From b31a018e7ca6983bb0babf83c054e9cf36085cb3 Mon Sep 17 00:00:00 2001 From: Cool Fire Date: Fri, 8 Feb 2019 16:54:11 +0100 Subject: [PATCH 1/5] Add override for dovecot failed logins on debian --- config/paths-debian.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config/paths-debian.conf b/config/paths-debian.conf index 50ff948b..ae45e72e 100644 --- a/config/paths-debian.conf +++ b/config/paths-debian.conf @@ -31,6 +31,8 @@ apache_error_log = /var/log/apache2/*error.log apache_access_log = /var/log/apache2/*access.log +dovecot_log = /var/log/mail.log + # was in debian squeezy but not in wheezy # /etc/proftpd/proftpd.conf (SystemLog) proftpd_log = /var/log/proftpd/proftpd.log From 27526e431b31add8181b6dcd88ab5022021eccea Mon Sep 17 00:00:00 2001 From: Cool Fire Date: Wed, 13 Feb 2019 10:10:24 +0100 Subject: [PATCH 2/5] Changes static logfile string to variable Since we don't want to re-declare a log file name we already have a varialbe for, use the existing variable to set dovecot_log. --- config/paths-debian.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/paths-debian.conf b/config/paths-debian.conf index ae45e72e..0904668b 100644 --- a/config/paths-debian.conf +++ b/config/paths-debian.conf @@ -31,7 +31,7 @@ apache_error_log = /var/log/apache2/*error.log apache_access_log = /var/log/apache2/*access.log -dovecot_log = /var/log/mail.log +dovecot_log = %(syslog_mail)s # was in debian squeezy but not in wheezy # /etc/proftpd/proftpd.conf (SystemLog) From ec2b5dc483060032499b50d67772ebcee9c8d732 Mon Sep 17 00:00:00 2001 From: sebres Date: Fri, 15 Mar 2019 22:28:08 +0100 Subject: [PATCH 3/5] fixed log-level in error case (logging error instead of Level 39) --- fail2ban/server/utils.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fail2ban/server/utils.py b/fail2ban/server/utils.py index d88c29b8..2bde3f4d 100644 --- a/fail2ban/server/utils.py +++ b/fail2ban/server/utils.py @@ -244,8 +244,8 @@ class Utils(): return False if not output else (False, stdout, stderr, retcode) std_level = logging.DEBUG if retcode in success_codes else logging.ERROR - if std_level > logSys.getEffectiveLevel(): - if logCmd: logCmd(std_level-1); logCmd = None + if std_level >= logSys.getEffectiveLevel(): + if logCmd: logCmd(std_level-1 if std_level == logging.DEBUG else logging.ERROR); logCmd = None # if we need output (to return or to log it): if output or std_level >= logSys.getEffectiveLevel(): From e8401a7e65c699e4a3ecbd42951d5bada90871ca Mon Sep 17 00:00:00 2001 From: sebres Date: Sat, 16 Mar 2019 00:05:06 +0100 Subject: [PATCH 4/5] action.d/xarf-login-attack.conf: fixes gh-2372, correction for split of addresses, interpolation is shell-independent now, etc; extended with option `boundary`, additionally dynamic boundary part is used (is not so predictable as it was previously); --- config/action.d/xarf-login-attack.conf | 28 ++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf index 2b135c43..f348b2c4 100644 --- a/config/action.d/xarf-login-attack.conf +++ b/config/action.d/xarf-login-attack.conf @@ -41,7 +41,12 @@ actionstop = actioncheck = -actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs} +actionban = oifs=${IFS}; + RESOLVER_ADDR="%(addr_resolver)s" + if [ "" -gt 0 ]; then echo "try to resolve $RESOLVER_ADDR"; fi + ADDRESSES=$(dig +short -t txt -q $RESOLVER_ADDR | tr -d '"') + IFS=,; ADDRESSES=$(echo $ADDRESSES) + IFS=${oifs} IP= FROM= SERVICE= @@ -51,26 +56,37 @@ actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP}; ADDRESSES=$(di PORT= DATE=`LC_ALL=C date --date=@