filter is aimed at blocking specific URLs that don't exist. This
 # could be a set of URLs places in a Disallow: directive in robots.txt or
 # just some web services that don't exist caused bots are searching for
-# exploitable content. This filter is designed to have a low false positive
+# exploitable content. This filter is designed to have a low false postitive
 # rate due.
 #
 # An alternative to this is the apache-noscript filter which blocks all
@@ -23,17 +23,18 @@ before = apache-common.conf
 
 [Definition]
 
-prefregex = ^%(_apache_error_client)s (?:AH\d+: )?<F-CONTENT>.+</F-CONTENT>$
-
-failregex = ^(?:File does not exist|script not found or unable to stat): <webroot><block>(, referer: \S+)?\s*$
-            ^script '<webroot><block>' not found or unable to stat(, referer: \S+)?\s*$
+failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): <webroot><block>(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s script '<webroot><block>' not found or unable to stat(, referer: \S+)?\s*$
 
 ignoreregex = 
 
+
+[Init]
+
 # Webroot represents the webroot on which all other files are based
 webroot = /var/www/
 
 
 # DEV Notes:
 #
-# Author: Daniel Black
+# Author: Daniel Black

config/filter.d/apache-common.conf

@@ -3,35 +3,12 @@
 
 [INCLUDES]
 
-before = common.conf
 # Load customizations if any available
 after = apache-common.local
 
 [DEFAULT]
 
-# Apache logging mode:
-#   all - universal prefix (logfile, syslog)
-#   logfile - logfile only
-#   syslog - syslog only
-# Use `filter = apache-auth[logging=syslog]` to get more precise regex if apache logs into syslog (ErrorLog syslog).
-# Use `filter = apache-auth[logging=all]` to get universal regex matches both logging variants.
-logging = logfile
-
-# Apache logging prefixes (date-pattern prefix, server, process etc.):
-apache-prefix-syslog = %(__prefix_line)s
-apache-prefix-logfile = \[\]\s
-apache-prefix-all = (?:%(apache-prefix-logfile)s|%(apache-prefix-syslog)s)?
-
-# Setting for __prefix_line (only `logging=syslog`):
-_daemon = (?:apache\d*|httpd(?:/\w+)?)
-
-apache-prefix = <apache-prefix-<logging>>
-
-apache-pref-ignore =
-
-_apache_error_client = <apache-prefix>\[(:?error|<apache-pref-ignore>\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]
-
-datepattern = {^LN-BEG}
+_apache_error_client = \[\] \[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]
 
 # Common prefix for [error] apache messages which also would include <HOST>
 # Depending on the version it could be

config/filter.d/apache-fakegooglebot.conf

@@ -2,12 +2,10 @@
 
 [Definition]
 
-failregex = ^\s*<HOST> \S+ \S+(?: \S+)?\s+\S+ "[A-Z]+ /\S* [^"]*" \d+ \d+ \"[^"]*\" "[^"]*\bGooglebot/[^"]*"
+failregex = ^<HOST> .*Googlebot.*$
 
 ignoreregex =
 
-datepattern = ^[^\[]*(\[{DATE}\s*\])
-              {^LN-BEG}
 
 # DEV Notes:
 #

config/filter.d/apache-modsecurity.conf

@@ -10,10 +10,9 @@ before = apache-common.conf
 [Definition]
 
 
-failregex = ^%(_apache_error_client)s(?: \[client [^\]]+\])? ModSecurity:\s+(?:\[(?:\w+ \"[^\"]*\"|[^\]]*)\]\s*)*Access denied with code [45]\d\d
+failregex = ^%(_apache_error_client)s ModSecurity:  (\[.*?\] )*Access denied with code [45]\d\d.*$
 
 ignoreregex = 
 
 # https://github.com/SpiderLabs/ModSecurity/wiki/ModSecurity-2-Data-Formats
 # Author: Daniel Black
-#         Sergey G. Brester aka sebres (review, optimization)

config/filter.d/apache-noscript.conf

@@ -17,13 +17,8 @@ before = apache-common.conf
 
 [Definition]
 
-script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin/)
-
-prefregex = ^%(_apache_error_client)s (?:AH0(?:01(?:28|30)|1(?:264|071)|2811): )?(?:(?:[Ff]ile|script|[Gg]ot) )<F-CONTENT>.+</F-CONTENT>$
-
-failregex = ^(?:does not exist|not found or unable to stat): <script>\b
-            ^'<script>\S*' not found or unable to stat
-            ^error '[Pp]rimary script unknown(?:\\n)?'
+failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s script '/\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)\S*' not found or unable to stat(, referer: \S+)?\s*$
 
 ignoreregex = 
 

config/filter.d/apache-overflows.conf

@@ -8,15 +8,11 @@ before = apache-common.conf
 
 [Definition]
 
-failregex = ^%(_apache_error_client)s (?:(?:AH001[23][456]: )?Invalid (method|URI) in request\b|(?:AH00565: )?request failed: URI too long \(longer than \d+\)|request failed: erroneous characters after protocol string:|(?:AH00566: )?request failed: invalid characters in URI\b)
+failregex = ^%(_apache_error_client)s ((AH0013[456]: )?Invalid (method|URI) in request .*( - possible attempt to establish SSL connection on non-SSL port)?|(AH00565: )?request failed: URI too long \(longer than \d+\)|request failed: erroneous characters after protocol string: .*|AH00566: request failed: invalid characters in URI)(, referer: \S+)?$
 
 ignoreregex =
 
 # DEV Notes:
-#
-# [sebres] Because this apache-log could contain very long URLs (and/or referrer), 
-#          the parsing of it anchored way may be very vulnerable (at least as regards 
-#          the system resources, see gh-1790). Thus rewritten without end-anchor ($).
 # 
 # fgrep -r 'URI too long' httpd-2.*
 #   httpd-2.2.25/server/protocol.c:                          "request failed: URI too long (longer than %d)", r->server->limit_req_line);

config/filter.d/apache-pass.conf

@@ -3,15 +3,16 @@
 #
 # The knocking request must have a referer.
 
+[INCLUDES]
+
+before = apache-common.conf
+
 [Definition]
 
 failregex = ^<HOST> - \w+ \[\] "GET <knocking_url> HTTP/1\.[01]" 200 \d+ ".*" "[^-].*"$
 
 ignoreregex =
 
-datepattern = ^[^\[]*\[({DATE})
-              {^LN-BEG}
-
 [Init]
 
 knocking_url = /knocking/

config/filter.d/apache-shellshock.conf

@@ -9,10 +9,8 @@ before = apache-common.conf
 
 [Definition]
 
-prefregex = ^%(_apache_error_client)s (AH01215: )?/bin/([bd]a)?sh: <F-CONTENT>.+</F-CONTENT>$
-
-failregex = ^warning: HTTP_[^:]+: ignoring function definition attempt(, referer: \S+)?\s*$
-            ^error importing function definition for `HTTP_[^']+'(, referer: \S+)?\s*$
+failregex = ^%(_apache_error_client)s (AH01215: )?/bin/(ba)?sh: warning: HTTP_.*?: ignoring function definition attempt(, referer: \S+)?\s*$
+            ^%(_apache_error_client)s (AH01215: )?/bin/(ba)?sh: error importing function definition for `HTTP_.*?'(, referer: \S+)?\s*$
 
 ignoreregex = 
 
@@ -25,4 +23,4 @@ ignoreregex =
 # [Thu Sep 25 09:27:18.813902 2014] [cgi:error] [pid 16860] [client 89.207.132.76:59635] AH01215: /bin/bash: warning: HTTP_TEST: ignoring function definition attempt
 # [Thu Sep 25 09:29:56.141832 2014] [cgi:error] [pid 16864] [client 162.247.73.206:41273] AH01215: /bin/bash: error importing function definition for `HTTP_TEST'
 #
-# Author: Eugene Hopkinson (e.hopkinson@gmail.com)
+# Author: Eugene Hopkinson (riot@riot.so)

config/filter.d/assp.conf

@@ -1,46 +1,24 @@
-# Fail2Ban filter for Anti-Spam SMTP Proxy Server (ASSP)
-#    Filter works in theory for both ASSP V1 and V2. Recommended ASSP is V2.5.1 or later.
-#    Support for ASSP V1 ended in 2014 so if you are still running ASSP V1 an immediate upgrade is recommended.
-#
-#    Homepage:    http://sourceforge.net/projects/assp/
-#    ProjectSite: http://sourceforge.net/projects/assp/?source=directory
+# Fail2Ban filter for Anti-Spam SMTP Proxy Server also known as ASSP
+# 
+#    Honmepage:   http://www.magicvillage.de/~Fritz_Borgstedt/assp/0003D91C-8000001C/
+#    ProjektSite: http://sourceforge.net/projects/assp/?source=directory
 #
 #
 
 [Definition] 
-# Note: First three failregex matches below are for ASSP V1 with the remaining being designed for V2. Deleting the V1 regex is recommended but I left it in for compatibility reasons.
 
 __assp_actions = (?:dropping|refusing)
 
 failregex = ^(:? \[SSL-out\])? <HOST> max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$
 			^(?: \[SSL-out\])? <HOST> SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$
 			^ Blocking <HOST> - too much AUTH errors \(\d{,3}\);$
-			^\s*(?:[\w\-]+\s+)*(?:\[\S+\]\s+)*<HOST> (?:\<\S+@\S+\.\S+\> )*(?:to: \S+@\S+\.\S+ )*relay attempt blocked for(?: \(parsing\))?: \S+$
-			^\s*(?:[\w\-]+\s+)*(?:\[\S+\]\s+)*<HOST> \[SMTP Error\] 535 5\.7\.8 Error: authentication failed:\s+(?:\S+|Connection lost to authentication server|Invalid authentication mechanism|Invalid base64 data in continued response)?$
 
 ignoreregex = 
 
-datepattern = {^LN-BEG}%%b-%%d-%%Exy %%H:%%M:%%S
-              {^LN-BEG}
-
 # DEV Notes:
-# V1 Examples matches:
-#   Apr-27-13 02:33:09 Blocking 217.194.197.97 - too much AUTH errors (41);
-#   Dec-29-12 17:10:31 [SSL-out] 200.247.87.82 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
-#   Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded 
 #
-# V2 Examples matches:
-#   Jul-29-16 16:49:52 m1-25391-06124 [Worker_1] [TLS-out] [RelayAttempt] 0.0.0.0 <user@example.com> to: user@example.org relay attempt blocked for: someone@example.org
-#   Jul-30-16 16:59:42 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
-#   Jul-30-16 00:15:36 m1-52131-09651 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
-#   Jul-31-16 06:45:59 [Worker_1] [TLS-in] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed:
-#   Jan-05-16 08:38:49 m1-01129-09140 [Worker_1] [TLS-in] [TLS-out] [RelayAttempt] 0.0.0.0 <user@example.com> relay attempt blocked for (parsing): <user2@example>
-#   Jun-12-16 16:43:37 m1-64217-12013 [Worker_1] [TLS-in] [TLS-out] [RelayAttempt] 0.0.0.0 <user@example.com> to: user2@example.com relay attempt blocked for (parsing): <a.notheruser69@example.c>
-#   Jan-22-16 22:25:51 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: Invalid authentication mechanism
-#   Mar-19-16 13:42:20 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: Invalid base64 data in continued response
-#   Jul-18-16 16:54:21 [Worker_2] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: Connection lost to authentication server
-#   Jul-18-16 17:14:23 m1-76453-02949 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: Connection lost to authentication server
-
+# Examples: Apr-27-13 02:33:09 Blocking 217.194.197.97 - too much AUTH errors (41);
+#           Dec-29-12 17:10:31 [SSL-out] 200.247.87.82 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
+#           Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded 
 #
 # Author: Enrico Labedzki (enrico.labedzki@deiwos.de)
-# V2 Filters: Robert Hardy (rhardy@webcon.ca)

config/filter.d/asterisk.conf

@@ -11,30 +11,25 @@ before = common.conf
 
 _daemon = asterisk
 
-__pid_re = (?:\s*\[\d+\])
+__pid_re = (?:\[\d+\])
 
 iso8601 = \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+[+-]\d{4}
 
 # All Asterisk log messages begin like this:
-log_prefix= (?:NOTICE|SECURITY|WARNING)%(__pid_re)s:?(?:\[C-[\da-f]*\])?:? [^:]+:\d*(?:(?: in)? [^:]+:)?
+log_prefix= (?:NOTICE|SECURITY)%(__pid_re)s:?(?:\[C-[\da-f]*\])? \S+:\d*( in \w+:)?
 
-prefregex = ^%(__prefix_line)s%(log_prefix)s <F-CONTENT>.+</F-CONTENT>$
-
-failregex = ^Registration from '[^']*' failed for '<HOST>(:\d+)?' - (?:Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$
-            ^Call from '[^']*' \((?:(?:TCP|UDP):)?<HOST>:\d+\) to extension '[^']*' rejected because extension not found in context
-            ^(?:Host )?<HOST> (?:failed (?:to authenticate\b|MD5 authentication\b)|tried to authenticate with nonexistent user\b)
-            ^No registration for peer '[^']*' \(from <HOST>\)$
-            ^hacking attempt detected '<HOST>'$
-            ^SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)"(?:(?:,(?!RemoteAddress=)\w+="[^"]*")*|.*?),RemoteAddress="IPV[46]/[^/"]+/<HOST>/\d+"(?:,(?!RemoteAddress=)\w+="[^"]*")*$
-            ^"Rejecting unknown SIP connection from <HOST>(?::\d+)?"$
-            ^Request (?:'[^']*' )?from '(?:[^']*|.*?)' failed for '<HOST>(?::\d+)?'\s\(callid: [^\)]*\) - (?:No matching endpoint found|Not match Endpoint(?: Contact)? ACL|(?:Failed|Error) to authenticate)\s*$
-
-# FreePBX (todo: make optional in v.0.10):
-#            ^(%(__prefix_line)s|\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])? )[^:]+: Friendly Scanner from <HOST>$
+failregex = ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - (Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Call from '[^']*' \(<HOST>:\d+\) to extension '[^']*' rejected because extension not found in context
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Host <HOST> failed to authenticate as '[^']*'$
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)$
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Failed to authenticate (user|device) [^@]+@<HOST>\S*$
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s hacking attempt detected '<HOST>'$
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="([\d-]+|%(iso8601)s)",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="(\d*|<unknown>)",SessionID=".+",LocalAddress="IPV[46]/(UDP|TCP|WS)/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UDP|TCP|WS)/<HOST>/\d+"(,Challenge="[\w/]+")?(,ReceivedChallenge="\w+")?(,Response="\w+",ExpectedResponse="\w*")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$
+            ^(%(__prefix_line)s|\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])? )Ext\. s: "Rejecting unknown SIP connection from <HOST>"$
 
 ignoreregex =
 
-datepattern = {^LN-BEG}
 
 # Author: Xavier Devlamynck / Daniel Black
 #
@@ -44,12 +39,3 @@ datepattern = {^LN-BEG}
 # First regex: channels/chan_sip.c
 #
 # main/logger.c:ast_log_vsyslog - "in {functionname}:" only occurs in syslog
-
-journalmatch = _SYSTEMD_UNIT=asterisk.service
-
-
-[lt_journal]
-
-# asterisk can log timestamp if logs into systemd-journal (optional part matching this timestamp, gh-2383):
-__extra_timestamp = (?:\[[^\]]+\]\s+)?
-__prefix_line = %(known/__prefix_line)s%(__extra_timestamp)s

config/filter.d/bitwarden.conf

@@ -1,13 +0,0 @@
-# Fail2Ban filter for Bitwarden
-# Detecting failed login attempts
-# Logged in bwdata/logs/identity/Identity/log.txt
-
-[INCLUDES]
-before = common.conf
-
-[Definition]
-_daemon = Bitwarden-Identity
-failregex = ^%(__prefix_line)s\s*\[(?:W(?:RN|arning)|Bit\.Core\.[^\]]+)\]\s+Failed login attempt(?:, 2FA invalid)?\. <ADDR>$
-
-# DEV Notes:
-# __prefix_line can result to an empty string, so it can support syslog and non-syslog at once.