From 03d73b78f84f717c1c221315f2ed53a4f59b6629 Mon Sep 17 00:00:00 2001 From: Cyril Jaquier Date: Tue, 12 Oct 2004 21:45:41 +0000 Subject: [PATCH] - Setup and dist files git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@22 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- CHANGELOG | 12 ++++++ MANIFEST | 12 ++++++ README | 116 +++++++++++++++++++++++++++++++++++++++++++++++++++++ setup.cfg | 5 +++ setup.py | 42 +++++++++++++++++++ version.py | 27 +++++++++++++ 6 files changed, 214 insertions(+) create mode 100644 CHANGELOG create mode 100644 MANIFEST create mode 100644 README create mode 100644 setup.cfg create mode 100755 setup.py create mode 100644 version.py diff --git a/CHANGELOG b/CHANGELOG new file mode 100644 index 00000000..23a93525 --- /dev/null +++ b/CHANGELOG @@ -0,0 +1,12 @@ + __ _ _ ___ _ + / _|__ _(_) |_ ) |__ __ _ _ _ + | _/ _` | | |/ /| '_ \/ _` | ' \ + |_| \__,_|_|_/___|_.__/\__,_|_||_| + +============================================================= +Fail2Ban (version 0.1.0) 10/12/2004 +============================================================= + +ver. 0.1.0 (10/12/2004) - alpha +---------- +- Initial release diff --git a/MANIFEST b/MANIFEST new file mode 100644 index 00000000..233eed8b --- /dev/null +++ b/MANIFEST @@ -0,0 +1,12 @@ +README +CHANGELOG +setup.cfg +setup.py +version.py +fail2ban.py +firewall/__init__.py +firewall/firewall.py +firewall/iptables.py +logreader/__init__.py +logreader/logreader.py +logreader/metalog.py diff --git a/README b/README new file mode 100644 index 00000000..60c077ef --- /dev/null +++ b/README @@ -0,0 +1,116 @@ + __ _ _ ___ _ + / _|__ _(_) |_ ) |__ __ _ _ _ + | _/ _` | | |/ /| '_ \/ _` | ' \ + |_| \__,_|_|_/___|_.__/\__,_|_||_| + +============================================================= +Fail2Ban (version 0.1.0) 10/12/2004 +============================================================= + +Fail2Ban scans log files like /var/log/pwdfail and bans IP +that makes too much password failures. It updates firewall +rules to reject the IP address. Currently metalog and +iptables are supported but it should work with other syslog +daemons. It needs log4py. + +This is my first Python program. I began learning Python for +less than one week so please be understanding ;-) English is +not either my mother tongue... + + +More details: +------------- + +Fail2Ban is rather simple. I have a home server connected to +the Internet which runs apache, samba, sshd, ... I see in my +logs that people are trying to log into my box using "manual" +brute force or scripts. They try 10, 20 and sometimes more +user/password (without success anyway). In order to +discourage these script kiddies, I wanted that sshd refuse +login from a specific ip after 3 password failures. After +some google searches, I found that sshd was not able of that. +So I search for a script or program that do it. Found +nothing :-( So I decide to write mine and to learn Python :-) + +I read the log file (/var/log/pwdfail/current on metalog) and +search for line with "Failed password". Then get the ip and +if it has already done 3 or more password failure in the last +banTime, I ban the ip for banTime using a iptable rule. After +banTime, the rule is deleted. + +Runs on my server and does its job rather well :-) The idea +is to make fail2ban usable with most syslog daemons and +services that require a login (sshd, telnetd, ...). It should +also support others firewalls than iptables. + + +Installation: +------------- + +Require: python-2.? (http://www.python.org) + log4py-1.1 (http://sourceforge.net/projects/log4py) + +To install, just do: + +> tar xvfj fail2ban-0.1.0.tar.bz2 +> cd fail2ban-0.1.0 +> python setup.py install + +Fail2Ban should now be correctly installed. Just type: + +> fail2ban.py -h + +to see if everything is alright. + + +Configuration: +-------------- + +For the time, there is no configuration file. You must use +commande line options instead. Here are the options: + + -b start fail2ban in background + -d start fail2ban in debug mode + -f read password failure from FILE + -h display this help message + -l log message in FILE + -t