github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge branch master (0.9) into 0.10

pull/1563/head
sebres 2016-09-29 19:46:11 +02:00
parent a0d8581a2c 8e3e333d54
commit 310d4e224d
5 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -142,6 +142,8 @@ releases.
* Fixed test case "testSetupInstallRoot" for not default python version (also * Fixed test case "testSetupInstallRoot" for not default python version (also
using direct call, out of virtualenv); using direct call, out of virtualenv);
* Fixed ambiguous wrong recognized date pattern resp. its optional parts (see gh-1512); * Fixed ambiguous wrong recognized date pattern resp. its optional parts (see gh-1512);
* FIPS compliant, use sha1 instead of md5 if it not allowed (see gh-1540)
* Monit config: scripting is not supported in path (gh-1556)
* `filter.d/asterisk.conf` * `filter.d/asterisk.conf`
- Fixed to match different asterisk log prefix (source file: method:) - Fixed to match different asterisk log prefix (source file: method:)
* `filter.d/ignorecommands/apache-fakegooglebot` * `filter.d/ignorecommands/apache-fakegooglebot`
@ -151,6 +153,9 @@ releases.
- Extended failregex and test cases to handle ASSP V1 and V2 (gh-1494) - Extended failregex and test cases to handle ASSP V1 and V2 (gh-1494)
* `filter.d/postfix-sasl.conf` * `filter.d/postfix-sasl.conf`
- Allow for having no trailing space after 'failed:' (gh-1497) - Allow for having no trailing space after 'failed:' (gh-1497)
* `filter.d/vsftpd.conf`
- Optional reason part in message after FAIL LOGIN (gh-1543)
### New Features ### New Features

2
config/filter.d/vsftpd.conf
View File

@ -14,7 +14,7 @@ __pam_re=\(?%(__pam_auth)s(?:\(\S+\))?\)?:?
_daemon = vsftpd _daemon = vsftpd
failregex = ^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=(ftp)? ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$ failregex = ^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=(ftp)? ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
^ \[pid \d+\] \[.+\] FAIL LOGIN: Client "<HOST>"\s*$ ^ \[pid \d+\] \[[^\]]+\] FAIL LOGIN: Client "<HOST>"(?:\s*$|,)
ignoreregex = ignoreregex =

7
fail2ban/server/filter.py
View File

@ -934,7 +934,12 @@ class FileFilter(Filter):
try: try:
import hashlib import hashlib
md5sum = hashlib.md5 try:
md5sum = hashlib.md5
# try to use it (several standards like FIPS forbid it):
md5sum(' ').hexdigest()
except: # pragma: no cover
md5sum = hashlib.sha1
except ImportError: # pragma: no cover except ImportError: # pragma: no cover
# hashlib was introduced in Python 2.5. For compatibility with those # hashlib was introduced in Python 2.5. For compatibility with those
# elderly Pythons, import from md5 # elderly Pythons, import from md5

3
fail2ban/tests/files/logs/vsftpd
View File

@ -12,3 +12,6 @@ Fri Jan 19 12:20:33 2007 [pid 27202] [anonymous] FAIL LOGIN: Client "64.106.46.9
# failJSON: { "time": "2004-10-23T21:15:42", "match": true , "host": "58.254.172.161" } # failJSON: { "time": "2004-10-23T21:15:42", "match": true , "host": "58.254.172.161" }
Oct 23 21:15:42 vps vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test rhost=58.254.172.161 Oct 23 21:15:42 vps vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test rhost=58.254.172.161
# failJSON: { "time": "2016-09-08T00:39:49", "match": true , "host": "192.0.2.1" }
Thu Sep 8 00:39:49 2016 [pid 15019] [guest] FAIL LOGIN: Client "::ffff:192.0.2.1", "User is not in the allow user list."

2
files/monit/fail2ban
View File

@ -1,7 +1,7 @@
check process fail2ban with pidfile /var/run/fail2ban/fail2ban.pid check process fail2ban with pidfile /var/run/fail2ban/fail2ban.pid
group services group services
start program = "/etc/init.d/fail2ban force-start" start program = "/etc/init.d/fail2ban force-start"
stop program = "/etc/init.d/fail2ban stop || :" stop program = "/etc/init.d/fail2ban stop"
if failed unixsocket /var/run/fail2ban/fail2ban.sock then restart if failed unixsocket /var/run/fail2ban/fail2ban.sock then restart
if 5 restarts within 5 cycles then timeout if 5 restarts within 5 cycles then timeout