gitignore

This allows me to build in a VM on a Mac.

.coveragerc

@@ -1,11 +1,4 @@
 
 [run]
 branch = True
-source =
-    config
-    fail2ban
-
-[report]
-exclude_lines =
-    pragma: no cover
-    pragma: systemd no cover
+omit = /usr*

.github/ISSUE_TEMPLATE.md

@@ -1,49 +0,0 @@
-_We will be very grateful, if your problem was described as completely as possible,
-enclosing excerpts from logs (if possible within DEBUG mode, if no errors evident
-within INFO mode), and configuration in particular of effected relevant settings
-(e.g., with ` fail2ban-client -d | grep 'affected-jail-name' ` for a particular
-jail troubleshooting).
-Thank you in advance for the details, because such issues like "It does not work" 
-alone could not help to resolve anything!
-Thanks! (remove this paragraph and other comments upon reading)_
-
-### Environment:
-
-_Fill out and check (`[x]`) the boxes which apply. If your Fail2Ban version is outdated, 
-and you can't verify that the issue persists in the recent release, better seek support 
-from the distribution you obtained Fail2Ban from_
-
-- Fail2Ban version (including any possible distribution suffixes):
-- OS, including release name/version: 
-- [ ] Fail2Ban installed via OS/distribution mechanisms
-- [ ] You have not applied any additional foreign patches to the codebase
-- [ ] Some customizations were done to the configuration (provide details below is so)
-
-### The issue:
-
-_Summary here_
-
-#### Steps to reproduce
-
-#### Expected behavior
-
-#### Observed behavior
-
-#### Any additional information
-
-### Configuration, dump and another helpful excerpts
-
-#### Any customizations done to /etc/fail2ban/ configuration
-```
-```
-
-#### Relevant parts of /var/log/fail2ban.log file:
-_preferably obtained while running fail2ban with `loglevel = 4`_
-
-```
-```
-
-#### Relevant lines from monitored log files in question:
-
-```
-```

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,9 +0,0 @@
-Before submitting your PR, please review the following checklist:
-
-- [ ] **CONSIDER adding a unit test** if your PR resolves an issue
-- [ ] **LIST ISSUES** this PR resolves
-- [ ] **MAKE SURE** this PR doesn't break existing tests 
-- [ ] **KEEP PR small** so it could be easily reviewed.
-- [ ] **AVOID** making unnecessary stylistic changes in unrelated code
-- [ ] **ACCOMPANY** each new `failregex` for filter `X` with sample log lines 
-      within `fail2ban/tests/files/logs/X` file

.gitignore

@@ -1,3 +1,4 @@
+.pc/*
 *~
 build
 dist
@@ -9,4 +10,3 @@ htmlcov
 *.bak
 __pycache__
 .vagrant/
-.idea/

.mailmap

@@ -1,5 +0,0 @@
-Lee Clemens <java@leeclemens.net>
-Serg G. Brester <info@sebres.de>
-Serg G. Brester <serg.brester@sebres.de>
-Serg G. Brester <sergey.brester@W7-DEHBG0189.wincor-nixdorf.com>
-Viktor Szépe <viktor@szepe.net>

.pydevproject

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<?eclipse-pydev version="1.0"?>
+
+<pydev_project>
+<pydev_property name="org.python.pydev.PYTHON_PROJECT_VERSION">python 2.3</pydev_property>
+<pydev_pathproperty name="org.python.pydev.PROJECT_SOURCE_PATH">
+<path>/fail2ban-0.8/client</path>
+<path>/fail2ban-0.8/server</path>
+<path>/fail2ban-0.8/testcases</path>
+<path>/fail2ban-0.8</path>
+</pydev_pathproperty>
+</pydev_project>

.travis.yml

@@ -1,58 +1,22 @@
 # vim ft=yaml
 # travis-ci.org definition for Fail2Ban build
-# https://travis-ci.org/fail2ban/fail2ban/
 language: python
 python:
-  - 2.6
-  - 2.7
-  - pypy
-  # disabled until coverage module fixes up compatibility issue
-  # - 3.2
-  - 3.3
-  - 3.4
-  - pypy3
+  - "2.6"
+  - "2.7"
+  - "3.2"
+  - "3.3"
+  - "3.4"
+  - "pypy"
 before_install:
-  - if [[ $TRAVIS_PYTHON_VERSION == 2* || $TRAVIS_PYTHON_VERSION == 'pypy' ]]; then export F2B_PY_2=true && echo "Set F2B_PY_2"; fi
-  - if [[ $TRAVIS_PYTHON_VERSION == 3* || $TRAVIS_PYTHON_VERSION == 'pypy3' ]]; then export F2B_PY_3=true && echo "Set F2B_PY_3"; fi
-  - travis_retry sudo apt-get update -qq
-  # Set this so sudo executes the correct python binary
-  #   Anything not using sudo will already have the correct environment
-  - export VENV_BIN="$VIRTUAL_ENV/bin" && echo "VENV_BIN set to $VENV_BIN"
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get update -qq; fi
 install:
-  # Install Python packages / dependencies
-  #   coverage
-  - travis_retry pip install coverage
-  #   coveralls
-  - travis_retry pip install coveralls codecov
-  #   dnspython or dnspython3
-  - if [[ "$F2B_PY_2" ]]; then travis_retry pip install dnspython; fi
-  - if [[ "$F2B_PY_3" ]]; then travis_retry pip install dnspython3; fi
-  #   gamin - install manually (not in PyPI) - travis-ci system Python is 2.7
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then travis_retry sudo apt-get install -qq python-gamin && cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/; fi
-  #   pyinotify
-  - travis_retry pip install pyinotify
-before_script:
-  # Manually execute 2to3 for now
-  - if [[ "$F2B_PY_3" ]]; then ./fail2ban-2to3; fi
+  - pip install pyinotify
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get install -qq python-gamin; cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then cd ..; pip install -q coveralls; cd -; fi
 script:
-  # Keep the legacy setup.py test approach of checking coverage for python2
-  - if [[ "$F2B_PY_2" ]]; then coverage run setup.py test; fi
-  # Coverage doesn't pick up setup.py test with python3, so run it directly
-  - if [[ "$F2B_PY_3" ]]; then coverage run bin/fail2ban-testcases; fi
-  # Use $VENV_BIN (not python) or else sudo will always run the system's python (2.7)
-  - sudo $VENV_BIN/pip install .
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coverage run --rcfile=.travis_coveragerc setup.py test; else python setup.py test; fi
 after_success:
-  - coveralls
-  - codecov
-matrix:
-  fast_finish: true
-# Might be worth looking into
-#notifications:
-#  email: true
-#  irc:
-#    channels: "irc.freenode.org#fail2ban"
-#    template:
-#      - "%{repository}@%{branch}: %{message} (%{build_url})"
-#    on_success: change
-#    on_failure: change
-#    skip_join: true
+# Coverage config file must be .coveragerc for coveralls
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then cp -v .travis_coveragerc .coveragerc; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coveralls; fi

.travis_coveragerc

@@ -0,0 +1,7 @@
+
+[run]
+branch = True
+omit =
+    /usr/*
+    /home/travis/virtualenv/*
+    fail2ban/server/filtersystemd.py

3rdparty/logwatch/fail2ban

@@ -0,0 +1,181 @@
+#!/usr/bin/perl
+##########################################################################
+# $Id: fail2ban 150 2013-06-18 22:19:38Z mtremaine $
+##########################################################################
+# $Log: fail2ban,v $
+# Revision 1.5  2008/08/18 16:07:46  mike
+# Patches from Paul Gear <paul at libertysys.com> -mgt
+#
+# Revision 1.4  2008/06/30 23:07:51  kirk
+# fixed copyright holders for files where I know who they should be
+#
+# Revision 1.3  2008/03/24 23:31:26  kirk
+# added copyright/license notice to each script
+#
+# Revision 1.2  2006/12/15 04:53:59  bjorn
+# Additional filtering, by Willi Mann.
+#
+# Revision 1.1  2006/05/30 19:04:26  bjorn
+# Added fail2ban service, written by Yaroslav Halchenko.
+#
+# Written by Yaroslav Halchenko <debian@onerussian.com> for fail2ban
+#
+##########################################################################
+
+########################################################
+## Copyright (c) 2008  Yaroslav Halchenko
+## Covered under the included MIT/X-Consortium License:
+##    http://www.opensource.org/licenses/mit-license.php
+## All modifications and contributions by other persons to
+## this script are assumed to have been donated to the
+## Logwatch project and thus assume the above copyright
+## and licensing terms.  If you want to make contributions
+## under your own copyright or a different license this
+## must be explicitly stated in the contribution an the
+## Logwatch project reserves the right to not accept such
+## contributions.  If you have made significant
+## contributions to this script and want to claim
+## copyright please contact logwatch-devel@lists.sourceforge.net.
+#########################################################
+
+use strict;
+use Logwatch ':all';
+
+my $Debug = $ENV{'LOGWATCH_DEBUG'} || 0;
+my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
+my $IgnoreHost = $ENV{'sshd_ignore_host'} || "";
+my $DebugCounter = 0;
+my $ReInitializations = 0;
+my @IptablesErrors = ();
+my @ActionErrors = ();
+my $NotValidIP = 0;		# reported invalid IPs number
+my @OtherList = ();
+
+my %ServicesBans = ();
+
+if ( $Debug >= 5 ) {
+	print STDERR "\n\nDEBUG: Inside Fail2Ban Filter \n\n";
+	$DebugCounter = 1;
+}
+
+while (defined(my $ThisLine = <STDIN>)) {
+    if ( $Debug >= 5 ) {
+	print STDERR "DEBUG($DebugCounter): $ThisLine";
+	$DebugCounter++;
+    }
+    chomp($ThisLine);
+    if ( ($ThisLine =~ /..,... DEBUG: /) or
+	 ($ThisLine =~ /..,... \S*\s*: DEBUG /) or # syntax of 0.7.? fail2ban
+	 ($ThisLine =~ /..,... INFO: (Fail2Ban v.* is running|Exiting|Enabled sections:)/) or
+	 ($ThisLine =~ /INFO\s+Log rotation detected for/) or
+	 ($ThisLine =~ /INFO\s+Jail.+(?:stopped|started|uses poller)/) or
+	 ($ThisLine =~ /INFO\s+Changed logging target to/) or
+	 ($ThisLine =~ /INFO\s+Creating new jail/) or
+	 ($ThisLine =~ /..,... \S+\s*: INFO\s+(Set |Socket|Exiting|Gamin|Created|Added|Using)/) or # syntax of 0.7.? fail2ban
+	 ($ThisLine =~ /..,... WARNING: Verbose level is /) or
+	 ($ThisLine =~ /..,... WARNING: Restoring firewall rules/)
+       )
+    {
+	if ( $Debug >= 6 ) {
+	    print STDERR "DEBUG($DebugCounter): line ignored\n";
+	}
+    } elsif ( my ($Service,$Action,$Host) = ($ThisLine =~ m/WARNING:?\s\[?(.*?)[]:]?\s(Ban|Unban)[^\.]* (\S+)/)) {
+	if ( $Debug >= 6 ) {
+	    print STDERR "DEBUG($DebugCounter): Found $Action for $Service from $Host\n";
+	}
+	$ServicesBans{$Service}{$Host}{$Action}++;
+	$ServicesBans{$Service}{"(all)"}{$Action}++;
+    } elsif ( my ($Service,$Host,$NumFailures) = ($ThisLine =~ m/INFO: (\S+): (.+) has (\d+) login failure\(s\). Banned./)) {
+	if ($Debug >= 4) {
+	    print STDERR "DEBUG: Found host $Host trying to access $Service - failed $NumFailures times\n";
+	}
+	push @{$ServicesBans{$Service}{$Host}{'Failures'}}, $NumFailures;
+    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ ERROR:\s(.*):\s(\S+)\salready in ban list/)) {
+   	 $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
+    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/WARNING\s*\[(.*)\]\s*(\S+)\s*already banned/)) {
+       $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
+    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ WARNING:\s(.*):\sReBan (\S+)/)) {
+	    $ServicesBans{$Service}{$Host}{'ReBan'}++;
+    } elsif ($ThisLine =~ / ERROR:?\s*(Execution of command )?\'?iptables/) {
+	    push @IptablesErrors, "$ThisLine\n";
+    } elsif ($ThisLine =~ /ERROR.*returned \d+$/) {
+       push @ActionErrors, "$ThisLine\n";
+    } elsif (($ThisLine =~ /..,... WARNING: \#\S+ reinitialization of firewalls/) or
+	    ($ThisLine =~ / ERROR\s*Invariant check failed. Trying to restore a sane environment/)) {
+	    $ReInitializations++;
+    } elsif ($ThisLine =~ /..,... WARNING:  is not a valid IP address/) {
+	# just ignore - this will be fixed within fail2ban and is harmless warning
+    }
+    else
+    {
+	# Report any unmatched entries...
+	push @OtherList, "$ThisLine\n";
+    }
+}
+
+###########################################################
+
+
+if (keys %ServicesBans) {
+    printf("\nBanned services with Fail2Ban:				 Bans:Unbans\n");
+    foreach my $service (sort {$a cmp $b} keys %ServicesBans) {
+	printf("   %-55s [%3d:%-3d]\n", "$service:",
+	       $ServicesBans{$service}{'(all)'}{'Ban'},
+	       $ServicesBans{$service}{'(all)'}{'Unban'});
+	delete $ServicesBans{$service}{'(all)'};
+	my $totalSort = TotalCountOrder(%{$ServicesBans{$service}}, \&SortIP);
+	if ($Detail >= 5) {
+	    foreach my $ip (sort $totalSort keys %{$ServicesBans{$service}}) {
+		   my $name = LookupIP($ip);
+		   printf("      %-53s %3d:%-3d\n",
+		       $name,
+		       $ServicesBans{$service}{$ip}{'Ban'},
+		       $ServicesBans{$service}{$ip}{'Unban'});
+		   if (($Detail >= 10) and ($ServicesBans{$service}{$ip}{'Failures'}>0)) {
+		      print "	   Failed ";
+		      foreach my $fails (@{$ServicesBans{$service}{$ip}{'Failures'}}) {
+			      print " $fails";
+		      }
+		    print " times";
+		    printf("\n	   %d Duplicate Ban attempts", $ServicesBans{$service}{$ip}{'AlreadyInTheList'}) ;
+		    printf("\n	   %d ReBans due to rules reinitilizations", $ServicesBans{$service}{$ip}{'ReBan'}) ;
+		    print "\n";
+		   }
+	    }
+	   }
+    }
+}
+
+
+if ($Detail>0) {
+    if ($#IptablesErrors > 0) {
+	   printf("\n%d faulty iptables invocation(s)", $#IptablesErrors);
+	   if ($Detail > 5) {
+	    print ":\n";
+	    print @IptablesErrors ;
+	   }
+    }
+    if ($#ActionErrors > 0) {
+       printf("\n%d error(s) returned from actions", $#ActionErrors);
+       if ($Detail > 5) {
+           print ":\n";
+           print @ActionErrors ;
+       }
+    }
+    if ($ReInitializations > 0) {
+	   printf("\n%d fail2ban rules reinitialization(s)", $ReInitializations);
+    }
+    if ($#OtherList >= 0) {
+	   print "\n**Unmatched Entries**\n";
+	   print @OtherList;
+    }
+}
+
+exit(0);
+
+# vi: shiftwidth=3 tabstop=3 syntax=perl et
+# Local Variables:
+# mode: perl
+# perl-indent-level: 3
+# indent-tabs-mode: nil
+# End:

CONTRIBUTING.md

@@ -15,13 +15,3 @@ join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-us
 
 ### You would like to contribute (new filters/actions/code/documentation)?
 send a [pull request](https://github.com/fail2ban/fail2ban/pulls)
-
-Pull requests guidelines
-========================
-
-- If there is an issue on github to be closed by the pull request, include
-  ```Closes #ISSUE``` (where ISSUE is issue's number)
-  
-- Add a brief summary of the change to the ChangeLog file into a corresponding
-  section out of Fixes, New Features or Enhancements (improvements to existing
-  features)

ChangeLog

@@ -3,283 +3,11 @@
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
-Fail2Ban: Changelog
-===================
+================================================================================
+Fail2Ban (version 0.9.0.dev)                                          2014/xx/xx
+================================================================================
 
-ver. 0.9.5 (2016/XX/XXX) - wanna-be-released
------------
-
-- Fixes:
-   * filter.d/monit.conf
-     - extended failregex with new monit "access denied" version (gh-1355);
-     - failregex of previous monit version merged as single expression.
-   * filter.d/postfix.conf, filter.d/postfix-sasl.conf
-     - extended failregex daemon part, matching also `postfix/smtps/smtpd` now (gh-1391)
-
-- New Features:
-   * New Actions:
-     - action.d/firewallcmd-rich-rules and action.d/firewallcmd-rich-logging (gh-1367)
-- Enhancements:
-   * journald journalmatch for pure-ftpd (gh-1362)
-   * Add additional regex filter for dovecot ldap authentication failures (gh-1370)
-   * added additional regex filters for exim (gh-1371)
-
-
-ver. 0.9.4 (2016/03/08) - for-you-ladies
------------
-
-- Fixes:
-   * roundcube-auth jail typo for logpath
-   * Fix dnsToIp resolver for fqdn with large list of IPs (gh-1164)
-   * filter.d/apache-badbots.conf
-     - Updated useragent string regex adding escape for `+`
-   * filter.d/mysqld-auth.conf
-     - Updated "Access denied ..." regex for MySQL 5.6 and later (gh-1211, gh-1332)
-   * filter.d/sshd.conf
-     - Updated "Auth fail" regex for OpenSSH 5.9 and later
-   * Treat failed and killed execution of commands identically (only
-     different log messages), which addresses different behavior on different
-     exit codes of dash and bash (gh-1155)
-   * Fix jail.conf.5 man's section (gh-1226)
-   * Fixed default banaction for allports jails like pam-generic, recidive, etc
-     with new default variable `banaction_allports` (gh-1216)
-   * Fixed `fail2ban-regex` stops working on invalid (wrong encoded) character
-     for python version < 3.x (gh-1248)
-   * Use postfix_log logpath for postfix-rbl jail
-   * filters.d/postfix.conf - add 'Sender address rejected: Domain not found' failregex
-   * use `fail2ban_agent` as user-agent in actions badips, blocklist_de, etc (gh-1271)
-   * Fix ignoring the sender option by action_mw, action_mwl and action_c_mwl
-   * Changed filter.d/asterisk regex for "Call from ..." (few vulnerable now)
-   * Removed compression and rotation count from logrotate (inherit them from
-     the global logrotate config)
-
-- New Features:
-   * New interpolation feature for definition config readers - `<known/parameter>`
-     (means last known init definition of filters or actions with name `parameter`).
-     This interpolation makes possible to extend a parameters of stock filter or 
-     action directly in jail inside jail.local file, without creating a separately
-     filter.d/*.local file.
-     As extension to interpolation `%(known/parameter)s`, that does not works for
-     filter and action init parameters
-   * New actions:
-     - nftables-multiport and nftables-allports - filtering using nftables
-       framework. Note: it requires a pre-existing chain for the filtering rule.
-   * New filters:
-     - openhab - domotic software authentication failure with the
-       rest api and web interface (gh-1223)
-     - nginx-limit-req - ban hosts, that were failed through nginx by limit
-       request processing rate (ngx_http_limit_req_module)
-     - murmur - ban hosts that repeatedly attempt to connect to
-       murmur/mumble-server with an invalid server password or certificate.
-     - haproxy-http-auth - filter to match failed HTTP Authentications against a
-       HAProxy server
-   * New jails:
-     - murmur - bans TCP and UDP from the bad host on the default murmur port.
-   * sshd filter got new failregex to match "maximum authentication
-     attempts exceeded" (introduced in openssh 6.8)
-   * Added filter for Mac OS screen sharing (VNC) daemon
-   * IPv6 support:
-     - IP addresses are now handled as objects rather than strings capable for 
-       handling both address types IPv4 and IPv6
-     - iptables related actions have been amended to support IPv6 specific actions
-       additionally
-     - hostsdeny and route actions have been tested to be aware of v4 and v6 already
-     - pf action for *BSD systems has been improved and supports now also v4 and v6
-     - Name resolution is now working for either address type
-
-- Enhancements:
-   * Do not rotate empty log files
-   * Added new date pattern with year after day (e.g. Sun Jan 23 2005 21:59:59)
-     http://bugs.debian.org/798923
-   * Added openSUSE path configuration (Thanks Johannes Weberhofer)
-   * Allow to split ignoreip entries by ',' as well as by ' ' (gh-1197)
-   * Added a timeout (3 sec) to urlopen within badips.py action
-     (Thanks M. Maraun)
-   * Added check against atacker's Googlebot PTR fake records
-     (Thanks Pablo Rodriguez Fernandez)
-   * Enhance filter against atacker's Googlebot PTR fake records
-     (gh-1226)
-   * Nginx log paths extended (prefixed with "*" wildcard) (gh-1237)
-   * Added filter for openhab domotic software authentication failure with the
-     rest api and web interface (gh-1223)
-   * Add *_backend options for services to allow distros to set the default
-     backend per service, set default to systemd for Fedora as appropriate
-   * Performance improvements while monitoring large number of files (gh-1265).
-     Use associative array (dict) for monitored log files to speed up lookup 
-     operations. Thanks @kshetragia
-   * Specified that fail2ban is PartOf iptables.service firewalld.service in
-     .service file -- would reload fail2ban if those services are restarted
-   * Provides new default `fail2ban_version` and interpolation variable
-     `fail2ban_agent` in jail.conf
-   * Enhance filter 'postfix' to ban incoming SMTP client with no fqdn hostname,
-     and to support multiple instances of postfix having varying suffix (gh-1331)
-     (Thanks Tom Hendrikx)
-   * files/gentoo-initd to use start-stop-daemon to robustify restarting the service
-
-
-ver. 0.9.3 (2015/08/01) - lets-all-stay-friends
-----------
-
-- IMPORTANT incompatible changes:
-   * filter.d/roundcube-auth.conf
-     - Changed logpath to 'errors' log (was 'userlogins')
-   * action.d/iptables-common.conf
-     - All calls to iptables command now use -w switch introduced in
-       iptables 1.4.20 (some distribution could have patched their
-       earlier base version as well) to provide this locking mechanism
-       useful under heavy load to avoid contesting on iptables calls.
-       If you need to disable, define 'action.d/iptables-common.local'
-       with empty value for 'lockingopt' in `[Init]` section.
-   * mail-whois-lines, sendmail-geoip-lines and sendmail-whois-lines
-     actions now include by default only the first 1000 log lines in
-     the emails.  Adjust <grepopts> to augment the behavior.
-
-- Fixes:
-   * reload in interactive mode appends all the jails twice (gh-825)
-   * reload server/jail failed if database used (but was not changed) and
-     some jail active (gh-1072)
-   * filter.d/dovecot.conf - also match unknown user in passwd-file.
-     Thanks Anton Shestakov
-   * Fix fail2ban-regex not parsing journalmatch correctly from filter config
-   * filter.d/asterisk.conf - fix security log support for Asterisk 12+
-   * filter.d/roundcube-auth.conf
-     - Updated regex to work with 'errors' log (1.0.5 and 1.1.1)
-     - Added regex to work with 'userlogins' log
-   * action.d/sendmail*.conf - use LC_ALL (superseeding LC_TIME) to override
-     locale on systems with customized LC_ALL
-   * performance fix: minimizes connection overhead, close socket only at
-     communication end (gh-1099)
-   * unbanip always deletes ip from database (independent of bantime, also if
-     currently not banned or persistent)
-   * guarantee order of dbfile to be before dbpurgeage (gh-1048)
-   * always set 'dbfile' before other database options (gh-1050)
-   * kill the entire process group of the child process upon timeout (gh-1129).
-     Otherwise could lead to resource exhaustion due to hanging whois
-     processes.
-   * resolve /var/run/fail2ban path in setup.py to help installation
-     on platforms with /var/run -> /run symlink (gh-1142)
-
-- New Features:
-   * RETURN iptables target is now a variable: <returntype>
-   * New type of operation: pass2allow, use fail2ban for "knocking",
-     opening a closed port by swapping blocktype and returntype
-   * New filters:
-     - froxlor-auth - Thanks Joern Muehlencord
-     - apache-pass - filter Apache access log for successful authentication
-   * New actions:
-     - shorewall-ipset-proto6 - using proto feature of the Shorewall. Still requires
-	   manual pre-configuration of the shorewall. See the action file for detail.
-   * New jails:
-     - pass2allow-ftp - allows FTP traffic after successful HTTP authentication
-
-- Enhancements:
-   * action.d/cloudflare.conf - improved documentation on how to allow
-     multiple CF accounts, and jail.conf got new compound action
-     definition action_cf_mwl to submit cloudflare report.
-   * Check access to socket for more detailed logging on error (gh-595)
-   * fail2ban-testcases man page
-   * filter.d/apache-badbots.conf, filter.d/nginx-botsearch.conf - add
-     HEAD method verb
-   * Revamp of Travis and coverage automated testing
-   * Added a space between IP address and the following colon
-     in notification emails for easier text selection
-   * Character detection heuristics for whois output via optional setting
-     in mail-whois*.conf. Thanks Thomas Mayer.
-     Not enabled by default, if _whois_command is set to be
-     %(_whois_convert_charset)s (e.g. in action.d/mail-whois-common.local),
-     it
-     - detects character set of whois output (which is undefined by
-       RFC 3912) via heuristics of the file command
-     - converts whois data to UTF-8 character set with iconv
-     - sends the whois output in UTF-8 character set to mail program
-     - avoids that heirloom mailx creates binary attachment for input with
-       unknown character set
-
-
-ver. 0.9.2 (2015/04/29) - better-quick-now-than-later
-----------
-
-- Fixes:
-   * Fix ufw action commands
-   * infinite busy loop on _escapedTags match in substituteRecursiveTags gh-907.
-     Thanks TonyThompson
-   * port[s] typo in jail.conf/nginx-http-auth gh-913. Thanks Frederik Wagner
-     (fnerdwq)
-   * $ typo in jail.conf. Thanks Skibbi. Debian bug #767255
-   * grep'ing for IP in *mail-whois-lines.conf should now match also
-     at the beginning and EOL.  Thanks Dean Lee
-   * jail.conf
-     - php-url-fopen: separate logpath entries by newline
-   * failregex declared direct in jail was joined to single line (specifying of
-     multiple expressions was not possible).
-   * filters.d/exim.conf - cover different settings of exim logs
-     details. Thanks bes.internal
-   * filter.d/postfix-sasl.conf - failregex is now case insensitive
-   * filters.d/postfix.conf - add 'Client host rejected error message' failregex
-   * fail2ban/__init__.py - add strptime thread safety hack-around
-   * recidive uses iptables-allports banaction by default now.
-     Avoids problems with iptables versions not understanding 'all' for
-     protocols and ports
-   * filter.d/dovecot.conf
-     - match pam_authenticate line from EL7
-     - match unknown user line from EL7
-   * Use use_poll=True for Python 2.7 and >=3.4 to overcome "Bad file
-     descriptor" msgs issue (gh-161)
-   * filter.d/postfix-sasl.conf - tweak failregex and add ignoreregex to ignore
-     system authentication issues
-   * fail2ban-regex reads filter file(s) completely, incl. '.local' file etc.
-     (gh-954)
-   * firewallcmd-* actions: split output into separate lines for grepping (gh-908)
-   * Guard unicode encode/decode issues while storing records in the database.
-     Fixes "binding parameter error (unsupported type)" (gh-973), thanks to kot
-     for reporting
-   * filter.d/sshd added regex for matching openSUSE ssh authentication failure
-   * filter.d/asterisk.conf:
-     - Dropped "Sending fake auth rejection" failregex since it incorrectly
-	   targets the asterisk server itself
-     - match "hacking attempt detected" logs
-
-- New Features:
-   - New filters:
-     - postfix-rbl  Thanks Lee Clemens
-     - apache-fakegooglebot.conf  Thanks Lee Clemens
-     - nginx-botsearch  Thanks Frantisek Sumsal
-     - drupal-auth  Thanks Lee Clemens
-   - New recursive embedded substitution feature added:
-     - `<<PREF>HOST>` becomes `<IPV4HOST>` for PREF=`IPV4`;
-     - `<<PREF>HOST>` becomes `1.2.3.4` for PREF=`IPV4` and IPV4HOST=`1.2.3.4`;
-   - New interpolation feature for config readers - `%(known/parameter)s`.
-     (means last known option with name `parameter`). This interpolation makes
-     possible to extend a stock filter or jail regexp in .local file
-     (opposite to simply set failregex/ignoreregex that overwrites it),
-     see gh-867.
-   - Monit config for fail2ban in files/monit/
-   - New actions:
-     - action.d/firewallcmd-multiport and action.d/firewallcmd-allports Thanks Donald Yandt
-     - action.d/sendmail-geoip-lines.conf
-     - action.d/nsupdate to update DNSBL. Thanks Andrew St. Jean
-   - New status argument for fail2ban-client -- flavor:
-     fail2ban-client status <jail> [flavor]
-     - empty or "basic" works as-is
-     - "cymru" additionally prints (ASN, Country RIR) per banned IP
-       (requires dnspython or dnspython3)
-   - Flush log at USR1 signal
-
-- Enhancements:
-   * Enable multiport for firewallcmd-new action.  Closes gh-834
-   * files/debian-initd migrated from the debian branch and should be
-     suitable for manual installations now (thanks Juan Karlo de Guzman)
-   * Define empty ignoreregex in filters which didn't have it to avoid
-     warnings (gh-934)
-   * action.d/{sendmail-*,xarf-login-attack}.conf - report local
-     timezone not UTC time/zone. Closes gh-911
-   * Conditionally log Ignore IP with reason (dns, ip, command). Closes gh-916
-   * Absorbed DNSUtils.cidr into addr2bin in filter.py, added unittests
-   * Added syslogsocket configuration to fail2ban.conf
-   * Note in the jail.conf for the recidive jail to increase dbpurgeage (gh-964)
-
-
-ver. 0.9.1 (2014/10/29) - better, faster, stronger
+ver. 0.9.1 (2014/xx/xx) - better, faster, stronger
 ----------
 
 - Refactoring (IMPORTANT -- Please review your setup and configuration):
@@ -288,8 +16,6 @@ ver. 0.9.1 (2014/10/29) - better, faster, stronger
      provides defaults for the chain, port, protocol and name tags
 
 - Fixes:
-   * start of file2ban aborted (on slow hosts, systemd considers the server has
-     been timed out and kills him), see gh-824
    * UTF-8 fixes in pure-ftp thanks to Johannes Weberhofer. Closes gh-806.
    * systemd backend error on bad utf-8 in python3
    * badips.py action error when logging HTTP error raised with badips request
@@ -322,26 +48,18 @@ ver. 0.9.1 (2014/10/29) - better, faster, stronger
    * cyrus-imap -- also catch also failed logins via secured (imaps/pop3s).
      Regression was introduced while strengthening failregex in 0.8.11 (bd175f)
      Debian bug #755173
-   * postfix-sasl - added journalmatch.  Thanks Luc Maisonobe
-   * postfix* - match with a new daemon string (postfix/submission/smtpd).
-     Closes gh-804 .  Thanks Paul Traina
-   * apache - added filter for AH01630 client denied by server configuration.
+   * postfix-sasl -- added journalmatch.  Thanks Luc Maisonobe
 
 - New features:
    - New filters:
      - monit  Thanks Jason H Martin
      - directadmin  Thanks niorg
-     - apache-shellshock  Thanks Eugene Hopkinson (SlowRiot)
    - New actions:
      - symbiosis-blacklist-allports  for Bytemark symbiosis firewall
    - fail2ban-client can fetch the running server version
    - Added Cloudflare API action
 
 - Enhancements
-   * Start performance of fail2ban-client (and tests) increased, start time
-     and cpu usage rapidly reduced. Introduced a shared storage logic, to
-     bypass reading lots of config files (see gh-824).
-     Thanks to Joost Molenaar for good catch (reported gh-820).
    * Fail2ban-regex - add print-all-matched option. Closes gh-652
    * Suppress fail2ban-client warnings for non-critical config options
    * Match non "Bye Bye" disconnect messages for sshd locked account regex
@@ -353,7 +71,6 @@ ver. 0.9.1 (2014/10/29) - better, faster, stronger
      not affect SYSLOG output
    * Log unhandled exceptions
    * cyrus-imap: catch "user not found" attempts
-   * Add support for Portsentry
 
 ver. 0.9.0 (2014/03/14) - beta
 ----------

DEVELOP

@@ -56,12 +56,9 @@ following (note: on Debian-based systems, the script is called
 `python-coverage`)::
 
   coverage run bin/fail2ban-testcases
-  coverage report
-
-Optionally:
   coverage html
 
-And then browse htmlcov/index.html and see how much coverage your test cases
+Then look at htmlcov/index.html and see how much coverage your test cases
 exert over the code base. Full coverage is a good thing however it may not be
 complete. Try to ensure tests cover as many independent paths through the
 code.
@@ -84,18 +81,6 @@ some quick commands::
   status test
 
 
-Testing with vagrant
---------------------
-
-Testing can now be done inside a vagrant VM.  Vagrantfile provided in
-source code repository established two VMs:
-
-- VM "secure" which can be used for testing fail2ban code.
-- VM "attacker" which can be used to perform attack against our "secure" VM.
-
-Both VMs are sharing the 192.168.200/24 network. If you are using this network
-take a look into the Vagrantfile and change the IP.
-
 
 Coding Standards
 ================

MANIFEST

@@ -1,270 +1,122 @@
-bin/fail2ban-client
-bin/fail2ban-regex
-bin/fail2ban-server
-bin/fail2ban-testcases
+README.md
+README.Solaris
 ChangeLog
-config/action.d/apf.conf
-config/action.d/badips.conf
-config/action.d/badips.py
-config/action.d/blocklist_de.conf
-config/action.d/bsd-ipfw.conf
-config/action.d/cloudflare.conf
-config/action.d/complain.conf
-config/action.d/dshield.conf
-config/action.d/dummy.conf
-config/action.d/firewallcmd-allports.conf
-config/action.d/firewallcmd-ipset.conf
-config/action.d/firewallcmd-multiport.conf
-config/action.d/firewallcmd-new.conf
-config/action.d/hostsdeny.conf
-config/action.d/ipfilter.conf
-config/action.d/ipfw.conf
-config/action.d/iptables-allports.conf
-config/action.d/iptables-common.conf
-config/action.d/iptables.conf
-config/action.d/iptables-ipset-proto4.conf
-config/action.d/iptables-ipset-proto6-allports.conf
-config/action.d/iptables-ipset-proto6.conf
-config/action.d/iptables-multiport.conf
-config/action.d/iptables-multiport-log.conf
-config/action.d/iptables-new.conf
-config/action.d/iptables-xt_recent-echo.conf
-config/action.d/mail-buffered.conf
-config/action.d/mail.conf
-config/action.d/mail-whois.conf
-config/action.d/mail-whois-lines.conf
-config/action.d/mynetwatchman.conf
-config/action.d/nftables-allports.conf
-config/action.d/nftables-common.conf
-config/action.d/nftables-multiport.conf
-config/action.d/nsupdate.conf
-config/action.d/osx-afctl.conf
-config/action.d/osx-ipfw.conf
-config/action.d/pf.conf
-config/action.d/route.conf
-config/action.d/sendmail-buffered.conf
-config/action.d/sendmail-common.conf
-config/action.d/sendmail.conf
-config/action.d/sendmail-geoip-lines.conf
-config/action.d/sendmail-whois.conf
-config/action.d/sendmail-whois-ipjailmatches.conf
-config/action.d/sendmail-whois-ipmatches.conf
-config/action.d/sendmail-whois-lines.conf
-config/action.d/sendmail-whois-matches.conf
-config/action.d/shorewall.conf
-config/action.d/smtp.py
-config/action.d/symbiosis-blacklist-allports.conf
-config/action.d/ufw.conf
-config/action.d/xarf-login-attack.conf
-config/fail2ban.conf
-config/filter.d/3proxy.conf
-config/filter.d/apache-auth.conf
-config/filter.d/apache-badbots.conf
-config/filter.d/apache-botsearch.conf
-config/filter.d/apache-common.conf
-config/filter.d/apache-fakegooglebot.conf
-config/filter.d/apache-modsecurity.conf
-config/filter.d/apache-nohome.conf
-config/filter.d/apache-noscript.conf
-config/filter.d/apache-overflows.conf
-config/filter.d/apache-shellshock.conf
-config/filter.d/assp.conf
-config/filter.d/asterisk.conf
-config/filter.d/botsearch-common.conf
-config/filter.d/common.conf
-config/filter.d/counter-strike.conf
-config/filter.d/courier-auth.conf
-config/filter.d/courier-smtp.conf
-config/filter.d/cyrus-imap.conf
-config/filter.d/directadmin.conf
-config/filter.d/dovecot.conf
-config/filter.d/dropbear.conf
-config/filter.d/ejabberd-auth.conf
-config/filter.d/exim-common.conf
-config/filter.d/exim.conf
-config/filter.d/exim-spam.conf
-config/filter.d/freeswitch.conf
-config/filter.d/groupoffice.conf
-config/filter.d/gssftpd.conf
-config/filter.d/guacamole.conf
-config/filter.d/haproxy-http-auth.conf
-config/filter.d/horde.conf
-config/filter.d/ignorecommands
-config/filter.d/ignorecommands/apache-fakegooglebot
-config/filter.d/kerio.conf
-config/filter.d/lighttpd-auth.conf
-config/filter.d/monit.conf
-config/filter.d/murmur.conf
-config/filter.d/mysqld-auth.conf
-config/filter.d/nagios.conf
-config/filter.d/named-refused.conf
-config/filter.d/nginx-botsearch.conf
-config/filter.d/nginx-http-auth.conf
-config/filter.d/nginx-limit-req.conf
-config/filter.d/nsd.conf
-config/filter.d/openhab.conf
-config/filter.d/openwebmail.conf
-config/filter.d/oracleims.conf
-config/filter.d/pam-generic.conf
-config/filter.d/perdition.conf
-config/filter.d/php-url-fopen.conf
-config/filter.d/portsentry.conf
-config/filter.d/postfix.conf
-config/filter.d/postfix-rbl.conf
-config/filter.d/postfix-sasl.conf
-config/filter.d/proftpd.conf
-config/filter.d/pure-ftpd.conf
-config/filter.d/qmail.conf
-config/filter.d/recidive.conf
-config/filter.d/roundcube-auth.conf
-config/filter.d/screensharingd.conf
-config/filter.d/selinux-common.conf
-config/filter.d/selinux-ssh.conf
-config/filter.d/sendmail-auth.conf
-config/filter.d/sendmail-reject.conf
-config/filter.d/sendmail-spam.conf
-config/filter.d/sieve.conf
-config/filter.d/sogo-auth.conf
-config/filter.d/solid-pop3d.conf
-config/filter.d/squid.conf
-config/filter.d/squirrelmail.conf
-config/filter.d/sshd.conf
-config/filter.d/sshd-ddos.conf
-config/filter.d/stunnel.conf
-config/filter.d/suhosin.conf
-config/filter.d/tine20.conf
-config/filter.d/uwimap-auth.conf
-config/filter.d/vsftpd.conf
-config/filter.d/webmin-auth.conf
-config/filter.d/wuftpd.conf
-config/filter.d/xinetd-fail.conf
-config/jail.conf
-config/paths-common.conf
-config/paths-debian.conf
-config/paths-fedora.conf
-config/paths-freebsd.conf
-config/paths-opensuse.conf
-config/paths-osx.conf
-CONTRIBUTING.md
+TODO
+THANKS
 COPYING
 DEVELOP
-doc/run-rootless.txt
+FILTERS
 fail2ban-2to3
-fail2ban/client/actionreader.py
-fail2ban/client/beautifier.py
-fail2ban/client/configparserinc.py
-fail2ban/client/configreader.py
-fail2ban/client/configurator.py
-fail2ban/client/csocket.py
-fail2ban/client/fail2banreader.py
-fail2ban/client/fail2banregex.py
-fail2ban/client/filterreader.py
-fail2ban/client/__init__.py
-fail2ban/client/jailreader.py
-fail2ban/client/jailsreader.py
-fail2ban/exceptions.py
-fail2ban/ipaddr.py
-fail2ban/helpers.py
-fail2ban/__init__.py
-fail2ban/protocol.py
-fail2ban/server/action.py
-fail2ban/server/actions.py
-fail2ban/server/asyncserver.py
-fail2ban/server/banmanager.py
-fail2ban/server/database.py
-fail2ban/server/datedetector.py
-fail2ban/server/datetemplate.py
-fail2ban/server/faildata.py
-fail2ban/server/failmanager.py
-fail2ban/server/failregex.py
-fail2ban/server/filtergamin.py
-fail2ban/server/filterpoll.py
-fail2ban/server/filter.py
-fail2ban/server/filterpyinotify.py
-fail2ban/server/filtersystemd.py
-fail2ban/server/__init__.py
-fail2ban/server/iso8601.py
-fail2ban/server/jail.py
-fail2ban/server/jails.py
-fail2ban/server/jailthread.py
-fail2ban/server/mytime.py
-fail2ban/server/server.py
-fail2ban/server/strptime.py
-fail2ban/server/ticket.py
-fail2ban/server/transmitter.py
 fail2ban-testcases-all
 fail2ban-testcases-all-python3
-fail2ban/tests/action_d/__init__.py
-fail2ban/tests/action_d/test_badips.py
-fail2ban/tests/action_d/test_smtp.py
-fail2ban/tests/actionstestcase.py
-fail2ban/tests/actiontestcase.py
+bin/fail2ban-client
+bin/fail2ban-server
+bin/fail2ban-testcases
+bin/fail2ban-regex
+doc/run-rootless.txt
+fail2ban/client/configreader.py
+fail2ban/client/configparserinc.py
+fail2ban/client/jailreader.py
+fail2ban/client/fail2banreader.py
+fail2ban/client/jailsreader.py
+fail2ban/client/beautifier.py
+fail2ban/client/filterreader.py
+fail2ban/client/actionreader.py
+fail2ban/client/__init__.py
+fail2ban/client/configurator.py
+fail2ban/client/csocket.py
+fail2ban/server/asyncserver.py
+fail2ban/server/database.py
+fail2ban/server/filter.py
+fail2ban/server/filterpyinotify.py
+fail2ban/server/filtergamin.py
+fail2ban/server/filterpoll.py
+fail2ban/server/filtersystemd.py
+fail2ban/server/iso8601.py
+fail2ban/server/server.py
+fail2ban/server/actions.py
+fail2ban/server/faildata.py
+fail2ban/server/failmanager.py
+fail2ban/server/datedetector.py
+fail2ban/server/jailthread.py
+fail2ban/server/transmitter.py
+fail2ban/server/action.py
+fail2ban/server/ticket.py
+fail2ban/server/jail.py
+fail2ban/server/jails.py
+fail2ban/server/__init__.py
+fail2ban/server/banmanager.py
+fail2ban/server/datetemplate.py
+fail2ban/server/mytime.py
+fail2ban/server/failregex.py
+fail2ban/server/database.py
 fail2ban/tests/banmanagertestcase.py
+fail2ban/tests/failmanagertestcase.py
 fail2ban/tests/clientreadertestcase.py
-fail2ban/tests/clientbeautifiertestcase.py
-fail2ban/tests/config/action.d/brokenaction.conf
-fail2ban/tests/config/fail2ban.conf
-fail2ban/tests/config/filter.d/simple.conf
-fail2ban/tests/config/filter.d/test.conf
-fail2ban/tests/config/filter.d/test.local
+fail2ban/tests/filtertestcase.py
+fail2ban/tests/__init__.py
+fail2ban/tests/dummyjail.py
+fail2ban/tests/samplestestcase.py
+fail2ban/tests/datedetectortestcase.py
+fail2ban/tests/actiontestcase.py
+fail2ban/tests/servertestcase.py
+fail2ban/tests/sockettestcase.py
+fail2ban/tests/utils.py
+fail2ban/tests/misctestcase.py
+fail2ban/tests/databasetestcase.py
 fail2ban/tests/config/jail.conf
+fail2ban/tests/config/fail2ban.conf
 fail2ban/tests/config/paths-common.conf
-fail2ban/tests/config/paths-debian.conf
 fail2ban/tests/config/paths-freebsd.conf
 fail2ban/tests/config/paths-osx.conf
-fail2ban/tests/databasetestcase.py
-fail2ban/tests/datedetectortestcase.py
-fail2ban/tests/dummyjail.py
-fail2ban/tests/fail2banregextestcase.py
-fail2ban/tests/failmanagertestcase.py
-fail2ban/tests/files/action.d/action_checkainfo.py
-fail2ban/tests/files/action.d/action_errors.py
-fail2ban/tests/files/action.d/action_modifyainfo.py
-fail2ban/tests/files/action.d/action_noAction.py
-fail2ban/tests/files/action.d/action_nomethod.py
-fail2ban/tests/files/action.d/action.py
-fail2ban/tests/files/config/apache-auth/basic/authz_owner/cant_get_me.html
+fail2ban/tests/config/paths-debian.conf
+fail2ban/tests/config/filter.d/simple.conf
+fail2ban/tests/config/action.d/brokenaction.conf
+fail2ban/tests/files/config/apache-auth/digest/.htaccess
+fail2ban/tests/files/config/apache-auth/digest/.htpasswd
+fail2ban/tests/files/config/apache-auth/digest_time/.htaccess
+fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd
 fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htaccess
+fail2ban/tests/files/config/apache-auth/basic/authz_owner/cant_get_me.html
 fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htpasswd
 fail2ban/tests/files/config/apache-auth/basic/file/.htaccess
 fail2ban/tests/files/config/apache-auth/basic/file/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest_anon/.htaccess
-fail2ban/tests/files/config/apache-auth/digest_anon/.htpasswd
-fail2ban/tests/files/config/apache-auth/digest/.htaccess
-fail2ban/tests/files/config/apache-auth/digest/.htpasswd
 fail2ban/tests/files/config/apache-auth/digest.py
-fail2ban/tests/files/config/apache-auth/digest_time/.htaccess
-fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd
 fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess
 fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd
-fail2ban/tests/files/config/apache-auth/noentry/.htaccess
+fail2ban/tests/files/config/apache-auth/digest_anon/.htaccess
+fail2ban/tests/files/config/apache-auth/digest_anon/.htpasswd
 fail2ban/tests/files/config/apache-auth/README
+fail2ban/tests/files/config/apache-auth/noentry/.htaccess
 fail2ban/tests/files/database_v1.db
-fail2ban/tests/files/filter.d/substition.conf
-fail2ban/tests/files/filter.d/testcase01.conf
-fail2ban/tests/files/filter.d/testcase-common.conf
 fail2ban/tests/files/ignorecommand.py
+fail2ban/tests/files/filter.d/substition.conf
+fail2ban/tests/files/filter.d/testcase-common.conf
+fail2ban/tests/files/filter.d/testcase01.conf
+fail2ban/tests/files/testcase01.log
+fail2ban/tests/files/testcase02.log
+fail2ban/tests/files/testcase03.log
+fail2ban/tests/files/testcase04.log
+fail2ban/tests/files/testcase-usedns.log
+fail2ban/tests/files/testcase-journal.log
+fail2ban/tests/files/testcase-multiline.log
+fail2ban/tests/files/logs/bsd/syslog-plain.txt
+fail2ban/tests/files/logs/bsd/syslog-v.txt
+fail2ban/tests/files/logs/bsd/syslog-vv.txt
 fail2ban/tests/files/logs/3proxy
 fail2ban/tests/files/logs/apache-auth
 fail2ban/tests/files/logs/apache-badbots
 fail2ban/tests/files/logs/apache-botscripts
-fail2ban/tests/files/logs/apache-botsearch
-fail2ban/tests/files/logs/apache-fakegooglebot
 fail2ban/tests/files/logs/apache-modsecurity
 fail2ban/tests/files/logs/apache-nohome
 fail2ban/tests/files/logs/apache-noscript
 fail2ban/tests/files/logs/apache-overflows
-fail2ban/tests/files/logs/apache-shellshock
 fail2ban/tests/files/logs/assp
 fail2ban/tests/files/logs/asterisk
-fail2ban/tests/files/logs/bsd/syslog-plain.txt
-fail2ban/tests/files/logs/bsd/syslog-v.txt
-fail2ban/tests/files/logs/bsd/syslog-vv.txt
 fail2ban/tests/files/logs/counter-strike
 fail2ban/tests/files/logs/courier-auth
 fail2ban/tests/files/logs/courier-smtp
 fail2ban/tests/files/logs/cyrus-imap
-fail2ban/tests/files/logs/directadmin
 fail2ban/tests/files/logs/dovecot
 fail2ban/tests/files/logs/dropbear
 fail2ban/tests/files/logs/ejabberd-auth
@@ -274,108 +126,193 @@ fail2ban/tests/files/logs/freeswitch
 fail2ban/tests/files/logs/groupoffice
 fail2ban/tests/files/logs/gssftpd
 fail2ban/tests/files/logs/guacamole
-fail2ban/tests/files/logs/haproxy-http-auth
-fail2ban/tests/files/logs/horde
 fail2ban/tests/files/logs/kerio
 fail2ban/tests/files/logs/lighttpd-auth
-fail2ban/tests/files/logs/monit
-fail2ban/tests/files/logs/murmur
 fail2ban/tests/files/logs/mysqld-auth
 fail2ban/tests/files/logs/nagios
-fail2ban/tests/files/logs/named-refused
-fail2ban/tests/files/logs/nginx-botsearch
-fail2ban/tests/files/logs/nginx-http-auth
-fail2ban/tests/files/logs/nginx-limit-req
 fail2ban/tests/files/logs/nsd
-fail2ban/tests/files/logs/openhab
-fail2ban/tests/files/logs/openwebmail
-fail2ban/tests/files/logs/oracleims
-fail2ban/tests/files/logs/pam-generic
 fail2ban/tests/files/logs/perdition
 fail2ban/tests/files/logs/php-url-fopen
-fail2ban/tests/files/logs/portsentry
-fail2ban/tests/files/logs/postfix
-fail2ban/tests/files/logs/postfix-rbl
 fail2ban/tests/files/logs/postfix-sasl
+fail2ban/tests/files/logs/named-refused
+fail2ban/tests/files/logs/nginx-http-auth
+fail2ban/tests/files/logs/pam-generic
+fail2ban/tests/files/logs/postfix
 fail2ban/tests/files/logs/proftpd
 fail2ban/tests/files/logs/pure-ftpd
 fail2ban/tests/files/logs/qmail
 fail2ban/tests/files/logs/recidive
 fail2ban/tests/files/logs/roundcube-auth
-fail2ban/tests/files/logs/screensharingd
 fail2ban/tests/files/logs/selinux-ssh
-fail2ban/tests/files/logs/sendmail-auth
-fail2ban/tests/files/logs/sendmail-reject
 fail2ban/tests/files/logs/sendmail-spam
 fail2ban/tests/files/logs/sieve
-fail2ban/tests/files/logs/sogo-auth
-fail2ban/tests/files/logs/solid-pop3d
 fail2ban/tests/files/logs/squid
-fail2ban/tests/files/logs/squirrelmail
-fail2ban/tests/files/logs/sshd
-fail2ban/tests/files/logs/sshd-ddos
 fail2ban/tests/files/logs/stunnel
 fail2ban/tests/files/logs/suhosin
-fail2ban/tests/files/logs/tine20
-fail2ban/tests/files/logs/uwimap-auth
+fail2ban/tests/files/logs/sogo-auth
+fail2ban/tests/files/logs/solid-pop3d
+fail2ban/tests/files/logs/sshd
+fail2ban/tests/files/logs/sshd-ddos
 fail2ban/tests/files/logs/vsftpd
 fail2ban/tests/files/logs/webmin-auth
 fail2ban/tests/files/logs/wuftpd
+fail2ban/tests/files/logs/uwimap-auth
 fail2ban/tests/files/logs/xinetd-fail
-fail2ban/tests/files/testcase01.log
-fail2ban/tests/files/testcase02.log
-fail2ban/tests/files/testcase03.log
-fail2ban/tests/files/testcase04.log
-fail2ban/tests/files/testcase-journal.log
-fail2ban/tests/files/testcase-multiline.log
-fail2ban/tests/files/testcase-usedns.log
-fail2ban/tests/files/testcase-wrong-char.log
-fail2ban/tests/filtertestcase.py
-fail2ban/tests/__init__.py
-fail2ban/tests/misctestcase.py
-fail2ban/tests/samplestestcase.py
-fail2ban/tests/servertestcase.py
-fail2ban/tests/sockettestcase.py
-fail2ban/tests/utils.py
+fail2ban/tests/config/jail.conf
+fail2ban/tests/config/fail2ban.conf
+fail2ban/tests/config/filter.d/simple.conf
+fail2ban/tests/config/action.d/brokenaction.conf
+setup.py
+setup.cfg
+fail2ban/__init__.py
+fail2ban/exceptions.py
+fail2ban/helpers.py
 fail2ban/version.py
-files/bash-completion
-files/cacti/cacti_host_template_fail2ban.xml
-files/cacti/fail2ban_stats.sh
-files/cacti/README
-files/debian-initd
-files/fail2ban-logrotate
-files/fail2ban.service
-files/fail2ban-tmpfiles.conf
-files/fail2ban.upstart
-files/gen_badbots
-files/gentoo-confd
+fail2ban/protocol.py
+setup.py
+setup.cfg
+kill-server
+config/jail.conf
+config/fail2ban.conf
+config/filter.d/common.conf
+config/filter.d/apache-auth.conf
+config/filter.d/apache-badbots.conf
+config/filter.d/apache-botsearch.conf
+config/filter.d/apache-modsecurity.conf
+config/filter.d/apache-nohome.conf
+config/filter.d/apache-noscript.conf
+config/filter.d/apache-overflows.conf
+config/filter.d/nginx-http-auth.conf
+config/filter.d/counter-strike.conf
+config/filter.d/courier-auth.conf
+config/filter.d/courier-smtp.conf
+config/filter.d/cyrus-imap.conf
+config/filter.d/ejabberd-auth.conf
+config/filter.d/exim.conf
+config/filter.d/freeswitch.conf
+config/filter.d/gssftpd.conf
+config/filter.d/kerio.conf
+config/filter.d/horde.conf
+config/filter.d/suhosin.conf
+config/filter.d/nagios.conf
+config/filter.d/named-refused.conf
+config/filter.d/nsd.conf
+config/filter.d/openwebmail.conf
+config/filter.d/pam-generic.conf
+config/filter.d/php-url-fopen.conf
+config/filter.d/postfix-sasl.conf
+config/filter.d/pam-generic.conf
+config/filter.d/php-url-fopen.conf
+config/filter.d/postfix-sasl.conf
+config/filter.d/postfix.conf
+config/filter.d/proftpd.conf
+config/filter.d/pure-ftpd.conf
+config/filter.d/qmail.conf
+config/filter.d/pam-generic.conf
+config/filter.d/php-url-fopen.conf
+config/filter.d/postfix-sasl.conf
+config/filter.d/sendmail-auth.conf
+config/filter.d/sendmail-reject.conf
+config/filter.d/sieve.conf
+config/filter.d/solid-pop3d.conf
+config/filter.d/squid.conf
+config/filter.d/sshd.conf
+config/filter.d/sshd-ddos.conf
+config/filter.d/stunnel.conf
+config/filter.d/vsftpd.conf
+config/filter.d/webmin-auth.conf
+config/filter.d/wuftpd.conf
+config/filter.d/xinetd-fail.conf
+config/filter.d/asterisk.conf
+config/filter.d/dovecot.conf
+config/filter.d/dropbear.conf
+config/filter.d/lighttpd-auth.conf
+config/filter.d/recidive.conf
+config/filter.d/roundcube-auth.conf
+config/filter.d/assp.conf
+config/filter.d/sogo-auth.conf
+config/filter.d/mysqld-auth.conf
+config/filter.d/selinux-common.conf
+config/filter.d/selinux-ssh.conf
+config/filter.d/3proxy.conf
+config/filter.d/apache-common.conf
+config/filter.d/exim-common.conf
+config/filter.d/exim-spam.conf
+config/filter.d/freeswitch.conf
+config/filter.d/groupoffice.conf
+config/filter.d/perdition.conf
+config/filter.d/uwimap-auth.conf
+config/filter.d/courier-auth.conf
+config/filter.d/courier-smtp.conf
+config/filter.d/ejabberd-auth.conf
+config/filter.d/guacamole.conf
+config/filter.d/sendmail-spam.conf
+config/action.d/apf.conf
+config/action.d/blocklist_de.conf
+config/action.d/osx-afctl.conf
+config/action.d/osx-ipfw.conf
+config/action.d/sendmail-common.conf
+config/action.d/badips.conf
+config/action.d/bsd-ipfw.conf
+config/action.d/dummy.conf
+config/action.d/firewallcmd-new.conf
+config/action.d/firewallcmd-ipset.conf
+config/action.d/iptables-ipset-proto6-allports.conf
+config/action.d/iptables-common.conf
+config/action.d/iptables-ipset-proto4.conf
+config/action.d/iptables-ipset-proto6.conf
+config/action.d/iptables-xt_recent-echo.conf
+config/action.d/route.conf
+config/action.d/complain.conf
+config/action.d/dshield.conf
+config/action.d/hostsdeny.conf
+config/action.d/ipfw.conf
+config/action.d/ipfilter.conf
+config/action.d/iptables.conf
+config/action.d/iptables-allports.conf
+config/action.d/iptables-multiport.conf
+config/action.d/iptables-multiport-log.conf
+config/action.d/iptables-new.conf
+config/action.d/mail.conf
+config/action.d/mail-buffered.conf
+config/action.d/mail-whois.conf
+config/action.d/mail-whois-lines.conf
+config/action.d/mynetwatchman.conf
+config/action.d/pf.conf
+config/action.d/sendmail.conf
+config/action.d/sendmail-buffered.conf
+config/action.d/sendmail-whois-ipmatches.conf
+config/action.d/sendmail-whois.conf
+config/action.d/sendmail-whois-lines.conf
+config/action.d/shorewall.conf
+config/action.d/xarf-login-attack.conf
+config/action.d/ufw.conf
+config/fail2ban.conf
+doc/run-rootless.txt
+man/fail2ban-client.1
+man/fail2ban.1
+man/jail.conf.5
+man/fail2ban-client.h2m
+man/fail2ban-server.1
+man/fail2ban-server.h2m
+man/fail2ban-regex.1
+man/fail2ban-regex.h2m
+man/generate-man
 files/gentoo-initd
-files/ipmasq-ZZZzzz_fail2ban.rul
-files/logwatch/fail2ban
-files/macosx-initd
-files/monit/fail2ban
-files/nagios/check_fail2ban
-files/nagios/README
+files/gentoo-confd
 files/redhat-initd
+files/macosx-initd
 files/solaris-fail2ban.xml
 files/solaris-svc-fail2ban
 files/suse-initd
-FILTERS
-kill-server
-man/fail2ban.1
-man/fail2ban-client.1
-man/fail2ban-client.h2m
-man/fail2ban-regex.1
-man/fail2ban-regex.h2m
-man/fail2ban-server.1
-man/fail2ban-server.h2m
-man/generate-man
-man/jail.conf.5
-README.md
-README.Solaris
-RELEASE
-setup.cfg
-setup.py
-THANKS
-TODO
-Vagrantfile
+files/fail2ban-logrotate
+files/cacti/fail2ban_stats.sh
+files/cacti/cacti_host_template_fail2ban.xml
+files/cacti/README
+files/nagios/check_fail2ban
+files/nagios/README
+files/bash-completion
+files/fail2ban-tmpfiles.conf
+files/fail2ban.service
+files/ipmasq-ZZZzzz_fail2ban.rul
+files/gen_badbots

MANIFEST.in

@@ -1,5 +1,4 @@
-include ChangeLog COPYING DEVELOP FILTERS README.* THANKS TODO CONTRIBUTING* Vagrantfile
+include ChangeLog COPYING DEVELOP FILTERS README.* THANKS TODO
 graft doc
 graft files
 recursive-include config *.conf *.py
-recursive-include config/filter.d/ignorecommands *

README.md

@@ -2,19 +2,17 @@
                         / _|__ _(_) |_  ) |__  __ _ _ _  
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
-                       v0.9.4.dev0             2016/??/??
+                       v0.9.0                  2014/03/14
 
 ## Fail2Ban: ban hosts that cause multiple authentication errors
 
-Fail2Ban scans log files like `/var/log/auth.log` and bans IP addresses having
-too many failed login attempts. It does this by updating system firewall rules
-to reject new connections from those IP addresses, for a configurable amount
-of time. Fail2Ban comes out-of-the-box ready to read many standard log files,
-such as those for sshd and Apache, and is easy to configure to read any log
-file you choose, for any error you choose.
+Fail2Ban scans log files like /var/log/pwdfail and bans IP that makes too many
+password failures. It updates firewall rules to reject the IP address. These
+rules can be defined by the user. Fail2Ban can read multiple log files such as
+sshd or Apache web server ones.
 
-Though Fail2Ban is able to reduce the rate of incorrect authentications
-attempts, it cannot eliminate the risk that weak authentication presents.
+Fail2Ban is able to reduce the rate of incorrect authentications attempts
+however it cannot eliminate the risk that weak authentication presents.
 Configure services to use only two factor or public/private authentication
 mechanisms if you really want to protect services.
 
@@ -35,16 +33,15 @@ Optional:
   - Linux >= 2.6.13
 - [gamin >= 0.0.21](http://www.gnome.org/~veillard/gamin)
 - [systemd >= 204](http://www.freedesktop.org/wiki/Software/systemd)
-- [dnspython](http://www.dnspython.org/)
 
 To install, just do:
 
-    tar xvfj fail2ban-0.9.4.tar.bz2
-    cd fail2ban-0.9.4
+    tar xvfj fail2ban-0.9.0.tar.bz2
+    cd fail2ban-0.9.0
     python setup.py install
 
 This will install Fail2Ban into the python library directory. The executable
-scripts are placed into `/usr/bin`, and configuration under `/etc/fail2ban`.
+scripts are placed into /usr/bin, and configuration under /etc/fail2ban.
 
 Fail2Ban should be correctly installed now. Just type:
 
@@ -53,20 +50,11 @@ Fail2Ban should be correctly installed now. Just type:
 to see if everything is alright. You should always use fail2ban-client and
 never call fail2ban-server directly.
 
-Please note that the system init/service script is not automatically installed.
-To enable fail2ban as an automatic service, simply copy the script for your
-distro from the `files` directory to `/etc/init.d`. Example (on a Debian-based
-system):
-
-    cp files/debian-initd /etc/init.d/fail2ban
-    update-rc.d fail2ban defaults
-    service fail2ban start
-
 Configuration:
 --------------
 
-You can configure Fail2Ban using the files in `/etc/fail2ban`. It is possible to
-configure the server using commands sent to it by `fail2ban-client`. The
+You can configure Fail2Ban using the files in /etc/fail2ban. It is possible to
+configure the server using commands sent to it by fail2ban-client. The
 available commands are described in the fail2ban-client(1) manpage.  Also see
 fail2ban(1) and jail.conf(5)  manpages for further references.
 
@@ -77,8 +65,6 @@ Code status:
 
 * [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.png?branch=master)](https://coveralls.io/r/fail2ban/fail2ban)
 
-* [![codecov.io](https://codecov.io/github/fail2ban/fail2ban/coverage.svg?branch=master)](https://codecov.io/github/fail2ban/fail2ban?branch=master)
-
 Contact:
 --------
 

RELEASE

@@ -47,15 +47,6 @@ Preparation
 
 * Ensure the MANIFEST is complete
 
-  ad-hoc bash script to run in a clean clone:
-
-     find -type f | grep -v -e '\.git' -e '/doc/' -e '\.travis' -e MANIFEST | sed -e 's,^\./,,g' | while read f; do grep -ne "^$f\$" MANIFEST >/dev/null || echo "$f" ; done
-
-  or an alternative for comparison with previous release
-
-     git diff 0.9.4 | grep -B2 'index 0000000..' | grep -B1 'new file mode' | sed -n -e '/^diff /s,.* b/,,gp' >> MANIFEST
-     sort MANIFEST | uniq | sponge MANIFEST
-
 * Run::
 
   python setup.py sdist
@@ -66,24 +57,24 @@ Preparation
 
   * Which indicates that testcases/files/logs/mysqld.log has been moved or is a directory::
 
-      tar -C /tmp -jxf dist/fail2ban-0.9.4.tar.bz2
+      tar -C /tmp -jxf dist/fail2ban-0.9.0.tar.bz2
 
 * clean up current direcory::
 
-    diff -rul --exclude \*.pyc . /tmp/fail2ban-0.9.4/
+    diff -rul --exclude \*.pyc . /tmp/fail2ban-0.9.0/
 
   * Only differences should be files that you don't want distributed.
 
 
 * Ensure the tests work from the tarball::
 
-    cd /tmp/fail2ban-0.9.4/ && bin/fail2ban-testcases
+    cd /tmp/fail2ban-0.9.0/ && export PYTHONPATH=`pwd` && bin/fail2ban-testcases
 
 * Add/finalize the corresponding entry in the ChangeLog
 
   * To generate a list of committers use e.g.::
 
-      git shortlog -sn 0.9.4.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
+      git shortlog -sn 0.8.12.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
 
   * Ensure the top of the ChangeLog has the right version and current date.
   * Ensure the top entry of the ChangeLog has the right version and current date.
@@ -106,7 +97,7 @@ Preparation
 * Tag the release by using a signed (and annotated) tag.  Cut/paste
   release ChangeLog entry as tag annotation::
 
-    git tag -s 0.9.4
+    git tag -s 0.9.1
 
 Pre Release
 ===========
@@ -121,7 +112,7 @@ Pre Release
 
     * http://packages.qa.debian.org/f/fail2ban.html
 
-  * FreeBSD: Christoph Theis theis@gmx.at>
+  * FreeBSD: Christoph Theis theis@gmx.at>, Nick Hilliard <nick@foobar.org>
 
     * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/Makefile?view=markup
     * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
@@ -149,7 +140,7 @@ Pre Release
 
     * https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
 
-  * And potentially to the fail2ban-users email list.
+  * An potentially to the fail2ban-users email list.
 
 
 * Wait for feedback from distributors
@@ -190,7 +181,7 @@ Post Release
 
 Add the following to the top of the ChangeLog::
 
-  ver. 0.9.6 (2016/XX/XXX) - wanna-be-released
+  ver. 0.9.1 (2014/XX/XXX) - wanna-be-released
   -----------
   
   - Fixes:
@@ -202,5 +193,5 @@ Add the following to the top of the ChangeLog::
 Alter the git shortlog command in the previous section to refer to the just
 released version.
 
-and adjust fail2ban/version.py to carry .dev0 suffix to signal
+and adjust fail2ban/version.py to carry .dev suffix to signal
 a version under development.

THANKS

@@ -6,17 +6,13 @@ the project.  If you have been left off, please let us know
 (preferably send a pull request on github with the "fix") and you will
 be added
 
-Aaron Brice
 Adam Tkac
 Adrien Clerc
 ache
 ag4ve (Shawn)
 Alasdair D. Campbell
-Alexander Koeppe (IPv6 support)
-Alexandre Perrin (kAworu)
 Amir Caspi
 Amy
-Andrew St. Jean
 Andrey G. Grozin
 Andy Fragen
 Arturo 'Buanzo' Busleiman
@@ -30,22 +26,16 @@ Christian Rauch
 Christophe Carles
 Christoph Haas
 Christos Psonis
-craneworks
 Cyril Jaquier
 Daniel B. Cid
 Daniel B.
 Daniel Black
 David Nutter
-David Reagan (jerrac)
 Derek Atkins
-Donald Yandt
 Eric Gerbier
 Enrico Labedzki
-Eugene Hopkinson (SlowRiot)
 ftoppi
-Florian Robert (1technophile)
 François Boulogne
-Frantisek Sumsal
 Frédéric
 Georgiy Mernov
 Guilhem Lettron
@@ -69,14 +59,12 @@ Joël Bertrand
 JP Espinosa
 jserrachinha
 Justin Shore
-Kevin Locke
 Kévin Drapel
 kjohnsonecl
 kojiro
 Lars Kneschke
 Lee Clemens
 leftyfb (Mike Rushton)
-M. Maraun
 Manuel Arostegui Ramirez
 Marcel Dopita
 Mark Edgington
@@ -92,10 +80,7 @@ Michael Hanselmann
 Mika (mkl)
 Nick Munger
 onorua
-Orion Poplawski
-Pablo Rodriguez Fernandez
 Paul Marrapese
-Paul Traina
 Noel Butler
 Patrick Börjesson
 Pressy
@@ -116,9 +101,7 @@ Stefan Tatschner
 Stephen Gildea
 Steven Hiscocks
 TESTOVIK
-Thomas Mayer
 Tom Pike
-Tom Hendrikx
 Tomas Pihl
 Tony Lawrence
 Tomasz Ciolek

Vagrantfile

@@ -1,5 +1,10 @@
 Vagrant.configure("2") do |config|
 
+  config.vm.define "builder" do |builder|
+    builder.vm.box = "vm144"
+    builder.vm.provision "shell", path: "provision.sh"
+  end
+
     config.vm.define "secure" do |secure|
         secure.vm.box = "ubuntu/trusty64"
         secure.vm.hostname = "secure.dev.fail2ban.org"

bin/fail2ban-client

@@ -22,17 +22,8 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import getopt
-import logging
-import os
-import pickle
-import re
-import shlex
-import signal
-import socket
-import string
-import sys
-import time
+import sys, string, os, pickle, re, logging, signal
+import getopt, time, shlex, socket
 
 from fail2ban.version import version
 from fail2ban.protocol import printFormatted
@@ -68,53 +59,53 @@ class Fail2banClient:
 		self.__conf["pidfile"] = None
 
 	def dispVersion(self):
-		print "Fail2Ban v" + version
-		print
-		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
-		print "Copyright of modifications held by their respective authors."
-		print "Licensed under the GNU General Public License v2 (GPL)."
-		print
-		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
-		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+		print("Fail2Ban v" + version)
+		print()
+		print("Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors")
+		print("Copyright of modifications held by their respective authors.")
+		print("Licensed under the GNU General Public License v2 (GPL).")
+		print()
+		print("Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.")
+		print("Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.")
 
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
-		print "Usage: "+self.__argv[0]+" [OPTIONS] <COMMAND>"
-		print
-		print "Fail2Ban v" + version + " reads log file that contains password failure report"
-		print "and bans the corresponding IP addresses using firewall rules."
-		print
-		print "Options:"
-		print "    -c <DIR>                configuration directory"
-		print "    -s <FILE>               socket path"
-		print "    -p <FILE>               pidfile path"
-		print "    -d                      dump configuration. For debugging"
-		print "    -i                      interactive mode"
-		print "    -v                      increase verbosity"
-		print "    -q                      decrease verbosity"
-		print "    -x                      force execution of the server (remove socket file)"
-		print "    -b                      start server in background (default)"
-		print "    -f                      start server in foreground (note that the client forks once itself)"
-		print "    -h, --help              display this help message"
-		print "    -V, --version           print the version"
-		print
-		print "Command:"
+		print("Usage: "+self.__argv[0]+" [OPTIONS] <COMMAND>")
+		print()
+		print("Fail2Ban v" + version + " reads log file that contains password failure report")
+		print("and bans the corresponding IP addresses using firewall rules.")
+		print()
+		print("Options:")
+		print("    -c <DIR>                configuration directory")
+		print("    -s <FILE>               socket path")
+		print("    -p <FILE>               pidfile path")
+		print("    -d                      dump configuration. For debugging")
+		print("    -i                      interactive mode")
+		print("    -v                      increase verbosity")
+		print("    -q                      decrease verbosity")
+		print("    -x                      force execution of the server (remove socket file)")
+		print("    -b                      start server in background (default)")
+		print("    -f                      start server in foreground (note that the client forks once itself)")
+		print("    -h, --help              display this help message")
+		print("    -V, --version           print the version")
+		print()
+		print("Command:")
 
 		# Prints the protocol
 		printFormatted()
 
-		print
-		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
+		print()
+		print("Report bugs to https://github.com/fail2ban/fail2ban/issues")
 
 	def dispInteractive(self):
-		print "Fail2Ban v" + version + " reads log file that contains password failure report"
-		print "and bans the corresponding IP addresses using firewall rules."
-		print
+		print("Fail2Ban v" + version + " reads log file that contains password failure report")
+		print("and bans the corresponding IP addresses using firewall rules.")
+		print()
 
 	def __sigTERMhandler(self, signum, frame):
 		# Print a new line because we probably come from wait
-		print
+		print()
 		logSys.warning("Caught signal %d. Exiting" % signum)
 		sys.exit(-1)
 
@@ -153,57 +144,31 @@ class Fail2banClient:
 		return self.__processCmd([["ping"]], False)
 
 	def __processCmd(self, cmd, showRet = True):
-		client = None
-		try:
-			beautifier = Beautifier()
-			streamRet = True
-			for c in cmd:
-				beautifier.setInputCmd(c)
-				try:
-					if not client:
-						client = CSocket(self.__conf["socket"])
-					ret = client.send(c)
-					if ret[0] == 0:
-						logSys.debug("OK : " + `ret[1]`)
-						if showRet:
-							print beautifier.beautify(ret[1])
-					else:
-						logSys.error("NOK: " + `ret[1].args`)
-						if showRet:
-							print beautifier.beautifyError(ret[1])
-						streamRet = False
-				except socket.error:
+		beautifier = Beautifier()
+		streamRet = True
+		for c in cmd:
+			beautifier.setInputCmd(c)
+			try:
+				client = CSocket(self.__conf["socket"])
+				ret = client.send(c)
+				if ret[0] == 0:
+					logSys.debug("OK : " + repr(ret[1]))
 					if showRet:
-						self.__logSocketError()
-					return False
-				except Exception, e:
-					if showRet:
-						logSys.error(e)
-					return False
-		finally:
-			if client:
-				client.close()
-		return streamRet
-
-	def __logSocketError(self):
-		try:
-			if os.access(self.__conf["socket"], os.F_OK):
-				# This doesn't check if path is a socket,
-				#  but socket.error should be raised
-				if os.access(self.__conf["socket"], os.W_OK):
-					# Permissions look good, but socket.error was raised
-					logSys.error("Unable to contact server. Is it running?")
+						print(beautifier.beautify(ret[1]))
 				else:
-					logSys.error("Permission denied to socket: %s,"
-								 " (you must be root)", self.__conf["socket"])
-			else:
-				logSys.error("Failed to access socket path: %s."
-							 " Is fail2ban running?",
-							 self.__conf["socket"])
-		except Exception as e:
-			logSys.error("Exception while checking socket access: %s",
-						 self.__conf["socket"])
-			logSys.error(e)
+					logSys.error("NOK: " + repr(ret[1].args))
+					if showRet:
+						print(beautifier.beautifyError(ret[1]))
+					streamRet = False
+			except socket.error:
+				if showRet:
+					logSys.error("Unable to contact server. Is it running?")
+				return False
+			except Exception as e:
+				if showRet:
+					logSys.error(e)
+				return False
+		return streamRet
 
 	##
 	# Process a command line.
@@ -376,10 +341,8 @@ class Fail2banClient:
 			logSys.setLevel(logging.WARNING)
 		elif verbose == 2:
 			logSys.setLevel(logging.INFO)
-		elif verbose == 3:
-			logSys.setLevel(logging.DEBUG)
 		else:
-			logSys.setLevel(logging.HEAVYDEBUG)
+			logSys.setLevel(logging.DEBUG)
 		# Add the default logging handler to dump to stderr
 		logout = logging.StreamHandler(sys.stderr)
 		# set a format which is simpler for console use
@@ -420,7 +383,7 @@ class Fail2banClient:
 					readline.parse_and_bind("tab: complete")
 					self.dispInteractive()
 					while True:
-						cmd = raw_input(self.PROMPT)
+						cmd = input(self.PROMPT)
 						if cmd == "exit" or cmd == "quit":
 							# Exit
 							return True
@@ -429,10 +392,10 @@ class Fail2banClient:
 						elif not cmd == "":
 							try:
 								self.__processCommand(shlex.split(cmd))
-							except Exception, e:
+							except Exception as e:
 								logSys.error(e)
 			except (EOFError, KeyboardInterrupt):
-				print
+				print()
 				return True
 		# Single command mode
 		else:
@@ -446,21 +409,21 @@ class Fail2banClient:
 		# TODO: get away from stew of return codes and exception
 		# handling -- handle via exceptions
 		try:
-			self.__configurator.Reload()
 			self.__configurator.readAll()
 			ret = self.__configurator.getOptions(jail)
 			self.__configurator.convertToProtocol()
 			self.__stream = self.__configurator.getConfigStream()
-		except Exception, e:
+		except Exception as e:
 			logSys.error("Failed during configuration: %s" % e)
 			ret = False
 		return ret
 
-	@staticmethod
+	#@staticmethod
 	def dumpConfig(cmd):
 		for c in cmd:
-			print c
+			print(c)
 		return True
+	dumpConfig = staticmethod(dumpConfig)
 
 
 class ServerExecutionException(Exception):

bin/fail2ban-regex

@@ -29,6 +29,543 @@ __author__ = "Fail2Ban Developers"
 __copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko"
 __license__ = "GPL"
 
-from fail2ban.client.fail2banregex import exec_command_line
+import getopt, sys, time, logging, os, locale, shlex, time, urllib.request, urllib.parse, urllib.error
+from optparse import OptionParser, Option
 
-exec_command_line()
+from configparser import NoOptionError, NoSectionError, MissingSectionHeaderError
+
+try:
+	from systemd import journal
+	from fail2ban.server.filtersystemd import FilterSystemd
+except ImportError:
+	journal = None
+
+from fail2ban.version import version
+from fail2ban.client.filterreader import FilterReader
+from fail2ban.server.filter import Filter
+from fail2ban.server.failregex import RegexException
+
+from fail2ban.helpers import FormatterWithTraceBack, getLogger
+# Gets the instance of the logger.
+logSys = getLogger("fail2ban")
+
+def debuggexURL(sample, regex):
+	q = urllib.parse.urlencode({ 're': regex.replace('<HOST>', '(?&.ipv4)'),
+							'str': sample,
+							'flavor': 'python' })
+	return 'http://www.debuggex.com/?' + q
+
+def shortstr(s, l=53):
+	"""Return shortened string
+	"""
+	if len(s) > l:
+		return s[:l-3] + '...'
+	return s
+
+def pprint_list(l, header=None):
+	if not len(l):
+		return
+	if header:
+		s = "|- %s\n" % header
+	else:
+		s = ''
+	print(s + "|  " + "\n|  ".join(l) + '\n`-')
+
+def file_lines_gen(hdlr):
+	for line in hdlr:
+		try:
+			line = line.decode(fail2banRegex.encoding, 'strict')
+		except UnicodeDecodeError:
+			if sys.version_info >= (3,): # Python 3 must be decoded
+				line = line.decode(fail2banRegex.encoding, 'ignore')
+		yield line
+
+def journal_lines_gen(myjournal):
+	while True:
+		try:
+			entry = myjournal.get_next()
+		except OSError:
+			continue
+		if not entry:
+			break
+		yield FilterSystemd.formatJournalEntry(entry)
+
+def get_opt_parser():
+	# use module docstring for help output
+	p = OptionParser(
+				usage="%s [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]\n" % sys.argv[0] + __doc__
+				+ """
+LOG:
+    string                  a string representing a log line
+    filename                path to a log file (/var/log/auth.log)
+    "systemd-journal"       search systemd journal (systemd-python required)
+
+REGEX:
+    string                  a string representing a 'failregex'
+    filename                path to a filter file (filter.d/sshd.conf)
+
+IGNOREREGEX:
+    string                  a string representing an 'ignoreregex'
+    filename                path to a filter file (filter.d/sshd.conf)
+
+Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors
+Copyright of modifications held by their respective authors.
+Licensed under the GNU General Public License v2 (GPL).
+
+Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
+Many contributions by Yaroslav O. Halchenko and Steven Hiscocks.
+
+Report bugs to https://github.com/fail2ban/fail2ban/issues
+""",
+				version="%prog " + version)
+
+	p.add_options([
+		Option("-d", "--datepattern",
+			   help="set custom pattern used to match date/times"),
+		Option("-e", "--encoding",
+			   help="File encoding. Default: system locale"),
+		Option("-L", "--maxlines", type=int, default=0,
+			   help="maxlines for multi-line regex"),
+		Option("-m", "--journalmatch",
+			   help="journalctl style matches overriding filter file. "
+			   "\"systemd-journal\" only"),
+		Option('-l', "--log-level", type="choice",
+			   dest="log_level",
+			   choices=('heavydebug', 'debug', 'info', 'notice', 'warning', 'error', 'critical'),
+			   default=None,
+			   help="Log level for the Fail2Ban logger to use"),
+		Option("-v", "--verbose", action='store_true',
+			   help="Be verbose in output"),
+		Option("-D", "--debuggex", action='store_true',
+			   help="Produce debuggex.com urls for debugging there"),
+		Option("--print-no-missed", action='store_true',
+			   help="Do not print any missed lines"),
+		Option("--print-no-ignored", action='store_true',
+			   help="Do not print any ignored lines"),
+		Option("--print-all-matched", action='store_true',
+			   help="Print all matched lines"),
+		Option("--print-all-missed", action='store_true',
+			   help="Print all missed lines, no matter how many"),
+		Option("--print-all-ignored", action='store_true',
+			   help="Print all ignored lines, no matter how many"),
+		Option("-t", "--log-traceback", action='store_true',
+			   help="Enrich log-messages with compressed tracebacks"),
+		Option("--full-traceback", action='store_true',
+			   help="Either to make the tracebacks full, not compressed (as by default)"),
+		])
+
+	return p
+
+
+class RegexStat(object):
+
+	def __init__(self, failregex):
+		self._stats = 0
+		self._failregex = failregex
+		self._ipList = list()
+
+	def __str__(self):
+		return "%s(%r) %d failed: %s" \
+		  % (self.__class__, self._failregex, self._stats, self._ipList)
+
+	def inc(self):
+		self._stats += 1
+
+	def getStats(self):
+		return self._stats
+
+	def getFailRegex(self):
+		return self._failregex
+
+	def appendIP(self, value):
+		self._ipList.append(value)
+
+	def getIPList(self):
+		return self._ipList
+
+
+class LineStats(object):
+	"""Just a convenience container for stats
+	"""
+	def __init__(self):
+		self.tested = self.matched = 0
+		self.matched_lines = []
+		self.missed = 0
+		self.missed_lines = []
+		self.missed_lines_timeextracted = []
+		self.ignored = 0
+		self.ignored_lines = []
+		self.ignored_lines_timeextracted = []
+
+	def __str__(self):
+		return "%(tested)d lines, %(ignored)d ignored, %(matched)d matched, %(missed)d missed" % self
+
+	# just for convenient str
+	def __getitem__(self, key):
+		return getattr(self, key)
+
+
+class Fail2banRegex(object):
+
+	def __init__(self, opts):
+		self._verbose = opts.verbose
+		self._debuggex = opts.debuggex
+		self._maxlines = 20
+		self._print_no_missed = opts.print_no_missed
+		self._print_no_ignored = opts.print_no_ignored
+		self._print_all_matched = opts.print_all_matched
+		self._print_all_missed = opts.print_all_missed
+		self._print_all_ignored = opts.print_all_ignored
+		self._maxlines_set = False		  # so we allow to override maxlines in cmdline
+		self._datepattern_set = False
+		self._journalmatch = None
+
+		self._filter = Filter(None)
+		self._ignoreregex = list()
+		self._failregex = list()
+		self._time_elapsed = None
+		self._line_stats = LineStats()
+
+		if opts.maxlines:
+			self.setMaxLines(opts.maxlines)
+		if opts.journalmatch is not None:
+			self.setJournalMatch(opts.journalmatch.split())
+		if opts.datepattern:
+			self.setDatePattern(opts.datepattern)
+		if opts.encoding:
+			self.encoding = opts.encoding
+		else:
+			self.encoding = locale.getpreferredencoding()
+
+
+
+	def setDatePattern(self, pattern):
+		if not self._datepattern_set:
+			self._filter.setDatePattern(pattern)
+			self._datepattern_set = True
+			if pattern is not None:
+				print("Use      datepattern : %s" % (
+					self._filter.getDatePattern()[1], ))
+
+	def setMaxLines(self, v):
+		if not self._maxlines_set:
+			self._filter.setMaxLines(int(v))
+			self._maxlines_set = True
+			print("Use         maxlines : %d" % self._filter.getMaxLines())
+
+	def setJournalMatch(self, v):
+		if self._journalmatch is None:
+			self._journalmatch = v
+
+	def readRegex(self, value, regextype):
+		assert(regextype in ('fail', 'ignore'))
+		regex = regextype + 'regex'
+		if os.path.isfile(value):
+			print("Use %11s file : %s" % (regex, value))
+			reader = FilterReader(value, 'fail2ban-regex-jail', {})
+			reader.setBaseDir(None)
+
+			if reader.readexplicit():
+				reader.getOptions(None)
+				readercommands = reader.convert()
+				regex_values = [
+					RegexStat(m[3])
+					for m in [x for x in readercommands if x[0] == 'set' and x[2] == "add%sregex" % regextype]]
+				# Read out and set possible value of maxlines
+				for command in readercommands:
+					if command[2] == "maxlines":
+						maxlines = int(command[3])
+						try:
+							self.setMaxLines(maxlines)
+						except ValueError:
+							print("ERROR: Invalid value for maxlines (%(maxlines)r) " \
+								  "read from %(value)s" % locals())
+							return False
+					elif command[2] == 'addjournalmatch':
+						journalmatch = command[3]
+						self.setJournalMatch(shlex.split(journalmatch))
+					elif command[2] == 'datepattern':
+						datepattern = command[3]
+						self.setDatePattern(datepattern)
+			else:
+				print("ERROR: failed to read %s" % value)
+				return False
+		else:
+			print("Use %11s line : %s" % (regex, shortstr(value)))
+			regex_values = [RegexStat(value)]
+
+		setattr(self, "_" + regex, regex_values)
+		for regex in regex_values:
+			getattr(
+				self._filter,
+				'add%sRegex' % regextype.title())(regex.getFailRegex())
+		return True
+
+	def testIgnoreRegex(self, line):
+		found = False
+		try:
+			ret = self._filter.ignoreLine([(line, "", "")])
+			if ret is not None:
+				found = True
+				regex = self._ignoreregex[ret].inc()
+		except RegexException as e:
+			print(e)
+			return False
+		return found
+
+	def testRegex(self, line, date=None):
+		orgLineBuffer = self._filter._Filter__lineBuffer
+		fullBuffer = len(orgLineBuffer) >= self._filter.getMaxLines()
+		try:
+			line, ret = self._filter.processLine(line, date, checkAllRegex=True)
+			for match in ret:
+				# Append True/False flag depending if line was matched by
+				# more than one regex
+				match.append(len(ret)>1)
+				regex = self._failregex[match[0]]
+				regex.inc()
+				regex.appendIP(match)
+		except RegexException as e:
+			print(e)
+			return False
+		except IndexError:
+			print("Sorry, but no <HOST> found in regex")
+			return False
+		for bufLine in orgLineBuffer[int(fullBuffer):]:
+			if bufLine not in self._filter._Filter__lineBuffer:
+				try:
+					self._line_stats.missed_lines.pop(
+						self._line_stats.missed_lines.index("".join(bufLine)))
+					self._line_stats.missed_lines_timeextracted.pop(
+						self._line_stats.missed_lines_timeextracted.index(
+							"".join(bufLine[::2])))
+				except ValueError:
+					pass
+				else:
+					self._line_stats.matched += 1
+					self._line_stats.missed -= 1
+		return line, ret
+
+	def process(self, test_lines):
+		t0 = time.time()
+		for line_no, line in enumerate(test_lines):
+			if isinstance(line, tuple):
+				line_datetimestripped, ret = fail2banRegex.testRegex(
+					line[0], line[1])
+				line = "".join(line[0])
+			else:
+				line = line.rstrip('\r\n')
+				if line.startswith('#') or not line:
+					# skip comment and empty lines
+					continue
+				line_datetimestripped, ret = fail2banRegex.testRegex(line)
+			is_ignored = fail2banRegex.testIgnoreRegex(line_datetimestripped)
+
+			if is_ignored:
+				self._line_stats.ignored += 1
+				if not self._print_no_ignored and (self._print_all_ignored or self._line_stats.ignored <= self._maxlines + 1):
+					self._line_stats.ignored_lines.append(line)
+					self._line_stats.ignored_lines_timeextracted.append(line_datetimestripped)
+
+			if len(ret) > 0:
+				assert(not is_ignored)
+				self._line_stats.matched += 1
+				if self._print_all_matched:
+					self._line_stats.matched_lines.append(line)
+			else:
+				if not is_ignored:
+					self._line_stats.missed += 1
+					if not self._print_no_missed and (self._print_all_missed or self._line_stats.missed <= self._maxlines + 1):
+						self._line_stats.missed_lines.append(line)
+						self._line_stats.missed_lines_timeextracted.append(line_datetimestripped)
+			self._line_stats.tested += 1
+
+			if line_no % 10 == 0 and self._filter.dateDetector is not None:
+				self._filter.dateDetector.sortTemplate()
+		self._time_elapsed = time.time() - t0
+
+
+
+	def printLines(self, ltype):
+		lstats = self._line_stats
+		assert(self._line_stats.missed == lstats.tested - (lstats.matched + lstats.ignored))
+		lines = lstats[ltype]
+		l = lstats[ltype + '_lines']
+		if lines:
+			header = "%s line(s):" % (ltype.capitalize(),)
+			if self._debuggex:
+				if ltype == 'missed' or ltype == 'matched':
+					regexlist = self._failregex
+				else:
+					regexlist = self._ignoreregex
+				l = lstats[ltype + '_lines_timeextracted']
+				if lines < self._maxlines or getattr(self, '_print_all_' + ltype):
+					ans = [[]]
+					for arg in [l, regexlist]:
+						ans = [ x + [y] for x in ans for y in arg ]
+					b = [a[0] +  ' | ' + a[1].getFailRegex() + ' |  ' + debuggexURL(a[0], a[1].getFailRegex()) for a in ans]
+					pprint_list([x.rstrip() for x in b], header)
+				else:
+					print("%s too many to print.  Use --print-all-%s " \
+						  "to print all %d lines" % (header, ltype, lines))
+			elif lines < self._maxlines or getattr(self, '_print_all_' + ltype):
+				pprint_list([x.rstrip() for x in l], header)
+			else:
+				print("%s too many to print.  Use --print-all-%s " \
+					  "to print all %d lines" % (header, ltype, lines))
+
+	def printStats(self):
+		print()
+		print("Results")
+		print("=======")
+
+		def print_failregexes(title, failregexes):
+			# Print title
+			total, out = 0, []
+			for cnt, failregex in enumerate(failregexes):
+				match = failregex.getStats()
+				total += match
+				if (match or self._verbose):
+					out.append("%2d) [%d] %s" % (cnt+1, match, failregex.getFailRegex()))
+
+				if self._verbose and len(failregex.getIPList()):
+					for ip in failregex.getIPList():
+						timeTuple = time.localtime(ip[2])
+						timeString = time.strftime("%a %b %d %H:%M:%S %Y", timeTuple)
+						out.append(
+							"    %s  %s%s" % (
+								ip[1],
+								timeString,
+								ip[-1] and " (multiple regex matched)" or ""))
+
+			print("\n%s: %d total" % (title, total))
+			pprint_list(out, " #) [# of hits] regular expression")
+			return total
+
+		# Print title
+		total = print_failregexes("Failregex", self._failregex)
+		_ = print_failregexes("Ignoreregex", self._ignoreregex)
+
+
+		if self._filter.dateDetector is not None:
+			print("\nDate template hits:")
+			out = []
+			for template in self._filter.dateDetector.templates:
+				if self._verbose or template.hits:
+					out.append("[%d] %s" % (
+						template.hits, template.name))
+			pprint_list(out, "[# of hits] date format")
+
+		print("\nLines: %s" % self._line_stats, end=' ')
+		if self._time_elapsed is not None:
+			print("[processed in %.2f sec]" % self._time_elapsed, end=' ')
+		print()
+
+		if self._print_all_matched:
+			self.printLines('matched')
+		if not self._print_no_ignored:
+			self.printLines('ignored')
+		if not self._print_no_missed:
+			self.printLines('missed')
+
+		return True
+
+
+if __name__ == "__main__":
+
+	parser = get_opt_parser()
+	(opts, args) = parser.parse_args()
+	if opts.print_no_missed and opts.print_all_missed:
+		sys.stderr.write("ERROR: --print-no-missed and --print-all-missed are mutually exclusive.\n\n")
+		parser.print_help()
+		sys.exit(-1)
+	if opts.print_no_ignored and opts.print_all_ignored:
+		sys.stderr.write("ERROR: --print-no-ignored and --print-all-ignored are mutually exclusive.\n\n")
+		parser.print_help()
+		sys.exit(-1)
+
+	print()
+	print("Running tests")
+	print("=============")
+	print()
+
+	fail2banRegex = Fail2banRegex(opts)
+
+	# We need 2 or 3 parameters
+	if not len(args) in (2, 3):
+		sys.stderr.write("ERROR: provide both <LOG> and <REGEX>.\n\n")
+		parser.print_help()
+		sys.exit(-1)
+
+	# TODO: taken from -testcases -- move common functionality somewhere
+	if opts.log_level is not None: # pragma: no cover
+		# so we had explicit settings
+		logSys.setLevel(getattr(logging, opts.log_level.upper()))
+	else: # pragma: no cover
+		# suppress the logging but it would leave unittests' progress dots
+		# ticking, unless like with '-l critical' which would be silent
+		# unless error occurs
+		logSys.setLevel(getattr(logging, 'CRITICAL'))
+
+	# Add the default logging handler
+	stdout = logging.StreamHandler(sys.stdout)
+
+	fmt = 'D: %(message)s'
+
+	if opts.log_traceback:
+		Formatter = FormatterWithTraceBack
+		fmt = (opts.full_traceback and ' %(tb)s' or ' %(tbc)s') + fmt
+	else:
+		Formatter = logging.Formatter
+
+	# Custom log format for the verbose tests runs
+	if opts.verbose: # pragma: no cover
+		stdout.setFormatter(Formatter(' %(asctime)-15s %(thread)s' + fmt))
+	else: # pragma: no cover
+		# just prefix with the space
+		stdout.setFormatter(Formatter(fmt))
+	logSys.addHandler(stdout)
+
+	cmd_log, cmd_regex = args[:2]
+
+	fail2banRegex.readRegex(cmd_regex, 'fail') or sys.exit(-1)
+
+	if len(args) == 3:
+		fail2banRegex.readRegex(args[2], 'ignore') or sys.exit(-1)
+
+	if os.path.isfile(cmd_log):
+		try:
+			hdlr = open(cmd_log, 'rb')
+			print("Use         log file : %s" % cmd_log)
+			print("Use         encoding : %s" % fail2banRegex.encoding)
+			test_lines = file_lines_gen(hdlr)
+		except IOError as e:
+			print(e)
+			sys.exit(-1)
+	elif cmd_log == "systemd-journal":
+		if not journal:
+			print("Error: systemd library not found. Exiting...")
+			sys.exit(-1)
+		myjournal = journal.Reader(converters={'__CURSOR': lambda x: x})
+		journalmatch = fail2banRegex._journalmatch
+		fail2banRegex.setDatePattern(None)
+		if journalmatch:
+			try:
+				for element in journalmatch:
+					if element == "+":
+						myjournal.add_disjunction()
+					else:
+						myjournal.add_match(element)
+			except ValueError:
+				print("Error: Invalid journalmatch: %s" % shortstr(" ".join(journalmatch)))
+				sys.exit(-1)
+		print("Use    journal match : %s" % " ".join(journalmatch))
+		test_lines = journal_lines_gen(myjournal)
+	else:
+		print("Use      single line : %s" % shortstr(cmd_log))
+		test_lines = [ cmd_log ]
+	print()
+
+	fail2banRegex.process(test_lines)
+
+	fail2banRegex.printStats() or sys.exit(-1)

bin/fail2ban-server

@@ -22,9 +22,7 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import getopt
-import os
-import sys
+import getopt, sys, os
 
 from fail2ban.version import version
 from fail2ban.server.server import Server
@@ -53,37 +51,37 @@ class Fail2banServer:
 		self.__conf["pidfile"] = "/var/run/fail2ban/fail2ban.pid"
 
 	def dispVersion(self):
-		print "Fail2Ban v" + version
-		print
-		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
-		print "Copyright of modifications held by their respective authors."
-		print "Licensed under the GNU General Public License v2 (GPL)."
-		print
-		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
-		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+		print("Fail2Ban v" + version)
+		print()
+		print("Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors")
+		print("Copyright of modifications held by their respective authors.")
+		print("Licensed under the GNU General Public License v2 (GPL).")
+		print()
+		print("Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.")
+		print("Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.")
 
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
-		print "Usage: "+self.__argv[0]+" [OPTIONS]"
-		print
-		print "Fail2Ban v" + version + " reads log file that contains password failure report"
-		print "and bans the corresponding IP addresses using firewall rules."
-		print
-		print "Only use this command for debugging purpose. Start the server with"
-		print "fail2ban-client instead. The default behaviour is to start the server"
-		print "in background."
-		print
-		print "Options:"
-		print "    -b                   start in background"
-		print "    -f                   start in foreground"
-		print "    -s <FILE>            socket path"
-		print "    -p <FILE>            pidfile path"
-		print "    -x                   force execution of the server (remove socket file)"
-		print "    -h, --help           display this help message"
-		print "    -V, --version        print the version"
-		print
-		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
+		print("Usage: "+self.__argv[0]+" [OPTIONS]")
+		print()
+		print("Fail2Ban v" + version + " reads log file that contains password failure report")
+		print("and bans the corresponding IP addresses using firewall rules.")
+		print()
+		print("Only use this command for debugging purpose. Start the server with")
+		print("fail2ban-client instead. The default behaviour is to start the server")
+		print("in background.")
+		print()
+		print("Options:")
+		print("    -b                   start in background")
+		print("    -f                   start in foreground")
+		print("    -s <FILE>            socket path")
+		print("    -p <FILE>            pidfile path")
+		print("    -x                   force execution of the server (remove socket file)")
+		print("    -h, --help           display this help message")
+		print("    -V, --version        print the version")
+		print()
+		print("Report bugs to https://github.com/fail2ban/fail2ban/issues")
 
 	def __getCmdLineOptions(self, optList):
 		""" Gets the command line options
@@ -127,7 +125,7 @@ class Fail2banServer:
 								self.__conf["pidfile"],
 								self.__conf["force"])
 			return True
-		except Exception, e:
+		except Exception as e:
 			logSys.exception(e)
 			self.__server.quit()
 			return False

bin/fail2ban-testcases

@@ -25,10 +25,7 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2012- Yaroslav Halchenko"
 __license__ = "GPL"
 
 import logging
-import os
-import sys
-import time
-import unittest
+import unittest, sys, time, os
 
 # Check if local fail2ban module exists, and use if it exists by 
 # modifying the path. This is such that tests can be used in dev
@@ -117,8 +114,8 @@ logSys.addHandler(stdout)
 # Let know the version
 #
 if not opts.log_level or opts.log_level != 'critical': # pragma: no cover
-	print("Fail2ban %s test suite. Python %s. Please wait..." \
-	    % (version, str(sys.version).replace('\n', '')))
+	print(("Fail2ban %s test suite. Python %s. Please wait..." \
+	    % (version, str(sys.version).replace('\n', ''))))
 
 tests = gatherTests(regexps, opts.no_network)
 #

config/action.d/badips.conf

@@ -10,7 +10,7 @@
 
 [Definition]
 
-actionban = curl --fail  --user-agent "<agent>" http://www.badips.com/add/<category>/<ip>
+actionban = curl --fail  --user-agent "fail2ban v0.8.12" http://www.badips.com/add/<category>/<ip>
 
 [Init]
 

config/action.d/badips.py

@@ -21,6 +21,7 @@ import sys
 if sys.version_info < (2, 7):
 	raise ImportError("badips.py action requires Python >= 2.7")
 import json
+from functools import partial
 import threading
 import logging
 if sys.version_info >= (3, ):
@@ -32,8 +33,7 @@ else:
 	from urllib import urlencode
 
 from fail2ban.server.actions import ActionBase
-from fail2ban.server.filter import IPAddr
-
+from fail2ban.version import version as f2bVersion
 
 class BadIPsAction(ActionBase):
 	"""Fail2Ban action which reports bans to badips.com, and also
@@ -71,9 +71,6 @@ class BadIPsAction(ActionBase):
 	updateperiod : int, optional
 		Time in seconds between updating bad IPs blacklist.
 		Default 900 (15 minutes)
-	agent : str, optional
-		User agent transmitted to server.
-		Default `Fail2Ban/ver.`
 
 	Raises
 	------
@@ -82,14 +79,13 @@ class BadIPsAction(ActionBase):
 	"""
 
 	_badips = "http://www.badips.com"
-	def _Request(self, url, **argv):
-		return Request(url, headers={'User-Agent': self.agent}, **argv)
+	_Request = partial(
+		Request, headers={'User-Agent': "Fail2Ban %s" % f2bVersion})
 
 	def __init__(self, jail, name, category, score=3, age="24h", key=None,
-		banaction=None, bancategory=None, bankey=None, updateperiod=900, agent="Fail2Ban"):
+		banaction=None, bancategory=None, bankey=None, updateperiod=900):
 		super(BadIPsAction, self).__init__(jail, name)
 
-		self.agent = agent
 		self.category = category
 		self.score = score
 		self.age = age
@@ -115,12 +111,10 @@ class BadIPsAction(ActionBase):
 		------
 		HTTPError
 			Any issues with badips.com request.
-		ValueError
-			If badips.com response didn't contain necessary information
 		"""
 		try:
 			response = urlopen(
-				self._Request("/".join([self._badips, "get", "categories"])), None, 3)
+				self._Request("/".join([self._badips, "get", "categories"])))
 		except HTTPError as response:
 			messages = json.loads(response.read().decode('utf-8'))
 			self._logSys.error(
@@ -128,13 +122,7 @@ class BadIPsAction(ActionBase):
 				messages['err'])
 			raise
 		else:
-			response_json = json.loads(response.read().decode('utf-8'))
-			if not 'categories' in response_json:
-				err = "badips.com response lacked categories specification. Response was: %s" \
-				  % (response_json,)
-				self._logSys.error(err)
-				raise ValueError(err)
-			categories = response_json['categories']
+			categories = json.loads(response.read().decode('utf-8'))['categories']
 			categories_names = set(
 				value['Name'] for value in categories)
 			if incParents:
@@ -260,7 +248,7 @@ class BadIPsAction(ActionBase):
 		for ip in ips:
 			try:
 				self._jail.actions[self.banaction].ban({
-					'ip': IPAddr(ip),
+					'ip': ip,
 					'failures': 0,
 					'matches': "",
 					'ipmatches': "",
@@ -281,7 +269,7 @@ class BadIPsAction(ActionBase):
 		for ip in ips:
 			try:
 				self._jail.actions[self.banaction].unban({
-					'ip': IPAddr(ip),
+					'ip': ip,
 					'failures': 0,
 					'matches': "",
 					'ipmatches': "",

config/action.d/blocklist_de.conf

@@ -54,7 +54,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = curl --fail --data-urlencode 'server=<email>' --data 'apikey=<apikey>' --data 'service=<service>' --data 'ip=<ip>' --data-urlencode 'logs=<matches>' --data 'format=text' --user-agent "<agent>" "https://www.blocklist.de/en/httpreports.html"
+actionban = curl --fail --data-urlencode 'server=<email>' --data 'apikey=<apikey>' --data 'service=<service>' --data 'ip=<ip>' --data-urlencode 'logs=<matches>' --data 'format=text' --user-agent "fail2ban v0.8.12" "https://www.blocklist.de/en/httpreports.html"
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the

config/action.d/bsd-ipfw.conf

@@ -38,7 +38,7 @@ actioncheck =
 # Values:  CMD
 #
 # requires an ipfw rule like "deny ip from table(1) to me"
-actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || { echo "$e" 1>&2; exit $x; }
+actionban = ipfw table <table> add <ip>
 
 
 # Option:  actionunban
@@ -47,7 +47,7 @@ actionban = e=`ipfw table <table> add <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ip
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = e=`ipfw table <table> delete <ip> 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || { echo "$e" 1>&2; exit $x; }
+actionunban = ipfw table <table> delete <ip>
 
 [Init]
 # Option:  table

config/action.d/cloudflare.conf

@@ -1,16 +1,10 @@
 #
 # Author: Mike Rushton
 #
-# IMPORTANT
+# Referenced from from http://www.normyee.net/blog/2012/02/02/adding-cloudflare-support-to-fail2ban by NORM YEE
 #
-# Please set jail.local's permission to 640 because it contains your CF API key.
+# To get your Cloudflare API key: https://www.cloudflare.com/my-account
 #
-# This action depends on curl.
-# Referenced from http://www.normyee.net/blog/2012/02/02/adding-cloudflare-support-to-fail2ban by NORM YEE
-#
-# To get your CloudFlare API Key: https://www.cloudflare.com/a/account/my-account
-#
-# CloudFlare API error codes: https://www.cloudflare.com/docs/host-api.html#s4.2
 
 [Definition]
 
@@ -40,8 +34,7 @@ actioncheck =
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=ban' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
-
+actionban = curl https://www.cloudflare.com/api_json.html -d 'a=ban' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -50,19 +43,13 @@ actionban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionunban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=nul' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
+actionunban = curl https://www.cloudflare.com/api_json.html -d 'a=nul' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
+
 
 [Init]
 
-# If you like to use this action with mailing whois lines, you could use the composite action
-# action_cf_mwl predefined in jail.conf, just define in your jail:
-#
-# action = %(action_cf_mwl)s
-# # Your CF account e-mail
-# cfemail  = 
-# # Your CF API Key
-# cfapikey = 
+# Default Cloudflare API token 
+cftoken = 
 
-cftoken =
-
-cfuser =
+# Default Cloudflare username
+cfuser = 

config/action.d/firewallcmd-allports.conf

@@ -1,53 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# Because of the --remove-rules in stop this action requires firewalld-0.3.8+
-
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
-              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -j f2b-<name>
-
-actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -j f2b-<name>
-             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
-             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
-
-
-# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-recidive$'
-
-actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
-
-actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-
-chain = INPUT_direct
-
-# DEV NOTES:
-#
-# Author: Donald Yandt 
-# Uses "FirewallD" instead of the "iptables daemon".
-#
-#
-# Output:
-
-# actionstart:
-# $ firewall-cmd --direct --add-chain ipv4 filter f2b-recidive
-# success
-# $ firewall-cmd --direct --add-rule ipv4 filter f2b-recidive 1000 -j RETURN
-# success
-# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-recidive
-# success
-

config/action.d/firewallcmd-multiport.conf

@@ -1,63 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# Because of the --remove-rules in stop this action requires firewalld-0.3.8+
-
-[INCLUDES]
-
-before = iptables-common.conf
-
-[Definition]
-
-actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
-              firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-
-actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m conntrack --ctstate NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
-             firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
-
-# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$'
-
-actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'
-
-actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
-
-[Init]
-
-# Default name of the chain
-name = default
-
-chain = INPUT_direct
-
-# Could also use port numbers separated by a comma. 
-port = 1:65535
-
-
-# Option:  protocol
-# Values:  [ tcp | udp | icmp | all ]
-
-protocol = tcp
-
-
-
-# DEV NOTES:
-#
-# Author: Donald Yandt 
-# Uses "FirewallD" instead of the "iptables daemon".
-#
-#
-# Output:
-# actionstart:
-# $ firewall-cmd --direct --add-chain ipv4 filter f2b-apache-modsecurity
-# success
-# $ firewall-cmd --direct --add-rule ipv4 filter f2b-apache-modsecurity 1000 -j RETURN
-# success
-# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 80,443 -j f2b-apache-modsecurity
-# success
-# actioncheck:
-# $ firewall-cmd --direct --get-chains ipv4 filter f2b-apache-modsecurity | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$'
-# f2b-apache-modsecurity
-

config/action.d/firewallcmd-new.conf

@@ -10,9 +10,9 @@ before = iptables-common.conf
 
 actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b-<name>
               firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 1000 -j RETURN
-              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+              firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
 
-actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> -m multiport --dports <port> -j f2b-<name>
+actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
              firewall-cmd --direct --remove-rules ipv4 filter f2b-<name>
              firewall-cmd --direct --remove-chain ipv4 filter f2b-<name>
 
@@ -43,7 +43,7 @@ chain = INPUT_direct
 # success
 # $ firewall-cmd --direct --add-rule ipv4 filter fail2ban-name 1000 -j RETURN
 # success
-# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 22 -j fail2ban-name
+# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp --dport 22 -j fail2ban-name
 # success
 # $ firewall-cmd --direct --get-chains ipv4 filter
 # fail2ban-name

config/action.d/firewallcmd-rich-logging.conf

@@ -1,65 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# 
-# Because of the rich rule commands requires firewalld-0.3.1+
-# This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not
-# by chain. So for an example all deny rules will be listed under <zone>_deny and all log rules under <zone>_log. 
-#
-# Also this action logs banned access attempts so you can filter that and increase ban time for offenders.
-#
-# If you use the --permanent rule you get a xml file in /etc/firewalld/zones/<zone>.xml that can be shared and parsed easliy
-#
-# Example commands to view rules:
-# firewall-cmd [--zone=<zone>] --list-rich-rules
-# firewall-cmd [--zone=<zone>] --list-all
-# firewall-cmd [--zone=zone] --query-rich-rule='rule'
-
-[Definition]
-
-actionstart = 
-
-actionstop = 
-
-actioncheck = 
-
-# you can also use zones and/or service names. 
-#
-# zone example: 
-# 	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' port port='<port>' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"
-# service name example:
-#	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' service name='<service>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"
-# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges seperated by a comma or space for an example: http, https, 22-60, 18 smtp 
-
-actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"; done
-	   
-actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <blocktype>"; done
-
-[Init]
-
-name = default
-
-# log levels are "emerg", "alert", "crit", "error", "warning", "notice", "info" or "debug"
-level = info
-
-# log rate per minute
-rate = 1
-
-zone = public
-
-# use command firewall-cmd --get-services to see a list of services available
-#
-# Examples:
-#
-# amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps 
-# freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos 
-# kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s 
-# postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy 
-# telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
-
-service = ssh
-
-# reject types: 'icmp-net-unreachable', 'icmp-host-unreachable', 'icmp-port-unreachable', 'icmp-proto-unreachable', 
-# 'icmp-net-prohibited', 'icmp-host-prohibited', 'icmp-admin-prohibited' or 'tcp-reset'
-
-blocktype = reject type='icmp-port-unreachable'

config/action.d/firewallcmd-rich-rules.conf

@@ -1,57 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Donald Yandt 
-# 
-# Because of the rich rule commands requires firewalld-0.3.1+
-# This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not
-# by chain. So for an example all deny rules will be listed under <zone>_deny. 
-#
-# If you use the --permanent rule you get a xml file in /etc/firewalld/zones/<zone>.xml that can be shared and parsed easliy
-#
-# Example commands to view rules:
-# firewall-cmd [--zone=<zone>] --list-rich-rules
-# firewall-cmd [--zone=<zone>] --list-all
-# firewall-cmd [--zone=zone] --query-rich-rule='rule'
-
-[Definition]
-
-actionstart = 
-
-actionstop = 
-
-actioncheck = 
-
-#you can also use zones and/or service names. 
-#
-# zone example: 
-# 	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' port port='<port>' protocol='<protocol>' <blocktype>"
-# service name example:
-#	firewall-cmd --zone=<zone> --add-rich-rule="rule family='ipv4' source address='<ip>' service name='<service>' <blocktype>"
-# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges seperated by a comma or space for an example: http, https, 22-60, 18 smtp 
-
-actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' <blocktype>"; done
-	   
-actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='<ip>' port port='$p' protocol='<protocol>' <blocktype>"; done
-
-[Init]
-
-name = default
-
-zone = public
-
-# use command firewall-cmd --get-services to see a list of services available
-#
-# Examples:
-#
-# amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps 
-# freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos 
-# kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s 
-# postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy 
-# telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
-
-service = ssh
-
-# reject types: 'icmp-net-unreachable', 'icmp-host-unreachable', 'icmp-port-unreachable', 'icmp-proto-unreachable', 
-# 'icmp-net-prohibited', 'icmp-host-prohibited', 'icmp-admin-prohibited' or 'tcp-reset'
-
-blocktype = reject type='icmp-port-unreachable'

config/action.d/iptables-allports.conf

@@ -3,8 +3,6 @@
 # Author: Cyril Jaquier
 # Modified: Yaroslav O. Halchenko <debian@onerussian.com>
 # 			made active on all ports from original iptables.conf
-# Modified: Alexander Koeppe <format_c@online.de>
-#        make config file IPv6 capable
 #
 #
 
@@ -19,32 +17,23 @@ before = iptables-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -p <protocol> -j f2b-<name>
-
-actionstart6 = <ip6tables> -N f2b-<name>
-               <ip6tables> -A f2b-<name> -j <returntype>
-               <ip6tables> -I <chain> -p <protocol> -j f2b-<name>
+actionstart = iptables -N f2b-<name>
+              iptables -A f2b-<name> -j RETURN
+              iptables -I <chain> -p <protocol> -j f2b-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -j f2b-<name>
-             <iptables> -F f2b-<name>
-             <iptables> -X f2b-<name>
-
-actionstop6 = <ip6tables> -D <chain> -p <protocol> -j f2b-<name>
-              <ip6tables> -F f2b-<name>
-              <ip6tables> -X f2b-<name>
+actionstop = iptables -D <chain> -p <protocol> -j f2b-<name>
+             iptables -F f2b-<name>
+             iptables -X f2b-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
-actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -52,8 +41,7 @@ actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
-actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
+actionban = iptables -I f2b-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -61,9 +49,7 @@ actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
-actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j <blocktype6>
-
+actionunban = iptables -D f2b-<name> -s <ip> -j <blocktype>
 
 [Init]
 

config/action.d/iptables-common.conf

@@ -6,9 +6,6 @@
 # used in all iptables based actions by default.
 #
 # The user can override the defaults in iptables-common.local
-#
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 
 [INCLUDES]
 
@@ -46,28 +43,3 @@ protocol = tcp
 #          REJECT, REJECT --reject-with icmp-port-unreachable
 # Values:  STRING
 blocktype = REJECT --reject-with icmp-port-unreachable
-blocktype6 = REJECT --reject-with icmp6-port-unreachable
-
-# Option:  returntype
-# Note:    This is the default rule on "actionstart". This should be RETURN
-#          in all (blocking) actions, except REJECT in allowing actions.
-# Values:  STRING
-returntype = RETURN
-
-# Option:  lockingopt
-# Notes.:  Option was introduced to iptables to prevent multiple instances from
-#          running concurrently and causing irratic behavior.  -w was introduced
-#          in iptables 1.4.20, so might be absent on older systems
-#          See https://github.com/fail2ban/fail2ban/issues/1122
-# Values:  STRING
-lockingopt = -w
-
-# Option:  iptables
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-iptables = iptables <lockingopt>
-
-# Option:  ip6tables
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-ip6tables = ip6tables <lockingopt>

config/action.d/iptables-ipset-proto4.conf

@@ -28,13 +28,13 @@ before = iptables-common.conf
 # Values:  CMD
 #
 actionstart = ipset --create f2b-<name> iphash
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
+              iptables -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
              ipset --flush f2b-<name>
              ipset --destroy f2b-<name>
 

config/action.d/iptables-ipset-proto6-allports.conf

@@ -12,9 +12,6 @@
 #
 # If you are running on an older kernel you make need to patch in external
 # modules which probably won't be protocol version 6.
-#
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 
 [INCLUDES]
 
@@ -27,23 +24,16 @@ before = iptables-common.conf
 # Values:  CMD
 #
 actionstart = ipset create f2b-<name> hash:ip timeout <bantime>
-              <iptables> -I <chain> -m set --match-set f2b-<name> src -j <blocktype>
-
-actionstart6 = ipset create f2b-<name>6 hash:ip timeout <bantime> family inet6
-               <ip6tables> -I <chain> -m set --match-set f2b-<name>6 src -j <blocktype6>
+              iptables -I <chain> -m set --match-set f2b-<name> src -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -m set --match-set f2b-<name> src -j <blocktype>
+actionstop = iptables -D <chain> -m set --match-set f2b-<name> src -j <blocktype>
              ipset flush f2b-<name>
              ipset destroy f2b-<name>
 
-actionstop6 = <ip6tables> -D <chain> -m set --match-set f2b-<name>6 src -j <blocktype6>
-              ipset flush f2b-<name>6
-              ipset destroy f2b-<name>6
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -51,7 +41,6 @@ actionstop6 = <ip6tables> -D <chain> -m set --match-set f2b-<name>6 src -j <bloc
 # Values:  CMD
 #
 actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
-actionban6 = ipset add f2b-<name>6 <ip> timeout <bantime> -exist
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -60,7 +49,6 @@ actionban6 = ipset add f2b-<name>6 <ip> timeout <bantime> -exist
 # Values:  CMD
 #
 actionunban = ipset del f2b-<name> <ip> -exist
-actionunban6 = ipset del f2b-<name>6 <ip> -exist
 
 [Init]
 

config/action.d/iptables-ipset-proto6.conf

@@ -12,9 +12,6 @@
 #
 # If you are running on an older kernel you make need to patch in external
 # modules.
-#
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 
 [INCLUDES]
 
@@ -27,23 +24,16 @@ before = iptables-common.conf
 # Values:  CMD
 #
 actionstart = ipset create f2b-<name> hash:ip timeout <bantime>
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
-
-actionstart6 = ipset create f2b-<name>6 hash:ip timeout <bantime> family inet6
-               <ip6tables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name>6 src -j <blocktype6>
+              iptables -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name> src -j <blocktype>
              ipset flush f2b-<name>
              ipset destroy f2b-<name>
 
-actionstop6 = <ip6tables> -D <chain> -p <protocol> -m multiport --dports <port> -m set --match-set f2b-<name>6 src -j <blocktype6>
-              ipset flush f2b-<name>6
-              ipset destroy f2b-<name>6
-
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -51,7 +41,6 @@ actionstop6 = <ip6tables> -D <chain> -p <protocol> -m multiport --dports <port>
 # Values:  CMD
 #
 actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
-actionban6 = ipset add f2b-<name>6 <ip> timeout <bantime> -exist
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -60,7 +49,6 @@ actionban6 = ipset add f2b-<name>6 <ip> timeout <bantime> -exist
 # Values:  CMD
 #
 actionunban = ipset del f2b-<name> <ip> -exist
-actionunban6 = ipset del f2b-<name>6 <ip> -exist
 
 [Init]
 

config/action.d/iptables-multiport-log.conf

@@ -7,8 +7,6 @@
 # make "f2b-<name>-log" chain to log and drop
 # insert a jump to f2b-<name> from -I <chain> if proto/port match
 #
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 #
 
 [INCLUDES]
@@ -21,42 +19,28 @@ before = iptables-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> 1 -p <protocol> -m multiport --dports <port> -j f2b-<name>
-              <iptables> -N f2b-<name>-log
-              <iptables> -I f2b-<name>-log -j LOG --log-prefix "$(expr f2b-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
-              <iptables> -A f2b-<name>-log -j <blocktype>
-
-actionstart6 = <ip6tables> -N f2b-<name>
-               <ip6tables> -A f2b-<name> -j <returntype>
-               <ip6tables> -I <chain> 1 -p <protocol> -m multiport --dports <port> -j f2b-<name>
-               <ip6tables> -N f2b-<name>-log
-               <ip6tables> -I f2b-<name>-log -j LOG --log-prefix "$(expr f2b-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
-               <ip6tables> -A f2b-<name>-log -j <blocktype6>
+actionstart = iptables -N f2b-<name>
+              iptables -A f2b-<name> -j RETURN
+              iptables -I <chain> 1 -p <protocol> -m multiport --dports <port> -j f2b-<name>
+              iptables -N f2b-<name>-log
+              iptables -I f2b-<name>-log -j LOG --log-prefix "$(expr f2b-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
+              iptables -A f2b-<name>-log -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             <iptables> -F f2b-<name>
-             <iptables> -F f2b-<name>-log
-             <iptables> -X f2b-<name>
-             <iptables> -X f2b-<name>-log
-
-actionstop6 = <ip6tables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-              <ip6tables> -F f2b-<name>
-              <ip6tables> -F f2b-<name>-log
-              <ip6tables> -X f2b-<name>
-              <ip6tables> -X f2b-<name>-log
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
+             iptables -F f2b-<name>
+             iptables -F f2b-<name>-log
+             iptables -X f2b-<name>
+             iptables -X f2b-<name>-log
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L f2b-<name>-log >/dev/null
-actioncheck6 = <ip6tables> -n -L f2b-<name>-log >/dev/null
+actioncheck = iptables -n -L f2b-<name>-log >/dev/null
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -64,8 +48,7 @@ actioncheck6 = <ip6tables> -n -L f2b-<name>-log >/dev/null
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
-actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
+actionban = iptables -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -73,8 +56,7 @@ actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j f2b-<name>-log
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j f2b-<name>-log
-actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j f2b-<name>-log
+actionunban = iptables -D f2b-<name> -s <ip> -j f2b-<name>-log
 
 [Init]
 

config/action.d/iptables-multiport.conf

@@ -2,8 +2,6 @@
 #
 # Author: Cyril Jaquier
 # Modified by Yaroslav Halchenko for multiport banning
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 #
 
 [INCLUDES]
@@ -16,32 +14,23 @@ before = iptables-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-
-actionstart6 = <ip6tables> -N f2b-<name>
-               <ip6tables> -A f2b-<name> -j <returntype>
-               <ip6tables> -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
+actionstart = iptables -N f2b-<name>
+              iptables -A f2b-<name> -j RETURN
+              iptables -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-             <iptables> -F f2b-<name>
-             <iptables> -X f2b-<name>
-
-actionstop6 = <ip6tables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
-              <ip6tables> -F f2b-<name>
-              <ip6tables> -X f2b-<name>
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
+             iptables -F f2b-<name>
+             iptables -X f2b-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
-actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -49,8 +38,7 @@ actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
-actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
+actionban = iptables -I f2b-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -58,8 +46,7 @@ actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
-actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j <blocktype6>
+actionunban = iptables -D f2b-<name> -s <ip> -j <blocktype>
 
 [Init]
 

config/action.d/iptables-new.conf

@@ -4,8 +4,6 @@
 # Copied from iptables.conf and modified by Yaroslav Halchenko 
 #  to fulfill the needs of bugreporter dbts#350746.
 #
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 #
 
 [INCLUDES]
@@ -18,32 +16,23 @@ before = iptables-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
-
-actionstart6 = <ip6tables> -N f2b-<name>
-               <ip6tables> -A f2b-<name> -j <returntype>
-               <ip6tables> -I <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
+actionstart = iptables -N f2b-<name>
+              iptables -A f2b-<name> -j RETURN
+              iptables -I <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
-             <iptables> -F f2b-<name>
-             <iptables> -X f2b-<name>
-
-actionstop6 = <ip6tables> -D <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
-              <ip6tables> -F f2b-<name>
-              <ip6tables> -X f2b-<name>
+actionstop = iptables -D <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
+             iptables -F f2b-<name>
+             iptables -X f2b-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
-actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -51,8 +40,7 @@ actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
-actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
+actionban = iptables -I f2b-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -60,8 +48,7 @@ actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
-actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j <blocktype6>
+actionunban = iptables -D f2b-<name> -s <ip> -j <blocktype>
 
 [Init]
 

config/action.d/iptables-xt_recent-echo.conf

@@ -2,8 +2,6 @@
 #
 # Author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
 #
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 #
 
 [INCLUDES]
@@ -34,24 +32,20 @@ before = iptables-common.conf
 #    own rules. The 3600 second timeout is independent and acts as a
 #    safeguard in case the fail2ban process dies unexpectedly. The
 #    shorter of the two timeouts actually matters.
-actionstart = if [ `id -u` -eq 0 ];then <iptables> -I <chain> -m recent --update --seconds 3600 --name f2b-<name> -j <blocktype>;fi
-actionstart6 = if [ `id -u` -eq 0 ];then <ip6tables> -I <chain> -m recent --update --seconds 3600 --name f2b-<name>6 -j <blocktype6>;fi
+actionstart = if [ `id -u` -eq 0 ];then iptables -I <chain> -m recent --update --seconds 3600 --name f2b-<name> -j <blocktype>;fi
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = echo / > /proc/net/xt_recent/f2b-<name>
-             if [ `id -u` -eq 0 ];then <iptables> -D <chain> -m recent --update --seconds 3600 --name f2b-<name> -j <blocktype>;fi
-actionstop6 = echo / > /proc/net/xt_recent/f2b-<name>6
-             if [ `id -u` -eq 0 ];then <ip6tables> -D <chain> -m recent --update --seconds 3600 --name f2b-<name>6 -j <blocktype6>;fi
+             if [ `id -u` -eq 0 ];then iptables -D <chain> -m recent --update --seconds 3600 --name f2b-<name> -j <blocktype>;fi
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = test -e /proc/net/xt_recent/f2b-<name>
-actioncheck6 = test -e /proc/net/xt_recent/f2b-<name>6
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -60,7 +54,6 @@ actioncheck6 = test -e /proc/net/xt_recent/f2b-<name>6
 # Values:  CMD
 #
 actionban = echo +<ip> > /proc/net/xt_recent/f2b-<name>
-actionban6 = echo +<ip> > /proc/net/xt_recent/f2b-<name>6
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -69,7 +62,6 @@ actionban6 = echo +<ip> > /proc/net/xt_recent/f2b-<name>6
 # Values:  CMD
 #
 actionunban = echo -<ip> > /proc/net/xt_recent/f2b-<name>
-actionunban6 = echo -<ip> > /proc/net/xt_recent/f2b-<name>6
 
 [Init]
 

config/action.d/iptables.conf

@@ -2,8 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# Modified: Alexander Koeppe <format_c@online.de>
-#       made config file IPv6 capable
 #
 
 [INCLUDES]
@@ -16,32 +14,23 @@ before = iptables-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = <iptables> -N f2b-<name>
-              <iptables> -A f2b-<name> -j <returntype>
-              <iptables> -I <chain> -p <protocol> --dport <port> -j f2b-<name>
-
-actionstart6 = <ip6tables> -N f2b-<name>
-               <ip6tables> -A f2b-<name> -j <returntype>
-               <ip6tables> -I <chain> -p <protocol> --dport <port> -j f2b-<name>
+actionstart = iptables -N f2b-<name>
+              iptables -A f2b-<name> -j RETURN
+              iptables -I <chain> -p <protocol> --dport <port> -j f2b-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = <iptables> -D <chain> -p <protocol> --dport <port> -j f2b-<name>
-             <iptables> -F f2b-<name>
-             <iptables> -X f2b-<name>
-
-actionstop6 = <ip6tables> -D <chain> -p <protocol> --dport <port> -j f2b-<name>
-              <ip6tables> -F f2b-<name>
-              <ip6tables> -X f2b-<name>
+actionstop = iptables -D <chain> -p <protocol> --dport <port> -j f2b-<name>
+             iptables -F f2b-<name>
+             iptables -X f2b-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
-actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
+actioncheck = iptables -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -49,8 +38,7 @@ actioncheck6 = <ip6tables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
-actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
+actionban = iptables -I f2b-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -58,8 +46,7 @@ actionban6 = <ip6tables> -I f2b-<name> 1 -s <ip> -j <blocktype6>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
-actionunban6 = <ip6tables> -D f2b-<name> -s <ip> -j <blocktype6>
+actionunban = iptables -D f2b-<name> -s <ip> -j <blocktype>
 
 [Init]
 

config/action.d/mail-whois-common.conf

@@ -1,28 +0,0 @@
-# Fail2Ban configuration file
-#
-# Common settings for mail actions
-#
-# Users can override the defaults in mail-whois-common.local
-
-[INCLUDES]
-
-# Load customizations if any available
-after = mail-whois-common.local
-
-[DEFAULT]
-#original character set of whois output will be sent to mail program
-_whois = whois <ip> || echo "missing whois program"
-
-# use heuristics to convert charset of whois output to a target
-# character set before sending it to a mail program
-# make sure you have 'file' and 'iconv' commands installed when opting for that
-_whois_target_charset = UTF-8
-_whois_convert_charset = whois <ip> |
-                         { WHOIS_OUTPUT=$(cat) ; WHOIS_CHARSET=$(printf %%b "$WHOIS_OUTPUT" | file -b --mime-encoding -) ; printf %%b "$WHOIS_OUTPUT" | iconv -f $WHOIS_CHARSET -t %(_whois_target_charset)s//TRANSLIT - ; }
-
-# choose between _whois and _whois_convert_charset in mail-whois-common.local
-# or other *.local which include mail-whois-common.conf.
-_whois_command = %(_whois)s
-#_whois_command = %(_whois_convert_charset)s
-
-[Init]

config/action.d/mail-whois-lines.conf

@@ -4,10 +4,6 @@
 # Modified-By: Yaroslav Halchenko to include grepping on IP over log files
 #
 
-[INCLUDES]
-
-before = mail-whois-common.conf
-
 [Definition]
 
 # Option:  actionstart
@@ -43,10 +39,10 @@ actioncheck =
 actionban = printf %%b "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n\n
+            Here is more information about <ip>:\n
+            `whois <ip> || echo missing whois program`\n\n
             Lines containing IP:<ip> in <logpath>\n
-            `grep -E <grepopts> '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
+            `grep '[^0-9]<ip>[^0-9]' <logpath>`\n\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from  `uname -n`" <dest>
 
@@ -71,7 +67,3 @@ dest = root
 # Path to the log files which contain relevant lines for the abuser IP
 #
 logpath = /dev/null
-
-# Number of log lines to include in the email
-#
-grepopts = -m 1000

config/action.d/mail-whois.conf

@@ -4,10 +4,6 @@
 #
 #
 
-[INCLUDES]
-
-before = mail-whois-common.conf
-
 [Definition]
 
 # Option:  actionstart
@@ -43,8 +39,8 @@ actioncheck =
 actionban = printf %%b "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            `%(_whois_command)s`\n
+            Here is more information about <ip>:\n
+            `whois <ip> || echo missing whois program`\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest>
 

config/action.d/mynetwatchman.conf

@@ -111,17 +111,13 @@ myip = `ip -4 addr show dev eth0 | grep inet | head -n 1 | sed -r 's/.*inet ([0-
 #
 protocol = tcp
 
-# Option:  agent
-# Default: Fail2ban
-agent = Fail2ban
-
 # Option:  getcmd
 # Notes.:  A command to fetch a URL. Should output page to STDOUT
 # Values:  CMD  Default: wget
 #
-getcmd = wget --no-verbose --tries=3 --waitretry=10 --connect-timeout=10 --read-timeout=60 --retry-connrefused --output-document=- --user-agent=<agent>
+getcmd = wget --no-verbose --tries=3 --waitretry=10 --connect-timeout=10 --read-timeout=60 --retry-connrefused --output-document=- --user-agent=Fail2Ban
 # Alternative value:
-# getcmd = curl --silent --show-error --retry 3 --connect-timeout 10 --max-time 60 --user-agent <agent>
+# getcmd = curl --silent --show-error --retry 3 --connect-timeout 10 --max-time 60 --user-agent Fail2Ban
 
 # Option:  srcport
 # Notes.:  The source port of the attack. You're unlikely to have this info, so

config/action.d/nftables-allports.conf

@@ -1,22 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-
-[INCLUDES]
-
-before = nftables-common.conf
-
-[Definition]
-
-# Option:  nftables_mode
-# Notes.:  additional expressions for nftables filter rule
-# Values:  nftables expressions
-#
-nftables_mode = ip protocol <protocol>
-
-[Init]

config/action.d/nftables-common.conf

@@ -1,119 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Daniel Black
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-# This is a included configuration file and includes the definitions for the nftables
-# used in all nftables based actions by default.
-#
-# The user can override the defaults in nftables-common.local
-
-[INCLUDES]
-
-after = nftables-common.local
-
-[Definition]
-
-# Option:  nftables_mode
-# Notes.:  additional expressions for nftables filter rule
-# Values:  nftables expressions
-#
-nftables_mode = <protocol> dport \{ <port> \}
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = <nftables> add set <nftables_family> <nftables_table> f2b-<name> \{ type <nftables_type>\; \}
-              <nftables> insert rule <nftables_family> <nftables_table> <chain> %(nftables_mode)s ip saddr @f2b-<name> <blocktype>
-
-_nft_list = <nftables> --handle --numeric list chain <nftables_family> <nftables_table> <chain>
-_nft_get_handle_id = grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep -oe ' handle [0-9]*'
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = HANDLE_ID=$(%(_nft_list)s | %(_nft_get_handle_id)s)
-             <nftables> delete rule <nftables_family> <nftables_table> <chain> $HANDLE_ID
-             <nftables> delete set <nftables_family> <nftables_table> f2b-<name>
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <nftables> list chain <nftables_family> <nftables_table> <chain> | grep -q '@f2b-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <nftables> add element <nftables_family> <nftables_table> f2b-<name> \{ <ip> \}
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <nftables> delete element <nftables_family> <nftables_table> f2b-<name> \{ <ip> \}
-
-[Init]
-
-# Option:  nftables_type
-# Notes.:  address type to work with
-# Values:  [ipv4_addr | ipv6_addr]  Default: ipv4_addr
-#
-nftables_type = ipv4_addr
-
-# Option:  nftables_family
-# Notes.:  address family to work in
-# Values:  [ip | ip6 | inet]  Default: inet
-#
-nftables_family = inet
-
-# Option:  nftables_table
-# Notes.:  table in the address family to work in
-# Values:  STRING  Default: filter
-#
-nftables_table = filter
-
-# Option:  chain
-# Notes    specifies the nftables chain to which the Fail2Ban rules should be
-#          added
-# Values:  STRING  Default: input
-chain = input
-
-# Default name of the filtering set
-#
-name = default
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp ] Default: tcp
-#
-protocol = tcp
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the nftables man page (section 8). Common values are drop
-#          reject, reject with icmp type host-unreachable
-# Values:  STRING
-blocktype = reject
-
-# Option:  nftables
-# Notes.:  Actual command to be executed, including common to all calls options
-# Values:  STRING
-nftables = nft

config/action.d/nftables-multiport.conf

@@ -1,22 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-# Modified: Alexander Belykh <albel727@ngs.ru>
-#                       adapted for nftables
-#
-
-[INCLUDES]
-
-before = nftables-common.conf
-
-[Definition]
-
-# Option:  nftables_mode
-# Notes.:  additional expressions for nftables filter rule
-# Values:  nftables expressions
-#
-nftables_mode = <protocol> dport \{ <port> \}
-
-[Init]

config/action.d/nsupdate.conf

@@ -1,114 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Andrew St. Jean
-#
-# Use nsupdate to perform dynamic DNS updates on a BIND zone file.
-# One may want to do this to update a local RBL with banned IP addresses.
-#
-# Options
-#
-# domain	DNS domain that will appear in nsupdate add and delete
-#		commands.
-#
-# ttl		The time to live (TTL) in seconds of the TXT resource
-#		record.
-#
-# rdata		Data portion of the TXT resource record.
-#
-# nsupdatecmd	Full path to the nsupdate command.
-#
-# keyfile	Full path to TSIG key file used for authentication between
-#		nsupdate and BIND.
-#
-# Create an nsupdate.local to set at least the <domain> and <keyfile>
-# options as they don't have default values.
-#
-# The ban and unban commands assume nsupdate will authenticate to the BIND
-# server using a TSIG key. The full path to the key file must be specified
-# in the <keyfile> parameter. Use this command to generate your TSIG key.
-#
-# dnssec-keygen -a HMAC-MD5 -b 256 -n HOST <key_name>
-#
-# Replace <key_name> with some meaningful name.
-#
-# This command will generate two files. Specify the .private file in the
-# <keyfile> option. Note that the .key file must also be present in the same
-# directory for nsupdate to use the key.
-#
-# Don't forget to add the key and appropriate allow-update or update-policy
-# option to your named.conf file.
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart =
-
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop =
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = echo <ip> | awk -F. '{print "prereq nxrrset "$4"."$3"."$2"."$1".<domain> TXT"; print "update add "$4"."$3"."$2"."$1".<domain> <ttl> IN TXT \"<rdata>\""; print "send"}' | <nsupdatecmd> -k <keyfile>
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = echo <ip> | awk -F. '{print "update delete "$4"."$3"."$2"."$1".<domain>"; print "send"}' | <nsupdatecmd> -k <keyfile>
-
-[Init]
-
-# Option:  domain
-# Notes.:  DNS domain that nsupdate will update.
-# Values:  STRING
-#
-domain = 
-
-# Option:  ttl
-# Notes.:  time to live (TTL) in seconds of TXT resource record
-#          added by nsupdate.
-# Values:  NUM
-#
-ttl = 60
-
-# Option:  rdata
-# Notes.:  data portion of the TXT resource record added by nsupdate.
-# Values:  STRING
-#
-rdata = Your IP has been banned
-
-# Option:  nsupdatecmd
-# Notes.:  specifies the full path to the nsupdate program that dynamically
-#          updates BIND zone files.
-# Values:  CMD
-#
-nsupdatecmd = /usr/bin/nsupdate
-
-# Option:  keyfile
-# Notes.:  specifies the full path to the file containing the
-#	   TSIG key for communicating with BIND.
-# Values:  STRING
-#
-keyfile = 
-

config/action.d/pf.conf

@@ -3,7 +3,6 @@
 # OpenBSD pf ban/unban
 #
 # Author: Nick Hilliard <nick@foobar.org>
-# Modified by: Alexander Koeppe making PF work seamless and with IPv4 and IPv6
 #
 #
 
@@ -13,27 +12,23 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-# we don't enable PF automatically; to enable run pfctl -e 
-# or add `pf_enable="YES"` to /etc/rc.conf (tested on FreeBSD)
-actionstart = echo "table <<tablename>-<name>> persist counters" | pfctl -f- 
-              echo "block proto <protocol> from <<tablename>-<name>> to any port <port>" | pfctl -f-
+# we don't enable PF automatically, as it will be enabled elsewhere
+actionstart = 
 
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-# we only disable PF rules we've installed prior
-actionstop = pfctl -sr 2>/dev/null | grep -v <tablename>-<name> | pfctl -f-
-             pfctl -t <tablename>-<name> -T flush
-             pfctl -t <tablename>-<name> -T kill
+# we don't disable PF automatically either
+actionstop = 
 
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = pfctl -sr | grep -q <tablename>-<name>
+actioncheck = 
 
 
 # Option:  actionban
@@ -44,7 +39,7 @@ actioncheck = pfctl -sr | grep -q <tablename>-<name>
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = pfctl -t <tablename>-<name> -T add <ip>
+actionban = /sbin/pfctl -t <tablename> -T add <ip>/32
 
 
 # Option:  actionunban
@@ -56,24 +51,12 @@ actionban = pfctl -t <tablename>-<name> -T add <ip>
 # Values:  CMD
 #
 # note -r option used to remove matching rule
-actionunban = pfctl -t <tablename>-<name> -T delete <ip>
+actionunban = /sbin/pfctl -t <tablename> -T delete <ip>/32
 
 [Init]
 # Option:  tablename
 # Notes.:  The pf table name.
 # Values:  [ STRING ]
 #
-tablename = f2b
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | ipv6-icmp ] Default: tcp
-#
-protocol = tcp
-
-# Option:  port
-# Notes.:  the port to block, defaults to any
-# Values:  [ STRING ]
-#
-port = any
+tablename = fail2ban
 

config/action.d/route.conf

@@ -17,9 +17,6 @@
 [Definition]
 actionban   = ip route add <blocktype> <ip>
 actionunban = ip route del <blocktype> <ip>
-actioncheck =
-actionstart =
-actionstop =
 
 [Init]
 

config/action.d/sendmail-common.conf

@@ -15,7 +15,7 @@ after = sendmail-common.local
 # Values:  CMD
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
-              Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
+              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
               From: <sendername> <<sender>>
               To: <dest>\n
               Hi,\n
@@ -28,7 +28,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
 # Values:  CMD
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
-             Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
+             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
              From: <sendername> <<sender>>
              To: <dest>\n
              Hi,\n
@@ -40,7 +40,7 @@ actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck =
+actioncheck = 
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -48,7 +48,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban =
+actionban = 
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -56,7 +56,7 @@ actionban =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban =
+actionunban = 
 
 [Init]
 

config/action.d/sendmail-geoip-lines.conf

@@ -1,53 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Viktor Szépe
-#
-#
-
-[INCLUDES]
-
-before = sendmail-common.conf
-
-[Definition]
-
-# Option:  actionban
-# Notes.:  Command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-#          You need to install geoiplookup and the GeoLite or GeoIP databases.
-#          (geoip-bin and geoip-database in Debian)
-#          The host command comes from bind9-host package.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
-            From: <sendername> <<sender>>
-            To: <dest>\n
-            Hi,\n
-            The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
-            http://bgp.he.net/ip/<ip>
-            http://www.projecthoneypot.org/ip_<ip>
-            http://whois.domaintools.com/<ip>\n\n
-            Country:`geoiplookup -f /usr/share/GeoIP/GeoIP.dat "<ip>" | cut -d':' -f2-`
-            AS:`geoiplookup -f /usr/share/GeoIP/GeoIPASNum.dat "<ip>" | cut -d':' -f2-`
-            hostname: `host -t A <ip> 2>&1`\n\n
-            Lines containing IP:<ip> in <logpath>\n
-            `grep -E <grepopts> '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
-            Regards,\n
-            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
-
-[Init]
-
-# Default name of the chain
-#
-name = default
-
-# Path to the log files which contain relevant lines for the abuser IP
-#
-logpath = /dev/null
-
-# Number of log lines to include in the email
-#
-grepopts = -m 1000

config/action.d/sendmail-whois-ipjailmatches.conf

@@ -17,13 +17,13 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
+            Here are more information about <ip>:\n
             `/usr/bin/whois <ip>`\n\n
             Matches for <name> with <ipjailfailures> failures IP:<ip>\n
             <ipjailmatches>\n\n

config/action.d/sendmail-whois-ipmatches.conf

@@ -17,13 +17,13 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
+            Here are more information about <ip>:\n
             `/usr/bin/whois <ip>`\n\n
             Matches with <ipfailures> failures IP:<ip>\n
             <ipmatches>\n\n

config/action.d/sendmail-whois-lines.conf

@@ -17,16 +17,16 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
+            Here is more information about <ip>:\n
             `/usr/bin/whois <ip> || echo missing whois program`\n\n
             Lines containing IP:<ip> in <logpath>\n
-            `grep -E <grepopts> '(^|[^0-9])<ip>([^0-9]|$)' <logpath>`\n\n
+            `grep '[^0-9]<ip>[^0-9]' <logpath>`\n\n
             Regards,\n
             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 
@@ -40,6 +40,3 @@ name = default
 #
 logpath = /dev/null
 
-# Number of log lines to include in the email
-#
-grepopts = -m 1000

config/action.d/sendmail-whois-matches.conf

@@ -17,13 +17,13 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
+            Here are more information about <ip>:\n
             `/usr/bin/whois <ip>`\n\n
             Matches:\n
             <matches>\n\n

config/action.d/sendmail-whois.conf

@@ -17,13 +17,13 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here is more information about <ip> :\n
+            Here is more information about <ip>:\n
             `/usr/bin/whois <ip> || echo missing whois program`\n
             Regards,\n
             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>

config/action.d/sendmail.conf

@@ -17,7 +17,7 @@ before = sendmail-common.conf
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
-            Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n

config/action.d/shorewall-ipset-proto6.conf

@@ -1,85 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Eduardo Diaz
-#
-# This is for ipset protocol 6 (and hopefully later) (ipset v6.14).
-# for shorewall
-#
-# Use this setting in jail.conf to modify use this action instead of a
-# default one
-#
-# banaction   = shorewall-ipset-proto6
-#
-# This requires the program ipset which is normally in package called ipset.
-#
-# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0
-# kernels, and you need Shorewall >= 4.5.5 to use this action.
-#
-# The default Shorewall configuration is with "BLACKLISTNEWONLY=Yes" (see
-# file /etc/shorewall/shorewall.conf). This means that when Fail2ban adds a
-# new shorewall rule to ban an IP address, that rule will affect only new
-# connections. So if the attacker goes on trying using the same connection
-# he could even log in. In order to get the same behavior of the iptable
-# action (so that the ban is immediate) the /etc/shorewall/shorewall.conf
-# file should me modified with "BLACKLISTNEWONLY=No".
-#
-#
-# Enable shorewall to use a blacklist using iptables creating a file
-# /etc/shorewall/blrules and adding "DROP net:+f2b-ssh all" and
-# similar lines for every jail.  To enable restoring you ipset you
-# must set SAVE_IPSETS=Yes in shorewall.conf .  You can read more
-# about ipsets handling in Shorewall at http://shorewall.net/ipsets.html
-#
-# To force creation of the ipset in the case that somebody deletes the
-# ipset create a file /etc/shorewall/initdone and add one line for
-# every ipset (this files are in Perl) and add 1 at the end of the file.
-# The example:
-# system("/usr/sbin/ipset -quiet -exist create f2b-ssh hash:ip timeout 600 ");
-# 1;
-#
-# To destroy the ipset in shorewall you must add to the file /etc/shorewall/stopped
-# # One line of every ipset
-# system("/usr/sbin/ipset -quiet destroy f2b-ssh ");
-# 1; # This must go to the end of the file if not shorewall compilation fails
-#
-
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = if ! ipset -quiet -name list f2b-<name> >/dev/null;
-              then ipset -quiet -exist create f2b-<name> hash:ip timeout <bantime>;
-              fi
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = ipset flush f2b-<name>
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = ipset del f2b-<name> <ip> -exist
-
-[Init]
-
-# Option: bantime
-# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
-# Values:  [ NUM ]  Default: 600
-#
-bantime = 600

config/action.d/smtp.py

@@ -68,7 +68,6 @@ Matches for %(ip)s for jail %(jailname)s:
 %(ipjailmatches)s
 """
 
-
 class SMTPAction(ActionBase):
 	"""Fail2Ban action which sends emails to inform on jail starting,
 	stopping and bans.

config/action.d/symbiosis-blacklist-allports.conf

@@ -3,9 +3,6 @@
 # Author: Yaroslav Halchenko
 #
 
-[INCLUDES]
-
-before = iptables-common.conf
 
 [Definition]
 
@@ -25,21 +22,21 @@ actionstop =
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <iptables> -n -L <chain>
+actioncheck = iptables -n -L <chain>
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP.
 # Values:  CMD
 #
 actionban = echo 'all' >| /etc/symbiosis/firewall/blacklist.d/<ip>.auto
-            <iptables> -I <chain> 1 -s <ip> -j <blocktype>
+            iptables -I <chain> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP.
 # Values:  CMD
 #
 actionunban = rm -f /etc/symbiosis/firewall/blacklist.d/<ip>.auto
-              <iptables> -D <chain> -s <ip> -j <blocktype> || :
+              iptables -D <chain> -s <ip> -j <blocktype> || :
 
 [Init]
 

config/action.d/ufw.conf

@@ -13,11 +13,9 @@ actionstop =
 
 actioncheck = 
 
-actionban = [ -n "<application>" ] && app="app <application>"
-            ufw insert <insertpos> <blocktype> from <ip> to <destination> $app
+actionban = [ -n "<application>" ] && app="app <application>" ; ufw insert <insertpos> <blocktype> from <ip> to <destination> $app
 
-actionunban = [ -n "<application>" ] && app="app <application>"
-              ufw delete <blocktype> from <ip> to <destination> $app
+actionunban = [ -n "<application>" ] && app="app <application>" ; ufw delete <blocktype> from <ip> to <destination> $app
 
 [Init]
 # Option: insertpos

config/action.d/xarf-login-attack.conf

@@ -1,7 +1,7 @@
 # Fail2Ban action for sending xarf Login-Attack messages to IP owner
 #
-# IMPORTANT:
-#
+# IMPORTANT: 
+# 
 # Emailing a IP owner of abuse is a serious complain. Make sure that it is
 # serious. Fail2ban developers and network owners recommend you only use this
 # action for:
@@ -46,7 +46,7 @@ actionban = oifs=${IFS}; IFS=.;SEP_IP=( <ip> ); set -- ${SEP_IP}; ADDRESSES=$(di
             REPORTID=<time>@`uname -n`
             TLP=<tlp>
             PORT=<port>
-            DATE=`LC_ALL=C date --date=@<time> +"%%a, %%d %%h %%Y %%T %%z"`
+            DATE=`LC_TIME=C date -u --date=@<time> +"%%a, %%d %%h %%Y %%T +0000"`
             if [ ! -z "$ADDRESSES" ]; then
                 (printf -- %%b "<header>\n<message>\n<report>\n";
                  date '+Note: Local timezone is %%z (%%Z)';
@@ -70,7 +70,7 @@ footer = \n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e--
 report =  --Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8; name=\"report.txt\";\n\n---\nReported-From: $FROM\nCategory: abuse\nReport-ID: $REPORTID\nReport-Type: login-attack\nService: $SERVICE\nVersion: 0.2\nUser-Agent: Fail2ban v0.9\nDate: $DATE\nSource-Type: ip-address\nSource: $IP\nPort: $PORT\nSchema-URL: http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json\nAttachment: text/plain\nOccurances: $FAILURES\nTLP: $TLP\n\n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf8; name=\"logfile.log\";
 
 # Option: Message
-# Notes:  This can be modified by the users
+# Notes:  This can be modified by the users 
 message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to abusix.com is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process.)\n\n This mail was generated by Fail2Ban in a X-ARF format! You can find more information about x-arf at http://www.x-arf.org/specification.html.\n\nThe recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here: https://abusix.com/global-reporting/abuse-contact-db\nabusix.com is neither responsible nor liable for the content or accuracy of this message.\n
 
 # Option:  loglines
@@ -97,7 +97,7 @@ mailargs = -f <sender>
 # Option:  tlp
 # Notes.:  Traffic light protocol defining the sharing of this information.
 #          http://www.trusted-introducer.org/ISTLPv11.pdf
-#          green is share to those involved in network security but it is not
+#          green is share to those involved in network security but it is not 
 #          to be released to the public.
 tlp = green
 

config/fail2ban.conf

@@ -34,12 +34,6 @@ loglevel = INFO
 #
 logtarget = /var/log/fail2ban.log
 
-# Option: syslogsocket
-# Notes: Set the syslog socket file. Only used when logtarget is SYSLOG
-#        auto uses platform.system() to determine predefined paths
-# Values: [ auto | FILE ]  Default: auto
-syslogsocket = auto
-
 # Option: socket
 # Notes.: Set the socket file. This is used to communicate with the daemon. Do
 #         not remove this file when Fail2ban runs. It will not be possible to

config/filter.d/apache-auth.conf

@@ -10,7 +10,7 @@ before = apache-common.conf
 [Definition]
 
 
-failregex = ^%(_apache_error_client)s (AH(01797|01630): )?client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$
+failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$
             ^%(_apache_error_client)s (AH01617: )?user .*? authentication failure for "\S*": Password Mismatch(, referer: \S+)?$
             ^%(_apache_error_client)s (AH01618: )?user .*? not found(: )?\S*(, referer: \S+)?\s*$
             ^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme: \S*(, referer: \S+)?\s*$

config/filter.d/apache-badbots.conf

@@ -8,9 +8,9 @@
 [Definition]
 
 badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider
-badbots = Atomic_Email_Hunter/4\.0|atSpider/1\.0|autoemailspider|bwh3_user_agent|China Local Browse 2\.6|ContactBot/0\.2|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailSpider|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Guestbook Auto Submitter|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 \+http\://letscrawl\.com/|Lincoln State Web Browser|LMQueueBot/0\.2|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|MVAClient|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/3\.0 \(compatible; scan4mail \(advanced version\) http\://www\.peterspages\.net/?scan4mail\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|NameOfAgent \(CMS Spider\)|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|ShablastBot 1\.0|snap\.com beta crawler v0|Snapbot/1\.0|Snapbot/1\.0 \(Snap Shots, \+http\://www\.snap\.com\)|sogou develop spider|Sogou Orion spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sogou spider|Sogou web spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|VadixBot|WebVulnCrawl\.unknown/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
+badbots = Atomic_Email_Hunter/4\.0|atSpider/1\.0|autoemailspider|bwh3_user_agent|China Local Browse 2\.6|ContactBot/0\.2|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailSpider|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Guestbook Auto Submitter|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LMQueueBot/0\.2|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|MVAClient|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/3\.0 \(compatible; scan4mail \(advanced version\) http\://www\.peterspages\.net/?scan4mail\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|NameOfAgent \(CMS Spider\)|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|ShablastBot 1\.0|snap\.com beta crawler v0|Snapbot/1\.0|Snapbot/1\.0 \(Snap Shots, +http\://www\.snap\.com\)|sogou develop spider|Sogou Orion spider/3\.0\(+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sogou spider|Sogou web spider/3\.0\(+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|VadixBot|WebVulnCrawl\.unknown/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
 
-failregex = ^<HOST> -.*"(GET|POST|HEAD).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
+failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
 
 ignoreregex =
 

config/filter.d/apache-botsearch.conf

@@ -17,9 +17,7 @@
 [INCLUDES]
 
 # overwrite with apache-common.local if _apache_error_client is incorrect.
-# Load regexes for filtering from botsearch-common.conf
 before = apache-common.conf
-         botsearch-common.conf
 
 [Definition]
 
@@ -33,8 +31,18 @@ ignoreregex =
 
 # Webroot represents the webroot on which all other files are based
 webroot = /var/www/
+# Block is the actual non-found directories to block
+block = (<webmail>|<phpmyadmin>|<wordpress>)[^,]*
+
+# These are just convient definitions that assist the blocking of stuff that 
+# isn't installed
+webmail = roundcube|(ext)?mail|horde|(v-?)?webmail
+
+phpmyadmin = (typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin)
+
+wordpress = wp-(login|signup)\.php
 
 
 # DEV Notes:
 #
-# Author: Daniel Black
+# Author: Daniel Black

config/filter.d/apache-fakegooglebot.conf

@@ -1,14 +0,0 @@
-# Fail2Ban filter for fake Googlebot User Agents
-
-[Definition]
-
-failregex = ^<HOST> .*Googlebot.*$
-
-ignoreregex =
-
-
-# DEV Notes:
-#
-# Author: Lee Clemens
-# Thanks: Johannes B. Ullrich, Ph.D.
-# Reference: https://isc.sans.edu/forums/diary/When+Google+isnt+Google/15968/

config/filter.d/apache-pass.conf

@@ -1,20 +0,0 @@
-# Fail2Ban Apache pass filter
-# This filter is for access.log, NOT for error.log
-#
-# The knocking request must have a referer.
-
-[INCLUDES]
-
-before = apache-common.conf
-
-[Definition]
-
-failregex = ^<HOST> - \w+ \[\] "GET <knocking_url> HTTP/1\.[01]" 200 \d+ ".*" "[^-].*"$
-
-ignoreregex =
-
-[Init]
-
-knocking_url = /knocking/
-
-# Author: Viktor Szépe

config/filter.d/apache-shellshock.conf

@@ -1,26 +0,0 @@
-# Fail2Ban filter to block web requests containing custom headers attempting to exploit the shellshock bug
-#
-#
-
-[INCLUDES]
-
-# overwrite with apache-common.local if _apache_error_client is incorrect.
-before = apache-common.conf
-
-[Definition]
-
-failregex = ^%(_apache_error_client)s (AH01215: )?/bin/(ba)?sh: warning: HTTP_.*?: ignoring function definition attempt(, referer: \S+)?\s*$
-            ^%(_apache_error_client)s (AH01215: )?/bin/(ba)?sh: error importing function definition for `HTTP_.*?'(, referer: \S+)?\s*$
-
-ignoreregex = 
-
-
-# DEV Notes:
-#
-# https://wiki.apache.org/httpd/ListOfErrors for apache error IDs
-#
-# example log lines: 
-# [Thu Sep 25 09:27:18.813902 2014] [cgi:error] [pid 16860] [client 89.207.132.76:59635] AH01215: /bin/bash: warning: HTTP_TEST: ignoring function definition attempt
-# [Thu Sep 25 09:29:56.141832 2014] [cgi:error] [pid 16864] [client 162.247.73.206:41273] AH01215: /bin/bash: error importing function definition for `HTTP_TEST'
-#
-# Author: Eugene Hopkinson (riot@riot.so)

config/filter.d/asterisk.conf

@@ -13,19 +13,17 @@ _daemon = asterisk
 
 __pid_re = (?:\[\d+\])
 
-iso8601 = \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+[+-]\d{4}
-
 # All Asterisk log messages begin like this:
 log_prefix= (?:NOTICE|SECURITY)%(__pid_re)s:?(?:\[C-[\da-f]*\])? \S+:\d*( in \w+:)?
 
 failregex = ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - (Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$
-            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Call from '[^']*' \(<HOST>:\d+\) to extension '[^']*' rejected because extension not found in context
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Call from '[^']*' \(<HOST>:\d+\) to extension '\d+' rejected because extension not found in context 'default'\.$
             ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Host <HOST> failed to authenticate as '[^']*'$
             ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)$
             ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
             ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Failed to authenticate (user|device) [^@]+@<HOST>\S*$
-            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s hacking attempt detected '<HOST>'$
-            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="([\d-]+|%(iso8601)s)",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="(\d*|<unknown>)",SessionID=".+",LocalAddress="IPV[46]/(UDP|TCP|WS)/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UDP|TCP|WS)/<HOST>/\d+"(,Challenge="[\w/]+")?(,ReceivedChallenge="\w+")?(,Response="\w+",ExpectedResponse="\w*")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s (?:handle_request_subscribe: )?Sending fake auth rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S*$
+            ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d*",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"(,Challenge="\w+",ReceivedChallenge="\w+")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$
             ^(%(__prefix_line)s|\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])? )Ext\. s: "Rejecting unknown SIP connection from <HOST>"$
 
 ignoreregex =

config/filter.d/botsearch-common.conf

@@ -1,19 +0,0 @@
-# Generic configuration file for -botsearch filters
-
-[Init]
-
-# Block is the actual non-found directories to block
-block = \/?(<webmail>|<phpmyadmin>|<wordpress>|cgi-bin|mysqladmin)[^,]*
-
-# These are just convient definitions that assist the blocking of stuff that 
-# isn't installed
-webmail = roundcube|(ext)?mail|horde|(v-?)?webmail
-
-phpmyadmin = (typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin)
-
-wordpress = wp-(login|signup|admin)\.php
-
-# DEV Notes:
-# Taken from apache-botsearch filter
-# 
-# Author: Frantisek Sumsal

config/filter.d/common.conf

@@ -53,8 +53,4 @@ __bsd_syslog_verbose = (<[^.]+\.[^.]+>)
 # This can be optional (for instance if we match named native log files)
 __prefix_line = \s*%(__bsd_syslog_verbose)s?\s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s%(__daemon_extra_re)s?\s*
 
-# PAM authentication mechanism check for failures, e.g.: pam_unix, pam_sss,
-# pam_ldap
-__pam_auth = pam_unix
-
 # Author: Yaroslav Halchenko

config/filter.d/counter-strike.conf

@@ -6,7 +6,6 @@
 
 failregex = ^: Bad Rcon: "rcon \d+ "\S+"  sv_contact ".*?"" from "<HOST>:\d+"$
 
-ignoreregex =
 
 [Init]
 

config/filter.d/dovecot.conf

@@ -9,11 +9,9 @@ before = common.conf
 
 _daemon = (auth|dovecot(-auth)?|auth-worker)
 
-failregex = ^%(__prefix_line)s(%(__pam_auth)s(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
+failregex = ^%(__prefix_line)s(pam_unix(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
             ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>(, lip=(\d{1,3}\.){3}\d{1,3})?(, TLS( handshaking(: SSL_accept\(\) failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s*$
-            ^%(__prefix_line)s(Info|dovecot: auth\(default\)|auth-worker\(\d+\)): pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$
-            ^%(__prefix_line)s(auth|auth-worker\(\d+\)): (pam|passwd-file)\(\S+,<HOST>\): unknown user\s*$
-            ^%(__prefix_line)s(auth|auth-worker\(\d+\)): Info: ldap\(\S*,<HOST>,\S*\): invalid credentials\s*$
+            ^%(__prefix_line)s(Info|dovecot: auth\(default\)): pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$
 
 ignoreregex = 
 
@@ -23,10 +21,9 @@ journalmatch = _SYSTEMD_UNIT=dovecot.service
 
 # DEV Notes:
 # * the first regex is essentially a copy of pam-generic.conf
-# * Probably doesn't do dovecot sql/ldap backends properly (resolved in edit 21/03/2016)
+# * Probably doesn't do dovecot sql/ldap backends properly
 # * Removed the 'no auth attempts' log lines from the matches because produces
 #    lots of false positives on misconfigured MTAs making regexp unusable
 #
 # Author: Martin Waschbuesch
 #         Daniel Black (rewrote with begin and end anchors)
-#         Martin O'Neal (added LDAP authentication failure regex)

config/filter.d/drupal-auth.conf

@@ -1,26 +0,0 @@
-# Fail2Ban filter to block repeated failed login attempts to Drupal site(s)
-#
-#
-# Drupal must be setup to use Syslog, which defaults to the following format:
-#
-#   !base_url|!timestamp|!type|!ip|!request_uri|!referer|!uid|!link|!message
-#
-#
-
-[INCLUDES]
-
-before = common.conf
-
-
-[Definition]
-
-failregex = ^%(__prefix_line)s(https?:\/\/)([\da-z\.-]+)\.([a-z\.]{2,6})(\/[\w\.-]+)*\|\d{10}\|user\|<HOST>\|.+\|.+\|\d\|.*\|Login attempt failed for .+\.$
-
-ignoreregex =
-
-
-# DEV Notes:
-#
-# https://www.drupal.org/documentation/modules/syslog
-#
-# Author: Lee Clemens

config/filter.d/exim.conf

@@ -14,13 +14,10 @@ before = exim-common.conf
 [Definition]
 
 failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
-            ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[<HOST>\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
-            ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$
-            ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
-            ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
-            ^%(pid)s SMTP protocol error in "AUTH \S*(| \S*)" H=(|\S* )(|\(\S*\) )\[<HOST>\]\:\d+ I=\[\S*\]\:\d+ AUTH command used when not advertised\s*$
-            ^%(pid)s no MAIL in SMTP connection from (|\S* )(|\(\S*\) )\[<HOST>\]\:\d+ I=\[\S*\]\:\d+ D=\d+s(| C=\S*)\s*$
-            ^%(pid)s \S+ SMTP connection from (|\S* )(|\(\S*\) )\[<HOST>\]\:\d+ I=\[\S*\]\:\d+ closed by DROP in ACL\s*$
+             ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
+             ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$
+             ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
+             ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\]:\d+ )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
 
 ignoreregex = 
 
@@ -33,4 +30,3 @@ ignoreregex =
 #
 # Author: Cyril Jaquier
 #         Daniel Black (rewrote with strong regexs)
-#         Martin O'Neal (added additional regexs to detect authentication failures, protocol errors, and drops)

config/filter.d/freeswitch.conf

@@ -16,7 +16,7 @@ failregex = ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ SIP auth (failure|challenge) \((
 ignoreregex =
 
 # Author: Rupa SChomaker, soapee01, Daniel Black
-# https://freeswitch.org/confluence/display/FREESWITCH/Fail2Ban
+# http://wiki.freeswitch.org/wiki/Fail2ban
 # Thanks to Jim on mailing list of samples and guidance
 #
 # No need to match the following. Its a duplicate of the SIP auth regex.

config/filter.d/froxlor-auth.conf

@@ -1,37 +0,0 @@
-# Fail2Ban configuration file to block repeated failed login attempts to Frolor installation(s)
-# 
-# Froxlor needs to log to Syslog User (e.g. /var/log/user.log) with one of the following messages
-# <syslog prefix> Froxlor: [Login Action <HOST>] Unknown user '<USER>' tried to login.
-# <syslog prefix> Froxlor: [Login Action <HOST>] User '<USER>' tried to login with wrong password.
-#
-# Author: Joern Muehlencord
-#
-
-[INCLUDES]
-
-# Read common prefixes. If any customizations available -- read them from
-# common.local
-before = common.conf
-
-
-[Definition]
-
-_daemon = Froxlor
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = ^%(__prefix_line)s\[Login Action <HOST>\] Unknown user \S* tried to login.$
-            ^%(__prefix_line)s\[Login Action <HOST>\] User \S* tried to login with wrong password.$
-
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex =
-

config/filter.d/groupoffice.conf

@@ -8,7 +8,7 @@
 
 failregex = ^\[\]LOGIN FAILED for user: "\S+" from IP: <HOST>$
 
-ignoreregex =
+
 
 # Author: Daniel Black
 

config/filter.d/haproxy-http-auth.conf

@@ -1,37 +0,0 @@
-# Fail2Ban filter configuration file to match failed login attempts to
-# HAProxy HTTP Authentication protected servers.
-#
-# PLEASE NOTE - When a user first hits the HTTP Auth a 401 is returned by the server
-# which prompts their browser to ask for login details.
-# This initial 401 is logged by HAProxy.
-# In other words, even successful logins will have at least 1 fail regex match.
-# Please keep this in mind when setting findtime and maxretry for jails.
-#
-# Author: Jordan Moeser
-#
-
-[INCLUDES]
-
-# Read common prefixes. If any customizations available -- read them from
-# common.local
-before = common.conf
-
-
-[Definition]
-
-_daemon = haproxy
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-failregex = ^%(__prefix_line)s<HOST>.*<NOSRV> -1/-1/-1/-1/\+*\d* 401
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex =

config/filter.d/ignorecommands/apache-fakegooglebot

@@ -1,35 +0,0 @@
-#!/usr/bin/python
-# Inspired by https://isc.sans.edu/forums/diary/When+Google+isnt+Google/15968/
-#
-# Written in Python to reuse built-in Python batteries and not depend on
-# presence of host and cut commands
-#
-import sys
-
-def process_args(argv):
-    if len(argv) != 2:
-       sys.stderr.write("Please provide a single IP as an argument. Got: %s\n"
-                        % (argv[1:]))
-       sys.exit(2)
-
-    ip = argv[1]
-
-    from fail2ban.server.filter import DNSUtils
-    if not DNSUtils.isValidIP(ip):
-       sys.stderr.write("Argument must be a single valid IP. Got: %s\n"
-                        % ip)
-       sys.exit(3)
-    return ip
-
-def is_googlebot(ip):
-    import re
-    from fail2ban.server.filter import DNSUtils
-
-    host = DNSUtils.ipToName(ip)
-    if not host or not re.match('.*\.google(bot)?\.com$', host):
-       sys.exit(1)
-    host_ips = DNSUtils.dnsToIp(host)
-    sys.exit(0 if ip in host_ips else 1)
-
-if __name__ == '__main__':
-    is_googlebot(process_args(sys.argv))

config/filter.d/kerio.conf

@@ -6,9 +6,6 @@ failregex = ^ SMTP Spam attack detected from <HOST>,
             ^ IP address <HOST> found in DNS blacklist \S+, mail from \S+ to \S+$
             ^ Relay attempt from IP address <HOST>
             ^ Attempt to deliver to unknown recipient \S+, from \S+, IP address <HOST>$
-
-ignoreregex =
-
 [Init]
 
 datepattern = ^\[%%d/%%b/%%Y %%H:%%M:%%S\]

config/filter.d/monit.conf

@@ -2,20 +2,8 @@
 #
 #
 
-[INCLUDES]
-
-# Read common prefixes. If any customizations available -- read them from
-# common.local
-before = common.conf
-
 [Definition]
 
-_daemon = monit
+failregex = ^\[[A-Z]+\s+\]\s*error\s*:\s*Warning:\s+Client '<HOST>' supplied unknown user '\w+' accessing monit httpd$
+            ^\[[A-Z]+\s+\]\s*error\s*:\s*Warning:\s+Client '<HOST>' supplied wrong password for user '\w+' accessing monit httpd$
 
-# Regexp for previous (accessing monit httpd) and new (access denied) versions
-failregex = ^\[[A-Z]+\s+\]\s*error\s*:\s*Warning:\s+Client '<HOST>' supplied (?:unknown user '[^']+'|wrong password for user '[^']*') accessing monit httpd$
-            ^%(__prefix_line)s\w+: access denied -- client <HOST>: (?:unknown user '[^']+'|wrong password for user '[^']*'|empty password)$
-
-# Ignore login with empty user (first connect, no user specified)
-# ignoreregex = %(__prefix_line)s\w+: access denied -- client <HOST>: (?:unknown user '')
-ignoreregex =

config/filter.d/murmur.conf

@@ -1,28 +0,0 @@
-# Fail2Ban filter for murmur/mumble-server
-#
-
-[INCLUDES]
-
-before = common.conf
-
-
-[Definition]
-
-_daemon = murmurd
-
-# N.B. If you allow users to have usernames that include the '>' character you
-#      should change this to match the regex assigned to the 'username'
-#      variable in your server config file (murmur.ini / mumble-server.ini).
-_usernameregex = [^>]+
-
-_prefix = <W>[\n\s]*(\.\d{3})?\s+\d+ => <\d+:%(_usernameregex)s\(-1\)> Rejected connection from <HOST>:\d+:
-
-failregex = ^%(_prefix)s Invalid server password$
-            ^%(_prefix)s Wrong certificate or password for existing user$
-
-ignoreregex =
-
-
-# DEV Notes:
-#
-# Author: Ross Brown

config/filter.d/mysqld-auth.conf

@@ -17,7 +17,7 @@ before = common.conf
 
 _daemon = mysqld
 
-failregex = ^%(__prefix_line)s(?:\d+ |\d{6} \s?\d{1,2}:\d{2}:\d{2} )?\[\w+\] Access denied for user '[^']+'@'<HOST>' (to database '[^']*'|\(using password: (YES|NO)\))*\s*$
+failregex = ^%(__prefix_line)s(\d{6} \s?\d{1,2}:\d{2}:\d{2} )?\[Warning\] Access denied for user '\w+'@'<HOST>' (to database '[^']*'|\(using password: (YES|NO)\))*\s*$
 
 ignoreregex = 
 

config/filter.d/named-refused.conf

@@ -38,8 +38,6 @@ failregex = ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (vie
             ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
             ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$
 
-ignoreregex =
-
 # DEV Notes:
 # Trying to generalize the
 #          structure which is general to capture general patterns in log

config/filter.d/nginx-botsearch.conf

@@ -1,20 +0,0 @@
-# Fail2Ban filter to match web requests for selected URLs that don't exist
-#
-
-[INCLUDES]
-
-# Load regexes for filtering
-before = botsearch-common.conf
-
-[Definition]
-
-failregex = ^<HOST> \- \S+ \[\] \"(GET|POST|HEAD) \/<block> \S+\" 404 .+$
-            ^ \[error\] \d+#\d+: \*\d+ (\S+ )?\"\S+\" (failed|is not found) \(2\: No such file or directory\), client\: <HOST>\, server\: \S*\, request: \"(GET|POST|HEAD) \/<block> \S+\"\, .*?$
-
-ignoreregex = 
-
-
-# DEV Notes:
-# Based on apache-botsearch filter
-# 
-# Author: Frantisek Sumsal

config/filter.d/nginx-limit-req.conf

@@ -1,45 +0,0 @@
-# Fail2ban filter configuration for nginx :: limit_req
-# used to ban hosts, that were failed through nginx by limit request processing rate 
-#
-# Author: Serg G. Brester (sebres)
-#
-# To use 'nginx-limit-req' filter you should have `ngx_http_limit_req_module`
-# and define `limit_req` and `limit_req_zone` as described in nginx documentation
-# http://nginx.org/en/docs/http/ngx_http_limit_req_module.html
-#
-# Example:
-#
-#   http {
-#     ...
-#     limit_req_zone $binary_remote_addr zone=lr_zone:10m rate=1r/s;
-#     ...
-#     # http, server, or location:
-#     location ... {
-#       limit_req zone=lr_zone burst=1 nodelay;
-#       ...
-#     }
-#     ...
-#   }
-#   ...
-#
-
-[Definition]
-
-# Specify following expression to define exact zones, if you want to ban IPs limited 
-# from specified zones only.
-# Example:
-#
-#   ngx_limit_req_zones = lr_zone|lr_zone2
-#
-ngx_limit_req_zones = [^"]+
-
-# Use following full expression if you should range limit request to specified 
-# servers, requests, referrers etc. only :
-#
-# failregex = ^\s*\[error\] \d+#\d+: \*\d+ limiting requests, excess: [\d\.]+ by zone "(?:%(ngx_limit_req_zones)s)", client: <HOST>, server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(, referrer: "\S+")?\s*$
-
-# Shortly, much faster and stable version of regexp:
-failregex = ^\s*\[error\] \d+#\d+: \*\d+ limiting requests, excess: [\d\.]+ by zone "(?:%(ngx_limit_req_zones)s)", client: <HOST>
-
-ignoreregex = 
-

config/filter.d/nsd.conf

@@ -24,5 +24,3 @@ _daemon = nsd
 
 failregex =  ^\[\]%(__prefix_line)sinfo: ratelimit block .* query <HOST> TYPE255$
               ^\[\]%(__prefix_line)sinfo: .* <HOST> refused, no acl matches\.$
-
-ignoreregex =

config/filter.d/openhab.conf

@@ -1,16 +0,0 @@
-# Openhab brute force auth filter: /etc/fail2ban/filter.d/openhab.conf:
-#
-# Block IPs trying to auth openhab by web or rest api
-#
-# Matches e.g.
-# 12.34.33.22 -  -  [26/sept./2015:18:04:43 +0200] "GET /openhab.app HTTP/1.1" 401 1382 
-# 175.18.15.10 -  -  [02/sept./2015:00:11:31 +0200] "GET /rest/bindings HTTP/1.1" 401 1384
-
-[Definition] 
-failregex = ^<HOST>\s+-\s+-\s+\[\]\s+"[A-Z]+ .*" 401 \d+\s*$
-
-[Init]
-datepattern = %%d/%%b[^/]*/%%Y:%%H:%%M:%%S %%z
-
-
-

config/filter.d/pam-generic.conf

@@ -13,7 +13,7 @@ before = common.conf
 # Default: catch all failed logins
 _ttys_re=\S*
 
-__pam_re=\(?%(__pam_auth)s(?:\(\S+\))?\)?:?
+__pam_re=\(?pam_unix(?:\(\S+\))?\)?:?
 _daemon = \S+
 
 failregex = ^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=%(_ttys_re)s ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$

config/filter.d/portsentry.conf

@@ -1,12 +0,0 @@
-# Fail2Ban filter for failure attempts in Counter Strike-1.6
-#
-#
-
-[Definition]
-
-failregex = \/<HOST> Port\: [0-9]+ (TCP|UDP) Blocked$
-
-ignoreregex =
-
-# Author: Pacop <pacoparu@gmail.com>
-

config/filter.d/postfix-rbl.conf

@@ -1,19 +0,0 @@
-# Fail2Ban filter for Postfix's RBL based Blocked hosts
-#
-#
-
-[INCLUDES]
-
-# Read common prefixes. If any customizations available -- read them from
-# common.local
-before = common.conf
-
-[Definition]
-
-_daemon = postfix(-\w+)?/smtpd
-
-failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 454 4\.7\.1 Service unavailable; Client host \[\S+\] blocked using .* from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$
-
-ignoreregex =
-
-# Author: Lee Clemens

config/filter.d/postfix-sasl.conf

@@ -7,11 +7,9 @@ before = common.conf
 
 [Definition]
 
-_daemon = postfix(-\w+)?/(?:submission/|smtps/)?smtp[ds]
+_daemon = postfix/smtpd
 
-failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/:]*={0,2})?\s*$
-
-ignoreregex = authentication failed: Connection lost to authentication server$
+failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$
 
 [Init]
 

config/filter.d/postfix.conf

@@ -10,14 +10,11 @@ before = common.conf
 
 [Definition]
 
-_daemon = postfix(-\w+)?/(?:submission/|smtps/)?smtp[ds]
+_daemon = postfix/smtpd
 
 failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
-            ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$
             ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
-            ^%(__prefix_line)sNOQUEUE: reject: EHLO from \S+\[<HOST>\]: 504 5\.5\.2 <\S+>: Helo command rejected: need fully-qualified hostname;
             ^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$
-            ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.1\.8 <\S*>: Sender address rejected: Domain not found; from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$
             ^%(__prefix_line)simproper command pipelining after \S+ from [^[]*\[<HOST>\]:?$
 
 ignoreregex = 

config/filter.d/proftpd.conf

@@ -2,9 +2,6 @@
 #
 # Set "UseReverseDNS off" in proftpd.conf to avoid the need for DNS.
 # See: http://www.proftpd.org/docs/howto/DNS.html
-# When the default locale for your system is not en_US.UTF-8
-# on Debian-based systems be sure to add this to /etc/default/proftpd
-# export LC_TIME="en_US.UTF-8"
 
 [INCLUDES]
 

config/filter.d/pure-ftpd.conf

@@ -21,10 +21,6 @@ failregex = ^%(__prefix_line)s\(.+?@<HOST>\) \[WARNING\] %(__errmsg)s\s*$
 
 ignoreregex = 
 
-[Init]
-
-journalmatch = _SYSTEMD_UNIT=pure-ftpd.service + _COMM=pure-ftpd
-
 # Author: Cyril Jaquier
 # Modified: Yaroslav Halchenko for pure-ftpd
 # Documentation thanks to Blake on http://www.fail2ban.org/wiki/index.php?title=Fail2ban:Community_Portal