diff --git a/CHANGELOG b/CHANGELOG index 71983906..1de258b9 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -4,9 +4,22 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ============================================================= -Fail2Ban (version 0.7.6) 2007/01/04 +Fail2Ban (version 0.7.7) 2007/02/08 ============================================================= +ver. 0.7.7 (2007/02/08) - release candidate +---------- +- Added signal handling in fail2ban-client +- Added a wonderful visual effect when waiting on the server +- fail2ban-client returns an error code if configuration is + not valid +- Added new filters/actions. Thanks to Yaroslav Halchenko +- Call Python interpreter directly (instead of using "env") +- Added file support to fail2ban-regex. Benchmark feature has + been removed +- Added cacti script and template. +- Added IP list in "status ". Thanks to Eric Gerbier + ver. 0.7.6 (2007/01/04) - beta ---------- - Added a "sleep 1" in redhat-initd. Thanks to Jim Wight diff --git a/PKG-INFO b/PKG-INFO index ff840082..c4e2eb9b 100644 --- a/PKG-INFO +++ b/PKG-INFO @@ -1,6 +1,6 @@ Metadata-Version: 1.0 Name: fail2ban -Version: 0.7.6 +Version: 0.7.7 Summary: Ban IPs that make too many password failure Home-page: http://fail2ban.sourceforge.net Author: Cyril Jaquier diff --git a/README b/README index 6ff995c2..369c87e4 100644 --- a/README +++ b/README @@ -4,7 +4,7 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ============================================================= -Fail2Ban (version 0.7.6) 2007/01/04 +Fail2Ban (version 0.7.7) 2007/02/08 ============================================================= Fail2Ban scans log files like /var/log/pwdfail and bans IP @@ -15,7 +15,7 @@ or Apache web server ones. This README is a quick introduction to Fail2ban. More documentation, FAQ, HOWTOs are available on the project -website: http://fail2ban.sourceforge.net +website: http://www.fail2ban.org Installation: ------------- @@ -28,8 +28,8 @@ Optional: To install, just do: -> tar xvfj fail2ban-0.7.6.tar.bz2 -> cd fail2ban-0.7.6 +> tar xvfj fail2ban-0.7.7.tar.bz2 +> cd fail2ban-0.7.7 > python setup.py install This will install Fail2Ban into /usr/share/fail2ban. The @@ -53,7 +53,7 @@ You can configure Fail2ban using the files in /etc/fail2ban. It is possible to configure the server using commands sent to it by fail2ban-client. The available commands are described in the man page of fail2ban-client. Please refer to it or to -the website: http://fail2ban.sourceforge.net +the website: http://www.fail2ban.org Contact: -------- @@ -61,7 +61,7 @@ Contact: You need some new features, you found bugs or you just appreciate this program, you can contact me at: -Website: http://fail2ban.sourceforge.net +Website: http://www.fail2ban.org Cyril Jaquier: @@ -73,7 +73,7 @@ Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko, Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler, Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand, -René Berber, mEDI, Axel Thimm +René Berber, mEDI, Axel Thimm, Eric Gerbier License: -------- diff --git a/TODO b/TODO index 40eb6a46..e3818be2 100644 --- a/TODO +++ b/TODO @@ -4,7 +4,7 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ============================================================= -ToDo $Revision: 509 $ +ToDo $Revision: 540 $ ============================================================= Legend: @@ -13,6 +13,24 @@ Legend: # partially done * done +- Add timeout to external commands (signal alarm, watchdog + thread, etc) + +- New backend: pynotify + +- Uniformize filters and actions name. Use the software name + (openssh, postfix, proftp) + +- Added tag for failregex. Add features using this + information + +- Look at the memory consumption. Decrease memory usage + +- More detailed statistics + +- Auto-enable function (search for log files), check + modification date to see if service is still in use + - Improve parsing of the action parameters in jailreader.py - Better handling of the protocol in transmitter.py diff --git a/client/beautifier.py b/client/beautifier.py index cd485e7d..e545d0a4 100644 --- a/client/beautifier.py +++ b/client/beautifier.py @@ -16,11 +16,11 @@ # Author: Cyril Jaquier # -# $Revision: 504 $ +# $Revision: 537 $ __author__ = "Cyril Jaquier" -__version__ = "$Revision: 504 $" -__date__ = "$Date: 2006-12-23 17:37:17 +0100 (Sat, 23 Dec 2006) $" +__version__ = "$Revision: 537 $" +__date__ = "$Date: 2007-02-01 21:50:12 +0100 (Thu, 01 Feb 2007) $" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" @@ -70,11 +70,12 @@ class Beautifier: if len(inC) > 1: msg = "Status for the jail: " + inC[1] + "\n" msg = msg + "|- " + response[0][0] + "\n" - msg = msg + "| |- " + response[0][1][0][0] + ":\t\t" + `response[0][1][0][1]` + "\n" - msg = msg + "| `- " + response[0][1][1][0] + ":\t\t" + `response[0][1][1][1]` + "\n" + msg = msg + "| |- " + response[0][1][0][0] + ":\t" + `response[0][1][0][1]` + "\n" + msg = msg + "| `- " + response[0][1][1][0] + ":\t" + `response[0][1][1][1]` + "\n" msg = msg + "`- " + response[1][0] + "\n" - msg = msg + " |- " + response[1][1][0][0] + ":\t\t" + `response[1][1][0][1]` + "\n" - msg = msg + " `- " + response[1][1][1][0] + ":\t\t" + `response[1][1][1][1]` + msg = msg + " |- " + response[1][1][0][0] + ":\t" + `response[1][1][0][1]` + "\n" + msg = msg + " | `- " + response[1][1][2][0] + ":\t" + `response[1][1][2][1]` + "\n" + msg = msg + " `- " + response[1][1][1][0] + ":\t" + `response[1][1][1][1]` else: msg = "Status\n" msg = msg + "|- " + response[0][0] + ":\t" + `response[0][1]` + "\n" diff --git a/client/configurator.py b/client/configurator.py index 8279d26a..f37161a9 100644 --- a/client/configurator.py +++ b/client/configurator.py @@ -16,11 +16,11 @@ # Author: Cyril Jaquier # -# $Revision: 433 $ +# $Revision: 518 $ __author__ = "Cyril Jaquier" -__version__ = "$Revision: 433 $" -__date__ = "$Date: 2006-10-24 21:40:51 +0200 (Tue, 24 Oct 2006) $" +__version__ = "$Revision: 518 $" +__date__ = "$Date: 2007-01-08 22:15:47 +0100 (Mon, 08 Jan 2007) $" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" @@ -60,7 +60,7 @@ class Configurator: def getAllOptions(self): self.__fail2ban.getOptions() - self.__jails.getOptions() + return self.__jails.getOptions() def convertToProtocol(self): self.__streams["general"] = self.__fail2ban.convert() diff --git a/client/jailsreader.py b/client/jailsreader.py index 9e0170ad..9acf33ab 100644 --- a/client/jailsreader.py +++ b/client/jailsreader.py @@ -16,11 +16,11 @@ # Author: Cyril Jaquier # -# $Revision: 433 $ +# $Revision: 518 $ __author__ = "Cyril Jaquier" -__version__ = "$Revision: 433 $" -__date__ = "$Date: 2006-10-24 21:40:51 +0200 (Tue, 24 Oct 2006) $" +__version__ = "$Revision: 518 $" +__date__ = "$Date: 2007-01-08 22:15:47 +0100 (Mon, 08 Jan 2007) $" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" @@ -54,6 +54,8 @@ class JailsReader(ConfigReader): self.__jails.append(jail) else: logSys.error("Errors in jail '" + sec + "'. Skipping...") + return False + return True def convert(self): stream = list() diff --git a/common/protocol.py b/common/protocol.py index 2173cff3..9a2dd25d 100644 --- a/common/protocol.py +++ b/common/protocol.py @@ -16,11 +16,11 @@ # Author: Cyril Jaquier # -# $Revision: 504 $ +# $Revision: 529 $ __author__ = "Cyril Jaquier" -__version__ = "$Revision: 504 $" -__date__ = "$Date: 2006-12-23 17:37:17 +0100 (Sat, 23 Dec 2006) $" +__version__ = "$Revision: 529 $" +__date__ = "$Date: 2007-01-29 21:27:51 +0100 (Mon, 29 Jan 2007) $" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" @@ -30,23 +30,23 @@ import textwrap # Describes the protocol used to communicate with the server. protocol = [ -['', "Basic", ""], +['', "BASIC", ""], ["start", "starts the server and the jails"], ["reload", "reloads the configuration"], ["stop", "stops all jails and terminate the server"], ["status", "gets the current status of the server"], ["ping", "tests if the server is alive"], -['', "Logging", ""], +['', "LOGGING", ""], ["set loglevel ", "sets logging level to . 0 is minimal, 4 is debug"], ["get loglevel", "gets the logging level"], ["set logtarget ", "sets logging target to . Can be STDOUT, STDERR, SYSLOG or a file"], ["get logtarget", "gets logging target"], -['', "Jail control", ""], +['', "JAIL CONTROL", ""], ["add ", "creates using "], ["start ", "starts the jail "], ["stop ", "stops the jail . The jail is removed"], ["status ", "gets the current status of "], -['', "Jail configuration", ""], +['', "JAIL CONFIGURATION", ""], ["set idle on|off", "sets the idle state of "], ["set addignoreip ", "adds to the ignore list of "], ["set delignoreip ", "removes from the ignore list of "], @@ -70,7 +70,7 @@ protocol = [ ["set actioncheck ", "sets the check command of the action for "], ["set actionban ", "sets the ban command of the action for "], ["set actionunban ", "sets the unban command of the action for "], -['', "Jail information", ""], +['', "JAIL INFORMATION", ""], ["get logpath", "gets the list of the monitored files for "], ["get ignoreip", "gets the list of ignored IP addresses for "], ["get timeregex", "gets the regular expression used for the time detection for "], diff --git a/common/version.py b/common/version.py index 65655ff9..d6d3a207 100644 --- a/common/version.py +++ b/common/version.py @@ -16,12 +16,12 @@ # Author: Cyril Jaquier # -# $Revision: 512 $ +# $Revision: 543 $ __author__ = "Cyril Jaquier" -__version__ = "$Revision: 512 $" -__date__ = "$Date: 2007-01-04 13:59:09 +0100 (Thu, 04 Jan 2007) $" +__version__ = "$Revision: 543 $" +__date__ = "$Date: 2007-02-08 22:14:01 +0100 (Thu, 08 Feb 2007) $" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" -version = "0.7.6" +version = "0.7.7" diff --git a/config/action.d/iptables-multiport.conf b/config/action.d/iptables-multiport.conf new file mode 100644 index 00000000..89c87835 --- /dev/null +++ b/config/action.d/iptables-multiport.conf @@ -0,0 +1,69 @@ +# Fail2Ban configuration file +# +# Author: Cyril Jaquier +# Modified by Yaroslav Halchenko for multiport banning +# $Revision: 520 $ +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = iptables -N fail2ban- + iptables -A fail2ban- -j RETURN + iptables -I INPUT -p -m multiport --dports -j fail2ban- + +# Option: actionend +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = iptables -D INPUT -p -m multiport --dports -j fail2ban- + iptables -F fail2ban- + iptables -X fail2ban- + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = iptables -n -L INPUT | grep -q fail2ban- + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: IP address +# number of failures +#