changelog for spanish months addition

Update datetemplate.py to add spanish month names

.coveragerc

@@ -1,11 +1,4 @@
 
 [run]
 branch = True
-source =
-    config
-    fail2ban
-
-[report]
-exclude_lines =
-    pragma: no cover
-    pragma: systemd no cover
+omit = /usr*

.github/ISSUE_TEMPLATE.md

@@ -1,49 +0,0 @@
-_We will be very grateful, if your problem was described as completely as possible,
-enclosing excerpts from logs (if possible within DEBUG mode, if no errors evident
-within INFO mode), and configuration in particular of effected relevant settings
-(e.g., with ` fail2ban-client -d | grep 'affected-jail-name' ` for a particular
-jail troubleshooting).
-Thank you in advance for the details, because such issues like "It does not work" 
-alone could not help to resolve anything!
-Thanks! (remove this paragraph and other comments upon reading)_
-
-### Environment:
-
-_Fill out and check (`[x]`) the boxes which apply. If your Fail2Ban version is outdated, 
-and you can't verify that the issue persists in the recent release, better seek support 
-from the distribution you obtained Fail2Ban from_
-
-- Fail2Ban version (including any possible distribution suffixes):
-- OS, including release name/version: 
-- [ ] Fail2Ban installed via OS/distribution mechanisms
-- [ ] You have not applied any additional foreign patches to the codebase
-- [ ] Some customizations were done to the configuration (provide details below is so)
-
-### The issue:
-
-_Summary here_
-
-#### Steps to reproduce
-
-#### Expected behavior
-
-#### Observed behavior
-
-#### Any additional information
-
-### Configuration, dump and another helpful excerpts
-
-#### Any customizations done to /etc/fail2ban/ configuration
-```
-```
-
-#### Relevant parts of /var/log/fail2ban.log file:
-_preferably obtained while running fail2ban with `loglevel = 4`_
-
-```
-```
-
-#### Relevant lines from monitored log files in question:
-
-```
-```

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,9 +0,0 @@
-Before submitting your PR, please review the following checklist:
-
-- [ ] **CONSIDER adding a unit test** if your PR resolves an issue
-- [ ] **LIST ISSUES** this PR resolves
-- [ ] **MAKE SURE** this PR doesn't break existing tests 
-- [ ] **KEEP PR small** so it could be easily reviewed.
-- [ ] **AVOID** making unnecessary stylistic changes in unrelated code
-- [ ] **ACCOMPANY** each new `failregex` for filter `X` with sample log lines 
-      within `fail2ban/tests/files/logs/X` file

.gitignore

@@ -6,7 +6,3 @@ htmlcov
 .coverage
 *.orig
 *.rej
-*.bak
-__pycache__
-.vagrant/
-.idea/

.mailmap

@@ -1,5 +0,0 @@
-Lee Clemens <java@leeclemens.net>
-Serg G. Brester <info@sebres.de>
-Serg G. Brester <serg.brester@sebres.de>
-Serg G. Brester <sergey.brester@W7-DEHBG0189.wincor-nixdorf.com>
-Viktor Szépe <viktor@szepe.net>

.pydevproject

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<?eclipse-pydev version="1.0"?>
+
+<pydev_project>
+<pydev_property name="org.python.pydev.PYTHON_PROJECT_VERSION">python 2.3</pydev_property>
+<pydev_pathproperty name="org.python.pydev.PROJECT_SOURCE_PATH">
+<path>/fail2ban-0.8/client</path>
+<path>/fail2ban-0.8/server</path>
+<path>/fail2ban-0.8/testcases</path>
+<path>/fail2ban-0.8</path>
+</pydev_pathproperty>
+</pydev_project>

.travis.yml

@@ -1,58 +1,20 @@
 # vim ft=yaml
 # travis-ci.org definition for Fail2Ban build
-# https://travis-ci.org/fail2ban/fail2ban/
 language: python
 python:
-  - 2.6
-  - 2.7
-  - pypy
-  # disabled until coverage module fixes up compatibility issue
-  # - 3.2
-  - 3.3
-  - 3.4
-  - pypy3
+  - "2.6"
+  - "2.7"
+env:
+  - LOG_LEVEL=error
+  - LOG_LEVEL=heavydebug
 before_install:
-  - if [[ $TRAVIS_PYTHON_VERSION == 2* || $TRAVIS_PYTHON_VERSION == 'pypy' ]]; then export F2B_PY_2=true && echo "Set F2B_PY_2"; fi
-  - if [[ $TRAVIS_PYTHON_VERSION == 3* || $TRAVIS_PYTHON_VERSION == 'pypy3' ]]; then export F2B_PY_3=true && echo "Set F2B_PY_3"; fi
-  - travis_retry sudo apt-get update -qq
-  # Set this so sudo executes the correct python binary
-  #   Anything not using sudo will already have the correct environment
-  - export VENV_BIN="$VIRTUAL_ENV/bin" && echo "VENV_BIN set to $VENV_BIN"
+  - sudo apt-get update -qq
 install:
-  # Install Python packages / dependencies
-  #   coverage
-  - travis_retry pip install coverage
-  #   coveralls
-  - travis_retry pip install coveralls codecov
-  #   dnspython or dnspython3
-  - if [[ "$F2B_PY_2" ]]; then travis_retry pip install dnspython; fi
-  - if [[ "$F2B_PY_3" ]]; then travis_retry pip install dnspython3; fi
-  #   gamin - install manually (not in PyPI) - travis-ci system Python is 2.7
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then travis_retry sudo apt-get install -qq python-gamin && cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/; fi
-  #   pyinotify
-  - travis_retry pip install pyinotify
-before_script:
-  # Manually execute 2to3 for now
-  - if [[ "$F2B_PY_3" ]]; then ./fail2ban-2to3; fi
+  - pip install pyinotify
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get install -qq python-gamin; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then cd ..; pip install -q coveralls; cd -; fi
 script:
-  # Keep the legacy setup.py test approach of checking coverage for python2
-  - if [[ "$F2B_PY_2" ]]; then coverage run setup.py test; fi
-  # Coverage doesn't pick up setup.py test with python3, so run it directly
-  - if [[ "$F2B_PY_3" ]]; then coverage run bin/fail2ban-testcases; fi
-  # Use $VENV_BIN (not python) or else sudo will always run the system's python (2.7)
-  - sudo $VENV_BIN/pip install .
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then export PYTHONPATH="$PYTHONPATH:/usr/share/pyshared:/usr/lib/pyshared/python2.7"; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]] && [ $LOG_LEVEL == heavydebug ]; then coverage run --rcfile=.travis_coveragerc fail2ban-testcases -l $LOG_LEVEL; else python ./fail2ban-testcases -l $LOG_LEVEL; fi
 after_success:
-  - coveralls
-  - codecov
-matrix:
-  fast_finish: true
-# Might be worth looking into
-#notifications:
-#  email: true
-#  irc:
-#    channels: "irc.freenode.org#fail2ban"
-#    template:
-#      - "%{repository}@%{branch}: %{message} (%{build_url})"
-#    on_success: change
-#    on_failure: change
-#    skip_join: true
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]] && [ $LOG_LEVEL == heavydebug ]; then coveralls; fi

.travis_coveragerc

@@ -0,0 +1,6 @@
+
+[run]
+branch = True
+omit =
+    /usr/*
+    /home/travis/virtualenv/*

CONTRIBUTING.md

@@ -1,27 +0,0 @@
-Guidelines on Fail2Ban contributions
-====================================
-
-### You found a severe security vulnerability in Fail2Ban?
-email details to fail2ban-vulnerabilities at lists dot sourceforge dot net .
-
-### You need some new features, you found bugs?
-visit [Issues](https://github.com/fail2ban/fail2ban/issues)
-and if your issue is not yet known -- file a bug report. See
-[Fail2Ban wiki](http://www.fail2ban.org/wiki/index.php/HOWTO_Seek_Help)
-on further instructions.
-
-### You would like to troubleshoot or discuss?
-join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
-
-### You would like to contribute (new filters/actions/code/documentation)?
-send a [pull request](https://github.com/fail2ban/fail2ban/pulls)
-
-Pull requests guidelines
-========================
-
-- If there is an issue on github to be closed by the pull request, include
-  ```Closes #ISSUE``` (where ISSUE is issue's number)
-  
-- Add a brief summary of the change to the ChangeLog file into a corresponding
-  section out of Fixes, New Features or Enhancements (improvements to existing
-  features)

ChangeLog

@@ -3,450 +3,34 @@
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
-Fail2Ban: Changelog
-===================
+================================================================================
+Fail2Ban (version 0.8.14.dev)                                         2014/../..
+================================================================================
 
-ver. 0.9.5 (2016/XX/XXX) - wanna-be-released
+ver. 0.8.15 (2014/XX/XXX) - hopefully-never-to-be-released
 -----------
 
 - Fixes:
-   * filter.d/monit.conf
-     - extended failregex with new monit "access denied" version (gh-1355);
-     - failregex of previous monit version merged as single expression.
-   * filter.d/postfix.conf, filter.d/postfix-sasl.conf
-     - extended failregex daemon part, matching also `postfix/smtps/smtpd` now (gh-1391)
 
 - New Features:
-   * New Actions:
-     - action.d/firewallcmd-rich-rules and action.d/firewallcmd-rich-logging (gh-1367)
+
 - Enhancements:
-   * journald journalmatch for pure-ftpd (gh-1362)
-   * Add additional regex filter for dovecot ldap authentication failures (gh-1370)
-   * added additional regex filters for exim (gh-1371)
+   * Date detector learnt Spanish month names (Thanks David AKA darues@github)
 
 
-ver. 0.9.4 (2016/03/08) - for-you-ladies
+ver. 0.8.14 (2014/08/19) - take-care-of-the-elderly
 -----------
 
 - Fixes:
-   * roundcube-auth jail typo for logpath
-   * Fix dnsToIp resolver for fqdn with large list of IPs (gh-1164)
-   * filter.d/apache-badbots.conf
-     - Updated useragent string regex adding escape for `+`
-   * filter.d/mysqld-auth.conf
-     - Updated "Access denied ..." regex for MySQL 5.6 and later (gh-1211, gh-1332)
-   * filter.d/sshd.conf
-     - Updated "Auth fail" regex for OpenSSH 5.9 and later
-   * Treat failed and killed execution of commands identically (only
-     different log messages), which addresses different behavior on different
-     exit codes of dash and bash (gh-1155)
-   * Fix jail.conf.5 man's section (gh-1226)
-   * Fixed default banaction for allports jails like pam-generic, recidive, etc
-     with new default variable `banaction_allports` (gh-1216)
-   * Fixed `fail2ban-regex` stops working on invalid (wrong encoded) character
-     for python version < 3.x (gh-1248)
-   * Use postfix_log logpath for postfix-rbl jail
-   * filters.d/postfix.conf - add 'Sender address rejected: Domain not found' failregex
-   * use `fail2ban_agent` as user-agent in actions badips, blocklist_de, etc (gh-1271)
-   * Fix ignoring the sender option by action_mw, action_mwl and action_c_mwl
-   * Changed filter.d/asterisk regex for "Call from ..." (few vulnerable now)
-   * Removed compression and rotation count from logrotate (inherit them from
-     the global logrotate config)
+  - minor fixes for claimed Python 2.4 and 2.5 compatibility
+  - Handle case when inotify watch is auto deleted on file deletion to stop
+    error messages
+  - tests - fixed few "leaky" file descriptors when files were not closed while
+    being removed physically
+  - grep in mail*-whois-lines.conf now also matches end of line to work
+    with the recidive filter
+  - filters.d/sieve.conf - fixed typo in _daemon.  Thanks Jisoo Park
 
-- New Features:
-   * New interpolation feature for definition config readers - `<known/parameter>`
-     (means last known init definition of filters or actions with name `parameter`).
-     This interpolation makes possible to extend a parameters of stock filter or 
-     action directly in jail inside jail.local file, without creating a separately
-     filter.d/*.local file.
-     As extension to interpolation `%(known/parameter)s`, that does not works for
-     filter and action init parameters
-   * New actions:
-     - nftables-multiport and nftables-allports - filtering using nftables
-       framework. Note: it requires a pre-existing chain for the filtering rule.
-   * New filters:
-     - openhab - domotic software authentication failure with the
-       rest api and web interface (gh-1223)
-     - nginx-limit-req - ban hosts, that were failed through nginx by limit
-       request processing rate (ngx_http_limit_req_module)
-     - murmur - ban hosts that repeatedly attempt to connect to
-       murmur/mumble-server with an invalid server password or certificate.
-     - haproxy-http-auth - filter to match failed HTTP Authentications against a
-       HAProxy server
-   * New jails:
-     - murmur - bans TCP and UDP from the bad host on the default murmur port.
-   * sshd filter got new failregex to match "maximum authentication
-     attempts exceeded" (introduced in openssh 6.8)
-   * Added filter for Mac OS screen sharing (VNC) daemon
-   * IPv6 support:
-     - IP addresses are now handled as objects rather than strings capable for 
-       handling both address types IPv4 and IPv6
-     - iptables related actions have been amended to support IPv6 specific actions
-       additionally
-     - hostsdeny and route actions have been tested to be aware of v4 and v6 already
-     - pf action for *BSD systems has been improved and supports now also v4 and v6
-     - Name resolution is now working for either address type
-
-- Enhancements:
-   * Do not rotate empty log files
-   * Added new date pattern with year after day (e.g. Sun Jan 23 2005 21:59:59)
-     http://bugs.debian.org/798923
-   * Added openSUSE path configuration (Thanks Johannes Weberhofer)
-   * Allow to split ignoreip entries by ',' as well as by ' ' (gh-1197)
-   * Added a timeout (3 sec) to urlopen within badips.py action
-     (Thanks M. Maraun)
-   * Added check against atacker's Googlebot PTR fake records
-     (Thanks Pablo Rodriguez Fernandez)
-   * Enhance filter against atacker's Googlebot PTR fake records
-     (gh-1226)
-   * Nginx log paths extended (prefixed with "*" wildcard) (gh-1237)
-   * Added filter for openhab domotic software authentication failure with the
-     rest api and web interface (gh-1223)
-   * Add *_backend options for services to allow distros to set the default
-     backend per service, set default to systemd for Fedora as appropriate
-   * Performance improvements while monitoring large number of files (gh-1265).
-     Use associative array (dict) for monitored log files to speed up lookup 
-     operations. Thanks @kshetragia
-   * Specified that fail2ban is PartOf iptables.service firewalld.service in
-     .service file -- would reload fail2ban if those services are restarted
-   * Provides new default `fail2ban_version` and interpolation variable
-     `fail2ban_agent` in jail.conf
-   * Enhance filter 'postfix' to ban incoming SMTP client with no fqdn hostname,
-     and to support multiple instances of postfix having varying suffix (gh-1331)
-     (Thanks Tom Hendrikx)
-   * files/gentoo-initd to use start-stop-daemon to robustify restarting the service
-
-
-ver. 0.9.3 (2015/08/01) - lets-all-stay-friends
-----------
-
-- IMPORTANT incompatible changes:
-   * filter.d/roundcube-auth.conf
-     - Changed logpath to 'errors' log (was 'userlogins')
-   * action.d/iptables-common.conf
-     - All calls to iptables command now use -w switch introduced in
-       iptables 1.4.20 (some distribution could have patched their
-       earlier base version as well) to provide this locking mechanism
-       useful under heavy load to avoid contesting on iptables calls.
-       If you need to disable, define 'action.d/iptables-common.local'
-       with empty value for 'lockingopt' in `[Init]` section.
-   * mail-whois-lines, sendmail-geoip-lines and sendmail-whois-lines
-     actions now include by default only the first 1000 log lines in
-     the emails.  Adjust <grepopts> to augment the behavior.
-
-- Fixes:
-   * reload in interactive mode appends all the jails twice (gh-825)
-   * reload server/jail failed if database used (but was not changed) and
-     some jail active (gh-1072)
-   * filter.d/dovecot.conf - also match unknown user in passwd-file.
-     Thanks Anton Shestakov
-   * Fix fail2ban-regex not parsing journalmatch correctly from filter config
-   * filter.d/asterisk.conf - fix security log support for Asterisk 12+
-   * filter.d/roundcube-auth.conf
-     - Updated regex to work with 'errors' log (1.0.5 and 1.1.1)
-     - Added regex to work with 'userlogins' log
-   * action.d/sendmail*.conf - use LC_ALL (superseeding LC_TIME) to override
-     locale on systems with customized LC_ALL
-   * performance fix: minimizes connection overhead, close socket only at
-     communication end (gh-1099)
-   * unbanip always deletes ip from database (independent of bantime, also if
-     currently not banned or persistent)
-   * guarantee order of dbfile to be before dbpurgeage (gh-1048)
-   * always set 'dbfile' before other database options (gh-1050)
-   * kill the entire process group of the child process upon timeout (gh-1129).
-     Otherwise could lead to resource exhaustion due to hanging whois
-     processes.
-   * resolve /var/run/fail2ban path in setup.py to help installation
-     on platforms with /var/run -> /run symlink (gh-1142)
-
-- New Features:
-   * RETURN iptables target is now a variable: <returntype>
-   * New type of operation: pass2allow, use fail2ban for "knocking",
-     opening a closed port by swapping blocktype and returntype
-   * New filters:
-     - froxlor-auth - Thanks Joern Muehlencord
-     - apache-pass - filter Apache access log for successful authentication
-   * New actions:
-     - shorewall-ipset-proto6 - using proto feature of the Shorewall. Still requires
-	   manual pre-configuration of the shorewall. See the action file for detail.
-   * New jails:
-     - pass2allow-ftp - allows FTP traffic after successful HTTP authentication
-
-- Enhancements:
-   * action.d/cloudflare.conf - improved documentation on how to allow
-     multiple CF accounts, and jail.conf got new compound action
-     definition action_cf_mwl to submit cloudflare report.
-   * Check access to socket for more detailed logging on error (gh-595)
-   * fail2ban-testcases man page
-   * filter.d/apache-badbots.conf, filter.d/nginx-botsearch.conf - add
-     HEAD method verb
-   * Revamp of Travis and coverage automated testing
-   * Added a space between IP address and the following colon
-     in notification emails for easier text selection
-   * Character detection heuristics for whois output via optional setting
-     in mail-whois*.conf. Thanks Thomas Mayer.
-     Not enabled by default, if _whois_command is set to be
-     %(_whois_convert_charset)s (e.g. in action.d/mail-whois-common.local),
-     it
-     - detects character set of whois output (which is undefined by
-       RFC 3912) via heuristics of the file command
-     - converts whois data to UTF-8 character set with iconv
-     - sends the whois output in UTF-8 character set to mail program
-     - avoids that heirloom mailx creates binary attachment for input with
-       unknown character set
-
-
-ver. 0.9.2 (2015/04/29) - better-quick-now-than-later
-----------
-
-- Fixes:
-   * Fix ufw action commands
-   * infinite busy loop on _escapedTags match in substituteRecursiveTags gh-907.
-     Thanks TonyThompson
-   * port[s] typo in jail.conf/nginx-http-auth gh-913. Thanks Frederik Wagner
-     (fnerdwq)
-   * $ typo in jail.conf. Thanks Skibbi. Debian bug #767255
-   * grep'ing for IP in *mail-whois-lines.conf should now match also
-     at the beginning and EOL.  Thanks Dean Lee
-   * jail.conf
-     - php-url-fopen: separate logpath entries by newline
-   * failregex declared direct in jail was joined to single line (specifying of
-     multiple expressions was not possible).
-   * filters.d/exim.conf - cover different settings of exim logs
-     details. Thanks bes.internal
-   * filter.d/postfix-sasl.conf - failregex is now case insensitive
-   * filters.d/postfix.conf - add 'Client host rejected error message' failregex
-   * fail2ban/__init__.py - add strptime thread safety hack-around
-   * recidive uses iptables-allports banaction by default now.
-     Avoids problems with iptables versions not understanding 'all' for
-     protocols and ports
-   * filter.d/dovecot.conf
-     - match pam_authenticate line from EL7
-     - match unknown user line from EL7
-   * Use use_poll=True for Python 2.7 and >=3.4 to overcome "Bad file
-     descriptor" msgs issue (gh-161)
-   * filter.d/postfix-sasl.conf - tweak failregex and add ignoreregex to ignore
-     system authentication issues
-   * fail2ban-regex reads filter file(s) completely, incl. '.local' file etc.
-     (gh-954)
-   * firewallcmd-* actions: split output into separate lines for grepping (gh-908)
-   * Guard unicode encode/decode issues while storing records in the database.
-     Fixes "binding parameter error (unsupported type)" (gh-973), thanks to kot
-     for reporting
-   * filter.d/sshd added regex for matching openSUSE ssh authentication failure
-   * filter.d/asterisk.conf:
-     - Dropped "Sending fake auth rejection" failregex since it incorrectly
-	   targets the asterisk server itself
-     - match "hacking attempt detected" logs
-
-- New Features:
-   - New filters:
-     - postfix-rbl  Thanks Lee Clemens
-     - apache-fakegooglebot.conf  Thanks Lee Clemens
-     - nginx-botsearch  Thanks Frantisek Sumsal
-     - drupal-auth  Thanks Lee Clemens
-   - New recursive embedded substitution feature added:
-     - `<<PREF>HOST>` becomes `<IPV4HOST>` for PREF=`IPV4`;
-     - `<<PREF>HOST>` becomes `1.2.3.4` for PREF=`IPV4` and IPV4HOST=`1.2.3.4`;
-   - New interpolation feature for config readers - `%(known/parameter)s`.
-     (means last known option with name `parameter`). This interpolation makes
-     possible to extend a stock filter or jail regexp in .local file
-     (opposite to simply set failregex/ignoreregex that overwrites it),
-     see gh-867.
-   - Monit config for fail2ban in files/monit/
-   - New actions:
-     - action.d/firewallcmd-multiport and action.d/firewallcmd-allports Thanks Donald Yandt
-     - action.d/sendmail-geoip-lines.conf
-     - action.d/nsupdate to update DNSBL. Thanks Andrew St. Jean
-   - New status argument for fail2ban-client -- flavor:
-     fail2ban-client status <jail> [flavor]
-     - empty or "basic" works as-is
-     - "cymru" additionally prints (ASN, Country RIR) per banned IP
-       (requires dnspython or dnspython3)
-   - Flush log at USR1 signal
-
-- Enhancements:
-   * Enable multiport for firewallcmd-new action.  Closes gh-834
-   * files/debian-initd migrated from the debian branch and should be
-     suitable for manual installations now (thanks Juan Karlo de Guzman)
-   * Define empty ignoreregex in filters which didn't have it to avoid
-     warnings (gh-934)
-   * action.d/{sendmail-*,xarf-login-attack}.conf - report local
-     timezone not UTC time/zone. Closes gh-911
-   * Conditionally log Ignore IP with reason (dns, ip, command). Closes gh-916
-   * Absorbed DNSUtils.cidr into addr2bin in filter.py, added unittests
-   * Added syslogsocket configuration to fail2ban.conf
-   * Note in the jail.conf for the recidive jail to increase dbpurgeage (gh-964)
-
-
-ver. 0.9.1 (2014/10/29) - better, faster, stronger
-----------
-
-- Refactoring (IMPORTANT -- Please review your setup and configuration):
-   * iptables-common.conf replaced iptables-blocktype.conf
-     (iptables-blocktype.local should still be read) and now also
-     provides defaults for the chain, port, protocol and name tags
-
-- Fixes:
-   * start of file2ban aborted (on slow hosts, systemd considers the server has
-     been timed out and kills him), see gh-824
-   * UTF-8 fixes in pure-ftp thanks to Johannes Weberhofer. Closes gh-806.
-   * systemd backend error on bad utf-8 in python3
-   * badips.py action error when logging HTTP error raised with badips request
-   * fail2ban-regex failed to work in python3 due to space/tab mix
-   * recidive regex samples incorrect log level
-   * journalmatch for recidive incorrect PRIORITY
-   * loglevel couldn't be changed in fail2ban.conf
-   * Handle case when no sqlite library is available for persistent database
-   * Only reban once per IP from database on fail2ban restart
-   * Nginx filter to support missing server_name. Closes gh-676
-   * fail2ban-regex assertion error caused by miscount missed lines with
-     multiline regex
-   * Fix actions failing to execute for Python 3.4.0. Workaround for
-     http://bugs.python.org/issue21207
-   * Database now returns persistent bans on restart (bantime < 0)
-   * Recursive action tags now fully processed. Fixes issue with bsd-ipfw
-     action
-   * Fixed TypeError with "ipfailures" and "ipjailfailures" action tags.
-     Thanks Serg G. Brester
-   * Correct times for non-timezone date times formats during DST
-   * Pass a copy of, not original, aInfo into actions to avoid side-effects
-   * Per-distribution paths to the exim's main log
-   * Ignored IPs are no longer banned when being restored from persistent
-     database
-   * Manually unbanned IPs are now removed from persistent database, such they
-     wont be banned again when Fail2Ban is restarted
-   * Pass "bantime" parameter to the actions in default jail's action
-     definition(s)
-   * filters.d/sieve.conf - fixed typo in _daemon.  Thanks Jisoo Park
-   * cyrus-imap -- also catch also failed logins via secured (imaps/pop3s).
-     Regression was introduced while strengthening failregex in 0.8.11 (bd175f)
-     Debian bug #755173
-   * postfix-sasl - added journalmatch.  Thanks Luc Maisonobe
-   * postfix* - match with a new daemon string (postfix/submission/smtpd).
-     Closes gh-804 .  Thanks Paul Traina
-   * apache - added filter for AH01630 client denied by server configuration.
-
-- New features:
-   - New filters:
-     - monit  Thanks Jason H Martin
-     - directadmin  Thanks niorg
-     - apache-shellshock  Thanks Eugene Hopkinson (SlowRiot)
-   - New actions:
-     - symbiosis-blacklist-allports  for Bytemark symbiosis firewall
-   - fail2ban-client can fetch the running server version
-   - Added Cloudflare API action
-
-- Enhancements
-   * Start performance of fail2ban-client (and tests) increased, start time
-     and cpu usage rapidly reduced. Introduced a shared storage logic, to
-     bypass reading lots of config files (see gh-824).
-     Thanks to Joost Molenaar for good catch (reported gh-820).
-   * Fail2ban-regex - add print-all-matched option. Closes gh-652
-   * Suppress fail2ban-client warnings for non-critical config options
-   * Match non "Bye Bye" disconnect messages for sshd locked account regex
-   * courier-smtp filter:
-     - match lines with user names
-     - match lines containing "535 Authentication failed" attempts
-   * Add <chain> tag to iptables-ipsets
-   * Realign fail2ban log output with white space to improve readability. Does
-     not affect SYSLOG output
-   * Log unhandled exceptions
-   * cyrus-imap: catch "user not found" attempts
-   * Add support for Portsentry
-
-ver. 0.9.0 (2014/03/14) - beta
-----------
-
-Carries all fixes, features and enhancements from 0.8.13 (unreleased) with
-major changes.
-
-The minimum supported python version is now 2.6. If you have python-2.4 or 2.5
-you can use the 0.8.12 version of fail2ban.
-
-Please take note of release notes:
-https://github.com/fail2ban/fail2ban/releases/tag/0.9.0
-
-Please test your configuration before relying on it.
-
-Nearly all development is thanks to Steven Hiscocks (THANKS!), merging,
-testcases and timezone support from Daniel Black, and code-review and minor
-additions from Yaroslav Halchenko.
-
-- Refactoring (IMPORTANT -- Please review your setup and configuration):
-   * [..bddbf1e] jail.conf was heavily refactored and now is similar
-     to how it looked on Debian systems:
-     - default action could be configured once for all jails
-     - jails definitions only provide customizations (port, logpath)
-     - no need to specify 'filter' if name matches jail name
-   * [..5aef036] Core functionality moved into fail2ban/ module.
-     Closes gh-26
-     - tests included in module to aid testing and debugging
-   * Added fail2ban persistent database
-     - default location at /var/lib/fail2ban/fail2ban.sqlite3
-     - allows active bans to be reinstated on restart
-     - log files read from last position after restart
-   * Added systemd journal backend
-     - Dependency on python-systemd
-     - New "journalmatch" option added to filter configs files
-     - New "systemd-journal" option added to fail2ban-regex
-   * Added python3 support
-   * Support %z (Timezone offset) and %f (sub-seconds) support for
-     datedetector. Enhanced existing date/time have been updated patterns to
-     support these. ISO8601 now defaults to localtime unless specified otherwise.
-     Some filters have been change as required to capture these elements in the
-     right timezone correctly.
-   * Log levels are now set by Syslog style strings e.g. DEBUG, ERROR.
-     - Log level INFO is now more verbose
-   * Optionally can read log files starting from "head" or "tail".
-     - See "logpath" option in jail.conf(5) man page.
-   * Can now set log encoding for files per jail.
-     - Default uses systemd locale.
-
-- New features:
-   * [..c7ae460] Multiline failregex. Close gh-54
-   * [8af32ed] Guacamole filter and support for Apache Tomcat date
-     format
-   * [..b6059f4] 'timeout' option for actions Close gh-60 and Debian bug
-     #410077.  Also it would now capture and include stdout and stderr
-     into logging messages in case of error or at DEBUG loglevel.
-   * Added action xarf-login-attack to report formatted attack messages
-     according to the XARF standard (v0.2). Close gh-105
-   * Support PyPy
-   * Add filter for apache-botsearch
-   * Add filter for kerio. Thanks Tony Lawrence for blog of regexs and
-     providing samples. Close gh-120
-   * Filter for stunnel
-   * Filter for Counter Strike 1.6. Thanks to onorua for logs.
-     Close gh-347
-   * Filter for squirrelmail. Close gh-261
-   * Filter for tine20. Close gh-583
-   * Custom date formats (strptime) can now be set in filters and jail.conf
-   * Python based actions can now be created.
-     - SMTP action for sending emails on jail start, stop and ban.
-   * Added action to use badips.com reporting and blacklist
-     - Requires Python 2.7+
-
-- Enhancements
-   * Fail2ban-regex - don't accumulate lines if not printing them.
-     add options to suppress output of missed/ignored lines. Close gh-644
-   * Asterisk now supports syslog format
-   * Jail names increased to 26 characters and iptables prefix reduced
-     from fail2ban- to f2b- as suggested by buanzo in gh-462.
-   * Multiline filter for sendmail-spam. Close gh-418
-   * Multiline regex for Disconnecting: Too many authentication failures for
-     root [preauth]\nConnection closed by 6X.XXX.XXX.XXX [preauth]
-   * Multiline regex for Disconnecting: Connection from 61.XX.XX.XX port
-     51353\nToo many authentication failures for root [preauth]. Thanks
-     Helmut Grohne. Close gh-457
-   * Replacing use of deprecated API (.warning, .assertEqual, etc)
-   * [..a648cc2] Filters can have options now too which are substituted into
-     failregex / ignoreregex
-   * [..e019ab7] Multiple instances of the same action are allowed in the
-     same jail -- use actname option to disambiguate.
-   * Add honeypot email address to exim-spam filter as argument
-   * Properties and methods of actions accessible from fail2ban-client
-     - Use of properties replaces command actions "cinfo" interface
 
 ver. 0.8.13 (2014/03/15) - maintenance-only-from-now-on
 -----------
@@ -468,7 +52,7 @@ ver. 0.8.13 (2014/03/15) - maintenance-only-from-now-on
     Thanks Noel Butler.
 
 ver. 0.8.12 (2014/01/22) - things-can-only-get-better
-----------
+-----------
 
 - IMPORTANT incompatible changes:
   - Rename firewall-cmd-direct-new to firewallcmd-new to fit within jail name
@@ -480,7 +64,7 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better
   - allow for ",milliseconds" in the custom date format of proftpd.log
   - allow for ", referer ..." in apache-* filter for apache error logs.
   - allow for spaces at the beginning of kernel messages. Closes gh-448
-  - recidive jail to block all protocols. Closes gh-440. Thanks Ioan Indreias
+  - recidive jail to block all protocols. Closes gh-440. Thanksg Ioan Indreias
   - smtps not a IANA standard and has been removed from Arch. Replaced with
     465. Thanks Stefan. Closes gh-447
   - add 'flushlogs' command to allow logrotation without clobbering logtarget
@@ -493,7 +77,7 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better
   - Asynchat changed to use push method which verifys whether all data was
     send. This ensures that all data is sent before closing the connection.
   - Removed unnecessary reference to as yet undeclared $jail_name when checking
-    a specific jail in nagios script.
+    a specific jail.
   - Filter dovecot reordered session and TLS items in regex with wider scope
     for session characters. Thanks Ivo Truxa. Closes gh-586
   - A single bad failregex or command syntax in configuration files won't stop
@@ -509,11 +93,8 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better
     Thanks dani. Closes gh-503
   - exim-spam filter to match spamassassin log entry for option SAdevnull.
     Thanks Ivo Truxa. Closes gh-533
-  - filter.d/nsd.conf -- also amended Unix date template to match nsd format
   - Added to sshd filter expression for "Received disconnect from <HOST>: 3:
     ...: Auth fail". Thanks Marcel Dopita. Closes gh-289
-  - loglines now also report "[PID]" after the name portion
-  - Added filter.d/ejabberd-auth
   - Improved ACL-handling for Asterisk
   - loglines now also report "[PID]" after the name portion
   - Added improper command pipelining to postfix filter.
@@ -523,12 +104,10 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better
   - filter.d/solid-pop3d -- added thanks to Jacques Lav!gnotte on mailinglist.
   - Add filter for apache-modsecurity.
   - filter.d/nsd.conf -- also amended Unix date template to match nsd format
-  - Added openwebmail filter thanks Ivo Truxa. Closes gh-543
+  - Added filter.d/openwebmail filter thanks Ivo Truxa. Closes gh-543
+  - Added filter.d/horde.
   - Added filter for freeswitch. Thanks Jim and editors and authors of 
-    http://wiki.freeswitch.org/wiki/Fail2ban
-  - Added groupoffice filter thanks to logs from Merijn Schering.
-    Closes gh-566
-  - Added filter for horde
+    http://wiki.freeswitch.org/wiki/Fail2ban.
   - Added filter for squid. Thanks Roman Gelfand.
   - Added filter for ejabberd-auth.
   - Added filter.d/openwebmail filter thanks Ivo Truxa. Closes gh-543
@@ -541,7 +120,7 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better
 
 
 ver. 0.8.11 (2013/11/13) - loves-unittests-and-tight-DoS-free-filter-regexes
-----------
+-----------
 
 In light of CVE-2013-2178 that triggered our last release we have put
 a significant effort into tightening all of the regexs of our filters
@@ -600,15 +179,15 @@ and bug requests.
   Daniel Black & Sebastian Arcus
    * filter.d/asterisk -- more regexes
   Daniel Black
-   * action.d/hostsdeny -- NOTE: new dependency 'ed'. Switched to use 'ed' across
+   * action.d/hostsdeny -- NOTE: new dependancy 'ed'. Switched to use 'ed' across
      all platforms to ensure permissions are the same before and after a ban.
      Closes gh-266. hostsdeny supports daemon_list now too.
-   * action.d/bsd-ipfw - action option unused. Change blocktype to port unreach
+   * action.d/bsd-ipfw - action option unsed. Change blocktype to port unreach
      instead of deny for consistancy.
    * filter.d/dovecot - added to support different dovecot failure
      "..disallowed plaintext auth". Closes Debian bug #709324
    * filter.d/roundcube-auth - timezone offset can be positive or negative
-   * action.d/bsd-ipfw - action option unused. Fixed to blocktype for
+   * action.d/bsd-ipfw - action option unsed. Fixed to blocktype for
      consistency. default to port unreach instead of deny
    * filter.d/dropbear - fix regexs to match standard dropbear and the patched
      http://www.unchartedbackwaters.co.uk/files/dropbear/dropbear-0.52.patch

DEVELOP

@@ -1,4 +1,4 @@
-..                       __      _ _ ___ _
+                         __      _ _ ___ _
                         / _|__ _(_) |_  ) |__  __ _ _ _
                        |  _/ _` | | |/ /| '_ \/ _` | ' \
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
@@ -25,7 +25,6 @@ Pull Requests
 =============
 
 When submitting pull requests on GitHub we ask you to:
-
 * Clearly describe the problem you're solving;
 * Don't introduce regressions that will make it hard for systems administrators
   to update;
@@ -40,9 +39,9 @@ If you are developing filters see the FILTERS file for documentation.
 Code Testing
 ============
 
-Existing tests can be run by executing `bin/fail2ban-testcases`. It has
-options like --log-level that will probably be useful.  Run
-`bin/fail2ban-testcases --help` for the full list of options.
+Existing tests can be run by executing `fail2ban-testcases`. This has options
+like --log-level that will probably be useful. `fail2ban-testcases --help` for
+full options.
 
 Test cases should cover all usual cases, all exception cases and all inside
 / outside boundary conditions.
@@ -53,49 +52,34 @@ for more details.
 
 Install the package python-coverage to visualise your test coverage. Run the
 following (note: on Debian-based systems, the script is called
-`python-coverage`)::
+`python-coverage`):
 
-  coverage run bin/fail2ban-testcases
-  coverage report
+coverage run fail2ban-testcases
+coverage html
 
-Optionally:
-  coverage html
-
-And then browse htmlcov/index.html and see how much coverage your test cases
+Then look at htmlcov/index.html and see how much coverage your test cases
 exert over the code base. Full coverage is a good thing however it may not be
 complete. Try to ensure tests cover as many independent paths through the
 code.
 
-Manual Execution. To run in a development environment do::
+Manual Execution. To run in a development environment do:
 
-  ./fail2ban-client -c config/ -s /tmp/f2b.sock -i start
+./fail2ban-client -c config/ -s /tmp/f2b.sock -i start
 
-some quick commands::
+some quick commands:
 
-  status
-  add test pyinotify
-  status test
-  set test addaction iptables
-  set test actionban iptables echo <ip> <cidr> >> /tmp/ban
-  set test actionunban iptables echo <ip> <cidr> >> /tmp/unban
-  get test actionban iptables
-  get test actionunban iptables
-  set test banip 192.168.2.2
-  status test
+status
+add test pyinotify
+status test
+set test addaction iptables
+set test actionban iptables echo <ip> <cidr> >> /tmp/ban
+set test actionunban iptables echo <ip> <cidr> >> /tmp/unban
+get test actionban iptables
+get test actionunban iptables
+set test banip 192.168.2.2
+status test
 
 
-Testing with vagrant
---------------------
-
-Testing can now be done inside a vagrant VM.  Vagrantfile provided in
-source code repository established two VMs:
-
-- VM "secure" which can be used for testing fail2ban code.
-- VM "attacker" which can be used to perform attack against our "secure" VM.
-
-Both VMs are sharing the 192.168.200/24 network. If you are using this network
-take a look into the Vagrantfile and change the IP.
-
 
 Coding Standards
 ================
@@ -120,15 +104,6 @@ older versions on python. For all other uses of "pragma: no cover" or
 "pragma: no branch" document the reason why its not covered. "I haven't written
 a test case" isn't a sufficient reason.
 
-pyflakes
---------
-
-pyflakes can be used to find unused imports, and unused, undefined and
-redefined variables. pyflakes should be run in any python code, including
-python based actions::
-
-  pyflakes bin/ config/ fail2ban/
-
 Documentation
 -------------
 
@@ -146,10 +121,10 @@ Git
 
 Use the following tags in your commit messages:
 
-* 'BF:' for bug fixes
-* 'DOC:' for documentation fixes
-* 'ENH:' for enhancements
-* 'TST:' for commits concerning tests only (thus not touching the main code-base)
+'BF:' for bug fixes
+'DOC:' for documentation fixes
+'ENH:' for enhancements
+'TST:' for commits concerning tests only (thus not touching the main code-base)
 
 Multiple tags could be joined with +, e.g. "BF+TST:".
 
@@ -293,3 +268,158 @@ action.py
 
 Takes care about executing start/check/ban/unban/stop commands
 
+
+Releasing
+=========
+
+# Check distribution patches and see if they can be included
+
+  * https://apps.fedoraproject.org/packages/fail2ban/sources
+  * http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/
+  * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/
+  * https://build.opensuse.org/package/show?package=fail2ban&project=openSUSE%3AFactory
+  * http://sophie.zarb.org/sources/fail2ban (Mageia)
+  * https://trac.macports.org/browser/trunk/dports/security/fail2ban
+
+# Check distribution outstanding bugs
+
+  * https://github.com/fail2ban/fail2ban/issues?sort=updated&state=open
+  * http://bugs.debian.org/cgi-bin/pkgreport.cgi?dist=unstable;package=fail2ban
+  * https://bugs.launchpad.net/ubuntu/+source/fail2ban
+  * http://bugs.sabayon.org/buglist.cgi?quicksearch=net-analyzer%2Ffail2ban
+  * https://bugs.archlinux.org/?project=5&cat%5B%5D=33&string=fail2ban
+  * https://bugs.gentoo.org/buglist.cgi?query_format=advanced&short_desc=fail2ban&bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=IN_PROGRESS&short_desc_type=allwords
+  * https://bugzilla.redhat.com/buglist.cgi?query_format=advanced&bug_status=NEW&bug_status=ASSIGNED&component=fail2ban&classification=Red%20Hat&classification=Fedora
+  * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
+  * https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
+  * https://build.opensuse.org/package/requests/openSUSE:Factory/fail2ban
+
+# Make sure the tests pass
+
+  ./fail2ban-testcases-all
+
+# Ensure the version is correct
+
+  in:
+  * ./common/version.py
+  * top of ChangeLog
+  * README.md
+
+# Ensure the MANIFEST is complete
+
+Run:
+
+  python setup.py sdist
+
+Look for errors like:
+ 'testcases/files/logs/mysqld.log' not a regular file -- skipping
+
+Which indicates that testcases/files/logs/mysqld.log has been moved or is a directory
+
+  tar -C /tmp -jxf dist/fail2ban-0.8.15.tar.bz2
+
+# clean up current direcory
+
+  diff -rul --exclude \*.pyc . /tmp/fail2ban-0.8.15/
+
+  # Only differences should be files that you don't want distributed.
+
+# Ensure the tests work from the tarball
+
+  cd /tmp/fail2ban-0.8.15/ && ./fail2ban-testcases-all
+
+# Add/finalize the corresponding entry in the ChangeLog
+
+  To generate a list of committers use e.g.
+
+  git shortlog -sn 0.8.14.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
+
+  Ensure the top of the ChangeLog has the right version and current date.
+
+  Ensure the top entry of the ChangeLog has the right version and current date.
+
+# Update man pages
+
+  (cd man ; ./generate-man )
+  git commit -m 'DOC/ENH: update man pages for release' man/*
+
+# Prepare source and rpm binary distributions
+
+  python setup.py sdist
+  python setup.py bdist_rpm
+  python setup.py upload
+
+# Provide a release sample to distributors
+
+  * Arch Linux:
+            https://www.archlinux.org/packages/community/any/fail2ban/
+  * Debian: Yaroslav Halchenko <debian@onerussian.com>
+            http://packages.qa.debian.org/f/fail2ban.html
+  * FreeBSD: Christoph Theis theis@gmx.at>, Nick Hilliard <nick@foobar.org>
+            http://svnweb.freebsd.org/ports/head/security/py-fail2ban/Makefile?view=markup
+            http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
+  * Fedora: Axel Thimm <Axel.Thimm@atrpms.net>
+            https://apps.fedoraproject.org/packages/fail2ban
+            http://pkgs.fedoraproject.org/cgit/fail2ban.git
+            https://admin.fedoraproject.org/pkgdb/acls/bugs/fail2ban
+  * Gentoo: netmon@gentoo.org
+            http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/metadata.xml?view=markup
+            https://bugs.gentoo.org/buglist.cgi?quicksearch=fail2ban
+  * openSUSE: Stephan Kulow <coolo@suse.com>
+            https://build.opensuse.org/package/show/openSUSE:Factory/fail2ban
+  * Mac Ports: @Malbrouck on github (gh-49)
+            https://trac.macports.org/browser/trunk/dports/security/fail2ban/Portfile
+  * Mageia:
+            https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
+  An potentially to the fail2ban-users directory.
+
+# Wait for feedback from distributors
+
+# Prepare a release notice https://github.com/fail2ban/fail2ban/releases/new
+
+  Upload the source/binaries from the dist directory and tag the release using the URL
+
+# Upload source/binaries to sourceforge http://sourceforge.net/projects/fail2ban/
+
+# Run the following and update the wiki with output:
+  python -c 'import common.protocol; common.protocol.printWiki()'
+
+  page: http://www.fail2ban.org/wiki/index.php/Commands
+
+* Update:
+  http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_Versions&action=edit
+
+  http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_News&action=edit
+  move old bits to:
+  http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_OldNews&action=edit
+
+  http://www.fail2ban.org/wiki/index.php/ChangeLog
+  http://www.fail2ban.org/wiki/index.php/Requirements (Check requirement)
+  http://www.fail2ban.org/wiki/index.php/Features
+
+* See if any filters are upgraded:
+  http://www.fail2ban.org/wiki/index.php/Special:AllPages
+
+# Email users and development list of release
+
+# notify distributors
+
+Post Release
+============
+
+Add the following to the top of the ChangeLog
+
+ver. 0.8.15 (2014/XX/XXX) - wanna-be-released
+-----------
+
+- Fixes:
+
+- New Features:
+
+- Enhancements:
+
+Alter the git shortlog command in the previous section to refer to the just
+released version.
+
+and adjust common/version.py to carry .dev suffix to signal
+a version under development.

FILTERS

@@ -1,4 +1,4 @@
-..                       __      _ _ ___ _
+                         __      _ _ ___ _
                         / _|__ _(_) |_  ) |__  __ _ _ _
                        |  _/ _` | | |/ /| '_ \/ _` | ' \
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
@@ -7,8 +7,10 @@
 Developing Filters
 ================================================================================
 
-Filters are tricky. They need to:
+Filters
+=======
 
+Filters are tricky. They need to:
 * work with a variety of the versions of the software that generates the logs;
 * work with the range of logging configuration options available in the
   software;
@@ -29,11 +31,10 @@ what you have done, what is the hurdle, and we'll attempt to help (PR
 will be automagically updated with future commits you would push to
 complete it).
 
-Filter Test Cases
-=================
+Filter test cases
+-----------------
 
-Purpose
--------
+Purpose:
 
 Start by finding the log messages that the application generates related to
 some form of authentication failure. If you are adding to an existing filter
@@ -48,8 +49,7 @@ and exim-spam at log messages related to spam.
 Even if it is a new filter you may consider separating the log messages into
 different filters based on purpose.
 
-Cause
------
+Cause:
 
 Are some of the log lines a result of the same action? For example, is a PAM
 failure log message, followed by an application specific failure message the
@@ -65,8 +65,7 @@ the log message be occurring due to the first step towards the application
 asking for authentication? Could the log messages occur often? If some of
 these are true make a note of this in the jail.conf example that you provide.
 
-Samples
--------
+Samples:
 
 It is important to include log file samples so any future change in the regular
 expression will still work with the log lines you have identified.
@@ -94,22 +93,21 @@ If the mechanism to create the log message isn't obvious provide a
 configuration and/or sample scripts testcases/files/config/{filtername} and
 reference these in the comments above the log line.
 
-FailJSON metadata
------------------
+FailJSON metadata:
 
 A failJSON metadata is a comment immediately above the log message. It will
-look like::
+look like:
 
-  # failJSON: { "time": "2013-06-10T10:10:59", "match": true , "host": "93.184.216.119" }
+# failJSON: { "time": "2013-06-10T10:10:59", "match": true , "host": "93.184.216.119" }
 
 Time should match the time of the log message. It is in a specific format of
 Year-Month-Day'T'Hour:minute:Second.  If your log message does not include a
 year, like the example below, the year should be listed as 2005, if before Sun
 Aug 14 10am UTC, and 2004 if afterwards.  Here is an example failJSON
-line preceding a sample log line::
+line preceding a sample log line:
 
-  # failJSON: { "time": "2005-03-24T15:25:51", "match": true , "host": "198.51.100.87" }
-  Mar 24 15:25:51 buffalo1 dropbear[4092]: bad password attempt for 'root' from 198.51.100.87:5543
+# failJSON: { "time": "2005-03-24T15:25:51", "match": true , "host": "198.51.100.87" }
+Mar 24 15:25:51 buffalo1 dropbear[4092]: bad password attempt for 'root' from 198.51.100.87:5543
 
 The "host" in failJSON should contain the IP or domain that should be blocked.
 
@@ -118,28 +116,27 @@ attacks) and any log lines to be excluded (see "Cause" section above), set
 "match": false in the failJSON and describe the reason in the comment above.
 
 After developing regexes, the following command will test all failJSON metadata
-against the log lines in all sample log files::
+against the log lines in all sample log files
 
-  ./fail2ban-testcases testSampleRegex
+./fail2ban-testcases testSampleRegex
 
 Developing Filter Regular Expressions
-=====================================
+-------------------------------------
 
-Date/Time
----------
+Date/Time:
 
 At the moment, Fail2Ban depends on log lines to have time stamps.  That is why
 before starting to develop failregex, check if your log line format known to
 Fail2Ban.  Copy the time component from the log line and append an IP address to
-test with following command::
+test with following command:
 
-  ./fail2ban-regex "2013-09-19 02:46:12 1.2.3.4" "<HOST>"
+./fail2ban-regex "2013-09-19 02:46:12 1.2.3.4" "<HOST>"
 
-Output of such command should contain something like::
+Output of such command should contain something like:
 
-  Date template hits:
-  |- [# of hits] date format
-  |  [1] Year-Month-Day Hour:Minute:Second
+Date template hits:
+|- [# of hits] date format
+|  [1] Year-Month-Day Hour:Minute:Second
 
 Ensure that the template description matches time/date elements in your log line
 time stamp.  If there is no matched format then date template needs to be added
@@ -147,31 +144,29 @@ to server/datedetector.py.  Ensure that a new template is added in the order
 that more specific matches occur first and that there is no confusion between a
 Day and a Month.
 
-Filter file
------------
+Filter file:
 
 The filter is specified in a config/filter.d/{filtername}.conf file. Filter file
-can have sections INCLUDES (optional) and Definition as follows::
+can have sections INCLUDES (optional) and Definition as follows:
 
-  [INCLUDES]
-  
-  before = common.conf
-  
-  after = filtername.local
-  
-  [Definition]
-  
-  failregex = ....
-  
-  ignoreregex = ....
+[INCLUDES]
+
+before = common.conf
+
+after = filtername.local
+
+[Definition]
+
+failregex = ....
+
+ignoreregex = ....
 
 This is also documented in the man page jail.conf (section 5). Other definitions
 can be added to make failregex's more readable and maintainable to be used
 through string Interpolations (see http://docs.python.org/2.7/library/configparser.html)
 
 
-General rules
--------------
+General rules:
 
 Use "before" if you need to include a common set of rules, like syslog or if
 there is a common set of regexes for multiple filters.
@@ -183,35 +178,33 @@ Try to avoid using ignoreregex mainly for performance reasons. The case when you
 would use it is if in trying to avoid using it, you end up with an unreadable
 failregex.
 
-Syslog
-------
+Syslog:
 
 If your application logs to syslog you can take advantage of log line prefix
-definitions present in common.conf.  So as a base use::
+definitions present in common.conf.  So as a base use:
 
-  [INCLUDES]
-  
-  before = common.conf
-  
-  [Definition]
-  
-  _daemon = app
-  
-  failregex = ^%(__prefix_line)s
+[INCLUDES]
+
+before = common.conf
+
+[Definition]
+
+_daemon = app
+
+failregex = ^%(__prefix_line)s
 
 In this example common.conf defines __prefix_line which also contains the
 _daemon name (in syslog terms the service) you have just specified. _daemon
 can also be a regex.
 
-For example, to capture following line _daemon should be set to "dovecot"::
+For example, to capture following line _daemon should be set to "dovecot"
 
-  Dec 12 11:19:11 dunnart dovecot: pop3-login: Aborted login (tried to use disabled plaintext auth): rip=190.210.136.21, lip=113.212.99.193
+Dec 12 11:19:11 dunnart dovecot: pop3-login: Aborted login (tried to use disabled plaintext auth): rip=190.210.136.21, lip=113.212.99.193
 
-and then ``^%(__prefix_line)s`` would match "Dec 12 11:19:11 dunnart dovecot:
+and then ^%(__prefix_line)s would match "Dec 12 11:19:11 dunnart dovecot:
 ". Note it matches the trailing space(s) as well.
 
-Substitutions (AKA string interpolations)
------------------------------------------
+Substitutions (AKA string interpolations):
 
 We have used string interpolations in above examples.  They are useful for
 making the regexes more readable, reuse generic patterns in multiple failregex
@@ -220,8 +213,7 @@ to the user.  General principle is that value of a _name variable replaces
 occurrences of %(_name)s within the same section or anywhere in the config file
 if defined in [DEFAULT] section.
 
-Regular Expressions
--------------------
+Regular Expressions:
 
 Regular expressions (failregex, ignoreregex) assume that the date/time has been
 removed from the log line (this is just how fail2ban works internally ATM).
@@ -244,33 +236,29 @@ If you have only a basic knowledge of regular repressions we advise to read
 http://docs.python.org/2/library/re.html first.  It doesn't take long and would
 remind you e.g. which characters you need to escape and which you don't.
 
-Developing/testing a regex
---------------------------
+Developing/testing a regex:
 
 You can develop a regex in a file or using command line depending on your
 preference. You can also use samples you have already created in the test cases
 or test them one at a time.
 
 The general tool for testing Fail2Ban regexes is fail2ban-regex. To see how to
-use it run::
+use it run:
 
-  ./fail2ban-regex --help
+./fail2ban-regex --help
 
 Take note of  -l heavydebug  / -l debug  and -v as they might be very useful.
 
-.. TIP::
-     Take a look at the source code of the application you are developing
+TIP: Take a look at the source code of the application you are developing
      failregex for. You may see optional or extra log messages, or parts there
      of, that need to form part of your regex.  It may also reveal how some
      parts are constrained and different formats depending on configuration or
      less common usages.
 
-.. TIP::
-     For looking through source code - http://sourcecodebrowser.com/ . It has
+TIP: For looking through source code - http://sourcecodebrowser.com/ . It has
      call graphs and can browse different versions.
 
-.. TIP::
-     Some applications log spaces at the end. If you are not sure add \s*$ as
+TIP: Some applications log spaces at the end. If you are not sure add \s*$ as
      the end part of the regex.
 
 If your regex is not matching, http://www.debuggex.com/?flavor=python can help
@@ -289,15 +277,13 @@ When you have fixed the regex put it back into your filter file.
 Please spread the good word about Debuggex - Serge Toarca is kindly continuing
 its free availability to Open Source developers.
 
-Finishing up
-------------
+Finishing up:
 
 If you've added a new filter, add a new entry in config/jail.conf. The theory
 here is that a user will create a jail.local with [filtername]\nenable=true to
 enable your jail.
 
 So more specifically in the [filter] section in jail.conf:
-
 * ensure that you have "enabled = false" (users will enable as needed);
 * use "filter =" set to your filter name;
 * use a typical action to disable ports associated with the application;
@@ -309,7 +295,7 @@ Submit github pull request (See "Pull Requests" above) for
 github.com/fail2ban/fail2ban containing your great work.
 
 Filter Security
-===============
+---------------
 
 Poor filter regular expressions are susceptible to DoS attacks.
 
@@ -335,33 +321,33 @@ Examples of poor filters
 
 1. Too restrictive
 
-We find a log message::
+We find a log message:
 
     Apr-07-13 07:08:36 Invalid command fial2ban from 1.2.3.4
 
-We make a failregex::
+We make a failregex
 
     ^Invalid command \S+ from <HOST>
 
 Now think evil. The user does the command 'blah from 1.2.3.44'
 
-The program diligently logs::
+The program diligently logs:
 
     Apr-07-13 07:08:36 Invalid command blah from 1.2.3.44 from 1.2.3.4
 
 And fail2ban matches 1.2.3.44 as the IP that it ban. A DoS attack was successful.
 
-The fix here is that the command can be anything so .* is appropriate::
+The fix here is that the command can be anything so .* is appropriate.
 
     ^Invalid command .* from <HOST>
 
 Here the .* will match until the end of the string. Then realise it has more to
 match, i.e. "from <HOST>" and go back until it find this. Then it will ban
-1.2.3.4 correctly. Since the <HOST> is always at the end, end the regex with a $::
+1.2.3.4 correctly. Since the <HOST> is always at the end, end the regex with a $.
 
     ^Invalid command .* from <HOST>$
 
-Note if we'd just had the expression::
+Note if we'd just had the expression:
 
     ^Invalid command \S+ from <HOST>$
 
@@ -373,16 +359,16 @@ banned.
 From the Apache vulnerability CVE-2013-2178
 ( original ref: https://vndh.net/note:fail2ban-089-denial-service ).
 
-An example bad regex for Apache::
+An example bad regex for Apache:
 
     failregex = [[]client <HOST>[]] user .* not found
 
-Since the user can do a get request on::
+Since the user can do a get request on:
 
     GET /[client%20192.168.0.1]%20user%20root%20not%20found HTTP/1.0
-    Host: remote.site
+Host: remote.site
 
-Now the log line will be::
+Now the log line will be:
 
     [Sat Jun 01 02:17:42 2013] [error] [client 192.168.33.1] File does not exist: /srv/http/site/[client 192.168.0.1] user root not found
 
@@ -393,27 +379,27 @@ regex and blocks 192.168.33.1 as a denial of service from the HTTP requester.
 
 From: https://github.com/fail2ban/fail2ban/pull/426
 
-An example ssh log (simplified)::
+An example ssh log (simplified)
 
     Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser remoteuser
 
 As we assume username can include anything including spaces its prudent to put
-.* here. The remote user can also exist as anything so lets not make assumptions again::
+.* here. The remote user can also exist as anything so lets not make assumptions again.
 
     failregex = ^%(__prefix_line)sFailed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
 
 So this works. The problem is if the .* after remote user is injected by the
-user to be 'from 1.2.3.4'. The resultant log line is::
+user to be 'from 1.2.3.4'. The resultant log line is.
 
     Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4
 
-Testing with::
+Testing with:
 
     fail2ban-regex -v 'Sep 29 17:15:02 Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4' '^ Failed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$'
 
-.. TIP:: I've removed the bit that matches __prefix_line from the regex and log.
+TIP: I've removed the bit that matches __prefix_line from the regex and log.
 
-Shows::
+Shows:
 
     1) [1] ^ Failed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
        1.2.3.4  Sun Sep 29 17:15:02 2013
@@ -426,14 +412,14 @@ The result was that 1.2.3.4 was matched, injected by the user, and the wrong IP
 was banned.
 
 The solution here is to make the first .* non-greedy with .*?. Here it matches
-as little as required and the fail2ban-regex tool shows the output::
+as little as required and the fail2ban-regex tool shows the output:
 
     fail2ban-regex -v 'Sep 29 17:15:02 Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4' '^ Failed \S+ for .*? from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$'
 
     1) [1] ^ Failed \S+ for .*? from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
        127.0.0.1  Sun Sep 29 17:15:02 2013
 
-So the general case here is a log line that contains::
+So the general case here is a log line that contains:
 
     (fixed_data_1)<HOST>(fixed_data_2)(user_injectable_data)
 
@@ -441,21 +427,20 @@ Where the regex that matches fixed_data_1 is gready and matches the entire
 string, before moving backwards and user_injectable_data can match the entire
 string.
 
-Another case
-------------
+Another case:
 
 ref: https://www.debuggex.com/r/CtAbeKMa2sDBEfA2/0
 
-A webserver logs the following without URL escaping::
+A webserver logs the following without URL escaping:
 
     [error] 2865#0: *66647 user "xyz" was not found in "/file", client: 1.2.3.1, server: www.host.com, request: "GET ", client: 3.2.1.1, server: fake.com, request: "GET exploited HTTP/3.3", host: "injected.host", host: "www.myhost.com"
 
-regex::
+regex:
 
     failregex = ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (?:password mismatch|was not found in ".*"), client: <HOST>, server: \S+, request: "\S+ .+ HTTP/\d+\.\d+", host: "\S+"
 
 The .* matches to the end of the string. Finds that it can't continue to match
-", client ... so it moves from the back and find that the user injected web URL::
+", client ... so it moves from the back and find that the user injected web URL:
 
     ", client: 3.2.1.1, server: fake.com, request: "GET exploited HTTP/3.3", host: "injected.host
 
@@ -468,17 +453,15 @@ beyond <HOST>.
 4. Application generates two identical log messages with different meanings
 
 If the application generates the following two messages under different
-circumstances::
+circumstances:
 
     client <IP>: authentication failed
     client <USER>: authentication failed
 
 
-Then it's obvious that a regex of ``^client <HOST>: authentication
-failed$`` will still cause problems if the user can trigger the second
+Then it's obvious that a regex of "^client <HOST>: authentication
+failed$" will still cause problems if the user can trigger the second
 log message with a <USER> of 123.1.1.1.
 
 Here there's nothing to do except request/change the application so it logs
 messages differently.
-
-

MANIFEST

@@ -1,381 +1,278 @@
-bin/fail2ban-client
-bin/fail2ban-regex
-bin/fail2ban-server
-bin/fail2ban-testcases
+README.md
+README.Solaris
 ChangeLog
-config/action.d/apf.conf
-config/action.d/badips.conf
-config/action.d/badips.py
-config/action.d/blocklist_de.conf
-config/action.d/bsd-ipfw.conf
-config/action.d/cloudflare.conf
-config/action.d/complain.conf
-config/action.d/dshield.conf
-config/action.d/dummy.conf
-config/action.d/firewallcmd-allports.conf
-config/action.d/firewallcmd-ipset.conf
-config/action.d/firewallcmd-multiport.conf
-config/action.d/firewallcmd-new.conf
-config/action.d/hostsdeny.conf
-config/action.d/ipfilter.conf
-config/action.d/ipfw.conf
-config/action.d/iptables-allports.conf
-config/action.d/iptables-common.conf
-config/action.d/iptables.conf
-config/action.d/iptables-ipset-proto4.conf
-config/action.d/iptables-ipset-proto6-allports.conf
-config/action.d/iptables-ipset-proto6.conf
-config/action.d/iptables-multiport.conf
-config/action.d/iptables-multiport-log.conf
-config/action.d/iptables-new.conf
-config/action.d/iptables-xt_recent-echo.conf
-config/action.d/mail-buffered.conf
-config/action.d/mail.conf
-config/action.d/mail-whois.conf
-config/action.d/mail-whois-lines.conf
-config/action.d/mynetwatchman.conf
-config/action.d/nftables-allports.conf
-config/action.d/nftables-common.conf
-config/action.d/nftables-multiport.conf
-config/action.d/nsupdate.conf
-config/action.d/osx-afctl.conf
-config/action.d/osx-ipfw.conf
-config/action.d/pf.conf
-config/action.d/route.conf
-config/action.d/sendmail-buffered.conf
-config/action.d/sendmail-common.conf
-config/action.d/sendmail.conf
-config/action.d/sendmail-geoip-lines.conf
-config/action.d/sendmail-whois.conf
-config/action.d/sendmail-whois-ipjailmatches.conf
-config/action.d/sendmail-whois-ipmatches.conf
-config/action.d/sendmail-whois-lines.conf
-config/action.d/sendmail-whois-matches.conf
-config/action.d/shorewall.conf
-config/action.d/smtp.py
-config/action.d/symbiosis-blacklist-allports.conf
-config/action.d/ufw.conf
-config/action.d/xarf-login-attack.conf
-config/fail2ban.conf
-config/filter.d/3proxy.conf
+TODO
+THANKS
+COPYING
+DEVELOP
+FILTERS
+fail2ban-client
+fail2ban-server
+fail2ban-testcases
+fail2ban-regex
+fail2ban-testcases-all
+setup.py
+setup.cfg
+kill-server
+client/configreader.py
+client/configparserinc.py
+client/jailreader.py
+client/fail2banreader.py
+client/jailsreader.py
+client/beautifier.py
+client/filterreader.py
+client/actionreader.py
+client/__init__.py
+client/configurator.py
+client/csocket.py
+server/asyncserver.py
+server/filter.py
+server/filterpyinotify.py
+server/filtergamin.py
+server/filterpoll.py
+server/iso8601.py
+server/server.py
+server/actions.py
+server/faildata.py
+server/failmanager.py
+server/datedetector.py
+server/jailthread.py
+server/transmitter.py
+server/action.py
+server/ticket.py
+server/jail.py
+server/jails.py
+server/__init__.py
+server/banmanager.py
+server/datetemplate.py
+server/mytime.py
+server/failregex.py
+testcases/actionstestcase.py
+testcases/dummyjail.py
+testcases/files/ignorecommand.py
+testcases/files/testcase-usedns.log
+testcases/files/logs/bsd/syslog-plain.txt
+testcases/files/logs/bsd/syslog-v.txt
+testcases/files/logs/bsd/syslog-vv.txt
+testcases/files/logs/apache-overflows
+testcases/files/logs/apache-modsecurity
+testcases/files/logs/assp
+testcases/files/logs/asterisk
+testcases/files/logs/dovecot
+testcases/files/logs/ejabberd-auth
+testcases/files/logs/exim
+testcases/files/logs/freeswitch
+testcases/files/logs/groupoffice
+testcases/files/logs/horde
+testcases/files/logs/suhosin
+testcases/files/logs/mysqld-auth
+testcases/files/logs/named-refused
+testcases/files/logs/nagios
+testcases/files/logs/nginx-http-auth
+testcases/files/logs/nsd
+testcases/files/logs/openwebmail
+testcases/files/logs/pam-generic
+testcases/files/logs/postfix
+testcases/files/logs/proftpd
+testcases/files/logs/pure-ftpd
+testcases/files/logs/roundcube-auth
+testcases/files/logs/postfix-sasl
+testcases/files/logs/sogo-auth
+testcases/files/logs/solid-pop3d
+testcases/files/logs/squid
+testcases/files/logs/sshd
+testcases/files/logs/sshd-ddos
+testcases/files/logs/vsftpd
+testcases/files/logs/webmin-auth
+testcases/files/logs/wuftpd
+testcases/files/logs/3proxy
+testcases/files/logs/apache-auth
+testcases/files/logs/apache-badbots
+testcases/files/logs/apache-nohome
+testcases/files/logs/apache-noscript
+testcases/files/logs/courierlogin
+testcases/files/logs/couriersmtp
+testcases/files/logs/cyrus-imap
+testcases/files/logs/dropbear
+testcases/files/logs/exim-spam
+testcases/files/logs/gssftpd
+testcases/files/logs/lighttpd-auth
+testcases/files/logs/mysqld-auth
+testcases/files/logs/perdition
+testcases/files/logs/php-url-fopen
+testcases/files/logs/qmail
+testcases/files/logs/recidive
+testcases/files/logs/sieve
+testcases/files/logs/selinux-ssh
+testcases/files/logs/sendmail-auth
+testcases/files/logs/sendmail-reject
+testcases/files/logs/suhosin
+testcases/files/logs/uwimap-auth
+testcases/files/logs/wuftpd
+testcases/files/logs/xinetd-fail
+testcases/files/config/apache-auth/digest/.htaccess
+testcases/files/config/apache-auth/digest/.htpasswd
+testcases/files/config/apache-auth/digest_time/.htaccess
+testcases/files/config/apache-auth/digest_time/.htpasswd
+testcases/files/config/apache-auth/basic/authz_owner/.htaccess
+testcases/files/config/apache-auth/basic/authz_owner/cant_get_me.html
+testcases/files/config/apache-auth/basic/authz_owner/.htpasswd
+testcases/files/config/apache-auth/basic/file/.htaccess
+testcases/files/config/apache-auth/basic/file/.htpasswd
+testcases/files/config/apache-auth/digest.py
+testcases/files/config/apache-auth/digest_wrongrelm/.htaccess
+testcases/files/config/apache-auth/digest_wrongrelm/.htpasswd
+testcases/files/config/apache-auth/digest_anon/.htaccess
+testcases/files/config/apache-auth/digest_anon/.htpasswd
+testcases/files/config/apache-auth/README
+testcases/files/config/apache-auth/noentry/.htaccess
+testcases/samplestestcase.py
+testcases/banmanagertestcase.py
+testcases/failmanagertestcase.py
+testcases/clientreadertestcase.py
+testcases/filtertestcase.py
+testcases/__init__.py
+testcases/datedetectortestcase.py
+testcases/actiontestcase.py
+testcases/servertestcase.py
+testcases/sockettestcase.py
+testcases/files/testcase01.log
+testcases/files/testcase02.log
+testcases/files/testcase03.log
+testcases/files/testcase04.log
+testcases/misctestcase.py
+testcases/utils.py
+common/__init__.py
+common/exceptions.py
+common/helpers.py
+common/version.py
+common/protocol.py
+config/jail.conf
+config/filter.d/common.conf
 config/filter.d/apache-auth.conf
 config/filter.d/apache-badbots.conf
-config/filter.d/apache-botsearch.conf
-config/filter.d/apache-common.conf
-config/filter.d/apache-fakegooglebot.conf
 config/filter.d/apache-modsecurity.conf
 config/filter.d/apache-nohome.conf
 config/filter.d/apache-noscript.conf
 config/filter.d/apache-overflows.conf
-config/filter.d/apache-shellshock.conf
-config/filter.d/assp.conf
-config/filter.d/asterisk.conf
-config/filter.d/botsearch-common.conf
-config/filter.d/common.conf
-config/filter.d/counter-strike.conf
-config/filter.d/courier-auth.conf
-config/filter.d/courier-smtp.conf
+config/filter.d/nginx-http-auth.conf
+config/filter.d/courierlogin.conf
+config/filter.d/couriersmtp.conf
 config/filter.d/cyrus-imap.conf
-config/filter.d/directadmin.conf
-config/filter.d/dovecot.conf
-config/filter.d/dropbear.conf
 config/filter.d/ejabberd-auth.conf
-config/filter.d/exim-common.conf
 config/filter.d/exim.conf
-config/filter.d/exim-spam.conf
 config/filter.d/freeswitch.conf
-config/filter.d/groupoffice.conf
 config/filter.d/gssftpd.conf
-config/filter.d/guacamole.conf
-config/filter.d/haproxy-http-auth.conf
 config/filter.d/horde.conf
-config/filter.d/ignorecommands
-config/filter.d/ignorecommands/apache-fakegooglebot
-config/filter.d/kerio.conf
-config/filter.d/lighttpd-auth.conf
-config/filter.d/monit.conf
-config/filter.d/murmur.conf
-config/filter.d/mysqld-auth.conf
+config/filter.d/suhosin.conf
 config/filter.d/nagios.conf
 config/filter.d/named-refused.conf
-config/filter.d/nginx-botsearch.conf
-config/filter.d/nginx-http-auth.conf
-config/filter.d/nginx-limit-req.conf
 config/filter.d/nsd.conf
-config/filter.d/openhab.conf
 config/filter.d/openwebmail.conf
-config/filter.d/oracleims.conf
-config/filter.d/pam-generic.conf
-config/filter.d/perdition.conf
-config/filter.d/php-url-fopen.conf
-config/filter.d/portsentry.conf
 config/filter.d/postfix.conf
-config/filter.d/postfix-rbl.conf
-config/filter.d/postfix-sasl.conf
 config/filter.d/proftpd.conf
 config/filter.d/pure-ftpd.conf
 config/filter.d/qmail.conf
-config/filter.d/recidive.conf
-config/filter.d/roundcube-auth.conf
-config/filter.d/screensharingd.conf
-config/filter.d/selinux-common.conf
-config/filter.d/selinux-ssh.conf
+config/filter.d/pam-generic.conf
+config/filter.d/php-url-fopen.conf
+config/filter.d/postfix-sasl.conf
 config/filter.d/sendmail-auth.conf
 config/filter.d/sendmail-reject.conf
-config/filter.d/sendmail-spam.conf
 config/filter.d/sieve.conf
-config/filter.d/sogo-auth.conf
 config/filter.d/solid-pop3d.conf
 config/filter.d/squid.conf
-config/filter.d/squirrelmail.conf
 config/filter.d/sshd.conf
 config/filter.d/sshd-ddos.conf
-config/filter.d/stunnel.conf
-config/filter.d/suhosin.conf
-config/filter.d/tine20.conf
-config/filter.d/uwimap-auth.conf
 config/filter.d/vsftpd.conf
 config/filter.d/webmin-auth.conf
 config/filter.d/wuftpd.conf
 config/filter.d/xinetd-fail.conf
-config/jail.conf
-config/paths-common.conf
-config/paths-debian.conf
-config/paths-fedora.conf
-config/paths-freebsd.conf
-config/paths-opensuse.conf
-config/paths-osx.conf
-CONTRIBUTING.md
-COPYING
-DEVELOP
+config/filter.d/asterisk.conf
+config/filter.d/dovecot.conf
+config/filter.d/dropbear.conf
+config/filter.d/lighttpd-auth.conf
+config/filter.d/recidive.conf
+config/filter.d/roundcube-auth.conf
+config/filter.d/assp.conf
+config/filter.d/sogo-auth.conf
+config/filter.d/mysqld-auth.conf
+config/filter.d/selinux-common.conf
+config/filter.d/selinux-ssh.conf
+config/filter.d/3proxy.conf
+config/filter.d/apache-common.conf
+config/filter.d/exim-common.conf
+config/filter.d/exim-spam.conf
+config/filter.d/groupoffice.conf
+config/filter.d/perdition.conf
+config/filter.d/uwimap-auth.conf
+config/action.d/apf.conf
+config/action.d/blocklist_de.conf
+config/action.d/osx-afctl.conf
+config/action.d/osx-ipfw.conf
+config/action.d/sendmail-common.conf
+config/action.d/badips.conf
+config/action.d/bsd-ipfw.conf
+config/action.d/dummy.conf
+config/action.d/firewallcmd-new.conf
+config/action.d/firewallcmd-ipset.conf
+config/action.d/iptables-ipset-proto6-allports.conf
+config/action.d/iptables-blocktype.conf
+config/action.d/iptables-ipset-proto4.conf
+config/action.d/iptables-ipset-proto6.conf
+config/action.d/iptables-xt_recent-echo.conf
+config/action.d/route.conf
+config/action.d/complain.conf
+config/action.d/dshield.conf
+config/action.d/hostsdeny.conf
+config/action.d/ipfw.conf
+config/action.d/ipfilter.conf
+config/action.d/iptables.conf
+config/action.d/iptables-allports.conf
+config/action.d/iptables-multiport.conf
+config/action.d/iptables-multiport-log.conf
+config/action.d/iptables-new.conf
+config/action.d/mail.conf
+config/action.d/mail-buffered.conf
+config/action.d/mail-whois.conf
+config/action.d/mail-whois-lines.conf
+config/action.d/mynetwatchman.conf
+config/action.d/pf.conf
+config/action.d/sendmail.conf
+config/action.d/sendmail-buffered.conf
+config/action.d/sendmail-whois.conf
+config/action.d/sendmail-whois-lines.conf
+config/action.d/shorewall.conf
+config/action.d/ufw.conf
+config/fail2ban.conf
 doc/run-rootless.txt
-fail2ban-2to3
-fail2ban/client/actionreader.py
-fail2ban/client/beautifier.py
-fail2ban/client/configparserinc.py
-fail2ban/client/configreader.py
-fail2ban/client/configurator.py
-fail2ban/client/csocket.py
-fail2ban/client/fail2banreader.py
-fail2ban/client/fail2banregex.py
-fail2ban/client/filterreader.py
-fail2ban/client/__init__.py
-fail2ban/client/jailreader.py
-fail2ban/client/jailsreader.py
-fail2ban/exceptions.py
-fail2ban/ipaddr.py
-fail2ban/helpers.py
-fail2ban/__init__.py
-fail2ban/protocol.py
-fail2ban/server/action.py
-fail2ban/server/actions.py
-fail2ban/server/asyncserver.py
-fail2ban/server/banmanager.py
-fail2ban/server/database.py
-fail2ban/server/datedetector.py
-fail2ban/server/datetemplate.py
-fail2ban/server/faildata.py
-fail2ban/server/failmanager.py
-fail2ban/server/failregex.py
-fail2ban/server/filtergamin.py
-fail2ban/server/filterpoll.py
-fail2ban/server/filter.py
-fail2ban/server/filterpyinotify.py
-fail2ban/server/filtersystemd.py
-fail2ban/server/__init__.py
-fail2ban/server/iso8601.py
-fail2ban/server/jail.py
-fail2ban/server/jails.py
-fail2ban/server/jailthread.py
-fail2ban/server/mytime.py
-fail2ban/server/server.py
-fail2ban/server/strptime.py
-fail2ban/server/ticket.py
-fail2ban/server/transmitter.py
-fail2ban-testcases-all
-fail2ban-testcases-all-python3
-fail2ban/tests/action_d/__init__.py
-fail2ban/tests/action_d/test_badips.py
-fail2ban/tests/action_d/test_smtp.py
-fail2ban/tests/actionstestcase.py
-fail2ban/tests/actiontestcase.py
-fail2ban/tests/banmanagertestcase.py
-fail2ban/tests/clientreadertestcase.py
-fail2ban/tests/clientbeautifiertestcase.py
-fail2ban/tests/config/action.d/brokenaction.conf
-fail2ban/tests/config/fail2ban.conf
-fail2ban/tests/config/filter.d/simple.conf
-fail2ban/tests/config/filter.d/test.conf
-fail2ban/tests/config/filter.d/test.local
-fail2ban/tests/config/jail.conf
-fail2ban/tests/config/paths-common.conf
-fail2ban/tests/config/paths-debian.conf
-fail2ban/tests/config/paths-freebsd.conf
-fail2ban/tests/config/paths-osx.conf
-fail2ban/tests/databasetestcase.py
-fail2ban/tests/datedetectortestcase.py
-fail2ban/tests/dummyjail.py
-fail2ban/tests/fail2banregextestcase.py
-fail2ban/tests/failmanagertestcase.py
-fail2ban/tests/files/action.d/action_checkainfo.py
-fail2ban/tests/files/action.d/action_errors.py
-fail2ban/tests/files/action.d/action_modifyainfo.py
-fail2ban/tests/files/action.d/action_noAction.py
-fail2ban/tests/files/action.d/action_nomethod.py
-fail2ban/tests/files/action.d/action.py
-fail2ban/tests/files/config/apache-auth/basic/authz_owner/cant_get_me.html
-fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htaccess
-fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htpasswd
-fail2ban/tests/files/config/apache-auth/basic/file/.htaccess
-fail2ban/tests/files/config/apache-auth/basic/file/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest_anon/.htaccess
-fail2ban/tests/files/config/apache-auth/digest_anon/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest/.htaccess
-fail2ban/tests/files/config/apache-auth/digest/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest.py
-fail2ban/tests/files/config/apache-auth/digest_time/.htaccess
-fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess
-fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd
-fail2ban/tests/files/config/apache-auth/noentry/.htaccess
-fail2ban/tests/files/config/apache-auth/README
-fail2ban/tests/files/database_v1.db
-fail2ban/tests/files/filter.d/substition.conf
-fail2ban/tests/files/filter.d/testcase01.conf
-fail2ban/tests/files/filter.d/testcase-common.conf
-fail2ban/tests/files/ignorecommand.py
-fail2ban/tests/files/logs/3proxy
-fail2ban/tests/files/logs/apache-auth
-fail2ban/tests/files/logs/apache-badbots
-fail2ban/tests/files/logs/apache-botscripts
-fail2ban/tests/files/logs/apache-botsearch
-fail2ban/tests/files/logs/apache-fakegooglebot
-fail2ban/tests/files/logs/apache-modsecurity
-fail2ban/tests/files/logs/apache-nohome
-fail2ban/tests/files/logs/apache-noscript
-fail2ban/tests/files/logs/apache-overflows
-fail2ban/tests/files/logs/apache-shellshock
-fail2ban/tests/files/logs/assp
-fail2ban/tests/files/logs/asterisk
-fail2ban/tests/files/logs/bsd/syslog-plain.txt
-fail2ban/tests/files/logs/bsd/syslog-v.txt
-fail2ban/tests/files/logs/bsd/syslog-vv.txt
-fail2ban/tests/files/logs/counter-strike
-fail2ban/tests/files/logs/courier-auth
-fail2ban/tests/files/logs/courier-smtp
-fail2ban/tests/files/logs/cyrus-imap
-fail2ban/tests/files/logs/directadmin
-fail2ban/tests/files/logs/dovecot
-fail2ban/tests/files/logs/dropbear
-fail2ban/tests/files/logs/ejabberd-auth
-fail2ban/tests/files/logs/exim
-fail2ban/tests/files/logs/exim-spam
-fail2ban/tests/files/logs/freeswitch
-fail2ban/tests/files/logs/groupoffice
-fail2ban/tests/files/logs/gssftpd
-fail2ban/tests/files/logs/guacamole
-fail2ban/tests/files/logs/haproxy-http-auth
-fail2ban/tests/files/logs/horde
-fail2ban/tests/files/logs/kerio
-fail2ban/tests/files/logs/lighttpd-auth
-fail2ban/tests/files/logs/monit
-fail2ban/tests/files/logs/murmur
-fail2ban/tests/files/logs/mysqld-auth
-fail2ban/tests/files/logs/nagios
-fail2ban/tests/files/logs/named-refused
-fail2ban/tests/files/logs/nginx-botsearch
-fail2ban/tests/files/logs/nginx-http-auth
-fail2ban/tests/files/logs/nginx-limit-req
-fail2ban/tests/files/logs/nsd
-fail2ban/tests/files/logs/openhab
-fail2ban/tests/files/logs/openwebmail
-fail2ban/tests/files/logs/oracleims
-fail2ban/tests/files/logs/pam-generic
-fail2ban/tests/files/logs/perdition
-fail2ban/tests/files/logs/php-url-fopen
-fail2ban/tests/files/logs/portsentry
-fail2ban/tests/files/logs/postfix
-fail2ban/tests/files/logs/postfix-rbl
-fail2ban/tests/files/logs/postfix-sasl
-fail2ban/tests/files/logs/proftpd
-fail2ban/tests/files/logs/pure-ftpd
-fail2ban/tests/files/logs/qmail
-fail2ban/tests/files/logs/recidive
-fail2ban/tests/files/logs/roundcube-auth
-fail2ban/tests/files/logs/screensharingd
-fail2ban/tests/files/logs/selinux-ssh
-fail2ban/tests/files/logs/sendmail-auth
-fail2ban/tests/files/logs/sendmail-reject
-fail2ban/tests/files/logs/sendmail-spam
-fail2ban/tests/files/logs/sieve
-fail2ban/tests/files/logs/sogo-auth
-fail2ban/tests/files/logs/solid-pop3d
-fail2ban/tests/files/logs/squid
-fail2ban/tests/files/logs/squirrelmail
-fail2ban/tests/files/logs/sshd
-fail2ban/tests/files/logs/sshd-ddos
-fail2ban/tests/files/logs/stunnel
-fail2ban/tests/files/logs/suhosin
-fail2ban/tests/files/logs/tine20
-fail2ban/tests/files/logs/uwimap-auth
-fail2ban/tests/files/logs/vsftpd
-fail2ban/tests/files/logs/webmin-auth
-fail2ban/tests/files/logs/wuftpd
-fail2ban/tests/files/logs/xinetd-fail
-fail2ban/tests/files/testcase01.log
-fail2ban/tests/files/testcase02.log
-fail2ban/tests/files/testcase03.log
-fail2ban/tests/files/testcase04.log
-fail2ban/tests/files/testcase-journal.log
-fail2ban/tests/files/testcase-multiline.log
-fail2ban/tests/files/testcase-usedns.log
-fail2ban/tests/files/testcase-wrong-char.log
-fail2ban/tests/filtertestcase.py
-fail2ban/tests/__init__.py
-fail2ban/tests/misctestcase.py
-fail2ban/tests/samplestestcase.py
-fail2ban/tests/servertestcase.py
-fail2ban/tests/sockettestcase.py
-fail2ban/tests/utils.py
-fail2ban/version.py
-files/bash-completion
-files/cacti/cacti_host_template_fail2ban.xml
-files/cacti/fail2ban_stats.sh
-files/cacti/README
-files/debian-initd
-files/fail2ban-logrotate
-files/fail2ban.service
-files/fail2ban-tmpfiles.conf
-files/fail2ban.upstart
-files/gen_badbots
-files/gentoo-confd
+man/fail2ban-client.1
+man/fail2ban.1
+man/jail.conf.5
+man/fail2ban-client.h2m
+man/fail2ban-server.1
+man/fail2ban-server.h2m
+man/fail2ban-regex.1
+man/fail2ban-regex.h2m
+man/generate-man
 files/gentoo-initd
-files/ipmasq-ZZZzzz_fail2ban.rul
-files/logwatch/fail2ban
-files/macosx-initd
-files/monit/fail2ban
-files/nagios/check_fail2ban
-files/nagios/README
+files/gentoo-confd
 files/redhat-initd
+files/macosx-initd
 files/solaris-fail2ban.xml
 files/solaris-svc-fail2ban
 files/suse-initd
-FILTERS
-kill-server
-man/fail2ban.1
-man/fail2ban-client.1
-man/fail2ban-client.h2m
-man/fail2ban-regex.1
-man/fail2ban-regex.h2m
-man/fail2ban-server.1
-man/fail2ban-server.h2m
-man/generate-man
-man/jail.conf.5
-README.md
-README.Solaris
-RELEASE
-setup.cfg
-setup.py
-THANKS
-TODO
-Vagrantfile
+files/fail2ban-logrotate
+files/cacti/fail2ban_stats.sh
+files/cacti/cacti_host_template_fail2ban.xml
+files/cacti/README
+files/nagios/check_fail2ban
+files/nagios/README
+files/bash-completion
+files/fail2ban-tmpfiles.conf
+files/fail2ban.service
+files/ipmasq-ZZZzzz_fail2ban.rul
+files/gen_badbots
+testcases/config/jail.conf
+testcases/config/fail2ban.conf
+testcases/config/filter.d/simple.conf
+testcases/config/action.d/brokenaction.conf

MANIFEST.in

@@ -1,5 +0,0 @@
-include ChangeLog COPYING DEVELOP FILTERS README.* THANKS TODO CONTRIBUTING* Vagrantfile
-graft doc
-graft files
-recursive-include config *.conf *.py
-recursive-include config/filter.d/ignorecommands *

README.md

@@ -2,21 +2,14 @@
                         / _|__ _(_) |_  ) |__  __ _ _ _  
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
-                       v0.9.4.dev0             2016/??/??
+                       v0.8.14.dev             2014/../..
 
 ## Fail2Ban: ban hosts that cause multiple authentication errors
 
-Fail2Ban scans log files like `/var/log/auth.log` and bans IP addresses having
-too many failed login attempts. It does this by updating system firewall rules
-to reject new connections from those IP addresses, for a configurable amount
-of time. Fail2Ban comes out-of-the-box ready to read many standard log files,
-such as those for sshd and Apache, and is easy to configure to read any log
-file you choose, for any error you choose.
-
-Though Fail2Ban is able to reduce the rate of incorrect authentications
-attempts, it cannot eliminate the risk that weak authentication presents.
-Configure services to use only two factor or public/private authentication
-mechanisms if you really want to protect services.
+Fail2Ban scans log files like /var/log/pwdfail and bans IP that makes too many
+password failures. It updates firewall rules to reject the IP address. These
+rules can be defined by the user. Fail2Ban can read multiple log files such as
+sshd or Apache web server ones.
 
 This README is a quick introduction to Fail2ban. More documentation, FAQ, HOWTOs
 are available in fail2ban(1) manpage and on the website http://www.fail2ban.org
@@ -28,23 +21,21 @@ Installation:
 this case, you should use it instead.**
 
 Required:
-- [Python2 >= 2.6 or Python >= 3.2](http://www.python.org) or [PyPy](http://pypy.org)
+- [Python >= 2.4](http://www.python.org)
 
 Optional:
 - [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify)
   - Linux >= 2.6.13
 - [gamin >= 0.0.21](http://www.gnome.org/~veillard/gamin)
-- [systemd >= 204](http://www.freedesktop.org/wiki/Software/systemd)
-- [dnspython](http://www.dnspython.org/)
 
 To install, just do:
 
-    tar xvfj fail2ban-0.9.4.tar.bz2
-    cd fail2ban-0.9.4
+    tar xvfj fail2ban-0.8.14.tar.bz2
+    cd fail2ban-0.8.14
     python setup.py install
 
-This will install Fail2Ban into the python library directory. The executable
-scripts are placed into `/usr/bin`, and configuration under `/etc/fail2ban`.
+This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
+placed into /usr/bin, and configuration under /etc/fail2ban.
 
 Fail2Ban should be correctly installed now. Just type:
 
@@ -53,22 +44,14 @@ Fail2Ban should be correctly installed now. Just type:
 to see if everything is alright. You should always use fail2ban-client and
 never call fail2ban-server directly.
 
-Please note that the system init/service script is not automatically installed.
-To enable fail2ban as an automatic service, simply copy the script for your
-distro from the `files` directory to `/etc/init.d`. Example (on a Debian-based
-system):
-
-    cp files/debian-initd /etc/init.d/fail2ban
-    update-rc.d fail2ban defaults
-    service fail2ban start
-
 Configuration:
 --------------
 
-You can configure Fail2Ban using the files in `/etc/fail2ban`. It is possible to
-configure the server using commands sent to it by `fail2ban-client`. The
+You can configure Fail2Ban using the files in /etc/fail2ban. It is possible to
+configure the server using commands sent to it by fail2ban-client. The
 available commands are described in the fail2ban-client(1) manpage.  Also see
-fail2ban(1) and jail.conf(5)  manpages for further references.
+fail2ban(1) manpage for further references and find even more documentation on
+the website: http://www.fail2ban.org
 
 Code status:
 ------------
@@ -77,17 +60,27 @@ Code status:
 
 * [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.png?branch=master)](https://coveralls.io/r/fail2ban/fail2ban)
 
-* [![codecov.io](https://codecov.io/github/fail2ban/fail2ban/coverage.svg?branch=master)](https://codecov.io/github/fail2ban/fail2ban?branch=master)
-
 Contact:
 --------
 
-### Bugs, feature requests, discussions?
-See [CONTRIBUTING.md](https://github.com/fail2ban/fail2ban/blob/master/CONTRIBUTING.md)
+### You found a severe security vulnerability in Fail2Ban?
+email details to fail2ban-vulnerabilities at lists dot sourceforge dot net .
+
+### You need some new features, you found bugs?
+visit [Issues](https://github.com/fail2ban/fail2ban/issues)
+and if your issue is not yet known -- file a bug report. See
+[Fail2Ban wiki](http://www.fail2ban.org/wiki/index.php/HOWTO_Seek_Help)
+on further instructions.
+
+### You would like to troubleshoot or discuss?
+join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
+
+### You would like to contribute (new filters/actions/code/documentation)?
+send a pull request
 
 ### You just appreciate this program:
-send kudos to the original author ([Cyril Jaquier](mailto: Cyril Jaquier <cyril.jaquier@fail2ban.org>))
-or *better* to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
+send kudos to the original author ([Cyril Jaquier](mailto: Cyril Jaquier <cyril.jaquier@fail2ban.org>)
+or better to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
 since Fail2Ban is "community-driven" for years now.
 
 Thanks:

RELEASE

@@ -1,206 +0,0 @@
-..                       __      _ _ ___ _
-                        / _|__ _(_) |_  ) |__  __ _ _ _
-                       |  _/ _` | | |/ /| '_ \/ _` | ' \
-                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
-
-================================================================================
-How to do a release for Fail2Ban
-================================================================================
-
-Preparation
-===========
-
-* Check distribution patches and see if they can be included
-
-  * https://apps.fedoraproject.org/packages/fail2ban/sources
-  * http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/
-  * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/
-  * https://build.opensuse.org/package/show?package=fail2ban&project=openSUSE%3AFactory
-  * http://sophie.zarb.org/sources/fail2ban (Mageia)
-  * https://trac.macports.org/browser/trunk/dports/security/fail2ban
-
-
-* Check distribution outstanding bugs
-
-  * https://github.com/fail2ban/fail2ban/issues?sort=updated&state=open
-  * http://bugs.debian.org/cgi-bin/pkgreport.cgi?dist=unstable;package=fail2ban
-  * https://bugs.launchpad.net/ubuntu/+source/fail2ban
-  * http://bugs.sabayon.org/buglist.cgi?quicksearch=net-analyzer%2Ffail2ban
-  * https://bugs.archlinux.org/?project=5&cat%5B%5D=33&string=fail2ban
-  * https://bugs.gentoo.org/buglist.cgi?query_format=advanced&short_desc=fail2ban&bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=IN_PROGRESS&short_desc_type=allwords
-  * https://bugzilla.redhat.com/buglist.cgi?query_format=advanced&bug_status=NEW&bug_status=ASSIGNED&component=fail2ban&classification=Red%20Hat&classification=Fedora
-  * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
-  * https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
-  * https://build.opensuse.org/package/requests/openSUSE:Factory/fail2ban
-
-
-* Make sure the tests pass::
-
-  ./fail2ban-testcases-all
-
-* Ensure the version is correct in:
-
-  * ./fail2ban/version.py
-  * top of ChangeLog
-  * README.md
-
-
-* Ensure the MANIFEST is complete
-
-  ad-hoc bash script to run in a clean clone:
-
-     find -type f | grep -v -e '\.git' -e '/doc/' -e '\.travis' -e MANIFEST | sed -e 's,^\./,,g' | while read f; do grep -ne "^$f\$" MANIFEST >/dev/null || echo "$f" ; done
-
-  or an alternative for comparison with previous release
-
-     git diff 0.9.4 | grep -B2 'index 0000000..' | grep -B1 'new file mode' | sed -n -e '/^diff /s,.* b/,,gp' >> MANIFEST
-     sort MANIFEST | uniq | sponge MANIFEST
-
-* Run::
-
-  python setup.py sdist
-
-* Look for errors like::
-
-   'testcases/files/logs/mysqld.log' not a regular file -- skipping
-
-  * Which indicates that testcases/files/logs/mysqld.log has been moved or is a directory::
-
-      tar -C /tmp -jxf dist/fail2ban-0.9.4.tar.bz2
-
-* clean up current direcory::
-
-    diff -rul --exclude \*.pyc . /tmp/fail2ban-0.9.4/
-
-  * Only differences should be files that you don't want distributed.
-
-
-* Ensure the tests work from the tarball::
-
-    cd /tmp/fail2ban-0.9.4/ && bin/fail2ban-testcases
-
-* Add/finalize the corresponding entry in the ChangeLog
-
-  * To generate a list of committers use e.g.::
-
-      git shortlog -sn 0.9.4.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
-
-  * Ensure the top of the ChangeLog has the right version and current date.
-  * Ensure the top entry of the ChangeLog has the right version and current date.
-
-* Update man pages::
-
-    (cd man ; ./generate-man )
-    git commit -m 'DOC/ENH: update man pages for release' man/*
-
-* Cleanout TODO file with the finished stuff
-
-* Prepare source and rpm binary distributions::
-
-    python setup.py sdist
-
-  * Broken for now:  python setup.py bdist_rpm
-  * Broken for now:  python setup.py upload
-
-
-* Tag the release by using a signed (and annotated) tag.  Cut/paste
-  release ChangeLog entry as tag annotation::
-
-    git tag -s 0.9.4
-
-Pre Release
-===========
-
-* Provide a release sample to distributors
-
-  * Arch Linux:
-
-    * https://www.archlinux.org/packages/community/any/fail2ban/
-
-  * Debian: Yaroslav Halchenko <debian@onerussian.com>
-
-    * http://packages.qa.debian.org/f/fail2ban.html
-
-  * FreeBSD: Christoph Theis theis@gmx.at>
-
-    * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/Makefile?view=markup
-    * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
-
-  * Fedora: Axel Thimm <Axel.Thimm@atrpms.net>
-
-    * https://apps.fedoraproject.org/packages/fail2ban
-    * http://pkgs.fedoraproject.org/cgit/fail2ban.git
-    * https://admin.fedoraproject.org/pkgdb/acls/bugs/fail2ban
-
-  * Gentoo: netmon@gentoo.org
-
-    * http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/metadata.xml?view=markup
-    * https://bugs.gentoo.org/buglist.cgi?quicksearch=fail2ban
-
-  * openSUSE: Stephan Kulow <coolo@suse.com>
-
-    * https://build.opensuse.org/package/show/openSUSE:Factory/fail2ban
-
-  * Mac Ports: @Malbrouck on github (gh-49)
-
-    * https://trac.macports.org/browser/trunk/dports/security/fail2ban/Portfile
-
-  * Mageia:
-
-    * https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
-
-  * And potentially to the fail2ban-users email list.
-
-
-* Wait for feedback from distributors
-
-* Prepare a release notice https://github.com/fail2ban/fail2ban/releases/new
-
-* Upload the source/binaries from the dist directory and tag the release using the URL
-
-* Upload source/binaries to sourceforge http://sourceforge.net/projects/fail2ban/
-
-* Run the following and update the wiki with output::
-
-    python -c 'import fail2ban.protocol; fail2ban.protocol.printWiki()'
-
-  * page: http://www.fail2ban.org/wiki/index.php/Commands
-
-
-* Update:
-
-  * http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_Versions&action=edit
-
-  * http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_News&action=edit
-    * move old bits to http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_OldNews&action=edit
-
-  * http://www.fail2ban.org/wiki/index.php/ChangeLog
-  * http://www.fail2ban.org/wiki/index.php/Requirements (Check requirement)
-  * http://www.fail2ban.org/wiki/index.php/Features
-
-* See if any filters are upgraded:
-  http://www.fail2ban.org/wiki/index.php/Special:AllPages
-
-* Email users and development list of release
-
-* notify distributors
-
-Post Release
-============
-
-Add the following to the top of the ChangeLog::
-
-  ver. 0.9.6 (2016/XX/XXX) - wanna-be-released
-  -----------
-  
-  - Fixes:
-  
-  - New Features:
-  
-  - Enhancements:
-
-Alter the git shortlog command in the previous section to refer to the just
-released version.
-
-and adjust fail2ban/version.py to carry .dev0 suffix to signal
-a version under development.

THANKS

@@ -6,17 +6,13 @@ the project.  If you have been left off, please let us know
 (preferably send a pull request on github with the "fix") and you will
 be added
 
-Aaron Brice
 Adam Tkac
 Adrien Clerc
 ache
 ag4ve (Shawn)
 Alasdair D. Campbell
-Alexander Koeppe (IPv6 support)
-Alexandre Perrin (kAworu)
 Amir Caspi
 Amy
-Andrew St. Jean
 Andrey G. Grozin
 Andy Fragen
 Arturo 'Buanzo' Busleiman
@@ -30,38 +26,26 @@ Christian Rauch
 Christophe Carles
 Christoph Haas
 Christos Psonis
-craneworks
 Cyril Jaquier
 Daniel B. Cid
 Daniel B.
 Daniel Black
 David Nutter
-David Reagan (jerrac)
 Derek Atkins
-Donald Yandt
 Eric Gerbier
 Enrico Labedzki
-Eugene Hopkinson (SlowRiot)
 ftoppi
-Florian Robert (1technophile)
 François Boulogne
-Frantisek Sumsal
 Frédéric
 Georgiy Mernov
 Guilhem Lettron
 Guillaume Delvit
-Hank Leininger
 Hanno 'Rince' Wagner
-Helmut Grohne
 Iain Lea
-Ioan Indreias
 Ivo Truxa
-John Thoe
 Jacques Lav!gnotte
-Johannes Weberhofer
-Jason H Martin
+Ioan Indreias
 Jisoo Park
-Joel M Snyder
 Jonathan Kamens
 Jonathan Lanning
 Jonathan Underwood
@@ -69,14 +53,10 @@ Joël Bertrand
 JP Espinosa
 jserrachinha
 Justin Shore
-Kevin Locke
 Kévin Drapel
 kjohnsonecl
 kojiro
-Lars Kneschke
 Lee Clemens
-leftyfb (Mike Rushton)
-M. Maraun
 Manuel Arostegui Ramirez
 Marcel Dopita
 Mark Edgington
@@ -89,16 +69,9 @@ mEDI
 Merijn Schering
 Michael C. Haller
 Michael Hanselmann
-Mika (mkl)
 Nick Munger
-onorua
-Orion Poplawski
-Pablo Rodriguez Fernandez
-Paul Marrapese
-Paul Traina
 Noel Butler
 Patrick Börjesson
-Pressy
 Raphaël Marichez
 RealRancor
 René Berber
@@ -106,30 +79,22 @@ Robert Edeker
 Rolf Fokkens
 Roman Gelfand
 Russell Odom
-SATO Kentaro
-Sean DuBois
 Sebastian Arcus
-Serg G. Brester
 Sireyessire
 silviogarbes
 Stefan Tatschner
 Stephen Gildea
 Steven Hiscocks
-TESTOVIK
-Thomas Mayer
 Tom Pike
-Tom Hendrikx
 Tomas Pihl
-Tony Lawrence
 Tomasz Ciolek
 Tyler
 Vaclav Misek
 Vincent Deffontaines
 Yaroslav Halchenko
 Winston Smith
-Yehuda Katz
 ykimon
-Yung-Chin Oei
+Yehuda Katz
 Zbigniew Jędrzejewski-Szmek
 zugeschmiert
 Zurd

TODO

@@ -7,12 +7,26 @@
 ToDo
 ================================================================================
 
+See https://github.com/fail2ban/fail2ban/issues?state=open for the list of
+current outstanding issues and wishlists.  They should also be sorted among
+milestones and tagged for filtering.  This file reflects possibly outdated
+plans but is kept for someone to move them into github's issues.
+
 Legend:
 - not yet done
 ? maybe
 # partially done
 * done
 
+* Removed relative imports
+
+* Cleanup fail2ban-client and fail2ban-server. Move code to server/ and client/
+
+- Add timeout to external commands (signal alarm, watchdog thread, etc)
+
+- Uniformize filters and actions name. Use the software name (openssh, postfix,
+  proftp) and possible qualifier (e.g. auth) after a '-'
+
 - Added <USER> tag for failregex. Add features using this information. Maybe add
   more tags
 
@@ -23,10 +37,23 @@ Legend:
 - Auto-enable function (search for log files), check modification date to see if
   service is still in use
 
+- Improve parsing of the action parameters in jailreader.py
+
 - Better handling of the protocol in transmitter.py
 
 - Add gettext support (I18N)
 
+- Multiline log reading
+
+- Improve execution of action. Why does subprocess.call deadlock with
+  multi-jails?
+
+# see Feature Request Tracking System at SourceForge.net
+
 # improve documentation and website for user
 
 # better return values in function
+
+# refactoring in server.py, actions.py, filter.py
+
+* New backend: pyinotify

Vagrantfile

@@ -1,30 +0,0 @@
-Vagrant.configure("2") do |config|
-
-    config.vm.define "secure" do |secure|
-        secure.vm.box = "ubuntu/trusty64"
-        secure.vm.hostname = "secure.dev.fail2ban.org"
-        secure.vm.network "private_network", ip: "192.168.200.100"
-
-#        secure.vm.synced_folder 'salt/roots', '/srv/salt'
-
-#        secure.vm.provision :salt do |salt|
-#            salt.minion_config = 'salt/minion'
-#            salt.run_highstate = true
-#            salt.verbose = true
-#        end
-    end
-
-    config.vm.define "attacker" do |attacker|
-        attacker.vm.box = "ubuntu/trusty64"
-        attacker.vm.hostname = "attacker.dev.fail2ban.org"
-        attacker.vm.network "private_network", ip: "192.168.200.150"
-
-#        attacker.vm.synced_folder 'salt/roots', '/srv/salt'
-
-#        attacker.vm.provision :salt do |salt|
-#            salt.minion_config = 'salt/minion'
-#            salt.run_highstate = true
-#            salt.verbose = true
-#        end
-    end
-end

bin/fail2ban-testcases

@@ -1,132 +0,0 @@
-#!/usr/bin/python
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-"""Script to run Fail2Ban tests battery
-"""
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-__author__ = "Cyril Jaquier"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2012- Yaroslav Halchenko"
-__license__ = "GPL"
-
-import logging
-import os
-import sys
-import time
-import unittest
-
-# Check if local fail2ban module exists, and use if it exists by 
-# modifying the path. This is such that tests can be used in dev
-# environment.
-if os.path.exists("fail2ban/__init__.py"):
-	sys.path.insert(0, ".")
-from fail2ban.version import version
-
-from fail2ban.tests.utils import gatherTests
-from fail2ban.helpers import FormatterWithTraceBack, getLogger
-from fail2ban.server.mytime import MyTime
-
-from optparse import OptionParser, Option
-
-def get_opt_parser():
-	# use module docstring for help output
-	p = OptionParser(
-				usage="%s [OPTIONS] [regexps]\n" % sys.argv[0] + __doc__,
-				version="%prog " + version)
-
-	p.add_options([
-		Option('-l', "--log-level", type="choice",
-			   dest="log_level",
-			   choices=('heavydebug', 'debug', 'info', 'notice', 'warning', 'error', 'critical'),
-			   default=None,
-			   help="Log level for the logger to use during running tests"),
-		Option('-n', "--no-network", action="store_true",
-			   dest="no_network",
-			   help="Do not run tests that require the network"),
-		Option("-t", "--log-traceback", action='store_true',
-			   help="Enrich log-messages with compressed tracebacks"),
-		Option("--full-traceback", action='store_true',
-			   help="Either to make the tracebacks full, not compressed (as by default)"),
-
-		])
-
-	return p
-
-parser = get_opt_parser()
-(opts, regexps) = parser.parse_args()
-
-#
-# Logging
-#
-logSys = getLogger("fail2ban")
-
-# Numerical level of verbosity corresponding to a log "level"
-verbosity = {'heavydebug': 4,
-			 'debug': 3,
-			 'info': 2,
-			 'notice': 2,
-			 'warning': 1,
-			 'error': 1,
-			 'critical': 0,
-			 None: 1}[opts.log_level]
-
-if opts.log_level is not None: # pragma: no cover
-	# so we had explicit settings
-	logSys.setLevel(getattr(logging, opts.log_level.upper()))
-else: # pragma: no cover
-	# suppress the logging but it would leave unittests' progress dots
-	# ticking, unless like with '-l critical' which would be silent
-	# unless error occurs
-	logSys.setLevel(getattr(logging, 'CRITICAL'))
-
-# Add the default logging handler
-stdout = logging.StreamHandler(sys.stdout)
-
-fmt = ' %(message)s'
-
-if opts.log_traceback:
-	Formatter = FormatterWithTraceBack
-	fmt = (opts.full_traceback and ' %(tb)s' or ' %(tbc)s') + fmt
-else:
-	Formatter = logging.Formatter
-
-# Custom log format for the verbose tests runs
-if verbosity > 1: # pragma: no cover
-	stdout.setFormatter(Formatter(' %(asctime)-15s %(thread)s' + fmt))
-else: # pragma: no cover
-	# just prefix with the space
-	stdout.setFormatter(Formatter(fmt))
-logSys.addHandler(stdout)
-
-#
-# Let know the version
-#
-if not opts.log_level or opts.log_level != 'critical': # pragma: no cover
-	print("Fail2ban %s test suite. Python %s. Please wait..." \
-	    % (version, str(sys.version).replace('\n', '')))
-
-tests = gatherTests(regexps, opts.no_network)
-#
-# Run the tests
-#
-testRunner = unittest.TextTestRunner(verbosity=verbosity)
-
-tests_results = testRunner.run(tests)
-
-if not tests_results.wasSuccessful(): # pragma: no cover
-	sys.exit(1)

client/actionreader.py

@@ -0,0 +1,90 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Cyril Jaquier
+# 
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class ActionReader(ConfigReader):
+	
+	def __init__(self, action, name, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
+		self.__file = action[0]
+		self.__cInfo = action[1]
+		self.__name = name
+	
+	def setFile(self, fileName):
+		self.__file = fileName
+	
+	def getFile(self):
+		return self.__file
+	
+	def setName(self, name):
+		self.__name = name
+	
+	def getName(self):
+		return self.__name
+	
+	def read(self):
+		return ConfigReader.read(self, "action.d/" + self.__file)
+	
+	def getOptions(self, pOpts):
+		opts = [["string", "actionstart", ""],
+				["string", "actionstop", ""],
+				["string", "actioncheck", ""],
+				["string", "actionban", ""],
+				["string", "actionunban", ""]]
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
+		
+		if self.has_section("Init"):
+			for opt in self.options("Init"):
+				if not self.__cInfo.has_key(opt):
+					self.__cInfo[opt] = self.get("Init", opt)
+	
+	def convert(self):
+		head = ["set", self.__name]
+		stream = list()
+		stream.append(head + ["addaction", self.__file])
+		for opt in self.__opts:
+			if opt == "actionstart":
+				stream.append(head + ["actionstart", self.__file, self.__opts[opt]])
+			elif opt == "actionstop":
+				stream.append(head + ["actionstop", self.__file, self.__opts[opt]])
+			elif opt == "actioncheck":
+				stream.append(head + ["actioncheck", self.__file, self.__opts[opt]])
+			elif opt == "actionban":
+				stream.append(head + ["actionban", self.__file, self.__opts[opt]])
+			elif opt == "actionunban":
+				stream.append(head + ["actionunban", self.__file, self.__opts[opt]])
+		# cInfo
+		if self.__cInfo:
+			for p in self.__cInfo:
+				stream.append(head + ["setcinfo", self.__file, p, self.__cInfo[p]])
+
+		return stream
+		

client/beautifier.py

@@ -21,12 +21,12 @@ __author__ = "Cyril Jaquier, Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2013- Yaroslav Halchenko"
 __license__ = "GPL"
 
-from ..exceptions import UnknownJailException, DuplicateJailException
-from ..helpers import getLogger
+import logging
+
+from common.exceptions import UnknownJailException, DuplicateJailException
 
 # Gets the instance of the logger.
-logSys = getLogger(__name__)
-
+logSys = logging.getLogger("fail2ban.client.config")
 
 ##
 # Beautify the output of the client.
@@ -35,26 +35,23 @@ logSys = getLogger(__name__)
 # converted into user readable messages.
 
 class Beautifier:
-
+	
 	def __init__(self, cmd = None):
 		self.__inputCmd = cmd
 
 	def setInputCmd(self, cmd):
 		self.__inputCmd = cmd
-
+		
 	def getInputCmd(self):
 		return self.__inputCmd
-
+		
 	def beautify(self, response):
-		logSys.debug(
-			"Beautify " + repr(response) + " with " + repr(self.__inputCmd))
+		logSys.debug("Beautify " + `response` + " with " + `self.__inputCmd`)
 		inC = self.__inputCmd
 		msg = response
 		try:
 			if inC[0] == "ping":
 				msg = "Server replied: " + response
-			elif inC[0] == "version":
-				msg = response
 			elif inC[0] == "start":
 				msg = "Jail started"
 			elif inC[0] == "stop":
@@ -70,26 +67,28 @@ class Beautifier:
 				msg = "logs: " + response
 			elif inC[0:1] == ['status']:
 				if len(inC) > 1:
+					# Create IP list
+					ipList = ""
+					for ip in response[1][1][2][1]:
+						ipList += ip + " "
+					# Creates file list.
+					fileList = ""
+					for f in response[0][1][2][1]:
+						fileList += f + " "
 					# Display information
-					msg = ["Status for the jail: %s" % inC[1]]
-					for n, res1 in enumerate(response):
-						prefix1 = "`-" if n == len(response) - 1 else "|-"
-						msg.append("%s %s" % (prefix1, res1[0]))
-						prefix1 = "   " if n == len(response) - 1 else "|  "
-						for m, res2 in enumerate(res1[1]):
-							prefix2 = prefix1 + ("`-" if m == len(res1[1]) - 1 else "|-")
-							val = " ".join(map(str, res2[1])) if isinstance(res2[1], list) else res2[1]
-							msg.append("%s %s:\t%s" % (prefix2, res2[0], val))
+					msg = "Status for the jail: " + inC[1] + "\n"
+					msg = msg + "|- " + response[0][0] + "\n"
+					msg = msg + "|  |- " + response[0][1][2][0] + ":\t" + fileList + "\n"
+					msg = msg + "|  |- " + response[0][1][0][0] + ":\t" + `response[0][1][0][1]` + "\n"
+					msg = msg + "|  `- " + response[0][1][1][0] + ":\t" + `response[0][1][1][1]` + "\n"
+					msg = msg + "`- " + response[1][0] + "\n"
+					msg = msg + "   |- " + response[1][1][0][0] + ":\t" + `response[1][1][0][1]` + "\n"
+					msg = msg + "   |  `- " + response[1][1][2][0] + ":\t" + ipList + "\n"
+					msg = msg + "   `- " + response[1][1][1][0] + ":\t" + `response[1][1][1][1]`
 				else:
-					msg = ["Status"]
-					for n, res1 in enumerate(response):
-						prefix1 = "`-" if n == len(response) - 1 else "|-"
-						val = " ".join(map(str, res1[1])) if isinstance(res1[1], list) else res1[1]
-						msg.append("%s %s:\t%s" % (prefix1, res1[0], val))
-				msg = "\n".join(msg)
-			elif inC[1] == "syslogsocket":
-				msg = "Current syslog socket is:\n"
-				msg = msg + "`- " + response
+					msg = "Status\n"
+					msg = msg + "|- " + response[0][0] + ":\t" + `response[0][1]` + "\n"
+					msg = msg + "`- " + response[1][0] + ":\t\t" + response[1][1]
 			elif inC[1] == "logtarget":
 				msg = "Current logging target is:\n"
 				msg = msg + "`- " + response
@@ -104,19 +103,7 @@ class Beautifier:
 				elif response == 4:
 					msg = msg + "DEBUG"
 				else:
-					msg = msg + repr(response)
-			elif inC[1] == "dbfile":
-				if response is None:
-					msg = "Database currently disabled"
-				else:
-					msg = "Current database file is:\n"
-					msg = msg + "`- " + response
-			elif inC[1] == "dbpurgeage":
-				if response is None:
-					msg = "Database currently disabled"
-				else:
-					msg = "Current database purge age is:\n"
-					msg = msg + "`- %iseconds" % response
+					msg = msg + `response`
 			elif inC[2] in ("logpath", "addlogpath", "dellogpath"):
 				if len(response) == 0:
 					msg = "No file is currently monitored"
@@ -125,23 +112,6 @@ class Beautifier:
 					for path in response[:-1]:
 						msg = msg + "|- " + path + "\n"
 					msg = msg + "`- " + response[len(response)-1]
-			elif inC[2] == "logencoding":
-				msg = "Current log encoding is set to:\n"
-				msg = msg + response
-			elif inC[2] in ("journalmatch", "addjournalmatch", "deljournalmatch"):
-				if len(response) == 0:
-					msg = "No journal match filter set"
-				else:
-					msg = "Current match filter:\n"
-					msg += ' + '.join(" ".join(res) for res in response)
-			elif inC[2] == "datepattern":
-				msg = "Current date pattern set to: "
-				if response is None:
-					msg = msg + "Not set/required"
-				elif response[0] is None:
-					msg = msg + "%s" % response[1]
-				else:
-					msg = msg + "%s (%s)" % response
 			elif inC[2] in ("ignoreip", "addignoreip", "delignoreip"):
 				if len(response) == 0:
 					msg = "No IP address/network is ignored"
@@ -161,43 +131,20 @@ class Beautifier:
 						msg = msg + "|- [" + str(c) + "]: " + ip + "\n"
 						c += 1
 					msg = msg + "`- [" + str(c) + "]: " + response[len(response)-1]
-			elif inC[2] == "actions":
-				if len(response) == 0:
-					msg = "No actions for jail %s" % inC[1]
-				else:
-					msg = "The jail %s has the following actions:\n" % inC[1]
-					msg += ", ".join(response)
-			elif inC[2] == "actionproperties":
-				if len(response) == 0:
-					msg = "No properties for jail %s action %s" % (
-						inC[1], inC[3])
-				else:
-					msg = "The jail %s action %s has the following " \
-						"properties:\n" % (inC[1], inC[3])
-					msg += ", ".join(response)
-			elif inC[2] == "actionmethods":
-				if len(response) == 0:
-					msg = "No methods for jail %s action %s" % (
-						inC[1], inC[3])
-				else:
-					msg = "The jail %s action %s has the following " \
-						"methods:\n" % (inC[1], inC[3])
-					msg += ", ".join(response)
 		except Exception:
-			logSys.warning("Beautifier error. Please report the error")
-			logSys.error("Beautify " + repr(response) + " with "
-				+ repr(self.__inputCmd) + " failed")
-			msg = msg + repr(response)
+			logSys.warn("Beautifier error. Please report the error")
+			logSys.error("Beautify " + `response` + " with " + `self.__inputCmd` +
+						 " failed")
+			msg = msg + `response`
 		return msg
 
 	def beautifyError(self, response):
-		logSys.debug("Beautify (error) " + repr(response) + " with "
-					 + repr(self.__inputCmd))
+		logSys.debug("Beautify (error) " + `response` + " with " + `self.__inputCmd`)
 		msg = response
 		if isinstance(response, UnknownJailException):
-			msg = "Sorry but the jail '" + response.args[0] + "' does not exist"
+			msg = "Sorry but the jail '" + response[0] + "' does not exist"
 		elif isinstance(response, IndexError):
 			msg = "Sorry but the command is invalid"
 		elif isinstance(response, DuplicateJailException):
-			msg = "The jail '" + response.args[0] + "' already exists"
+			msg = "The jail '" + response[0] + "' already exists"
 		return msg

client/configparserinc.py

@@ -0,0 +1,108 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Yaroslav Halchenko
+# Modified: Cyril Jaquier
+
+__author__ = 'Yaroslav Halhenko'
+__copyright__ = 'Copyright (c) 2007 Yaroslav Halchenko'
+__license__ = 'GPL'
+
+import logging, os
+from ConfigParser import SafeConfigParser
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class SafeConfigParserWithIncludes(SafeConfigParser):
+	"""
+	Class adds functionality to SafeConfigParser to handle included
+	other configuration files (or may be urls, whatever in the future)
+
+	File should have section [includes] and only 2 options implemented
+	are 'files_before' and 'files_after' where files are listed 1 per
+	line.
+
+	Example:
+
+[INCLUDES]
+before = 1.conf
+         3.conf
+
+after = 1.conf
+
+	It is a simple implementation, so just basic care is taken about
+	recursion. Includes preserve right order, ie new files are
+	inserted to the list of read configs before original, and their
+	includes correspondingly so the list should follow the leaves of
+	the tree.
+
+	I wasn't sure what would be the right way to implement generic (aka c++
+	template) so we could base at any *configparser class... so I will
+	leave it for the future
+
+	"""
+
+	SECTION_NAME = "INCLUDES"
+
+	#@staticmethod
+	def getIncludes(resource, seen = []):
+		"""
+		Given 1 config resource returns list of included files
+		(recursively) with the original one as well
+		Simple loops are taken care about
+		"""
+		
+		# Use a short class name ;)
+		SCPWI = SafeConfigParserWithIncludes
+		
+		parser = SafeConfigParser()
+		parser.read(resource)
+		
+		resourceDir = os.path.dirname(resource)
+
+		newFiles = [ ('before', []), ('after', []) ]
+		if SCPWI.SECTION_NAME in parser.sections():
+			for option_name, option_list in newFiles:
+				if option_name in parser.options(SCPWI.SECTION_NAME):
+					newResources = parser.get(SCPWI.SECTION_NAME, option_name)
+					for newResource in newResources.split('\n'):
+						if os.path.isabs(newResource):
+							r = newResource
+						else:
+							r = os.path.join(resourceDir, newResource)
+						if r in seen:
+							continue
+						s = seen + [resource]
+						option_list += SCPWI.getIncludes(r, s)
+		# combine lists
+		return newFiles[0][1] + [resource] + newFiles[1][1]
+		#print "Includes list for " + resource + " is " + `resources`
+	getIncludes = staticmethod(getIncludes)
+
+
+	def read(self, filenames):
+		fileNamesFull = []
+		if not isinstance(filenames, list):
+			filenames = [ filenames ]
+		for filename in filenames:
+			fileNamesFull += SafeConfigParserWithIncludes.getIncludes(filename)
+		logSys.debug("Reading files: %s" % fileNamesFull)
+		return SafeConfigParser.read(self, fileNamesFull)
+

client/configreader.py

@@ -0,0 +1,125 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Cyril Jaquier
+# Modified by: Yaroslav Halchenko (SafeConfigParserWithIncludes)
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import glob, logging, os
+from configparserinc import SafeConfigParserWithIncludes
+from ConfigParser import NoOptionError, NoSectionError
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class ConfigReader(SafeConfigParserWithIncludes):
+
+	DEFAULT_BASEDIR = '/etc/fail2ban'
+	
+	def __init__(self, basedir=None):
+		SafeConfigParserWithIncludes.__init__(self)
+		self.setBaseDir(basedir)
+		self.__opts = None
+	
+	def setBaseDir(self, basedir):
+		if basedir is None:
+			basedir = ConfigReader.DEFAULT_BASEDIR	# stock system location
+		self._basedir = basedir.rstrip('/')
+	
+	def getBaseDir(self):
+		return self._basedir
+	
+	def read(self, filename):
+		if not os.path.exists(self._basedir):
+			raise ValueError("Base configuration directory %s does not exist "
+							  % self._basedir)
+		basename = os.path.join(self._basedir, filename)
+		logSys.debug("Reading configs for %s under %s "  % (basename, self._basedir))
+		config_files = [ basename + ".conf" ]
+
+		# possible further customizations under a .conf.d directory
+		config_dir = basename + '.d'
+		config_files += sorted(glob.glob('%s/*.conf' % config_dir))
+
+		config_files.append(basename + ".local")
+	
+		config_files += sorted(glob.glob('%s/*.local' % config_dir))
+
+		# choose only existing ones
+		config_files = filter(os.path.exists, config_files)
+
+		if len(config_files):
+			# at least one config exists and accessible
+			logSys.debug("Reading config files: " + ', '.join(config_files))
+			config_files_read = SafeConfigParserWithIncludes.read(self, config_files)
+			missed = [ cf for cf in config_files if cf not in config_files_read ]
+			if missed:
+				logSys.error("Could not read config files: " + ', '.join(missed))
+			if config_files_read:
+				return True
+			logSys.error("Found no accessible config files for %r under %s" %
+						 ( filename, self.getBaseDir() ))
+			return False
+		else:
+			logSys.error("Found no accessible config files for %r " % filename
+						 + (["under %s" % self.getBaseDir(),
+							 "among existing ones: " + ', '.join(config_files)][bool(len(config_files))]))
+
+			return False
+
+	##
+	# Read the options.
+	#
+	# Read the given option in the configuration file. Default values
+	# are used...
+	# Each optionValues entry is composed of an array with:
+	# 0 -> the type of the option
+	# 1 -> the name of the option
+	# 2 -> the default value for the option
+	
+	def getOptions(self, sec, options, pOptions = None):
+		values = dict()
+		for option in options:
+			try:
+				if option[0] == "bool":
+					v = self.getboolean(sec, option[1])
+				elif option[0] == "int":
+					v = self.getint(sec, option[1])
+				else:
+					v = self.get(sec, option[1])
+				if not pOptions is None and option[1] in pOptions:
+					continue
+				values[option[1]] = v
+			except NoSectionError, e:
+				# No "Definition" section or wrong basedir
+				logSys.error(e)
+				return False
+			except NoOptionError:
+				if not option[2] is None:
+					logSys.warn("'%s' not defined in '%s'. Using default one: %r"
+								% (option[1], sec, option[2]))
+					values[option[1]] = option[2]
+			except ValueError:
+				logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +
+							"'. Using default one: '" + `option[2]` + "'")
+				values[option[1]] = option[2]
+		return values

client/configurator.py

@@ -24,30 +24,22 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from .fail2banreader import Fail2banReader
-from .jailsreader import JailsReader
-from ..helpers import getLogger
+import logging
+from configreader import ConfigReader
+from fail2banreader import Fail2banReader
+from jailsreader import JailsReader
 
 # Gets the instance of the logger.
-logSys = getLogger(__name__)
-
+logSys = logging.getLogger("fail2ban.client.config")
 
 class Configurator:
 	
-	def __init__(self, force_enable=False, share_config=None):
+	def __init__(self):
 		self.__settings = dict()
 		self.__streams = dict()
-		# always share all config readers:
-		if share_config is None:
-			share_config = dict()
-		self.__share_config = share_config
-		self.__fail2ban = Fail2banReader(share_config=share_config)
-		self.__jails = JailsReader(force_enable=force_enable, share_config=share_config)
-
-	def Reload(self):
-		# clear all shared handlers:
-		self.__share_config.clear()
-
+		self.__fail2ban = Fail2banReader()
+		self.__jails = JailsReader()
+	
 	def setBaseDir(self, folderName):
 		self.__fail2ban.setBaseDir(folderName)
 		self.__jails.setBaseDir(folderName)

client/csocket.py

@@ -26,42 +26,34 @@ __license__ = "GPL"
 
 #from cPickle import dumps, loads, HIGHEST_PROTOCOL
 from pickle import dumps, loads, HIGHEST_PROTOCOL
-from ..protocol import CSPROTO
 import socket
-import sys
 
 class CSocket:
 	
-	def __init__(self, sock="/var/run/fail2ban/fail2ban.sock"):
+	END_STRING = "<F2B_END_COMMAND>"
+	
+	def __init__(self, sock = "/var/run/fail2ban/fail2ban.sock"):
 		# Create an INET, STREAMing socket
 		#self.csock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 		self.__csock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
 		#self.csock.connect(("localhost", 2222))
 		self.__csock.connect(sock)
-
-	def __del__(self):
-		self.close(False)
 	
 	def send(self, msg):
 		# Convert every list member to string
 		obj = dumps([str(m) for m in msg], HIGHEST_PROTOCOL)
-		self.__csock.send(obj + CSPROTO.END)
-		return self.receive(self.__csock)
-
-	def close(self, sendEnd=True):
-		if not self.__csock:
-			return
-		if sendEnd:
-			self.__csock.sendall(CSPROTO.CLOSE + CSPROTO.END)
+		self.__csock.send(obj + CSocket.END_STRING)
+		ret = self.receive(self.__csock)
 		self.__csock.close()
-		self.__csock = None
+		return ret
 	
-	@staticmethod
+	#@staticmethod
 	def receive(sock):
-		msg = CSPROTO.EMPTY
-		while msg.rfind(CSPROTO.END) == -1:
+		msg = ''
+		while msg.rfind(CSocket.END_STRING) == -1:
 			chunk = sock.recv(6)
 			if chunk == '':
-				raise RuntimeError("socket connection broken")
+				raise RuntimeError, "socket connection broken"
 			msg = msg + chunk
 		return loads(msg)
+	receive = staticmethod(receive)

client/fail2banreader.py

@@ -24,12 +24,11 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from .configreader import ConfigReader
-from ..helpers import getLogger
+import logging
+from configreader import ConfigReader
 
 # Gets the instance of the logger.
-logSys = getLogger(__name__)
-
+logSys = logging.getLogger("fail2ban.client.config")
 
 class Fail2banReader(ConfigReader):
 	
@@ -45,22 +44,16 @@ class Fail2banReader(ConfigReader):
 		return ConfigReader.getOptions(self, "Definition", opts)
 	
 	def getOptions(self):
-		opts = [["string", "loglevel", "INFO" ],
-				["string", "logtarget", "STDERR"],
-				["string", "syslogsocket", "auto"],
-				["string", "dbfile", "/var/lib/fail2ban/fail2ban.sqlite3"],
-				["int", "dbpurgeage", 86400]]
+		opts = [["int", "loglevel", 1],
+				["string", "logtarget", "STDERR"]]
 		self.__opts = ConfigReader.getOptions(self, "Definition", opts)
 	
 	def convert(self):
-		# Ensure logtarget/level set first so any db errors are captured
-		# Also dbfile should be set before all other database options.
-		# So adding order indices into items, to be stripped after sorting, upon return
-		order = {"syslogsocket":0, "loglevel":1, "logtarget":2,
-			"dbfile":50, "dbpurgeage":51}
 		stream = list()
 		for opt in self.__opts:
-			if opt in order:
-				stream.append((order[opt], ["set", opt, self.__opts[opt]]))
-		return [opt[1] for opt in sorted(stream)]
+			if opt == "loglevel":
+				stream.append(["set", "loglevel", self.__opts[opt]])
+			elif opt == "logtarget":
+				stream.append(["set", "logtarget", self.__opts[opt]])
+		return stream
 	

client/filterreader.py

@@ -0,0 +1,79 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Cyril Jaquier
+# 
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os
+import logging
+from configreader import ConfigReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class FilterReader(ConfigReader):
+	
+	def __init__(self, fileName, name, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
+		# Defer initialization to the set Methods
+		self.__file = self.__name = self.__opts = None
+		self.setFile(fileName)
+		self.setName(name)
+	
+	def setFile(self, fileName):
+		self.__file = fileName
+		self.__opts = None
+	
+	def getFile(self):
+		return self.__file
+	
+	def setName(self, name):
+		self.__name = name
+
+	def getName(self):
+		return self.__name
+	
+	def read(self):
+		return ConfigReader.read(self, os.path.join("filter.d", self.__file))
+	
+	def getOptions(self, pOpts):
+		opts = [["string", "ignoreregex", ""],
+				["string", "failregex", ""],
+				]
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
+	
+	def convert(self):
+		stream = list()
+		for opt in self.__opts:
+			if opt == "failregex":
+				for regex in self.__opts[opt].split('\n'):
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addfailregex", regex])
+			elif opt == "ignoreregex":
+				for regex in self.__opts[opt].split('\n'):
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addignoreregex", regex])		
+		return stream
+		

client/jailreader.py

@@ -0,0 +1,234 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Cyril Jaquier
+# 
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging, re, glob, os.path
+
+from configreader import ConfigReader
+from filterreader import FilterReader
+from actionreader import ActionReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class JailReader(ConfigReader):
+	
+	actionCRE = re.compile("^([\w_.-]+)(?:\[(.*)\])?$")
+	
+	def __init__(self, name, force_enable=False, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
+		self.__name = name
+		self.__filter = None
+		self.__force_enable = force_enable
+		self.__actions = list()
+		self.__opts = None
+	
+	def getRawOptions(self):
+		return self.__opts
+
+	def setName(self, value):
+		self.__name = value
+	
+	def getName(self):
+		return self.__name
+	
+	def read(self):
+		return ConfigReader.read(self, "jail")
+	
+	def isEnabled(self):
+		return self.__force_enable or ( self.__opts and self.__opts["enabled"] )
+
+	@staticmethod
+	def _glob(path):
+		"""Given a path for glob return list of files to be passed to server.
+
+		Dangling symlinks are warned about and not returned
+		"""
+		pathList = []
+		for p in glob.glob(path):
+			if os.path.exists(p):
+				pathList.append(p)
+			else:
+				logSys.warning("File %s is a dangling link, thus cannot be monitored" % p)
+		return pathList
+
+	def getOptions(self):
+		opts = [["bool", "enabled", "false"],
+				["string", "logpath", "/var/log/messages"],
+				["string", "backend", "auto"],
+				["int", "maxretry", 3],
+				["int", "findtime", 600],
+				["int", "bantime", 600],
+				["string", "usedns", "warn"],
+				["string", "failregex", None],
+				["string", "ignoreregex", None],
+				["string", "ignorecommand", None],
+				["string", "ignoreip", None],
+				["string", "filter", ""],
+				["string", "action", ""]]
+		self.__opts = ConfigReader.getOptions(self, self.__name, opts)
+		if not self.__opts:
+			return False
+		
+		if self.isEnabled():
+			# Read filter
+			if self.__opts["filter"]:
+				self.__filter = FilterReader(self.__opts["filter"], self.__name,
+											 basedir=self.getBaseDir())
+				ret = self.__filter.read()
+				if ret:
+					self.__filter.getOptions(self.__opts)
+				else:
+					logSys.error("Unable to read the filter")
+					return False
+			else:
+				self.__filter = None
+				logSys.warn("No filter set for jail %s" % self.__name)
+		
+			# Read action
+			for act in self.__opts["action"].split('\n'):
+				try:
+					if not act:			  # skip empty actions
+						continue
+					splitAct = JailReader.splitAction(act)
+					action = ActionReader(splitAct, self.__name, basedir=self.getBaseDir())
+					ret = action.read()
+					if ret:
+						action.getOptions(self.__opts)
+						self.__actions.append(action)
+					else:
+						raise AttributeError("Unable to read action")
+				except Exception, e:
+					logSys.error("Error in action definition " + act)
+					logSys.debug("Caught exception: %s" % (e,))
+					return False
+			if not len(self.__actions):
+				logSys.warn("No actions were defined for %s" % self.__name)
+		return True
+	
+	def convert(self, allow_no_files=False):
+		"""Convert read before __opts to the commands stream
+
+		Parameters
+		----------
+		allow_missing : bool
+		  Either to allow log files to be missing entirely.  Primarily is
+		  used for testing
+		 """
+
+		stream = []
+		for opt in self.__opts:
+			if opt == "logpath":
+				found_files = 0
+				for path in self.__opts[opt].split("\n"):
+					pathList = JailReader._glob(path)
+					if len(pathList) == 0:
+						logSys.error("No file(s) found for glob %s" % path)
+					for p in pathList:
+						found_files += 1
+						stream.append(["set", self.__name, "addlogpath", p])
+				if not (found_files or allow_no_files):
+					raise ValueError(
+						"Have not found any log file for %s jail" % self.__name)
+			elif opt == "backend":
+				backend = self.__opts[opt]
+			elif opt == "maxretry":
+				stream.append(["set", self.__name, "maxretry", self.__opts[opt]])
+			elif opt == "ignoreip":
+				for ip in self.__opts[opt].split():
+					# Do not send a command if the rule is empty.
+					if ip != '':
+						stream.append(["set", self.__name, "addignoreip", ip])
+			elif opt == "findtime":
+				stream.append(["set", self.__name, "findtime", self.__opts[opt]])
+			elif opt == "bantime":
+				stream.append(["set", self.__name, "bantime", self.__opts[opt]])
+			elif opt == "usedns":
+				stream.append(["set", self.__name, "usedns", self.__opts[opt]])
+			elif opt == "failregex":
+				stream.append(["set", self.__name, "addfailregex", self.__opts[opt]])
+			elif opt == "ignorecommand":
+				stream.append(["set", self.__name, "ignorecommand", self.__opts[opt]])
+			elif opt == "ignoreregex":
+				for regex in self.__opts[opt].split('\n'):
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addignoreregex", regex])
+		if self.__filter:
+			stream.extend(self.__filter.convert())
+		for action in self.__actions:
+			stream.extend(action.convert())
+		stream.insert(0, ["add", self.__name, backend])
+		return stream
+	
+	#@staticmethod
+	def splitAction(action):
+		m = JailReader.actionCRE.match(action)
+		d = dict()
+		try:
+			mgroups = m.groups()
+		except AttributeError:
+			raise ValueError("While reading action %s we should have got 1 or "
+							 "2 groups. Got: 0" % action)
+		if len(mgroups) == 2:
+			action_name, action_opts = mgroups
+		elif len(mgroups) == 1: # pragma: nocover - unreachable - .* on second group always matches
+			action_name, action_opts = mgroups[0], None
+		else: # pragma: nocover - unreachable - regex only can capture 2 groups
+			raise ValueError("While reading action %s we should have got up to "
+							 "2 groups. Got: %r" % (action, mgroups))
+		if not action_opts is None:
+			# Huge bad hack :( This method really sucks. TODO Reimplement it.
+			actions = ""
+			escapeChar = None
+			allowComma = False
+			for c in action_opts:
+				if c in ('"', "'") and not allowComma:
+					# Start
+					escapeChar = c
+					allowComma = True
+				elif c == escapeChar:
+					# End
+					escapeChar = None
+					allowComma = False
+				else:
+					if c == ',' and allowComma:
+						actions += "<COMMA>"
+					else:
+						actions += c
+			
+			# Split using ,
+			actionsSplit = actions.split(',')
+			# Replace the tag <COMMA> with ,
+			actionsSplit = [n.replace("<COMMA>", ',') for n in actionsSplit]
+			
+			for param in actionsSplit:
+				p = param.split('=')
+				try:
+					d[p[0].strip()] = p[1].strip()
+				except IndexError:
+					logSys.error("Invalid argument %s in '%s'" % (p, action_opts))
+		return [action_name, d]
+	splitAction = staticmethod(splitAction)

client/jailsreader.py

@@ -24,13 +24,12 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from .configreader import ConfigReader
-from .jailreader import JailReader
-from ..helpers import getLogger
+import logging
+from configreader import ConfigReader
+from jailreader import JailReader
 
 # Gets the instance of the logger.
-logSys = getLogger(__name__)
-
+logSys = logging.getLogger("fail2ban.client.config")
 
 class JailsReader(ConfigReader):
 
@@ -46,12 +45,10 @@ class JailsReader(ConfigReader):
 		self.__jails = list()
 		self.__force_enable = force_enable
 
-	@property
-	def jails(self):
+	def getJails(self):
 		return self.__jails
 
 	def read(self):
-		self.__jails = list()
 		return ConfigReader.read(self, "jail")
 
 	def getOptions(self, section=None):
@@ -68,12 +65,9 @@ class JailsReader(ConfigReader):
 		# Get the options of all jails.
 		parse_status = True
 		for sec in sections:
-			if sec == 'INCLUDES':
-				continue
-			# use the cfg_share for filter/action caching and the same config for all 
-			# jails (use_config=...), therefore don't read it here:
-			jail = JailReader(sec, force_enable=self.__force_enable, 
-				share_config=self.share_config, use_config=self._cfg)
+			jail = JailReader(sec, basedir=self.getBaseDir(),
+							  force_enable=self.__force_enable)
+			jail.read()
 			ret = jail.getOptions()
 			if ret:
 				if jail.isEnabled():

common/__init__.py

@@ -17,6 +17,14 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-__author__ = "Steven Hiscocks"
-__copyright__ = "Copyright (c) 2014 Steven Hiscocks"
+# Author: Cyril Jaquier
+# 
+
+__author__ = "Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
+
+import logging
+
+# Custom debug level
+logging.HEAVYDEBUG = 5

common/exceptions.py

@@ -23,15 +23,13 @@ __author__ = "Cyril Jaquier, Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav Halchenko"
 __license__ = "GPL"
 
-
 #
 # Jails
 #
 class DuplicateJailException(Exception):
 	pass
 
-
-class UnknownJailException(KeyError):
+class UnknownJailException(Exception):
 	pass
 
 

common/helpers.py

@@ -1,7 +1,6 @@
-#!/usr/bin/python
 # emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
 # vi: set ft=python sts=4 ts=4 sw=4 noet :
-#
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -17,18 +16,13 @@
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-"""
-Fail2Ban  reads log file that contains password failure report
-and bans the corresponding IP addresses using firewall rules.
 
-This tools can test regular expressions for "fail2ban".
-
-"""
-
-__author__ = "Fail2Ban Developers"
-__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko"
+__author__ = "Cyril Jaquier, Arturo 'Buanzo' Busleiman, Yaroslav Halchenko"
 __license__ = "GPL"
 
-from fail2ban.client.fail2banregex import exec_command_line
 
-exec_command_line()
+def formatExceptionInfo():
+	""" Consistently format exception information """
+	import sys
+	cla, exc = sys.exc_info()[:2]
+	return (cla.__name__, str(exc))

common/protocol.py

@@ -29,16 +29,6 @@ import textwrap
 ##
 # Describes the protocol used to communicate with the server.
 
-class dotdict(dict):
-	def __getattr__(self, name):
-		return self[name]
-
-CSPROTO = dotdict({
-	"EMPTY":  b"",
-	"END":    b"<F2B_END_COMMAND>",
-	"CLOSE":  b"<F2B_CLOSE_COMMAND>"
-})
-
 protocol = [
 ['', "BASIC", ""],
 ["start", "starts the server and the jails"], 
@@ -48,34 +38,23 @@ protocol = [
 ["status", "gets the current status of the server"], 
 ["ping", "tests if the server is alive"], 
 ["help", "return this output"], 
-["version", "return the server version"],
 ['', "LOGGING", ""],
-["set loglevel <LEVEL>", "sets logging level to <LEVEL>. Levels: CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG"], 
+["set loglevel <LEVEL>", "sets logging level to <LEVEL>. 0 is minimal, 4 is debug"], 
 ["get loglevel", "gets the logging level"], 
 ["set logtarget <TARGET>", "sets logging target to <TARGET>. Can be STDOUT, STDERR, SYSLOG or a file"], 
 ["get logtarget", "gets logging target"], 
-["set syslogsocket auto|<SOCKET>", "sets the syslog socket path to auto or <SOCKET>. Only used if logtarget is SYSLOG"],
-["get syslogsocket", "gets syslog socket path"],
 ["flushlogs", "flushes the logtarget if a file and reopens it. For log rotation."], 
-['', "DATABASE", ""],
-["set dbfile <FILE>", "set the location of fail2ban persistent datastore. Set to \"None\" to disable"], 
-["get dbfile", "get the location of fail2ban persistent datastore"], 
-["set dbpurgeage <SECONDS>", "sets the max age in <SECONDS> that history of bans will be kept"], 
-["get dbpurgeage", "gets the max age in seconds that history of bans will be kept"], 
 ['', "JAIL CONTROL", ""],
 ["add <JAIL> <BACKEND>", "creates <JAIL> using <BACKEND>"], 
 ["start <JAIL>", "starts the jail <JAIL>"], 
 ["stop <JAIL>", "stops the jail <JAIL>. The jail is removed"], 
-["status <JAIL> [FLAVOR]", "gets the current status of <JAIL>, with optional flavor or extended info"],
+["status <JAIL>", "gets the current status of <JAIL>"],
 ['', "JAIL CONFIGURATION", ""],
 ["set <JAIL> idle on|off", "sets the idle state of <JAIL>"], 
 ["set <JAIL> addignoreip <IP>", "adds <IP> to the ignore list of <JAIL>"], 
 ["set <JAIL> delignoreip <IP>", "removes <IP> from the ignore list of <JAIL>"], 
-["set <JAIL> addlogpath <FILE> ['tail']", "adds <FILE> to the monitoring list of <JAIL>, optionally starting at the 'tail' of the file (default 'head')."], 
+["set <JAIL> addlogpath <FILE>", "adds <FILE> to the monitoring list of <JAIL>"], 
 ["set <JAIL> dellogpath <FILE>", "removes <FILE> from the monitoring list of <JAIL>"],
-["set <JAIL> logencoding <ENCODING>", "sets the <ENCODING> of the log files for <JAIL>"],
-["set <JAIL> addjournalmatch <MATCH>", "adds <MATCH> to the journal filter of <JAIL>"],
-["set <JAIL> deljournalmatch <MATCH>", "removes <MATCH> from the journal filter of <JAIL>"],
 ["set <JAIL> addfailregex <REGEX>", "adds the regular expression <REGEX> which must match failures for <JAIL>"], 
 ["set <JAIL> delfailregex <INDEX>", "removes the regular expression at <INDEX> for failregex"], 
 ["set <JAIL> ignorecommand <VALUE>", "sets ignorecommand of <JAIL>"],
@@ -83,53 +62,38 @@ protocol = [
 ["set <JAIL> delignoreregex <INDEX>", "removes the regular expression at <INDEX> for ignoreregex"], 
 ["set <JAIL> findtime <TIME>", "sets the number of seconds <TIME> for which the filter will look back for <JAIL>"], 
 ["set <JAIL> bantime <TIME>", "sets the number of seconds <TIME> a host will be banned for <JAIL>"], 
-["set <JAIL> datepattern <PATTERN>", "sets the <PATTERN> used to match date/times for <JAIL>"],
 ["set <JAIL> usedns <VALUE>", "sets the usedns mode for <JAIL>"],
 ["set <JAIL> banip <IP>", "manually Ban <IP> for <JAIL>"], 
 ["set <JAIL> unbanip <IP>", "manually Unban <IP> in <JAIL>"], 
 ["set <JAIL> maxretry <RETRY>", "sets the number of failures <RETRY> before banning the host for <JAIL>"], 
-["set <JAIL> maxlines <LINES>", "sets the number of <LINES> to buffer for regex search for <JAIL>"], 
-["set <JAIL> addaction <ACT>[ <PYTHONFILE> <JSONKWARGS>]", "adds a new action named <ACT> for <JAIL>. Optionally for a Python based action, a <PYTHONFILE> and <JSONKWARGS> can be specified, else will be a Command Action"], 
-["set <JAIL> delaction <ACT>", "removes the action <ACT> from <JAIL>"], 
-["", "COMMAND ACTION CONFIGURATION", ""],
-["set <JAIL> action <ACT> actionstart <CMD>", "sets the start command <CMD> of the action <ACT> for <JAIL>"], 
-["set <JAIL> action <ACT> actionstop <CMD>", "sets the stop command <CMD> of the action <ACT> for <JAIL>"], 
-["set <JAIL> action <ACT> actioncheck <CMD>", "sets the check command <CMD> of the action <ACT> for <JAIL>"], 
-["set <JAIL> action <ACT> actionban <CMD>", "sets the ban command <CMD> of the action <ACT> for <JAIL>"],
-["set <JAIL> action <ACT> actionunban <CMD>", "sets the unban command <CMD> of the action <ACT> for <JAIL>"], 
-["set <JAIL> action <ACT> timeout <TIMEOUT>", "sets <TIMEOUT> as the command timeout in seconds for the action <ACT> for <JAIL>"],
-["", "GENERAL ACTION CONFIGURATION", ""],
-["set <JAIL> action <ACT> <PROPERTY> <VALUE>", "sets the <VALUE> of <PROPERTY> for the action <ACT> for <JAIL>"],
-["set <JAIL> action <ACT> <METHOD>[ <JSONKWARGS>]", "calls the <METHOD> with <JSONKWARGS> for the action <ACT> for <JAIL>"],
+["set <JAIL> addaction <ACT>", "adds a new action named <NAME> for <JAIL>"], 
+["set <JAIL> delaction <ACT>", "removes the action <NAME> from <JAIL>"], 
+["set <JAIL> setcinfo <ACT> <KEY> <VALUE>", "sets <VALUE> for <KEY> of the action <NAME> for <JAIL>"], 
+["set <JAIL> delcinfo <ACT> <KEY>", "removes <KEY> for the action <NAME> for <JAIL>"], 
+["set <JAIL> actionstart <ACT> <CMD>", "sets the start command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actionstop <ACT> <CMD>", "sets the stop command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actioncheck <ACT> <CMD>", "sets the check command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actionban <ACT> <CMD>", "sets the ban command <CMD> of the action <ACT> for <JAIL>"],
+["set <JAIL> actionunban <ACT> <CMD>", "sets the unban command <CMD> of the action <ACT> for <JAIL>"], 
 ['', "JAIL INFORMATION", ""],
 ["get <JAIL> logpath", "gets the list of the monitored files for <JAIL>"],
-["get <JAIL> logencoding", "gets the encoding of the log files for <JAIL>"],
-["get <JAIL> journalmatch", "gets the journal filter match for <JAIL>"],
 ["get <JAIL> ignoreip", "gets the list of ignored IP addresses for <JAIL>"],
 ["get <JAIL> ignorecommand", "gets ignorecommand of <JAIL>"],
 ["get <JAIL> failregex", "gets the list of regular expressions which matches the failures for <JAIL>"],
 ["get <JAIL> ignoreregex", "gets the list of regular expressions which matches patterns to ignore for <JAIL>"],
 ["get <JAIL> findtime", "gets the time for which the filter will look back for failures for <JAIL>"],
 ["get <JAIL> bantime", "gets the time a host is banned for <JAIL>"],
-["get <JAIL> datepattern", "gets the patern used to match date/times for <JAIL>"],
 ["get <JAIL> usedns", "gets the usedns setting for <JAIL>"],
 ["get <JAIL> maxretry", "gets the number of failures allowed for <JAIL>"],
-["get <JAIL> maxlines", "gets the number of lines to buffer for <JAIL>"],
-["get <JAIL> actions", "gets a list of actions for <JAIL>"],
-["", "COMMAND ACTION INFORMATION",""],
-["get <JAIL> action <ACT> actionstart", "gets the start command for the action <ACT> for <JAIL>"],
-["get <JAIL> action <ACT> actionstop", "gets the stop command for the action <ACT> for <JAIL>"],
-["get <JAIL> action <ACT> actioncheck", "gets the check command for the action <ACT> for <JAIL>"],
-["get <JAIL> action <ACT> actionban", "gets the ban command for the action <ACT> for <JAIL>"],
-["get <JAIL> action <ACT> actionunban", "gets the unban command for the action <ACT> for <JAIL>"],
-["get <JAIL> action <ACT> timeout", "gets the command timeout in seconds for the action <ACT> for <JAIL>"],
-["", "GENERAL ACTION INFORMATION", ""],
-["get <JAIL> actionproperties <ACT>", "gets a list of properties for the action <ACT> for <JAIL>"],
-["get <JAIL> actionmethods <ACT>", "gets a list of methods for the action <ACT> for <JAIL>"],
-["get <JAIL> action <ACT> <PROPERTY>", "gets the value of <PROPERTY> for the action <ACT> for <JAIL>"],
+["get <JAIL> addaction", "gets the last action which has been added for <JAIL>"],
+["get <JAIL> actionstart <ACT>", "gets the start command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionstop <ACT>", "gets the stop command for the action <ACT> for <JAIL>"],
+["get <JAIL> actioncheck <ACT>", "gets the check command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionban <ACT>", "gets the ban command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionunban <ACT>", "gets the unban command for the action <ACT> for <JAIL>"],
+["get <JAIL> cinfo <ACT> <KEY>", "gets the value for <KEY> for the action <ACT> for <JAIL>"],
 ]
 
-
 ##
 # Prints the protocol in a "man" format. This is used for the
 # "-h" output of fail2ban-client.
@@ -144,17 +108,14 @@ def printFormatted():
 			print
 		firstHeading = True
 		first = True
-		if len(m[0]) >= MARGIN:
-			m[1] = ' ' * WIDTH + m[1]
-		for n in textwrap.wrap(m[1], WIDTH, drop_whitespace=False):
+		for n in textwrap.wrap(m[1], WIDTH):
 			if first:
-				line = ' ' * INDENT + m[0] + ' ' * (MARGIN - len(m[0])) + n.strip()
+				line = ' ' * INDENT + m[0] + ' ' * (MARGIN - len(m[0])) + n
 				first = False
 			else:
-				line = ' ' * (INDENT + MARGIN) + n.strip()
+				line = ' ' * (INDENT + MARGIN) + n
 			print line
 
-
 ##
 # Prints the protocol in a "mediawiki" format.
 
@@ -171,7 +132,6 @@ def printWiki():
 			print "| <span style=\"white-space:nowrap;\"><tt>" + m[0] + "</tt></span> || || " + m[1]
 	print "|}"
 
-
 def __printWikiHeader(section, desc):
 	print
 	print "=== " + section + " ==="

common/version.py

@@ -20,8 +20,8 @@
 # Author: Cyril Jaquier
 #
 
-__author__ = "Cyril Jaquier, Yaroslav Halchenko, Steven Hiscocks, Daniel Black"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2005-2016 Yaroslav Halchenko, 2013-2014 Steven Hiscocks, Daniel Black"
-__license__ = "GPL-v2+"
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2013 Yaroslav Halchenko"
+__license__ = "GPL"
 
-version = "0.9.4.dev0"
+version = "0.8.14.dev"

config/action.d/badips.conf

@@ -10,7 +10,7 @@
 
 [Definition]
 
-actionban = curl --fail  --user-agent "<agent>" http://www.badips.com/add/<category>/<ip>
+actionban = curl --fail  --user-agent "fail2ban v0.8.12" http://www.badips.com/add/<category>/<ip>
 
 [Init]
 

config/action.d/badips.py

@@ -1,375 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-import sys
-if sys.version_info < (2, 7):
-	raise ImportError("badips.py action requires Python >= 2.7")
-import json
-import threading
-import logging
-if sys.version_info >= (3, ):
-	from urllib.request import Request, urlopen
-	from urllib.parse import urlencode
-	from urllib.error import HTTPError
-else:
-	from urllib2 import Request, urlopen, HTTPError
-	from urllib import urlencode
-
-from fail2ban.server.actions import ActionBase
-from fail2ban.server.filter import IPAddr
-
-
-class BadIPsAction(ActionBase):
-	"""Fail2Ban action which reports bans to badips.com, and also
-	blacklist bad IPs listed on badips.com by using another action's
-	ban method.
-
-	Parameters
-	----------
-	jail : Jail
-		The jail which the action belongs to.
-	name : str
-		Name assigned to the action.
-	category : str
-		Valid badips.com category for reporting failures.
-	score : int, optional
-		Minimum score for bad IPs. Default 3.
-	age : str, optional
-		Age of last report for bad IPs, per badips.com syntax.
-		Default "24h" (24 hours)
-	key : str, optional
-		Key issued by badips.com to report bans, for later retrieval
-		of personalised content.
-	banaction : str, optional
-		Name of banaction to use for blacklisting bad IPs. If `None`,
-		no blacklist of IPs will take place.
-		Default `None`.
-	bancategory : str, optional
-		Name of category to use for blacklisting, which can differ
-		from category used for reporting. e.g. may want to report
-		"postfix", but want to use whole "mail" category for blacklist.
-		Default `category`.
-	bankey : str, optional
-		Key issued by badips.com to blacklist IPs reported with the
-		associated key.
-	updateperiod : int, optional
-		Time in seconds between updating bad IPs blacklist.
-		Default 900 (15 minutes)
-	agent : str, optional
-		User agent transmitted to server.
-		Default `Fail2Ban/ver.`
-
-	Raises
-	------
-	ValueError
-		If invalid `category`, `score`, `banaction` or `updateperiod`.
-	"""
-
-	_badips = "http://www.badips.com"
-	def _Request(self, url, **argv):
-		return Request(url, headers={'User-Agent': self.agent}, **argv)
-
-	def __init__(self, jail, name, category, score=3, age="24h", key=None,
-		banaction=None, bancategory=None, bankey=None, updateperiod=900, agent="Fail2Ban"):
-		super(BadIPsAction, self).__init__(jail, name)
-
-		self.agent = agent
-		self.category = category
-		self.score = score
-		self.age = age
-		self.key = key
-		self.banaction = banaction
-		self.bancategory = bancategory or category
-		self.bankey = bankey
-		self.updateperiod = updateperiod
-
-		self._bannedips = set()
-		# Used later for threading.Timer for updating badips
-		self._timer = None
-
-	def getCategories(self, incParents=False):
-		"""Get badips.com categories.
-
-		Returns
-		-------
-		set
-			Set of categories.
-
-		Raises
-		------
-		HTTPError
-			Any issues with badips.com request.
-		ValueError
-			If badips.com response didn't contain necessary information
-		"""
-		try:
-			response = urlopen(
-				self._Request("/".join([self._badips, "get", "categories"])), None, 3)
-		except HTTPError as response:
-			messages = json.loads(response.read().decode('utf-8'))
-			self._logSys.error(
-				"Failed to fetch categories. badips.com response: '%s'",
-				messages['err'])
-			raise
-		else:
-			response_json = json.loads(response.read().decode('utf-8'))
-			if not 'categories' in response_json:
-				err = "badips.com response lacked categories specification. Response was: %s" \
-				  % (response_json,)
-				self._logSys.error(err)
-				raise ValueError(err)
-			categories = response_json['categories']
-			categories_names = set(
-				value['Name'] for value in categories)
-			if incParents:
-				categories_names.update(set(
-					value['Parent'] for value in categories
-					if "Parent" in value))
-			return categories_names
-
-	def getList(self, category, score, age, key=None):
-		"""Get badips.com list of bad IPs.
-
-		Parameters
-		----------
-		category : str
-			Valid badips.com category.
-		score : int
-			Minimum score for bad IPs.
-		age : str
-			Age of last report for bad IPs, per badips.com syntax.
-		key : str, optional
-			Key issued by badips.com to fetch IPs reported with the
-			associated key.
-
-		Returns
-		-------
-		set
-			Set of bad IPs.
-
-		Raises
-		------
-		HTTPError
-			Any issues with badips.com request.
-		"""
-		try:
-			url = "?".join([
-				"/".join([self._badips, "get", "list", category, str(score)]),
-				urlencode({'age': age})])
-			if key:
-				url = "&".join([url, urlencode({'key': key})])
-			response = urlopen(self._Request(url))
-		except HTTPError as response:
-			messages = json.loads(response.read().decode('utf-8'))
-			self._logSys.error(
-				"Failed to fetch bad IP list. badips.com response: '%s'",
-				messages['err'])
-			raise
-		else:
-			return set(response.read().decode('utf-8').split())
-
-	@property
-	def category(self):
-		"""badips.com category for reporting IPs.
-		"""
-		return self._category
-
-	@category.setter
-	def category(self, category):
-		if category not in self.getCategories():
-			self._logSys.error("Category name '%s' not valid. "
-				"see badips.com for list of valid categories",
-				category)
-			raise ValueError("Invalid category: %s" % category)
-		self._category = category
-
-	@property
-	def bancategory(self):
-		"""badips.com bancategory for fetching IPs.
-		"""
-		return self._bancategory
-
-	@bancategory.setter
-	def bancategory(self, bancategory):
-		if bancategory not in self.getCategories(incParents=True):
-			self._logSys.error("Category name '%s' not valid. "
-				"see badips.com for list of valid categories",
-				bancategory)
-			raise ValueError("Invalid bancategory: %s" % bancategory)
-		self._bancategory = bancategory
-
-	@property
-	def score(self):
-		"""badips.com minimum score for fetching IPs.
-		"""
-		return self._score
-
-	@score.setter
-	def score(self, score):
-		score = int(score)
-		if 0 <= score <= 5:
-			self._score = score
-		else:
-			raise ValueError("Score must be 0-5")
-
-	@property
-	def banaction(self):
-		"""Jail action to use for banning/unbanning.
-		"""
-		return self._banaction
-
-	@banaction.setter
-	def banaction(self, banaction):
-		if banaction is not None and banaction not in self._jail.actions:
-			self._logSys.error("Action name '%s' not in jail '%s'",
-				banaction, self._jail.name)
-			raise ValueError("Invalid banaction")
-		self._banaction = banaction
-
-	@property
-	def updateperiod(self):
-		"""Period in seconds between banned bad IPs will be updated.
-		"""
-		return self._updateperiod
-
-	@updateperiod.setter
-	def updateperiod(self, updateperiod):
-		updateperiod = int(updateperiod)
-		if updateperiod > 0:
-			self._updateperiod = updateperiod
-		else:
-			raise ValueError("Update period must be integer greater than 0")
-
-	def _banIPs(self, ips):
-		for ip in ips:
-			try:
-				self._jail.actions[self.banaction].ban({
-					'ip': IPAddr(ip),
-					'failures': 0,
-					'matches': "",
-					'ipmatches': "",
-					'ipjailmatches': "",
-				})
-			except Exception as e:
-				self._logSys.error(
-					"Error banning IP %s for jail '%s' with action '%s': %s",
-					ip, self._jail.name, self.banaction, e,
-					exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG)
-			else:
-				self._bannedips.add(ip)
-				self._logSys.info(
-					"Banned IP %s for jail '%s' with action '%s'",
-					ip, self._jail.name, self.banaction)
-
-	def _unbanIPs(self, ips):
-		for ip in ips:
-			try:
-				self._jail.actions[self.banaction].unban({
-					'ip': IPAddr(ip),
-					'failures': 0,
-					'matches': "",
-					'ipmatches': "",
-					'ipjailmatches': "",
-				})
-			except Exception as e:
-				self._logSys.info(
-					"Error unbanning IP %s for jail '%s' with action '%s': %s",
-					ip, self._jail.name, self.banaction, e,
-					exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG)
-			else:
-				self._logSys.info(
-					"Unbanned IP %s for jail '%s' with action '%s'",
-					ip, self._jail.name, self.banaction)
-			finally:
-				self._bannedips.remove(ip)
-
-	def start(self):
-		"""If `banaction` set, blacklists bad IPs.
-		"""
-		if self.banaction is not None:
-			self.update()
-
-	def update(self):
-		"""If `banaction` set, updates blacklisted IPs.
-
-		Queries badips.com for list of bad IPs, removing IPs from the
-		blacklist if no longer present, and adds new bad IPs to the
-		blacklist.
-		"""
-		if self.banaction is not None:
-			if self._timer:
-				self._timer.cancel()
-				self._timer = None
-
-			try:
-				ips = self.getList(
-					self.bancategory, self.score, self.age, self.bankey)
-				# Remove old IPs no longer listed
-				self._unbanIPs(self._bannedips - ips)
-				# Add new IPs which are now listed
-				self._banIPs(ips - self._bannedips)
-
-				self._logSys.info(
-					"Updated IPs for jail '%s'. Update again in %i seconds",
-					self._jail.name, self.updateperiod)
-			finally:
-				self._timer = threading.Timer(self.updateperiod, self.update)
-				self._timer.start()
-
-	def stop(self):
-		"""If `banaction` set, clears blacklisted IPs.
-		"""
-		if self.banaction is not None:
-			if self._timer:
-				self._timer.cancel()
-				self._timer = None
-			self._unbanIPs(self._bannedips.copy())
-
-	def ban(self, aInfo):
-		"""Reports banned IP to badips.com.
-
-		Parameters
-		----------
-		aInfo : dict
-			Dictionary which includes information in relation to
-			the ban.
-
-		Raises
-		------
-		HTTPError
-			Any issues with badips.com request.
-		"""
-		try:
-			url = "/".join([self._badips, "add", self.category, aInfo['ip']])
-			if self.key:
-				url = "?".join([url, urlencode({'key': self.key})])
-			response = urlopen(self._Request(url))
-		except HTTPError as response:
-			messages = json.loads(response.read().decode('utf-8'))
-			self._logSys.error(
-				"Response from badips.com report: '%s'",
-				messages['err'])
-			raise
-		else:
-			messages = json.loads(response.read().decode('utf-8'))
-			self._logSys.info(
-				"Response from badips.com report: '%s'",
-				messages['suc'])
-
-Action = BadIPsAction

config/action.d/blocklist_de.conf

@@ -7,13 +7,13 @@
 # Action to report IP address to blocklist.de
 # Blocklist.de must be signed up to at www.blocklist.de
 # Once registered, one or more servers can be added.
-# This action requires the server 'email address' and the associated apikey.
+# This action requires the server 'email address' and the assoicate apikey.
 #
 # From blocklist.de:
 #   www.blocklist.de is a free and voluntary service provided by a
 #   Fraud/Abuse-specialist, whose servers are often attacked on SSH-,
 #   Mail-Login-, FTP-, Webserver- and other services.
-#   The mission is to report all attacks to the abuse departments of the
+#   The mission is to report all attacks to the abuse deparments of the
 #   infected PCs/servers to ensure that the responsible provider can inform
 #   the customer about the infection and disable them
 #
@@ -25,7 +25,7 @@
 #   * The recidive where the IP has been banned multiple times
 #   * Where maxretry has been set quite high, beyond the normal user typing
 #     password incorrectly.
-#   * For filters that have a low likelihood of receiving human errors
+#   * For filters that have a low likelyhood of receiving human errors
 #
 
 [Definition]
@@ -54,7 +54,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = curl --fail --data-urlencode 'server=<email>' --data 'apikey=<apikey>' --data 'service=<service>' --data 'ip=<ip>' --data-urlencode 'logs=<matches>' --data 'format=text' --user-agent "<agent>" "https://www.blocklist.de/en/httpreports.html"
+actionban = curl --fail --data-urlencode 'server=<email>' --data 'apikey=<apikey>' --data 'service=<service>' --data 'ip=<ip>' --data-urlencode 'logs=<matches>' --data 'format=text' --user-agent "fail2ban v0.8.12" "https://www.blocklist.de/en/httpreports.html"
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the

config/action.d/bsd-ipfw.conf

@@ -38,7 +38,7 @@ actioncheck =
 # Values:  CMD
 #
 # requires an ipfw rule like "deny ip from table(1) to me"
-actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || { echo "$e" 1>&2; exit $x; }
+actionban = ipfw table <table> add <ip>
 
 
 # Option:  actionunban
@@ -47,7 +47,7 @@ actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ip
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = e=`ipfw table <table> delete <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || { echo "$e" 1>&2; exit $x; }
+actionunban = ipfw table <table> delete <ip>
 
 [Init]
 # Option:  table

config/action.d/cloudflare.conf

@@ -1,68 +0,0 @@
-#
-# Author: Mike Rushton
-#
-# IMPORTANT
-#
-# Please set jail.local's permission to 640 because it contains your CF API key.
-#
-# This action depends on curl.
-# Referenced from http://www.normyee.net/blog/2012/02/02/adding-cloudflare-support-to-fail2ban by NORM YEE
-#
-# To get your CloudFlare API Key: https://www.cloudflare.com/a/account/my-account
-#
-# CloudFlare API error codes: https://www.cloudflare.com/docs/host-api.html#s4.2
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=ban' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionunban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=nul' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
-
-[Init]
-
-# If you like to use this action with mailing whois lines, you could use the composite action
-# action_cf_mwl predefined in jail.conf, just define in your jail:
-#
-# action = %(action_cf_mwl)s
-# # Your CF account e-mail
-# cfemail  = 
-# # Your CF API Key
-# cfapikey = 
-
-cftoken =
-
-cfuser =

config/action.d/complain.conf

@@ -5,7 +5,7 @@
 # offending IP address.
 # This uses the https://abusix.com/contactdb.html to lookup abuse contacts.
 #
-# DEPENDENCIES:
+# DEPENDANCIES:
 # This requires the dig command from bind-utils
 #
 # You should provide the <logpath> in the jail config - lines from the log

config/action.d/firewallcmd-allports.conf

@@ -1,53 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# Because of the --remove-rules in stop this action requires firewalld-0.3.8+
-
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
-              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -j f2b-<name>
-
-actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -j f2b-<name>
-             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
-             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
-
-
-# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-recidive$'
-
-actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
-
-actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-
-chain = INPUT_direct
-
-# DEV NOTES:
-#
-# Author: Donald Yandt 
-# Uses "FirewallD" instead of the "iptables daemon".
-#
-#
-# Output:
-
-# actionstart:
-# $ firewall-cmd --direct --add-chain ipv4 filter f2b-recidive
-# success
-# $ firewall-cmd --direct --add-rule ipv4 filter f2b-recidive 1000 -j RETURN
-# success
-# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-recidive
-# success
-

config/action.d/firewallcmd-ipset.conf

@@ -14,7 +14,7 @@
 
 [INCLUDES]
 
-before = iptables-common.conf
+before = iptables-blocktype.conf
 
 [Definition]
 
@@ -31,6 +31,22 @@ actionunban = ipset del fail2ban-<name> <ip> -exist
 
 [Init]
 
+# Default name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ]
+#
+protocol = tcp
+
 # Option:  chain
 # Notes    specifies the iptables chain to which the fail2ban rules should be
 #          added

config/action.d/firewallcmd-multiport.conf

@@ -1,63 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# Because of the --remove-rules in stop this action requires firewalld-0.3.8+
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
-              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-
-actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
-             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
-
-# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$'
-
-actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
-
-actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-[Init]
-
-# Default name of the chain
-name = default
-
-chain = INPUT_direct
-
-# Could also use port numbers separated by a comma. 
-port = 1:65535
-
-
-# Option:  protocol
-# Values:  [ tcp | udp | icmp | all ]
-
-protocol = tcp
-
-
-
-# DEV NOTES:
-#
-# Author: Donald Yandt 
-# Uses "FirewallD" instead of the "iptables daemon".
-#
-#
-# Output:
-# actionstart:
-# $ firewall-cmd --direct --add-chain ipv4 filter f2b-apache-modsecurity
-# success
-# $ firewall-cmd --direct --add-rule ipv4 filter f2b-apache-modsecurity 1000 -j RETURN
-# success
-# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 80,443 -j f2b-apache-modsecurity
-# success
-# actioncheck:
-# $ firewall-cmd --direct --get-chains ipv4 filter f2b-apache-modsecurity | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$'
-# f2b-apache-modsecurity
-

config/action.d/firewallcmd-new.conf

@@ -4,26 +4,42 @@
 
 [INCLUDES]
 
-before = iptables-common.conf
+before = iptables-blocktype.conf
 
 [Definition]
 
-actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
-              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+actionstart = firewall-cmd --direct --add-chain ipv4 filter fail2ban-<name>
+              firewall-cmd --direct --add-rule ipv4 filter fail2ban-<name> 1000 -j RETURN
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
 
-actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
-             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+             firewall-cmd --direct --remove-rules ipv4 filter fail2ban-<name>
+             firewall-cmd --direct --remove-chain ipv4 filter fail2ban-<name>
 
-actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q 'f2b-<name>$'
+actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q '^fail2ban-<name>$'
 
-actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionban = firewall-cmd --direct --add-rule ipv4 filter fail2ban-<name> 0 -s <ip> -j <blocktype>
 
-actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionunban = firewall-cmd --direct --remove-rule ipv4 filter fail2ban-<name> 0 -s <ip> -j <blocktype>
 
 [Init]
 
+# Default name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ]
+#
+protocol = tcp
+
 # Option:  chain
 # Notes    specifies the iptables chain to which the fail2ban rules should be
 #          added
@@ -43,7 +59,7 @@ chain = INPUT_direct
 # success
 # $ firewall-cmd --direct --add-rule ipv4 filter fail2ban-name 1000 -j RETURN
 # success
-# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 22 -j fail2ban-name
+# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp --dport 22 -j fail2ban-name
 # success
 # $ firewall-cmd --direct --get-chains ipv4 filter
 # fail2ban-name

config/action.d/firewallcmd-rich-logging.conf

@@ -1,65 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# 
-# Because of the rich rule commands requires firewalld-0.3.1+
-# This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not
-# by chain. So for an example all deny rules will be listed under <zone>_deny and all log rules under <zone>_log. 
-#
-# Also this action logs banned access attempts so you can filter that and increase ban time for offenders.
-#
-# If you use the --permanent rule you get a xml file in /etc/firewalld/zones/<zone>.xml that can be shared and parsed easliy
-#
-# Example commands to view rules:
-# firewall-cmd [--zone=<zone>] --list-rich-rules
-# firewall-cmd [--zone=<zone>] --list-all
-# firewall-cmd [--zone=zone] --query-rich-rule='rule'
-
-[Definition]
-
-actionstart = 
-
-actionstop = 
-
-actioncheck = 
-
-# you can also use zones and/or service names. 
-#
-# zone example: 
-# 	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' port port='<port>' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"
-# service name example:
-#	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' service name='<service>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"
-# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges seperated by a comma or space for an example: http, https, 22-60, 18 smtp 
-
-actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"; done
-	   
-actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"; done
-
-[Init]
-
-name = default
-
-# log levels are "emerg", "alert", "crit", "error", "warning", "notice", "info" or "debug"
-level = info
-
-# log rate per minute
-rate = 1
-
-zone = public
-
-# use command firewall-cmd --get-services to see a list of services available
-#
-# Examples:
-#
-# amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps 
-# freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos 
-# kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s 
-# postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy 
-# telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
-
-service = ssh
-
-# reject types: 'icmp-net-unreachable', 'icmp-host-unreachable', 'icmp-port-unreachable', 'icmp-proto-unreachable', 
-# 'icmp-net-prohibited', 'icmp-host-prohibited', 'icmp-admin-prohibited' or 'tcp-reset'
-
-blocktype = reject type='icmp-port-unreachable'

config/action.d/firewallcmd-rich-rules.conf

@@ -1,57 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# 
-# Because of the rich rule commands requires firewalld-0.3.1+
-# This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not
-# by chain. So for an example all deny rules will be listed under <zone>_deny. 
-#
-# If you use the --permanent rule you get a xml file in /etc/firewalld/zones/<zone>.xml that can be shared and parsed easliy
-#
-# Example commands to view rules:
-# firewall-cmd [--zone=<zone>] --list-rich-rules
-# firewall-cmd [--zone=<zone>] --list-all
-# firewall-cmd [--zone=zone] --query-rich-rule='rule'
-
-[Definition]
-
-actionstart = 
-
-actionstop = 
-
-actioncheck = 
-
-#you can also use zones and/or service names. 
-#
-# zone example: 
-# 	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' port port='<port>' protocol='<protocol>' <blocktype>"
-# service name example:
-#	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' service name='<service>' <blocktype>"
-# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges seperated by a comma or space for an example: http, https, 22-60, 18 smtp 
-
-actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' <blocktype>"; done
-	   
-actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' <blocktype>"; done
-
-[Init]
-
-name = default
-
-zone = public
-
-# use command firewall-cmd --get-services to see a list of services available
-#
-# Examples:
-#
-# amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps 
-# freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos 
-# kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s 
-# postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy 
-# telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
-
-service = ssh
-
-# reject types: 'icmp-net-unreachable', 'icmp-host-unreachable', 'icmp-port-unreachable', 'icmp-proto-unreachable', 
-# 'icmp-net-prohibited', 'icmp-host-prohibited', 'icmp-admin-prohibited' or 'tcp-reset'
-
-blocktype = reject type='icmp-port-unreachable'

config/action.d/iptables-allports.conf

@@ -3,14 +3,12 @@
 # Author: Cyril Jaquier
 # Modified: Yaroslav O. Halchenko <debian@onerussian.com>
 # 			made active on all ports from original iptables.conf
-# Modified: Alexander Koeppe <format_c@online.de>
-#        make config file IPv6 capable
 #
 #
 
 [INCLUDES]
 
-before = iptables-common.conf
+before = iptables-blocktype.conf
 
 
 [Definition]
@@ -19,32 +17,23 @@ before = iptables-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -p <protocol> -j f2b-<name>
-
-actionstart6 = <ip6tables> -N f2b-<name>
-               <ip6tables> -A f2b-<name> -j <returntype>
-               <ip6tables> -I <chain> -p <protocol> -j f2b-<name>
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> -p <protocol> -j fail2ban-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -j f2b-<name>
-             <iptables> -F f2b-<name>
-             <iptables> -X f2b-<name>
-
-actionstop6 = <ip6tables> -D <chain> -p <protocol> -j f2b-<name>
-              <ip6tables> -F f2b-<name>
-              <ip6tables> -X f2b-<name>
+actionstop = iptables -D <chain> -p <protocol> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
-actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -52,8 +41,7 @@ actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
-actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -61,9 +49,22 @@ actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
-actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j <blocktype6>
-
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>
 
 [Init]
 
+# Default name of the chain
+#
+name = default
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT

config/action.d/iptables-blocktype.conf

@@ -0,0 +1,22 @@
+# Fail2Ban configuration file
+#
+# Author: Daniel Black
+#
+# This is a included configuration file and includes the defination for the blocktype
+# used in all iptables based actions by default.
+#
+# The user can override the default in iptables-blocktype.local
+
+[INCLUDES]
+
+after = iptables-blocktype.local
+
+[Init]
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+blocktype = REJECT --reject-with icmp-port-unreachable
+

config/action.d/iptables-common.conf

@@ -1,73 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Daniel Black
-#
-# This is a included configuration file and includes the definitions for the iptables
-# used in all iptables based actions by default.
-#
-# The user can override the defaults in iptables-common.local
-#
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
-
-[INCLUDES]
-
-after = iptables-blocktype.local
-        iptables-common.local
-# iptables-blocktype.local is obsolete
-
-[Init]
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the Fail2Ban rules should be
-#          added
-# Values:  STRING  Default: INPUT
-chain = INPUT
-
-# Default name of the chain
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp-port-unreachable
-blocktype6 = REJECT --reject-with icmp6-port-unreachable
-
-# Option:  returntype
-# Note:    This is the default rule on "actionstart". This should be RETURN
-#          in all (blocking) actions, except REJECT in allowing actions.
-# Values:  STRING
-returntype = RETURN
-
-# Option:  lockingopt
-# Notes.:  Option was introduced to iptables to prevent multiple instances from
-#          running concurrently and causing irratic behavior.  -w was introduced
-#          in iptables 1.4.20, so might be absent on older systems
-#          See https://github.com/fail2ban/fail2ban/issues/1122
-# Values:  STRING
-lockingopt = -w
-
-# Option:  iptables
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-iptables = iptables <lockingopt>
-
-# Option:  ip6tables
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-ip6tables = ip6tables <lockingopt>

config/action.d/iptables-ipset-proto4.conf

@@ -19,7 +19,7 @@
 
 [INCLUDES]
 
-before = iptables-common.conf
+before = iptables-blocktype.conf
 
 [Definition]
 
@@ -27,16 +27,16 @@ before = iptables-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipset --create f2b-<name> iphash
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
+actionstart = ipset --create fail2ban-<name> iphash
+              iptables -I INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
-             ipset --flush f2b-<name>
-             ipset --destroy f2b-<name>
+actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
+             ipset --flush fail2ban-<name>
+             ipset --destroy fail2ban-<name>
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -44,7 +44,7 @@ actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset --test f2b-<name> <ip> ||  ipset --add f2b-<name> <ip>
+actionban = ipset --test fail2ban-<name> <ip> ||  ipset --add fail2ban-<name> <ip>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -52,7 +52,22 @@ actionban = ipset --test f2b-<name> <ip> ||  ipset --add f2b-<name> <ip>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipset --test f2b-<name> <ip> && ipset --del f2b-<name> <ip>
+actionunban = ipset --test fail2ban-<name> <ip> && ipset --del fail2ban-<name> <ip>
 
 [Init]
 
+# Default name of the ipset
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default: ssh
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp

config/action.d/iptables-ipset-proto6-allports.conf

@@ -12,13 +12,11 @@
 #
 # If you are running on an older kernel you make need to patch in external
 # modules which probably won't be protocol version 6.
-#
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 
 [INCLUDES]
 
-before = iptables-common.conf
+before = iptables-blocktype.conf
+
 
 [Definition]
 
@@ -26,23 +24,16 @@ before = iptables-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipset create f2b-<name> hash:ip timeout <bantime>
-              <iptables> -I <chain> -m set --match-set f2b-<name> src -j <blocktype>
-
-actionstart6 = ipset create f2b-<name>6 hash:ip timeout <bantime> family inet6
-               <ip6tables> -I <chain> -m set --match-set f2b-<name>6 src -j <blocktype6>
+actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
+              iptables -I INPUT -m set --match-set fail2ban-<name> src -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -m set --match-set f2b-<name> src -j <blocktype>
-             ipset flush f2b-<name>
-             ipset destroy f2b-<name>
-
-actionstop6 = <ip6tables> -D <chain> -m set --match-set f2b-<name>6 src -j <blocktype6>
-              ipset flush f2b-<name>6
-              ipset destroy f2b-<name>6
+actionstop = iptables -D INPUT -m set --match-set fail2ban-<name> src -j <blocktype>
+             ipset flush fail2ban-<name>
+             ipset destroy fail2ban-<name>
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -50,8 +41,7 @@ actionstop6 = <ip6tables> -D <chain> -m set --match-set f2b-<name>6 src -j <bloc
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
-actionban6 = ipset add f2b-<name>6 <ip> timeout <bantime> -exist
+actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -59,13 +49,16 @@ actionban6 = ipset add f2b-<name>6 <ip> timeout <bantime> -exist
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipset del f2b-<name> <ip> -exist
-actionunban6 = ipset del f2b-<name>6 <ip> -exist
+actionunban = ipset del fail2ban-<name> <ip> -exist
 
 [Init]
 
+# Default name of the ipset
+#
+name = default
+
 # Option: bantime
 # Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
 # Values:  [ NUM ]  Default: 600
-#
+
 bantime = 600

config/action.d/iptables-ipset-proto6.conf

@@ -12,13 +12,11 @@
 #
 # If you are running on an older kernel you make need to patch in external
 # modules.
-#
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 
 [INCLUDES]
 
-before = iptables-common.conf
+before = iptables-blocktype.conf
+
 
 [Definition]
 
@@ -26,23 +24,16 @@ before = iptables-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipset create f2b-<name> hash:ip timeout <bantime>
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
-
-actionstart6 = ipset create f2b-<name>6 hash:ip timeout <bantime> family inet6
-               <ip6tables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name>6 src -j <blocktype6>
+actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
+              iptables -I INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
-             ipset flush f2b-<name>
-             ipset destroy f2b-<name>
-
-actionstop6 = <ip6tables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name>6 src -j <blocktype6>
-              ipset flush f2b-<name>6
-              ipset destroy f2b-<name>6
+actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
+             ipset flush fail2ban-<name>
+             ipset destroy fail2ban-<name>
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -50,8 +41,7 @@ actionstop6 = <ip6tables> -D <chain> -p <protocol> -m multiport --dports <port>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
-actionban6 = ipset add f2b-<name>6 <ip> timeout <bantime> -exist
+actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -59,13 +49,28 @@ actionban6 = ipset add f2b-<name>6 <ip> timeout <bantime> -exist
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = ipset del f2b-<name> <ip> -exist
-actionunban6 = ipset del f2b-<name>6 <ip> -exist
+actionunban = ipset del fail2ban-<name> <ip> -exist
 
 [Init]
 
+# Default name of the ipset
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default: ssh
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
 # Option: bantime
 # Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
 # Values:  [ NUM ]  Default: 600
-#
+
 bantime = 600

config/action.d/iptables-multiport-log.conf

@@ -3,17 +3,15 @@
 # Author: Guido Bozzetto
 # Modified: Cyril Jaquier
 #
-# make "f2b-<name>" chain to match drop IP
-# make "f2b-<name>-log" chain to log and drop
-# insert a jump to f2b-<name> from -I <chain> if proto/port match
+# make "fail2ban-<name>" chain to match drop IP
+# make "fail2ban-<name>-log" chain to log and drop
+# insert a jump to fail2ban-<name> from -I <chain> if proto/port match
 #
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 #
 
 [INCLUDES]
 
-before = iptables-common.conf
+before = iptables-blocktype.conf
 
 [Definition]
 
@@ -21,42 +19,28 @@ before = iptables-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> 1 -p <protocol> -m multiport --dports <port> -j f2b-<name>
-              <iptables> -N f2b-<name>-log
-              <iptables> -I f2b-<name>-log -j LOG --log-prefix "$(expr f2b-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
-              <iptables> -A f2b-<name>-log -j <blocktype>
-
-actionstart6 = <ip6tables> -N f2b-<name>
-               <ip6tables> -A f2b-<name> -j <returntype>
-               <ip6tables> -I <chain> 1 -p <protocol> -m multiport --dports <port> -j f2b-<name>
-               <ip6tables> -N f2b-<name>-log
-               <ip6tables> -I f2b-<name>-log -j LOG --log-prefix "$(expr f2b-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
-               <ip6tables> -A f2b-<name>-log -j <blocktype6>
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> 1 -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+              iptables -N fail2ban-<name>-log
+              iptables -I fail2ban-<name>-log -j LOG --log-prefix "$(expr fail2ban-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
+              iptables -A fail2ban-<name>-log -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             <iptables> -F f2b-<name>
-             <iptables> -F f2b-<name>-log
-             <iptables> -X f2b-<name>
-             <iptables> -X f2b-<name>-log
-
-actionstop6 = <ip6tables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-              <ip6tables> -F f2b-<name>
-              <ip6tables> -F f2b-<name>-log
-              <ip6tables> -X f2b-<name>
-              <ip6tables> -X f2b-<name>-log
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -F fail2ban-<name>-log
+             iptables -X fail2ban-<name>
+             iptables -X fail2ban-<name>-log
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L f2b-<name>-log >/dev/null
-actioncheck6 = <ip6tables> -n -L f2b-<name>-log >/dev/null
+actioncheck = iptables -n -L fail2ban-<name>-log >/dev/null
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -64,8 +48,7 @@ actioncheck6 = <ip6tables> -n -L f2b-<name>-log >/dev/null
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
-actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -73,8 +56,28 @@ actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j f2b-<name>-log
-actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j f2b-<name>-log
+actionunban = iptables -D fail2ban-<name> -s <ip> -j fail2ban-<name>-log
 
 [Init]
 
+# Default name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT

config/action.d/iptables-multiport.conf

@@ -2,13 +2,11 @@
 #
 # Author: Cyril Jaquier
 # Modified by Yaroslav Halchenko for multiport banning
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 #
 
 [INCLUDES]
 
-before = iptables-common.conf
+before = iptables-blocktype.conf
 
 [Definition]
 
@@ -16,32 +14,23 @@ before = iptables-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-
-actionstart6 = <ip6tables> -N f2b-<name>
-               <ip6tables> -A f2b-<name> -j <returntype>
-               <ip6tables> -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             <iptables> -F f2b-<name>
-             <iptables> -X f2b-<name>
-
-actionstop6 = <ip6tables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-              <ip6tables> -F f2b-<name>
-              <ip6tables> -X f2b-<name>
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
-actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -49,8 +38,7 @@ actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
-actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -58,8 +46,28 @@ actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
-actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j <blocktype6>
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>
 
 [Init]
 
+# Default name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT

config/action.d/iptables-new.conf

@@ -4,13 +4,12 @@
 # Copied from iptables.conf and modified by Yaroslav Halchenko 
 #  to fulfill the needs of bugreporter dbts#350746.
 #
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 #
 
 [INCLUDES]
 
-before = iptables-common.conf
+before = iptables-blocktype.conf
+
 
 [Definition]
 
@@ -18,32 +17,23 @@ before = iptables-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
-
-actionstart6 = <ip6tables> -N f2b-<name>
-               <ip6tables> -A f2b-<name> -j <returntype>
-               <ip6tables> -I <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
-             <iptables> -F f2b-<name>
-             <iptables> -X f2b-<name>
-
-actionstop6 = <ip6tables> -D <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
-              <ip6tables> -F f2b-<name>
-              <ip6tables> -X f2b-<name>
+actionstop = iptables -D <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
-actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -51,8 +41,7 @@ actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
-actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -60,8 +49,28 @@ actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
-actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j <blocktype6>
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>
 
 [Init]
 
+# Default name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT

config/action.d/iptables-xt_recent-echo.conf

@@ -2,13 +2,12 @@
 #
 # Author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
 #
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 #
 
 [INCLUDES]
 
-before = iptables-common.conf
+before = iptables-blocktype.conf
+
 
 [Definition]
 
@@ -24,34 +23,30 @@ before = iptables-common.conf
 # iptables-persistent package).
 # 
 # Explanation of the rule below:
-#    Check if any packets coming from an IP on the f2b-<name>
+#    Check if any packets coming from an IP on the fail2ban-<name>
 #    list have been seen in the last 3600 seconds. If yes, update the
 #    timestamp for this IP and drop the packet. If not, let the packet
 #    through.
 #
-#    Fail2ban inserts blacklisted hosts into the f2b-<name> list
+#    Fail2ban inserts blacklisted hosts into the fail2ban-<name> list
 #    and removes them from the list after some time, according to its
 #    own rules. The 3600 second timeout is independent and acts as a
 #    safeguard in case the fail2ban process dies unexpectedly. The
 #    shorter of the two timeouts actually matters.
-actionstart = if [ `id -u` -eq 0 ];then <iptables> -I <chain> -m recent --update --seconds 3600 --name f2b-<name> -j <blocktype>;fi
-actionstart6 = if [ `id -u` -eq 0 ];then <ip6tables> -I <chain> -m recent --update --seconds 3600 --name f2b-<name>6 -j <blocktype6>;fi
+actionstart = if [ `id -u` -eq 0 ];then iptables -I INPUT -m recent --update --seconds 3600 --name fail2ban-<name> -j <blocktype>;fi
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = echo / > /proc/net/xt_recent/f2b-<name>
-             if [ `id -u` -eq 0 ];then <iptables> -D <chain> -m recent --update --seconds 3600 --name f2b-<name> -j <blocktype>;fi
-actionstop6 = echo / > /proc/net/xt_recent/f2b-<name>6
-             if [ `id -u` -eq 0 ];then <ip6tables> -D <chain> -m recent --update --seconds 3600 --name f2b-<name>6 -j <blocktype6>;fi
+actionstop = echo / > /proc/net/xt_recent/fail2ban-<name>
+             if [ `id -u` -eq 0 ];then iptables -D INPUT -m recent --update --seconds 3600 --name fail2ban-<name> -j <blocktype>;fi
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = test -e /proc/net/xt_recent/f2b-<name>
-actioncheck6 = test -e /proc/net/xt_recent/f2b-<name>6
+actioncheck = test -e /proc/net/xt_recent/fail2ban-<name>
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -59,8 +54,7 @@ actioncheck6 = test -e /proc/net/xt_recent/f2b-<name>6
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = echo +<ip> > /proc/net/xt_recent/f2b-<name>
-actionban6 = echo +<ip> > /proc/net/xt_recent/f2b-<name>6
+actionban = echo +<ip> > /proc/net/xt_recent/fail2ban-<name>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -68,8 +62,16 @@ actionban6 = echo +<ip> > /proc/net/xt_recent/f2b-<name>6
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = echo -<ip> > /proc/net/xt_recent/f2b-<name>
-actionunban6 = echo -<ip> > /proc/net/xt_recent/f2b-<name>6
+actionunban = echo -<ip> > /proc/net/xt_recent/fail2ban-<name>
 
 [Init]
 
+# Default name of the chain
+#
+name = default
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp

config/action.d/iptables.conf

@@ -2,13 +2,11 @@
 #
 # Author: Cyril Jaquier
 #
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 #
 
 [INCLUDES]
 
-before = iptables-common.conf
+before = iptables-blocktype.conf
 
 [Definition]
 
@@ -16,32 +14,23 @@ before = iptables-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -p <protocol> --dport <port> -j f2b-<name>
-
-actionstart6 = <ip6tables> -N f2b-<name>
-               <ip6tables> -A f2b-<name> -j <returntype>
-               <ip6tables> -I <chain> -p <protocol> --dport <port> -j f2b-<name>
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> -p <protocol> --dport <port> -j fail2ban-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> --dport <port> -j f2b-<name>
-             <iptables> -F f2b-<name>
-             <iptables> -X f2b-<name>
-
-actionstop6 = <ip6tables> -D <chain> -p <protocol> --dport <port> -j f2b-<name>
-              <ip6tables> -F f2b-<name>
-              <ip6tables> -X f2b-<name>
+actionstop = iptables -D <chain> -p <protocol> --dport <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
-actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -49,8 +38,7 @@ actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
-actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -58,8 +46,28 @@ actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
-actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j <blocktype6>
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>
 
 [Init]
 
+# Default name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT

config/action.d/mail-whois-common.conf

@@ -1,28 +0,0 @@
-# Fail2Ban configuration file
-#
-# Common settings for mail actions
-#
-# Users can override the defaults in mail-whois-common.local
-
-[INCLUDES]
-
-# Load customizations if any available
-after = mail-whois-common.local
-
-[DEFAULT]
-#original character set of whois output will be sent to mail program
-_whois = whois <ip> || echo "missing whois program"
-
-# use heuristics to convert charset of whois output to a target
-# character set before sending it to a mail program
-# make sure you have 'file' and 'iconv' commands installed when opting for that
-_whois_target_charset = UTF-8
-_whois_convert_charset = whois <ip> |
-                         { WHOIS_OUTPUT=$(cat) ; WHOIS_CHARSET=$(printf %%b "$WHOIS_OUTPUT" | file -b --mime-encoding -) ; printf %%b "$WHOIS_OUTPUT" | iconv -f $WHOIS_CHARSET -t %(_whois_target_charset)s//TRANSLIT - ; }
-
-# choose between _whois and _whois_convert_charset in mail-whois-common.local
-# or other *.local which include mail-whois-common.conf.
-_whois_command = %(_whois)s
-#_whois_command = %(_whois_convert_charset)s
-
-[Init]

config/action.d/mail-whois-lines.conf

@@ -4,10 +4,6 @@
 # Modified-By: Yaroslav Halchenko to include grepping on IP over log files
 #
 
-[INCLUDES]
-
-before = mail-whois-common.conf
-
 [Definition]
 
 # Option:  actionstart
@@ -43,10 +39,10 @@ actioncheck =
 actionban = printf %%b "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
+            Here is more information about <ip>:\n
+            `whois <ip> || echo missing whois program`\n\n
             Lines containing IP:<ip> in <logpath>\n
-            `grep -E <grepopts> '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
+            `grep -E '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from  `uname -n`" <dest>
 
@@ -71,7 +67,3 @@ dest = root
 # Path to the log files which contain relevant lines for the abuser IP
 #
 logpath = /dev/null
-
-# Number of log lines to include in the email
-#
-grepopts = -m 1000

config/action.d/mail-whois.conf

@@ -4,10 +4,6 @@
 #
 #
 
-[INCLUDES]
-
-before = mail-whois-common.conf
-
 [Definition]
 
 # Option:  actionstart
@@ -43,8 +39,8 @@ actioncheck =
 actionban = printf %%b "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n
+            Here is more information about <ip>:\n
+            `whois <ip> || echo missing whois program`\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest>
 

config/action.d/mynetwatchman.conf

@@ -111,17 +111,13 @@ myip = `ip -4 addr show dev eth0 | grep inet | head -n 1 | sed -r 's/.*inet ([0-
 #
 protocol = tcp
 
-# Option:  agent
-# Default: Fail2ban
-agent = Fail2ban
-
 # Option:  getcmd
 # Notes.:  A command to fetch a URL. Should output page to STDOUT
 # Values:  CMD  Default: wget
 #
-getcmd = wget --no-verbose --tries=3 --waitretry=10 --connect-timeout=10 --read-timeout=60 --retry-connrefused --output-document=- --user-agent=<agent>
+getcmd = wget --no-verbose --tries=3 --waitretry=10 --connect-timeout=10 --read-timeout=60 --retry-connrefused --output-document=- --user-agent=Fail2Ban
 # Alternative value:
-# getcmd = curl --silent --show-error --retry 3 --connect-timeout 10 --max-time 60 --user-agent <agent>
+# getcmd = curl --silent --show-error --retry 3 --connect-timeout 10 --max-time 60 --user-agent Fail2Ban
 
 # Option:  srcport
 # Notes.:  The source port of the attack. You're unlikely to have this info, so

config/action.d/nftables-allports.conf

@@ -1,22 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-
-[INCLUDES]
-
-before = nftables-common.conf
-
-[Definition]
-
-# Option:  nftables_mode
-# Notes.:  additional expressions for nftables filter rule
-# Values:  nftables expressions
-#
-nftables_mode = ip protocol <protocol>
-
-[Init]

config/action.d/nftables-common.conf

@@ -1,119 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Daniel Black
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-# This is a included configuration file and includes the definitions for the nftables
-# used in all nftables based actions by default.
-#
-# The user can override the defaults in nftables-common.local
-
-[INCLUDES]
-
-after = nftables-common.local
-
-[Definition]
-
-# Option:  nftables_mode
-# Notes.:  additional expressions for nftables filter rule
-# Values:  nftables expressions
-#
-nftables_mode = <protocol> dport \{ <port> \}
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = <nftables> add set <nftables_family> <nftables_table> f2b-<name> \{ type <nftables_type>\; \}
-              <nftables> insert rule <nftables_family> <nftables_table> <chain> %(nftables_mode)s ip saddr @f2b-<name> <blocktype>
-
-_nft_list = <nftables> --handle --numeric list chain <nftables_family> <nftables_table> <chain>
-_nft_get_handle_id = grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep -oe ' handle [0-9]*'
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = HANDLE_ID=$(%(_nft_list)s | %(_nft_get_handle_id)s)
-             <nftables> delete rule <nftables_family> <nftables_table> <chain> $HANDLE_ID
-             <nftables> delete set <nftables_family> <nftables_table> f2b-<name>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <nftables> list chain <nftables_family> <nftables_table> <chain> | grep -q '@f2b-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <nftables> add element <nftables_family> <nftables_table> f2b-<name> \{ <ip> \}
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <nftables> delete element <nftables_family> <nftables_table> f2b-<name> \{ <ip> \}
-
-[Init]
-
-# Option:  nftables_type
-# Notes.:  address type to work with
-# Values:  [ipv4_addr | ipv6_addr]  Default: ipv4_addr
-#
-nftables_type = ipv4_addr
-
-# Option:  nftables_family
-# Notes.:  address family to work in
-# Values:  [ip | ip6 | inet]  Default: inet
-#
-nftables_family = inet
-
-# Option:  nftables_table
-# Notes.:  table in the address family to work in
-# Values:  STRING  Default: filter
-#
-nftables_table = filter
-
-# Option:  chain
-# Notes    specifies the nftables chain to which the Fail2Ban rules should be
-#          added
-# Values:  STRING  Default: input
-chain = input
-
-# Default name of the filtering set
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp ] Default: tcp
-#
-protocol = tcp
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the nftables man page (section 8). Common values are drop
-#          reject, reject with icmp type host-unreachable
-# Values:  STRING
-blocktype = reject
-
-# Option:  nftables
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-nftables = nft

config/action.d/nftables-multiport.conf

@@ -1,22 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-
-[INCLUDES]
-
-before = nftables-common.conf
-
-[Definition]
-
-# Option:  nftables_mode
-# Notes.:  additional expressions for nftables filter rule
-# Values:  nftables expressions
-#
-nftables_mode = <protocol> dport \{ <port> \}
-
-[Init]

config/action.d/nsupdate.conf

@@ -1,114 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Andrew St. Jean
-#
-# Use nsupdate to perform dynamic DNS updates on a BIND zone file.
-# One may want to do this to update a local RBL with banned IP addresses.
-#
-# Options
-#
-# domain	DNS domain that will appear in nsupdate add and delete
-#		commands.
-#
-# ttl		The time to live (TTL) in seconds of the TXT resource
-#		record.
-#
-# rdata		Data portion of the TXT resource record.
-#
-# nsupdatecmd	Full path to the nsupdate command.
-#
-# keyfile	Full path to TSIG key file used for authentication between
-#		nsupdate and BIND.
-#
-# Create an nsupdate.local to set at least the <domain> and <keyfile>
-# options as they don't have default values.
-#
-# The ban and unban commands assume nsupdate will authenticate to the BIND
-# server using a TSIG key. The full path to the key file must be specified
-# in the <keyfile> parameter. Use this command to generate your TSIG key.
-#
-# dnssec-keygen -a HMAC-MD5 -b 256 -n HOST <key_name>
-#
-# Replace <key_name> with some meaningful name.
-#
-# This command will generate two files. Specify the .private file in the
-# <keyfile> option. Note that the .key file must also be present in the same
-# directory for nsupdate to use the key.
-#
-# Don't forget to add the key and appropriate allow-update or update-policy
-# option to your named.conf file.
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart =
-
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop =
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = echo <ip> | awk -F. '{print "prereq nxrrset "$4"."$3"."$2"."$1".<domain> TXT"; print "update add "$4"."$3"."$2"."$1".<domain> <ttl> IN TXT \"<rdata>\""; print "send"}' | <nsupdatecmd> -k <keyfile>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = echo <ip> | awk -F. '{print "update delete "$4"."$3"."$2"."$1".<domain>"; print "send"}' | <nsupdatecmd> -k <keyfile>
-
-[Init]
-
-# Option:  domain
-# Notes.:  DNS domain that nsupdate will update.
-# Values:  STRING
-#
-domain = 
-
-# Option:  ttl
-# Notes.:  time to live (TTL) in seconds of TXT resource record
-#          added by nsupdate.
-# Values:  NUM
-#
-ttl = 60
-
-# Option:  rdata
-# Notes.:  data portion of the TXT resource record added by nsupdate.
-# Values:  STRING
-#
-rdata = Your IP has been banned
-
-# Option:  nsupdatecmd
-# Notes.:  specifies the full path to the nsupdate program that dynamically
-#          updates BIND zone files.
-# Values:  CMD
-#
-nsupdatecmd = /usr/bin/nsupdate
-
-# Option:  keyfile
-# Notes.:  specifies the full path to the file containing the
-#	   TSIG key for communicating with BIND.
-# Values:  STRING
-#
-keyfile = 
-

config/action.d/pf.conf

@@ -3,7 +3,6 @@
 # OpenBSD pf ban/unban
 #
 # Author: Nick Hilliard <nick@foobar.org>
-# Modified by: Alexander Koeppe making PF work seamless and with IPv4 and IPv6
 #
 #
 
@@ -13,27 +12,23 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-# we don't enable PF automatically; to enable run pfctl -e 
-# or add `pf_enable="YES"` to /etc/rc.conf (tested on FreeBSD)
-actionstart = echo "table <<tablename>-<name>> persist counters" | pfctl -f- 
-              echo "block proto <protocol> from <<tablename>-<name>> to any port <port>" | pfctl -f-
+# we don't enable PF automatically, as it will be enabled elsewhere
+actionstart = 
 
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-# we only disable PF rules we've installed prior
-actionstop = pfctl -sr 2>/dev/null | grep -v <tablename>-<name> | pfctl -f-
-             pfctl -t <tablename>-<name> -T flush
-             pfctl -t <tablename>-<name> -T kill
+# we don't disable PF automatically either
+actionstop = 
 
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = pfctl -sr | grep -q <tablename>-<name>
+actioncheck = 
 
 
 # Option:  actionban
@@ -44,7 +39,7 @@ actioncheck = pfctl -sr | grep -q <tablename>-<name>
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = pfctl -t <tablename>-<name> -T add <ip>
+actionban = /sbin/pfctl -t <tablename> -T add <ip>/32
 
 
 # Option:  actionunban
@@ -56,24 +51,12 @@ actionban = pfctl -t <tablename>-<name> -T add <ip>
 # Values:  CMD
 #
 # note -r option used to remove matching rule
-actionunban = pfctl -t <tablename>-<name> -T delete <ip>
+actionunban = /sbin/pfctl -t <tablename> -T delete <ip>/32
 
 [Init]
 # Option:  tablename
 # Notes.:  The pf table name.
 # Values:  [ STRING ]
 #
-tablename = f2b
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | ipv6-icmp ] Default: tcp
-#
-protocol = tcp
-
-# Option:  port
-# Notes.:  the port to block, defaults to any
-# Values:  [ STRING ]
-#
-port = any
+tablename = fail2ban
 

config/action.d/route.conf

@@ -17,9 +17,6 @@
 [Definition]
 actionban   = ip route add <blocktype> <ip>
 actionunban = ip route del <blocktype> <ip>
-actioncheck =
-actionstart =
-actionstop =
 
 [Init]
 

config/action.d/sendmail-common.conf

@@ -8,56 +8,6 @@
 
 after = sendmail-common.local
 
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
-              Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-              From: <sendername> <<sender>>
-              To: <dest>\n
-              Hi,\n
-              The jail <name> has been started successfully.\n
-              Regards,\n
-              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
-             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-             From: <sendername> <<sender>>
-             To: <dest>\n
-             Hi,\n
-             The jail <name> has been stopped.\n
-             Regards,\n
-             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban =
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
 [Init]
 
 # Recipient mail address

config/action.d/sendmail-geoip-lines.conf

@@ -1,53 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Viktor Szépe
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-
-[Definition]
-
-# Option:  actionban
-# Notes.:  Command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-#          You need to install geoiplookup and the GeoLite or GeoIP databases.
-#          (geoip-bin and geoip-database in Debian)
-#          The host command comes from bind9-host package.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            http://bgp.he.net/ip/<ip>
-            http://www.projecthoneypot.org/ip_<ip>
-            http://whois.domaintools.com/<ip>\n\n
-            Country:`geoiplookup -f /usr/share/GeoIP/GeoIP.dat "<ip>" | cut -d':' -f2-`
-            AS:`geoiplookup -f /usr/share/GeoIP/GeoIPASNum.dat "<ip>" | cut -d':' -f2-`
-            hostname: `host -t A <ip> 2>&1`\n\n
-            Lines containing IP:<ip> in <logpath>\n
-            `grep -E <grepopts> '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
-            Regards,\n
-            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-
-# Path to the log files which contain relevant lines for the abuser IP
-#
-logpath = /dev/null
-
-# Number of log lines to include in the email
-#
-grepopts = -m 1000

config/action.d/sendmail-whois-ipjailmatches.conf

@@ -1,37 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-
-[Definition]
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `/usr/bin/whois <ip>`\n\n
-            Matches for <name> with <ipjailfailures> failures IP:<ip>\n
-            <ipjailmatches>\n\n
-            Regards,\n
-            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-[Init]
-
-# Default name of the chain
-#
-name = default

config/action.d/sendmail-whois-ipmatches.conf

@@ -1,37 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-
-[Definition]
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `/usr/bin/whois <ip>`\n\n
-            Matches with <ipfailures> failures IP:<ip>\n
-            <ipmatches>\n\n
-            Regards,\n
-            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-[Init]
-
-# Default name of the chain
-#
-name = default

config/action.d/sendmail-whois-lines.conf

@@ -10,6 +10,38 @@ before = sendmail-common.conf
 
 [Definition]
 
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
+              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+              From: <sendername> <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
+             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+             From: <sendername> <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -17,19 +49,27 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
+            Here is more information about <ip>:\n
             `/usr/bin/whois <ip> || echo missing whois program`\n\n
             Lines containing IP:<ip> in <logpath>\n
-            `grep -E <grepopts> '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
+            `grep -E '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
             Regards,\n
             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = 
+
 [Init]
 
 # Default name of the chain
@@ -40,6 +80,3 @@ name = default
 #
 logpath = /dev/null
 
-# Number of log lines to include in the email
-#
-grepopts = -m 1000

config/action.d/sendmail-whois-matches.conf

@@ -1,37 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-
-[Definition]
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `/usr/bin/whois <ip>`\n\n
-            Matches:\n
-            <matches>\n\n
-            Regards,\n
-            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-[Init]
-
-# Default name of the chain
-#
-name = default

config/action.d/sendmail-whois.conf

@@ -10,6 +10,38 @@ before = sendmail-common.conf
 
 [Definition]
 
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
+              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+              From: <sendername> <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
+             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+             From: <sendername> <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -17,17 +49,25 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
+            Here is more information about <ip>:\n
             `/usr/bin/whois <ip> || echo missing whois program`\n
             Regards,\n
             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = 
+
 [Init]
 
 # Default name of the chain

config/action.d/sendmail.conf

@@ -10,6 +10,38 @@ before = sendmail-common.conf
 
 [Definition]
 
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
+              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+              From: <sendername> <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
+             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
+             From: <sendername> <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -17,7 +49,7 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
@@ -26,6 +58,14 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Regards,\n
             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = 
+
 [Init]
 
 # Default name of the chain

config/action.d/shorewall-ipset-proto6.conf

@@ -1,85 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Eduardo Diaz
-#
-# This is for ipset protocol 6 (and hopefully later) (ipset v6.14).
-# for shorewall
-#
-# Use this setting in jail.conf to modify use this action instead of a
-# default one
-#
-# banaction   = shorewall-ipset-proto6
-#
-# This requires the program ipset which is normally in package called ipset.
-#
-# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0
-# kernels, and you need Shorewall >= 4.5.5 to use this action.
-#
-# The default Shorewall configuration is with "BLACKLISTNEWONLY=Yes" (see
-# file /etc/shorewall/shorewall.conf). This means that when Fail2ban adds a
-# new shorewall rule to ban an IP address, that rule will affect only new
-# connections. So if the attacker goes on trying using the same connection
-# he could even log in. In order to get the same behavior of the iptable
-# action (so that the ban is immediate) the /etc/shorewall/shorewall.conf
-# file should me modified with "BLACKLISTNEWONLY=No".
-#
-#
-# Enable shorewall to use a blacklist using iptables creating a file
-# /etc/shorewall/blrules and adding "DROP net:+f2b-ssh all" and
-# similar lines for every jail.  To enable restoring you ipset you
-# must set SAVE_IPSETS=Yes in shorewall.conf .  You can read more
-# about ipsets handling in Shorewall at http://shorewall.net/ipsets.html
-#
-# To force creation of the ipset in the case that somebody deletes the
-# ipset create a file /etc/shorewall/initdone and add one line for
-# every ipset (this files are in Perl) and add 1 at the end of the file.
-# The example:
-# system("/usr/sbin/ipset -quiet -exist create f2b-ssh hash:ip timeout 600 ");
-# 1;
-#
-# To destroy the ipset in shorewall you must add to the file /etc/shorewall/stopped
-# # One line of every ipset
-# system("/usr/sbin/ipset -quiet destroy f2b-ssh ");
-# 1; # This must go to the end of the file if not shorewall compilation fails
-#
-
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = if ! ipset -quiet -name list f2b-<name> >/dev/null;
-              then ipset -quiet -exist create f2b-<name> hash:ip timeout <bantime>;
-              fi
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = ipset flush f2b-<name>
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = ipset del f2b-<name> <ip> -exist
-
-[Init]
-
-# Option: bantime
-# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
-# Values:  [ NUM ]  Default: 600
-#
-bantime = 600

config/action.d/smtp.py

@@ -1,225 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-import socket
-import smtplib
-from email.mime.text import MIMEText
-from email.utils import formatdate, formataddr
-
-from fail2ban.server.actions import ActionBase, CallingMap
-
-messages = {}
-messages['start'] = \
-"""Hi,
-
-The jail %(jailname)s has been started successfully.
-
-Regards,
-Fail2Ban"""
-
-messages['stop'] = \
-"""Hi,
-
-The jail %(jailname)s has been stopped.
-
-Regards,
-Fail2Ban"""
-
-messages['ban'] = {}
-messages['ban']['head'] = \
-"""Hi,
-
-The IP %(ip)s has just been banned for %(bantime)i seconds
-by Fail2Ban after %(failures)i attempts against %(jailname)s.
-"""
-messages['ban']['tail'] = \
-"""
-Regards,
-Fail2Ban"""
-messages['ban']['matches'] = \
-"""
-Matches for this ban:
-%(matches)s
-"""
-messages['ban']['ipmatches'] = \
-"""
-Matches for %(ip)s:
-%(ipmatches)s
-"""
-messages['ban']['ipjailmatches'] = \
-"""
-Matches for %(ip)s for jail %(jailname)s:
-%(ipjailmatches)s
-"""
-
-
-class SMTPAction(ActionBase):
-	"""Fail2Ban action which sends emails to inform on jail starting,
-	stopping and bans.
-	"""
-
-	def __init__(
-		self, jail, name, host="localhost", user=None, password=None,
-		sendername="Fail2Ban", sender="fail2ban", dest="root", matches=None):
-		"""Initialise action.
-
-		Parameters
-		----------
-		jail : Jail
-			The jail which the action belongs to.
-		name : str
-			Named assigned to the action.
-		host : str, optional
-			SMTP host, of host:port format. Default host "localhost" and
-			port "25"
-		user : str, optional
-			Username used for authentication with SMTP server.
-		password : str, optional
-			Password used for authentication with SMTP server.
-		sendername : str, optional
-			Name to use for from address in email. Default "Fail2Ban".
-		sender : str, optional
-			Email address to use for from address in email.
-			Default "fail2ban".
-		dest : str, optional
-			Email addresses of intended recipient(s) in comma space ", "
-			delimited format. Default "root".
-		matches : str, optional
-			Type of matches to be included from ban in email. Can be one
-			of "matches", "ipmatches" or "ipjailmatches". Default None
-			(see man jail.conf.5).
-		"""
-
-		super(SMTPAction, self).__init__(jail, name)
-
-		self.host = host
-		#TODO: self.ssl = ssl
-
-		self.user = user
-		self.password =password
-
-		self.fromname = sendername
-		self.fromaddr = sender
-		self.toaddr = dest
-
-		self.matches = matches
-
-		self.message_values = CallingMap(
-			jailname = self._jail.name,
-			hostname = socket.gethostname,
-			bantime = self._jail.actions.getBanTime,
-			)
-
-	def _sendMessage(self, subject, text):
-		"""Sends message based on arguments and instance's properties.
-
-		Parameters
-		----------
-		subject : str
-			Subject of the email.
-		text : str
-			Body of the email.
-
-		Raises
-		------
-		SMTPConnectionError
-			Error on connecting to host.
-		SMTPAuthenticationError
-			Error authenticating with SMTP server.
-		SMTPException
-			See Python `smtplib` for full list of other possible
-			exceptions.
-		"""
-		msg = MIMEText(text)
-		msg['Subject'] = subject
-		msg['From'] = formataddr((self.fromname, self.fromaddr))
-		msg['To'] = self.toaddr
-		msg['Date'] = formatdate()
-
-		smtp = smtplib.SMTP()
-		try:
-			self._logSys.debug("Connected to SMTP '%s', response: %i: %s",
-				self.host, *smtp.connect(self.host))
-			if self.user and self.password:
-				smtp.login(self.user, self.password)
-			failed_recipients = smtp.sendmail(
-				self.fromaddr, self.toaddr.split(", "), msg.as_string())
-		except smtplib.SMTPConnectError:
-			self._logSys.error("Error connecting to host '%s'", self.host)
-			raise
-		except smtplib.SMTPAuthenticationError:
-			self._logSys.error(
-				"Failed to authenticate with host '%s' user '%s'",
-				self.host, self.user)
-			raise
-		except smtplib.SMTPException:
-			self._logSys.error(
-				"Error sending mail to host '%s' from '%s' to '%s'",
-				self.host, self.fromaddr, self.toaddr)
-			raise
-		else:
-			if failed_recipients:
-				self._logSys.warning(
-					"Email to '%s' failed to following recipients: %r",
-					self.toaddr, failed_recipients)
-			self._logSys.debug("Email '%s' successfully sent", subject)
-		finally:
-			try:
-				self._logSys.debug("Disconnected from '%s', response %i: %s",
-					self.host, *smtp.quit())
-			except smtplib.SMTPServerDisconnected:
-				pass # Not connected
-
-	def start(self):
-		"""Sends email to recipients informing that the jail has started.
-		"""
-		self._sendMessage(
-			"[Fail2Ban] %(jailname)s: started on %(hostname)s" %
-				self.message_values,
-			messages['start'] % self.message_values)
-
-	def stop(self):
-		"""Sends email to recipients informing that the jail has stopped.
-		"""
-		self._sendMessage(
-			"[Fail2Ban] %(jailname)s: stopped on %(hostname)s" %
-				self.message_values,
-			messages['stop'] % self.message_values)
-
-	def ban(self, aInfo):
-		"""Sends email to recipients informing that ban has occurred.
-
-		Parameters
-		----------
-		aInfo : dict
-			Dictionary which includes information in relation to
-			the ban.
-		"""
-		aInfo.update(self.message_values)
-		message = "".join([
-			messages['ban']['head'],
-			messages['ban'].get(self.matches, ""),
-			messages['ban']['tail']
-			])
-		self._sendMessage(
-			"[Fail2Ban] %(jailname)s: banned %(ip)s from %(hostname)s" %
-				aInfo,
-			message % aInfo)
-
-Action = SMTPAction

config/action.d/symbiosis-blacklist-allports.conf

@@ -1,55 +0,0 @@
-# Fail2Ban configuration file for Bytemark Symbiosis firewall
-#
-# Author: Yaroslav Halchenko
-#
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart =
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop =
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <iptables> -n -L <chain>
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP.
-# Values:  CMD
-#
-actionban = echo 'all' >| /etc/symbiosis/firewall/blacklist.d/<ip>.auto
-            <iptables> -I <chain> 1 -s <ip> -j <blocktype>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP.
-# Values:  CMD
-#
-actionunban = rm -f /etc/symbiosis/firewall/blacklist.d/<ip>.auto
-              <iptables> -D <chain> -s <ip> -j <blocktype> || :
-
-[Init]
-
-# Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
-#          added to.  blacklist is a chain initiated by symbiosis firewall.
-# Values:  STRING  Default: blacklist
-chain = blacklist
-
-# Option:  blocktype
-# Note:    This is to match default symbiosis firewall type for blacklisted IPs
-# Values:  STRING
-blocktype = DROP

config/action.d/ufw.conf

@@ -1,9 +1,9 @@
 # Fail2Ban action configuration file for ufw
 #
-# You are required to run "ufw enable" before this will have any effect.
+# You are required to run "ufw enable" before this will have an effect.
 #
-# The insert position should be appropriate to block the required traffic.
-# A number after an allow rule to the application won't be of much use.
+# The insert position should be approprate to block the required traffic.
+# A number after an allow rule to the application won't be much use.
 
 [Definition]
 
@@ -13,15 +13,13 @@ actionstop =
 
 actioncheck = 
 
-actionban = [ -n "<application>" ] && app="app <application>"
-            ufw insert <insertpos> <blocktype> from <ip> to <destination> $app
+actionban = [ -n "<application>" ] && app="app <application>" ; ufw insert <insertpos> <blocktype> from <ip> to <destination> $app
 
-actionunban = [ -n "<application>" ] && app="app <application>"
-              ufw delete <blocktype> from <ip> to <destination> $app
+actionunban = [ -n "<application>" ] && app="app <application>" ; ufw delete <blocktype> from <ip> to <destination> $app
 
 [Init]
 # Option: insertpos
-# Notes.:  The position number in the firewall list to insert the block rule
+# Notes.:  The postition number in the firewall list to insert the block rule
 insertpos = 1
 
 # Option: blocktype

config/action.d/xarf-login-attack.conf

@@ -1,124 +0,0 @@
-# Fail2Ban action for sending xarf Login-Attack messages to IP owner
-#
-# IMPORTANT:
-#
-# Emailing a IP owner of abuse is a serious complain. Make sure that it is
-# serious. Fail2ban developers and network owners recommend you only use this
-# action for:
-#   * The recidive where the IP has been banned multiple times
-#   * Where maxretry has been set quite high, beyond the normal user typing
-#     password incorrectly.
-#   * For filters that have a low likelihood of receiving human errors
-#
-# DEPENDENCIES:
-#
-# This requires the dig command from bind-utils
-#
-# This uses the https://abusix.com/contactdb.html to lookup abuse contacts.
-#
-# XARF is a specification for sending a formatted response
-# for non-messaging based abuse including:
-#
-# Login-Attack, Malware-Attack, Fraud (Phishing, etc.), Info DNSBL
-#
-# For details see:
-# https://github.com/abusix/xarf-specification
-# http://www.x-arf.org/schemata.html
-#
-# Author: Daniel Black
-# Based on complain written by Russell Odom <russ@gloomytrousers.co.uk>
-#
-#
-
-[Definition]
-
-actionstart =
-
-actionstop =
-
-actioncheck =
-
-actionban = oifs=${IFS}; IFS=.;SEP_IP=( <ip> ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs}
-            IP=<ip>
-            FROM=<sender>
-            SERVICE=<service>
-            FAILURES=<failures>
-            REPORTID=<time>@`uname -n`
-            TLP=<tlp>
-            PORT=<port>
-            DATE=`LC_ALL=C date --date=@<time> +"%%a, %%d %%h %%Y %%T %%z"`
-            if [ ! -z "$ADDRESSES" ]; then
-                (printf -- %%b "<header>\n<message>\n<report>\n";
-                 date '+Note: Local timezone is %%z (%%Z)';
-                 printf -- %%b "<ipmatches>\n\n<footer>") | <mailcmd> <mailargs> ${ADDRESSES//,/\" \"}
-            fi
-
-actionunban =
-
-[Init]
-# Option: header
-# Notes:  This is really a fixed value
-header  = Subject: abuse report about $IP - $DATE\nAuto-Submitted: auto-generated\nX-XARF: PLAIN\nContent-Transfer-Encoding: 7bit\nContent-Type: multipart/mixed; charset=utf8;\n  boundary=Abuse-bfbb0f920793ac03cb8634bde14d8a1e;\n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8;\n
-
-# Option: footer
-# Notes:  This is really a fixed value and needs to match the report and header
-#         mime delimiters
-footer = \n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e--
-
-# Option: report
-# Notes:  Intended to be fixed
-report =  --Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8; name=\"report.txt\";\n\n---\nReported-From: $FROM\nCategory: abuse\nReport-ID: $REPORTID\nReport-Type: login-attack\nService: $SERVICE\nVersion: 0.2\nUser-Agent: Fail2ban v0.9\nDate: $DATE\nSource-Type: ip-address\nSource: $IP\nPort: $PORT\nSchema-URL: http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json\nAttachment: text/plain\nOccurances: $FAILURES\nTLP: $TLP\n\n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf8; name=\"logfile.log\";
-
-# Option: Message
-# Notes:  This can be modified by the users
-message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to abusix.com is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process.)\n\n This mail was generated by Fail2Ban in a X-ARF format! You can find more information about x-arf at http://www.x-arf.org/specification.html.\n\nThe recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here: https://abusix.com/global-reporting/abuse-contact-db\nabusix.com is neither responsible nor liable for the content or accuracy of this message.\n
-
-# Option:  loglines
-# Notes.:  The number of log lines to search for the IP for the report
-loglines = 9000
-
-# Option:  mailcmd
-# Notes.:  Your system mail command. It is passed the recipient
-# Values:  CMD
-#
-mailcmd =  /usr/sbin/sendmail
-
-# Option:  mailargs
-# Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
-#          CC reports to another address:
-#              -c me@example.com
-#          Appear to come from a different address - the '--' indicates
-#          arguments to be passed to Sendmail:
-#              -- -f me@example.com
-# Values:  [ STRING ]
-#
-mailargs = -f <sender>
-
-# Option:  tlp
-# Notes.:  Traffic light protocol defining the sharing of this information.
-#          http://www.trusted-introducer.org/ISTLPv11.pdf
-#          green is share to those involved in network security but it is not
-#          to be released to the public.
-tlp = green
-
-# ALL of the following parameters should be set so the report contains
-# meaningful information
-
-# Option: service
-# Notes.: This is the service type that was attacked. e.g. ssh, pop3
-service = unspecified
-
-# Option:  logpath
-# Notes:   Path to the log files which contain relevant lines for the abuser IP
-# Values:  Filename(s) space separated and can contain wildcards (these are
-#          greped for the IP so make sure these aren't too long
-logpath = /dev/null
-
-# Option:  sender
-# Notes.:  This is the sender that is included in the XARF report
-sender = fail2ban@`uname -n`
-
-# Option:  port
-# Notes.:  This is the port number that received the login-attack
-port = 0
-

config/fail2ban.conf

@@ -6,22 +6,20 @@
 #           file, but provide customizations in fail2ban.local file, e.g.:
 #
 # [Definition]
-# loglevel = DEBUG
+# loglevel = 4
 #
 
 [Definition]
 
 # Option: loglevel
 # Notes.: Set the log level output.
-#         CRITICAL
-#         ERROR
-#         WARNING
-#         NOTICE
-#         INFO
-#         DEBUG
-# Values: [ LEVEL ]  Default: ERROR
+#         1 = ERROR
+#         2 = WARN
+#         3 = INFO
+#         4 = DEBUG
+# Values: [ NUM ]  Default: 1
 #
-loglevel = INFO
+loglevel = 3
 
 # Option: logtarget
 # Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
@@ -34,12 +32,6 @@ loglevel = INFO
 #
 logtarget = /var/log/fail2ban.log
 
-# Option: syslogsocket
-# Notes: Set the syslog socket file. Only used when logtarget is SYSLOG
-#        auto uses platform.system() to determine predefined paths
-# Values: [ auto | FILE ]  Default: auto
-syslogsocket = auto
-
 # Option: socket
 # Notes.: Set the socket file. This is used to communicate with the daemon. Do
 #         not remove this file when Fail2ban runs. It will not be possible to
@@ -55,15 +47,3 @@ socket = /var/run/fail2ban/fail2ban.sock
 #
 pidfile = /var/run/fail2ban/fail2ban.pid
 
-# Options: dbfile
-# Notes.: Set the file for the fail2ban persistent data to be stored.
-#         A value of ":memory:" means database is only stored in memory 
-#         and data is lost when fail2ban is stopped.
-#         A value of "None" disables the database.
-# Values: [ None :memory: FILE ] Default: /var/lib/fail2ban/fail2ban.sqlite3
-dbfile = /var/lib/fail2ban/fail2ban.sqlite3
-
-# Options: dbpurgeage
-# Notes.: Sets age at which bans should be purged from the database
-# Values: [ SECONDS ] Default: 86400 (24hours)
-dbpurgeage = 86400

config/filter.d/apache-auth.conf

@@ -10,7 +10,7 @@ before = apache-common.conf
 [Definition]
 
 
-failregex = ^%(_apache_error_client)s (AH(01797|01630): )?client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$
+failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$
             ^%(_apache_error_client)s (AH01617: )?user .*? authentication failure for "\S*": Password Mismatch(, referer: \S+)?$
             ^%(_apache_error_client)s (AH01618: )?user .*? not found(: )?\S*(, referer: \S+)?\s*$
             ^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme: \S*(, referer: \S+)?\s*$

config/filter.d/apache-badbots.conf

@@ -8,9 +8,9 @@
 [Definition]
 
 badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider
-badbots = Atomic_Email_Hunter/4\.0|atSpider/1\.0|autoemailspider|bwh3_user_agent|China Local Browse 2\.6|ContactBot/0\.2|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailSpider|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Guestbook Auto Submitter|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 \+http\://letscrawl\.com/|Lincoln State Web Browser|LMQueueBot/0\.2|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|MVAClient|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/3\.0 \(compatible; scan4mail \(advanced version\) http\://www\.peterspages\.net/?scan4mail\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|NameOfAgent \(CMS Spider\)|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|ShablastBot 1\.0|snap\.com beta crawler v0|Snapbot/1\.0|Snapbot/1\.0 \(Snap Shots, \+http\://www\.snap\.com\)|sogou develop spider|Sogou Orion spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sogou spider|Sogou web spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|VadixBot|WebVulnCrawl\.unknown/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
+badbots = Atomic_Email_Hunter/4\.0|atSpider/1\.0|autoemailspider|bwh3_user_agent|China Local Browse 2\.6|ContactBot/0\.2|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailSpider|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Guestbook Auto Submitter|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LMQueueBot/0\.2|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|MVAClient|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/3\.0 \(compatible; scan4mail \(advanced version\) http\://www\.peterspages\.net/?scan4mail\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|NameOfAgent \(CMS Spider\)|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|ShablastBot 1\.0|snap\.com beta crawler v0|Snapbot/1\.0|Snapbot/1\.0 \(Snap Shots, +http\://www\.snap\.com\)|sogou develop spider|Sogou Orion spider/3\.0\(+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sogou spider|Sogou web spider/3\.0\(+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|VadixBot|WebVulnCrawl\.unknown/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
 
-failregex = ^<HOST> -.*"(GET|POST|HEAD).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
+failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
 
 ignoreregex =
 

config/filter.d/apache-botsearch.conf

@@ -1,40 +0,0 @@
-# Fail2Ban filter to match web requests for selected URLs that don't exist
-#
-# This filter is aimed at blocking specific URLs that don't exist. This
-# could be a set of URLs places in a Disallow: directive in robots.txt or
-# just some web services that don't exist caused bots are searching for
-# exploitable content. This filter is designed to have a low false postitive
-# rate due.
-#
-# An alternative to this is the apache-noscript filter which blocks all
-# types of scripts that don't exist.
-#
-#
-# This is normally a predefined list of exploitable or valuable web services
-# that are hidden or aren't actually installed.
-#
-
-[INCLUDES]
-
-# overwrite with apache-common.local if _apache_error_client is incorrect.
-# Load regexes for filtering from botsearch-common.conf
-before = apache-common.conf
-         botsearch-common.conf
-
-[Definition]
-
-failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): <webroot><block>(, referer: \S+)?\s*$
-            ^%(_apache_error_client)s script '<webroot><block>' not found or unable to stat(, referer: \S+)?\s*$
-
-ignoreregex = 
-
-
-[Init]
-
-# Webroot represents the webroot on which all other files are based
-webroot = /var/www/
-
-
-# DEV Notes:
-#
-# Author: Daniel Black

config/filter.d/apache-common.conf

@@ -8,7 +8,7 @@ after = apache-common.local
 
 [DEFAULT]
 
-_apache_error_client = \[\] \[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]
+_apache_error_client = \[[^]]*\] \[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]
 
 # Common prefix for [error] apache messages which also would include <HOST>
 # Depending on the version it could be

config/filter.d/apache-fakegooglebot.conf

@@ -1,14 +0,0 @@
-# Fail2Ban filter for fake Googlebot User Agents
-
-[Definition]
-
-failregex = ^<HOST> .*Googlebot.*$
-
-ignoreregex =
-
-
-# DEV Notes:
-#
-# Author: Lee Clemens
-# Thanks: Johannes B. Ullrich, Ph.D.
-# Reference: https://isc.sans.edu/forums/diary/When+Google+isnt+Google/15968/

config/filter.d/apache-noscript.conf

@@ -1,13 +1,5 @@
 # Fail2Ban filter to block web requests for scripts (on non scripted websites)
 #
-# This matches many types of scripts that don't exist. This could generate a
-# lot of false positive matches in cases like wikis and forums where users
-# no affiliated with the website can insert links to missing files/scripts into
-# pages and cause non-malicious browsers of the site to trigger against this
-# filter.
-#
-# If you'd like to match specific URLs that don't exist see the
-# apache-botsearch filter.
 #
 
 [INCLUDES]
@@ -27,6 +19,6 @@ ignoreregex =
 #
 # https://wiki.apache.org/httpd/ListOfErrors for apache error IDs
 #
-# Second regex, script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat\s*$ is in httpd-2.2
+# Second regex, script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat\s*$ is Before http-2.2
 #
 # Author: Cyril Jaquier

config/filter.d/apache-pass.conf

@@ -1,20 +0,0 @@
-# Fail2Ban Apache pass filter
-# This filter is for access.log, NOT for error.log
-#
-# The knocking request must have a referer.
-
-[INCLUDES]
-
-before = apache-common.conf
-
-[Definition]
-
-failregex = ^<HOST> - \w+ \[\] "GET <knocking_url> HTTP/1\.[01]" 200 \d+ ".*" "[^-].*"$
-
-ignoreregex =
-
-[Init]
-
-knocking_url = /knocking/
-
-# Author: Viktor Szépe

config/filter.d/apache-shellshock.conf

@@ -1,26 +0,0 @@
-# Fail2Ban filter to block web requests containing custom headers attempting to exploit the shellshock bug
-#
-#
-
-[INCLUDES]
-
-# overwrite with apache-common.local if _apache_error_client is incorrect.
-before = apache-common.conf
-
-[Definition]
-
-failregex = ^%(_apache_error_client)s (AH01215: )?/bin/(ba)?sh: warning: HTTP_.*?: ignoring function definition attempt(, referer: \S+)?\s*$
-            ^%(_apache_error_client)s (AH01215: )?/bin/(ba)?sh: error importing function definition for `HTTP_.*?'(, referer: \S+)?\s*$
-
-ignoreregex = 
-
-
-# DEV Notes:
-#
-# https://wiki.apache.org/httpd/ListOfErrors for apache error IDs
-#
-# example log lines: 
-# [Thu Sep 25 09:27:18.813902 2014] [cgi:error] [pid 16860] [client 89.207.132.76:59635] AH01215: /bin/bash: warning: HTTP_TEST: ignoring function definition attempt
-# [Thu Sep 25 09:29:56.141832 2014] [cgi:error] [pid 16864] [client 162.247.73.206:41273] AH01215: /bin/bash: error importing function definition for `HTTP_TEST'
-#
-# Author: Eugene Hopkinson (riot@riot.so)

config/filter.d/asterisk.conf

@@ -13,19 +13,17 @@ _daemon = asterisk
 
 __pid_re = (?:\[\d+\])
 
-iso8601 = \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+[+-]\d{4}
-
 # All Asterisk log messages begin like this:
 log_prefix= (?:NOTICE|SECURITY)%(__pid_re)s:?(?:\[C-[\da-f]*\])? \S+:\d*( in \w+:)?
 
 failregex = ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - (Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$
-            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Call from '[^']*' \(<HOST>:\d+\) to extension '[^']*' rejected because extension not found in context
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Call from '[^']*' \(<HOST>:\d+\) to extension '\d+' rejected because extension not found in context 'default'\.$
             ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Host <HOST> failed to authenticate as '[^']*'$
             ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)$
             ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
             ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Failed to authenticate (user|device) [^@]+@<HOST>\S*$
-            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s hacking attempt detected '<HOST>'$
-            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="([\d-]+|%(iso8601)s)",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="(\d*|<unknown>)",SessionID=".+",LocalAddress="IPV[46]/(UDP|TCP|WS)/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UDP|TCP|WS)/<HOST>/\d+"(,Challenge="[\w/]+")?(,ReceivedChallenge="\w+")?(,Response="\w+",ExpectedResponse="\w*")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s (?:handle_request_subscribe: )?Sending fake auth rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S*$
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d*",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"(,Challenge="\w+",ReceivedChallenge="\w+")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$
             ^(%(__prefix_line)s|\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])? )Ext\. s: "Rejecting unknown SIP connection from <HOST>"$
 
 ignoreregex =

config/filter.d/botsearch-common.conf

@@ -1,19 +0,0 @@
-# Generic configuration file for -botsearch filters
-
-[Init]
-
-# Block is the actual non-found directories to block
-block = \/?(<webmail>|<phpmyadmin>|<wordpress>|cgi-bin|mysqladmin)[^,]*
-
-# These are just convient definitions that assist the blocking of stuff that 
-# isn't installed
-webmail = roundcube|(ext)?mail|horde|(v-?)?webmail
-
-phpmyadmin = (typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin)
-
-wordpress = wp-(login|signup|admin)\.php
-
-# DEV Notes:
-# Taken from apache-botsearch filter
-# 
-# Author: Frantisek Sumsal

config/filter.d/common.conf

@@ -53,8 +53,4 @@ __bsd_syslog_verbose = (<[^.]+\.[^.]+>)
 # This can be optional (for instance if we match named native log files)
 __prefix_line = \s*%(__bsd_syslog_verbose)s?\s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s%(__daemon_extra_re)s?\s*
 
-# PAM authentication mechanism check for failures, e.g.: pam_unix, pam_sss,
-# pam_ldap
-__pam_auth = pam_unix
-
 # Author: Yaroslav Halchenko

config/filter.d/counter-strike.conf

@@ -1,17 +0,0 @@
-# Fail2Ban filter for failure attempts in Counter Strike-1.6
-#
-#
-
-[Definition]
-
-failregex = ^: Bad Rcon: "rcon \d+ "\S+"  sv_contact ".*?"" from "<HOST>:\d+"$
-
-ignoreregex =
-
-[Init]
-
-datepattern = ^L %%d/%%m/%%Y - %%H:%%M:%%S
-
-
-# Author: Daniel Black
-

config/filter.d/couriersmtp.conf

@@ -12,8 +12,7 @@ before = common.conf
 
 _daemon = courieresmtpd
 
-failregex = ^%(__prefix_line)serror,relay=<HOST>,.*: 550 User (<.*> )?unknown\.?$
-            ^%(__prefix_line)serror,relay=<HOST>,msg="535 Authentication failed\.",cmd:( AUTH \S+)?( [0-9a-zA-Z\+/=]+)?$
+failregex = ^%(__prefix_line)serror,relay=<HOST>,.*: 550 User unknown\.$
 
 ignoreregex = 
 

config/filter.d/cyrus-imap.conf

@@ -11,9 +11,9 @@ before = common.conf
 
 [Definition]
 
-_daemon = (?:cyrus/)?(?:imap(d|s)?|pop3(d|s)?)
+_daemon = (?:cyrus/)?(?:imapd?|pop3d?)
 
-failregex = ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] \S+ .*?\[?SASL\(-13\): (authentication failure|user not found): .*\]?$
+failregex = ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] \S+ .*?\[?SASL\(-13\): authentication failure: .*\]?$
 
 ignoreregex = 
 

config/filter.d/directadmin.conf

@@ -1,23 +0,0 @@
-# Fail2Ban configuration file for Directadmin
-#
-#
-#
-
-[INCLUDES]
-
-before = common.conf
-
-[Definition]
-
-failregex = ^: \'<HOST>\' \d{1,3} failed login attempt(s)?. \s*
-
-ignoreregex = 
-
-[Init]
-datepattern = ^%%Y:%%m:%%d-%%H:%%M:%%S
-
-#
-# Requires Directadmin v1.45.3 or higher. http://www.directadmin.com/features.php?id=1590
-#
-# Author: Cyril Roos
-

config/filter.d/dovecot.conf

@@ -9,24 +9,17 @@ before = common.conf
 
 _daemon = (auth|dovecot(-auth)?|auth-worker)
 
-failregex = ^%(__prefix_line)s(%(__pam_auth)s(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
+failregex = ^%(__prefix_line)s(pam_unix(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
             ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>(, lip=(\d{1,3}\.){3}\d{1,3})?(, TLS( handshaking(: SSL_accept\(\) failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s*$
-            ^%(__prefix_line)s(Info|dovecot: auth\(default\)|auth-worker\(\d+\)): pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$
-            ^%(__prefix_line)s(auth|auth-worker\(\d+\)): (pam|passwd-file)\(\S+,<HOST>\): unknown user\s*$
-            ^%(__prefix_line)s(auth|auth-worker\(\d+\)): Info: ldap\(\S*,<HOST>,\S*\): invalid credentials\s*$
+            ^%(__prefix_line)s(Info|dovecot: auth\(default\)): pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$
 
 ignoreregex = 
 
-[Init]
-
-journalmatch = _SYSTEMD_UNIT=dovecot.service
-
 # DEV Notes:
 # * the first regex is essentially a copy of pam-generic.conf
-# * Probably doesn't do dovecot sql/ldap backends properly (resolved in edit 21/03/2016)
+# * Probably doesn't do dovecot sql/ldap backends properly
 # * Removed the 'no auth attempts' log lines from the matches because produces
-#    lots of false positives on misconfigured MTAs making regexp unusable
+#    lots of false positives on misconfigured MTAs making regexp unuseable
 #
 # Author: Martin Waschbuesch
 #         Daniel Black (rewrote with begin and end anchors)
-#         Martin O'Neal (added LDAP authentication failure regex)