diff --git a/ChangeLog b/ChangeLog index c54efc49..c6a39d87 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,9 +4,23 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ============================================================= -Fail2Ban (version 0.8.3) 2008/07/17 +Fail2Ban (version 0.8.4) 2008/??/?? ============================================================= +ver. 0.8.4 (2008/??/??) - stable +---------- +- Merged patches from Debian package. Thanks to Yaroslav + Halchenko. +- Use current day and month instead of Jan 1st if both are + not available in the log. Thanks to Andreas Itzchak + Rehberg. +- Try to match the regex even if the line does not contain a + valid date/time. Described in Debian #491253. Thanks to + Yaroslav Halchenko. +- Added/improved filters and date formats. +- Added actions to report abuse to ISP, DShield and + myNetWatchman. Thanks to Russell Odom. + ver. 0.8.3 (2008/07/17) - stable ---------- - Process failtickets as long as failmanager is not empty. diff --git a/README b/README index d413aca7..1c1cbf66 100644 --- a/README +++ b/README @@ -4,7 +4,7 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ============================================================= -Fail2Ban (version 0.8.3) 2008/07/17 +Fail2Ban (version 0.8.4) 2008/??/?? ============================================================= Fail2Ban scans log files like /var/log/pwdfail and bans IP @@ -28,8 +28,8 @@ Optional: To install, just do: -> tar xvfj fail2ban-0.8.3.tar.bz2 -> cd fail2ban-0.8.3 +> tar xvfj fail2ban-0.8.4.tar.bz2 +> cd fail2ban-0.8.4 > python setup.py install This will install Fail2Ban into /usr/share/fail2ban. The @@ -76,7 +76,8 @@ René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch, Michael C. Haller, Jonathan Underwood, Hanno 'Rince' Wagner, Daniel B. Cid, David Nutter, Raphaël Marichez, Guillaume Delvit, Vaclav Misek, Adrien Clerc, Michael Hanselmann, -Vincent Deffontaines, Bill Heaton and many others. +Vincent Deffontaines, Bill Heaton, Russell Odom and many +others. License: -------- diff --git a/client/filterreader.py b/client/filterreader.py index fa435496..583adb46 100644 --- a/client/filterreader.py +++ b/client/filterreader.py @@ -53,20 +53,14 @@ class FilterReader(ConfigReader): return ConfigReader.read(self, "filter.d/" + self.__file) def getOptions(self, pOpts): - opts = [["string", "timeregex", None], - ["string", "timepattern", None], - ["string", "ignoreregex", ""], + opts = [["string", "ignoreregex", ""], ["string", "failregex", ""]] self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts) def convert(self): stream = list() for opt in self.__opts: - if opt == "timeregex": - stream.append(["set", self.__name, "timeregex", self.__opts[opt]]) - elif opt == "timepattern": - stream.append(["set", self.__name, "timepattern", self.__opts[opt]]) - elif opt == "failregex": + if opt == "failregex": for regex in self.__opts[opt].split('\n'): # Do not send a command if the rule is empty. if regex != '': diff --git a/common/protocol.py b/common/protocol.py index 2b19964b..7d4a9fdf 100644 --- a/common/protocol.py +++ b/common/protocol.py @@ -72,8 +72,6 @@ protocol = [ ['', "JAIL INFORMATION", ""], ["get logpath", "gets the list of the monitored files for "], ["get ignoreip", "gets the list of ignored IP addresses for "], -["get timeregex", "gets the regular expression used for the time detection for "], -["get timepattern", "gets the pattern used for the time detection for "], ["get failregex", "gets the list of regular expressions which matches the failures for "], ["get ignoreregex", "gets the list of regular expressions which matches patterns to ignore for "], ["get findtime", "gets the time for which the filter will look back for failures for "], diff --git a/common/version.py b/common/version.py index 416848bb..d30eaab0 100644 --- a/common/version.py +++ b/common/version.py @@ -24,4 +24,4 @@ __date__ = "$Date: 2008-07-17 23:28:51 +0200 (Thu, 17 Jul 2008) $" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" -version = "0.8.3" +version = "0.8.3-SVN" diff --git a/config/action.d/complain.conf b/config/action.d/complain.conf new file mode 100644 index 00000000..5e672475 --- /dev/null +++ b/config/action.d/complain.conf @@ -0,0 +1,86 @@ +# Fail2Ban configuration file +# +# Author: Russell Odom +# Sends a complaint e-mail to addresses listed in the whois record for an +# offending IP address. +# +# You should provide the in the jail config - lines from the log +# matching the given IP address will be provided in the complaint as evidence. +# +# Note that we will try to use e-mail addresses that are most likely to be abuse +# addresses (based on various keywords). If they aren't found we fall back on +# any other addresses found in the whois record, with a few exceptions. +# If no addresses are found, no e-mail is sent. +# +# $Revision$ +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: IP address +# number of failures +# unix timestamp of the last failure +# unix timestamp of the ban time +# Values: CMD +# +actionban = ADDRESSES=`whois | perl -e 'while () { next if /^changed|@(ripe|apnic)\.net/io; $m += (/abuse|trouble:|report|spam|security/io?3:0); if (/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)/io) { while (s/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)//io) { if ($m) { $a{lc($1)}=$m } else { $b{lc($1)}=$m } } $m=0 } else { $m && --$m } } if (%%a) {print join(",",keys(%%a))} else {print join(",",keys(%%b))}'` + IP= + if [ ! -z "$ADDRESSES" ]; then + (printf %%b "\n"; date '+Note: Local timezone is %%z (%%Z)'; grep '' ) | "Abuse from " $ADDRESSES + fi + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: IP address +# unix timestamp of the ban time +# unix timestamp of the unban time +# Values: CMD +# +actionunban = + +[Init] +message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to a whois lookup is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process. This mail was generated by Fail2Ban.)\n + +# Path to the log files which contain relevant lines for the abuser IP +# +logpath = /dev/null + +# Option: mailcmd +# Notes.: Your system mail command. Is passed 2 args: subject and recipient +# Values: CMD Default: mail -s +# +mailcmd = mail -s + +# Option: mailargs +# Notes.: Additional arguments to mail command. e.g. for standard Unix mail: +# CC reports to another address: +# -c me@example.com +# Appear to come from a different address - the '--' indicates +# arguments to be passed to Sendmail: +# -- -f me@example.com +# Values: [ STRING ] Default: (empty) +# +mailargs = + diff --git a/config/action.d/dshield.conf b/config/action.d/dshield.conf new file mode 100644 index 00000000..b80698b4 --- /dev/null +++ b/config/action.d/dshield.conf @@ -0,0 +1,210 @@ +# Fail2Ban configuration file +# +# Author: Russell Odom +# Submits attack reports to DShield (http://www.dshield.org/) +# +# You MUST configure at least: +# (the port that's being attacked - use number not name). +# +# You SHOULD also provide: +# (your public IP address, if it's not the address of eth0) +# (your DShield userID, if you have one - recommended, but reports will +# be used anonymously if not) +# (the protocol in use - defaults to tcp) +# +# Best practice is to provide and in jail.conf like this: +# action = dshield[port=1234,protocol=tcp] +# +# ...and create "dshield.local" with contents something like this: +# [Init] +# myip = 10.0.0.1 +# userid = 12345 +# +# Other useful configuration values are (you can use for specifying +# a different sender address for the report e-mails, which should match what is +# configured at DShield), and // (to +# configure how often the buffer is flushed). +# +# $Revision$ + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = if [ -f .buffer ]; then + cat .buffer | "FORMAT DSHIELD USERID TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" + date +%%s > .lastsent + fi + rm -f .buffer .first + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: IP address +# number of failures +#