diff --git a/ChangeLog b/ChangeLog index 830085d0..ba124f92 100644 --- a/ChangeLog +++ b/ChangeLog @@ -12,6 +12,13 @@ ver. 0.9.3 (2015/XX/XXX) - wanna-be-released - IMPORTANT incompatible changes: * filter.d/roundcube-auth.conf - Changed logpath to 'errors' log (was 'userlogins') + * action.d/iptables-common.conf + - All calls to iptables command now use -w switch introduced in + iptables 1.4.20 (some distribution could have patched their + earlier base version as well) to provide this locking mechanism + useful under heavy load to avoid contesting on iptables calls. + If you need to disable, define 'action.d/iptables-common.local' + with empty value for 'lockingopt' in `[Init]` section. - Fixes: * reload in interactive mode appends all the jails twice (gh-825) diff --git a/config/action.d/iptables-allports.conf b/config/action.d/iptables-allports.conf index 9e2d18a3..15f3cbcc 100644 --- a/config/action.d/iptables-allports.conf +++ b/config/action.d/iptables-allports.conf @@ -17,23 +17,23 @@ before = iptables-common.conf # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = iptables -N f2b- - iptables -A f2b- -j - iptables -I -p -j f2b- +actionstart = -N f2b- + -A f2b- -j + -I -p -j f2b- # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = iptables -D -p -j f2b- - iptables -F f2b- - iptables -X f2b- +actionstop = -D -p -j f2b- + -F f2b- + -X f2b- # Option: actioncheck # Notes.: command executed once before each actionban command # Values: CMD # -actioncheck = iptables -n -L | grep -q 'f2b-[ \t]' +actioncheck = -n -L | grep -q 'f2b-[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the @@ -41,7 +41,7 @@ actioncheck = iptables -n -L | grep -q 'f2b-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = iptables -I f2b- 1 -s -j +actionban = -I f2b- 1 -s -j # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -49,7 +49,7 @@ actionban = iptables -I f2b- 1 -s -j # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = iptables -D f2b- -s -j +actionunban = -D f2b- -s -j [Init] diff --git a/config/action.d/iptables-common.conf b/config/action.d/iptables-common.conf index dff01362..45819e3d 100644 --- a/config/action.d/iptables-common.conf +++ b/config/action.d/iptables-common.conf @@ -49,3 +49,16 @@ blocktype = REJECT --reject-with icmp-port-unreachable # in all (blocking) actions, except REJECT in allowing actions. # Values: STRING returntype = RETURN + +# Option: lockingopt +# Notes.: Option was introduced to iptables to prevent multiple instances from +# running concurrently and causing irratic behavior. -w was introduced +# in iptables 1.4.20, so might be absent on older systems +# See https://github.com/fail2ban/fail2ban/issues/1122 +# Values: STRING +lockingopt = -w + +# Option: iptables +# Notes.: Actual command to be executed, including common to all calls options +# Values: STRING +iptables = iptables diff --git a/config/action.d/iptables-ipset-proto4.conf b/config/action.d/iptables-ipset-proto4.conf index c72b1a85..2f63cd4b 100644 --- a/config/action.d/iptables-ipset-proto4.conf +++ b/config/action.d/iptables-ipset-proto4.conf @@ -28,13 +28,13 @@ before = iptables-common.conf # Values: CMD # actionstart = ipset --create f2b- iphash - iptables -I -p -m multiport --dports -m set --match-set f2b- src -j + -I -p -m multiport --dports -m set --match-set f2b- src -j # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = iptables -D -p -m multiport --dports -m set --match-set f2b- src -j +actionstop = -D -p -m multiport --dports -m set --match-set f2b- src -j ipset --flush f2b- ipset --destroy f2b- diff --git a/config/action.d/iptables-ipset-proto6-allports.conf b/config/action.d/iptables-ipset-proto6-allports.conf index aaeee461..1f1d336f 100644 --- a/config/action.d/iptables-ipset-proto6-allports.conf +++ b/config/action.d/iptables-ipset-proto6-allports.conf @@ -24,13 +24,13 @@ before = iptables-common.conf # Values: CMD # actionstart = ipset create f2b- hash:ip timeout - iptables -I -m set --match-set f2b- src -j + -I -m set --match-set f2b- src -j # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = iptables -D -m set --match-set f2b- src -j +actionstop = -D -m set --match-set f2b- src -j ipset flush f2b- ipset destroy f2b- diff --git a/config/action.d/iptables-ipset-proto6.conf b/config/action.d/iptables-ipset-proto6.conf index bd36c49e..3b51ef58 100644 --- a/config/action.d/iptables-ipset-proto6.conf +++ b/config/action.d/iptables-ipset-proto6.conf @@ -24,13 +24,13 @@ before = iptables-common.conf # Values: CMD # actionstart = ipset create f2b- hash:ip timeout - iptables -I -p -m multiport --dports -m set --match-set f2b- src -j + -I -p -m multiport --dports -m set --match-set f2b- src -j # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = iptables -D -p -m multiport --dports -m set --match-set f2b- src -j +actionstop = -D -p -m multiport --dports -m set --match-set f2b- src -j ipset flush f2b- ipset destroy f2b- diff --git a/config/action.d/iptables-multiport-log.conf b/config/action.d/iptables-multiport-log.conf index 093ce7b2..1777ce62 100644 --- a/config/action.d/iptables-multiport-log.conf +++ b/config/action.d/iptables-multiport-log.conf @@ -19,28 +19,28 @@ before = iptables-common.conf # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = iptables -N f2b- - iptables -A f2b- -j - iptables -I 1 -p -m multiport --dports -j f2b- - iptables -N f2b--log - iptables -I f2b--log -j LOG --log-prefix "$(expr f2b- : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2 - iptables -A f2b--log -j +actionstart = -N f2b- + -A f2b- -j + -I 1 -p -m multiport --dports -j f2b- + -N f2b--log + -I f2b--log -j LOG --log-prefix "$(expr f2b- : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2 + -A f2b--log -j # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = iptables -D -p -m multiport --dports -j f2b- - iptables -F f2b- - iptables -F f2b--log - iptables -X f2b- - iptables -X f2b--log +actionstop = -D -p -m multiport --dports -j f2b- + -F f2b- + -F f2b--log + -X f2b- + -X f2b--log # Option: actioncheck # Notes.: command executed once before each actionban command # Values: CMD # -actioncheck = iptables -n -L f2b--log >/dev/null +actioncheck = -n -L f2b--log >/dev/null # Option: actionban # Notes.: command executed when banning an IP. Take care that the @@ -48,7 +48,7 @@ actioncheck = iptables -n -L f2b--log >/dev/null # Tags: See jail.conf(5) man page # Values: CMD # -actionban = iptables -I f2b- 1 -s -j f2b--log +actionban = -I f2b- 1 -s -j f2b--log # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -56,7 +56,7 @@ actionban = iptables -I f2b- 1 -s -j f2b--log # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = iptables -D f2b- -s -j f2b--log +actionunban = -D f2b- -s -j f2b--log [Init] diff --git a/config/action.d/iptables-multiport.conf b/config/action.d/iptables-multiport.conf index f365d917..9fd87d20 100644 --- a/config/action.d/iptables-multiport.conf +++ b/config/action.d/iptables-multiport.conf @@ -14,23 +14,23 @@ before = iptables-common.conf # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = iptables -N f2b- - iptables -A f2b- -j - iptables -I -p -m multiport --dports -j f2b- +actionstart = -N f2b- + -A f2b- -j + -I -p -m multiport --dports -j f2b- # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = iptables -D -p -m multiport --dports -j f2b- - iptables -F f2b- - iptables -X f2b- +actionstop = -D -p -m multiport --dports -j f2b- + -F f2b- + -X f2b- # Option: actioncheck # Notes.: command executed once before each actionban command # Values: CMD # -actioncheck = iptables -n -L | grep -q 'f2b-[ \t]' +actioncheck = -n -L | grep -q 'f2b-[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the @@ -38,7 +38,7 @@ actioncheck = iptables -n -L | grep -q 'f2b-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = iptables -I f2b- 1 -s -j +actionban = -I f2b- 1 -s -j # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -46,7 +46,7 @@ actionban = iptables -I f2b- 1 -s -j # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = iptables -D f2b- -s -j +actionunban = -D f2b- -s -j [Init] diff --git a/config/action.d/iptables-new.conf b/config/action.d/iptables-new.conf index 831931dd..795bc601 100644 --- a/config/action.d/iptables-new.conf +++ b/config/action.d/iptables-new.conf @@ -16,23 +16,23 @@ before = iptables-common.conf # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = iptables -N f2b- - iptables -A f2b- -j - iptables -I -m state --state NEW -p --dport -j f2b- +actionstart = -N f2b- + -A f2b- -j + -I -m state --state NEW -p --dport -j f2b- # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = iptables -D -m state --state NEW -p --dport -j f2b- - iptables -F f2b- - iptables -X f2b- +actionstop = -D -m state --state NEW -p --dport -j f2b- + -F f2b- + -X f2b- # Option: actioncheck # Notes.: command executed once before each actionban command # Values: CMD # -actioncheck = iptables -n -L | grep -q 'f2b-[ \t]' +actioncheck = -n -L | grep -q 'f2b-[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the @@ -40,7 +40,7 @@ actioncheck = iptables -n -L | grep -q 'f2b-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = iptables -I f2b- 1 -s -j +actionban = -I f2b- 1 -s -j # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -48,7 +48,7 @@ actionban = iptables -I f2b- 1 -s -j # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = iptables -D f2b- -s -j +actionunban = -D f2b- -s -j [Init] diff --git a/config/action.d/iptables-xt_recent-echo.conf b/config/action.d/iptables-xt_recent-echo.conf index 1a72968f..d3d43f86 100644 --- a/config/action.d/iptables-xt_recent-echo.conf +++ b/config/action.d/iptables-xt_recent-echo.conf @@ -32,14 +32,14 @@ before = iptables-common.conf # own rules. The 3600 second timeout is independent and acts as a # safeguard in case the fail2ban process dies unexpectedly. The # shorter of the two timeouts actually matters. -actionstart = if [ `id -u` -eq 0 ];then iptables -I -m recent --update --seconds 3600 --name f2b- -j ;fi +actionstart = if [ `id -u` -eq 0 ];then -I -m recent --update --seconds 3600 --name f2b- -j ;fi # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # actionstop = echo / > /proc/net/xt_recent/f2b- - if [ `id -u` -eq 0 ];then iptables -D -m recent --update --seconds 3600 --name f2b- -j ;fi + if [ `id -u` -eq 0 ];then -D -m recent --update --seconds 3600 --name f2b- -j ;fi # Option: actioncheck # Notes.: command executed once before each actionban command diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf index 572bdc11..38985ffa 100644 --- a/config/action.d/iptables.conf +++ b/config/action.d/iptables.conf @@ -14,23 +14,23 @@ before = iptables-common.conf # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = iptables -N f2b- - iptables -A f2b- -j - iptables -I -p --dport -j f2b- +actionstart = -N f2b- + -A f2b- -j + -I -p --dport -j f2b- # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = iptables -D -p --dport -j f2b- - iptables -F f2b- - iptables -X f2b- +actionstop = -D -p --dport -j f2b- + -F f2b- + -X f2b- # Option: actioncheck # Notes.: command executed once before each actionban command # Values: CMD # -actioncheck = iptables -n -L | grep -q 'f2b-[ \t]' +actioncheck = -n -L | grep -q 'f2b-[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the @@ -38,7 +38,7 @@ actioncheck = iptables -n -L | grep -q 'f2b-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = iptables -I f2b- 1 -s -j +actionban = -I f2b- 1 -s -j # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -46,7 +46,7 @@ actionban = iptables -I f2b- 1 -s -j # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = iptables -D f2b- -s -j +actionunban = -D f2b- -s -j [Init] diff --git a/config/action.d/symbiosis-blacklist-allports.conf b/config/action.d/symbiosis-blacklist-allports.conf index c4979302..c24a8e0a 100644 --- a/config/action.d/symbiosis-blacklist-allports.conf +++ b/config/action.d/symbiosis-blacklist-allports.conf @@ -3,6 +3,9 @@ # Author: Yaroslav Halchenko # +[INCLUDES] + +before = iptables-common.conf [Definition] @@ -22,21 +25,21 @@ actionstop = # Notes.: command executed once before each actionban command # Values: CMD # -actioncheck = iptables -n -L +actioncheck = -n -L # Option: actionban # Notes.: command executed when banning an IP. # Values: CMD # actionban = echo 'all' >| /etc/symbiosis/firewall/blacklist.d/.auto - iptables -I 1 -s -j + -I 1 -s -j # Option: actionunban # Notes.: command executed when unbanning an IP. # Values: CMD # actionunban = rm -f /etc/symbiosis/firewall/blacklist.d/.auto - iptables -D -s -j || : + -D -s -j || : [Init]