* Added filter ssh-ddos to fight DDOS attacks. Must be used with caution if

there is a possibility of clients accessing through unreliable connection 
  (Closes: #404487)

debian/changelog

@@ -5,8 +5,11 @@ fail2ban (0.7.5-3~pre4) unstable; urgency=low
   * Made fail2ban-server tollerate multiple <HOST> entries in failregex
   * Moved call to dh_pycentral before dh_installinit
   * Removed unnecessary call of dh_shlibdeps
+  * Added filter ssh-ddos to fight DDOS attacks. Must be used with caution if
+    there is a possibility of clients accessing through unreliable connection 
+    (Closes: #404487)
 
- -- Yaroslav Halchenko <debian@onerussian.com>  Thu, 21 Dec 2006 11:53:22 -0500
+ -- Yaroslav Halchenko <debian@onerussian.com>  Tue, 26 Dec 2006 21:56:58 -0500
 
 fail2ban (0.7.5-2) unstable; urgency=low
 

debian/jail.conf

@@ -67,6 +67,15 @@ filter	= sshd
 logpath  = /var/log/auth.log
 maxretry = 6
 
+
+[ssh-ddos]
+
+enabled = false
+port    = ssh
+filter  = sshd-ddos
+logpath  = /var/log/auth.log
+maxretry = 6
+
 #
 # HTTP servers
 #

debian/patches/00list

@@ -1,8 +1,9 @@
 X00_rigid_python24
 00_share_insteadof_lib
 00_iptables_NEW
+00_mail-whois-lines
 10_dbts_manpages
 10_wuftpd_section
-00_mail-whois-lines
 10_vsftpd_regex
+10_ssh-ddos_section
 10_multiple_HOST_regexp

debian/patches/10_ssh-ddos_section.dpatch

@@ -0,0 +1,52 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 10_ssh-ddos_section.dpatch by Yaroslav Halchenko <debian@onerussian.com>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad fail2ban-0.7.4~/config/filter.d/sshd-ddos.conf fail2ban-0.7.4/config/filter.d/sshd-ddos.conf
+--- fail2ban-0.7.4~/config/filter.d/sshd-ddos.conf	1969-12-31 19:00:00.000000000 -0500
++++ fail2ban-0.7.4/config/filter.d/sshd-ddos.conf	2006-12-26 21:59:03.000000000 -0500
+@@ -0,0 +1,22 @@
++# Fail2Ban configuration file
++#
++# Author: Yaroslav Halchenko
++#
++# $Revision: 471 $
++#
++
++[Definition]
++
++# Option:  failregex
++# Notes.:  regex to match the password failures messages in the logfile. The
++#          host must be matched by a group named "host". The tag "<HOST>" can
++#          be used for standard IP/hostname matching.
++# Values:  TEXT
++#
++failregex = sshd\[\S*\]: Did not receive identification string from <HOST>
++
++# Option:  ignoreregex
++# Notes.:  regex to ignore. If this regex matches, the line is ignored.
++# Values:  TEXT
++#
++ignoreregex = 
+diff -urNad fail2ban-0.7.4~/config/jail.conf fail2ban-0.7.4/config/jail.conf
+--- fail2ban-0.7.4~/config/jail.conf	2006-10-19 16:13:01.000000000 -0400
++++ fail2ban-0.7.4/config/jail.conf	2006-12-26 22:00:03.000000000 -0500
+@@ -33,6 +33,15 @@
+ logpath  = /var/log/sshd.log
+ maxretry = 5
+ 
++[ssh-ddos-iptables]
++
++enabled  = false
++filter   = sshd-ddos
++action   = iptables[name=SSH, port=ssh, protocol=tcp]
++           mail-whois[name=SSH, dest=yourmail@mail.com]
++logpath  = /var/log/sshd.log
++maxretry = 5
++
+ [proftpd-iptables]
+ 
+ enabled  = false