diff --git a/debian/changelog b/debian/changelog index c82cef17..8798a9f2 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,9 +1,14 @@ fail2ban (0.7.5-2) UNRELEASED; urgency=low - * NEWS.Debian confusions - the latest NEWS entry and postinst message - were rephrased (Closes: #402350) + * NEWS.Debian confusions - the latest NEWS entry and postinst message were + rephrased (Closes: #402350) + * Added mail-whois-lines action, which emails log lines containing abuser + IP. Those lines are often required for proper abuse reports sent to the + Internet providers. Forwarding of such received emails to the email + addresses of abuse departments present in the output of whois is a + tentative solution for semi-automatic abuse reporting (Closes: #358810) - -- Yaroslav Halchenko Sat, 9 Dec 2006 14:12:43 -0500 + -- Yaroslav Halchenko Sun, 10 Dec 2006 18:29:23 -0500 fail2ban (0.7.5-1) unstable; urgency=low diff --git a/debian/jail.conf b/debian/jail.conf index 1770d057..5b46267e 100644 --- a/debian/jail.conf +++ b/debian/jail.conf @@ -36,20 +36,27 @@ destemail = root@localhost # Default action to take: ban only action = iptables[name=%(__name__)s, port=%(port)s] -# Default action to take: ban & send an e-mail with whois report -# to the destemail. Copy/paste+uncomment next 2 lines into jail.local -# to activate -#action = iptables[name=%(__name__)s, port=%(port)s] -# mail-whois[name=%(__name__)s, dest=%(destemail)s] +# Following actions can be chosen as an alternatives to the above action. +# To activate, just copy/paste+uncomment chosen 2 (excluding comments) lines +# into jail.local -# +# Default action to take: ban & send an e-mail with whois report +# to the destemail. +# action = iptables[name=%(__name__)s, port=%(port)s] +# mail-whois[name=%(__name__)s, dest=%(destemail)s] + +# Default action to take: ban & send an e-mail with whois report +# and relevant log lines to the destemail. +# action = iptables[name=%(__name__)s, port=%(port)s] +# mail-whois-lines[name=%(__name__)s, dest=%(destemail)s, logpath=%(logpath)s] + # Next jails corresponds to the standard configuration in Fail2ban 0.6 -# which was shipped in Debian. Please enable them by including +# which was shipped in Debian. Please enable any defined here jail by including # # [SECTION_NAME] # enabled = true # -# in /etc/fail2ban/jail.local +# in /etc/fail2ban/jail.local. # [ssh] diff --git a/debian/patches/00_mail-whois-lines.dpatch b/debian/patches/00_mail-whois-lines.dpatch new file mode 100755 index 00000000..f426a269 --- /dev/null +++ b/debian/patches/00_mail-whois-lines.dpatch @@ -0,0 +1,87 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 00_mail-whois-lines.dpatch by Yaroslav Halchenko +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: New action which mails not only whois but the result of grep using the +## DP: abuser IP over the log files + +@DPATCH@ +diff -urNad fail2ban-0.7.5~/config/action.d/mail-whois-lines.conf fail2ban-0.7.5/config/action.d/mail-whois-lines.conf +--- fail2ban-0.7.5~/config/action.d/mail-whois-lines.conf 1969-12-31 19:00:00.000000000 -0500 ++++ fail2ban-0.7.5/config/action.d/mail-whois-lines.conf 2006-12-10 18:27:46.000000000 -0500 +@@ -0,0 +1,75 @@ ++# Fail2Ban configuration file ++# ++# Author: Cyril Jaquier ++# Modified-By: Yaroslav Halchenko to include grepping on IP over log files ++# $Revision: 254 $ ++# ++ ++[Definition] ++ ++# Option: fwstart ++# Notes.: command executed once at the start of Fail2Ban. ++# Values: CMD ++# ++actionstart = echo -en "Hi,\n ++ The jail has been started successfuly.\n ++ Regards,\n ++ Fail2Ban"|mail -s "[Fail2Ban] : started" ++ ++# Option: fwend ++# Notes.: command executed once at the end of Fail2Ban ++# Values: CMD ++# ++actionstop = echo -en "Hi,\n ++ The jail has been stopped.\n ++ Regards,\n ++ Fail2Ban"|mail -s "[Fail2Ban] : stopped" ++ ++# Option: fwcheck ++# Notes.: command executed once before each fwban command ++# Values: CMD ++# ++actioncheck = ++ ++# Option: fwban ++# Notes.: command executed when banning an IP. Take care that the ++# command is executed with Fail2Ban user rights. ++# Tags: IP address ++# number of failures ++# unix timestamp of the last failure ++# unix timestamp of the ban time ++# Values: CMD ++# ++actionban = echo -en "Hi,\n ++ The IP has just been banned by Fail2Ban after ++ attempts against .\n\n ++ Here are more information about :\n ++ `whois `\n\n ++ Lines containing IP: in \n ++ `grep '\<\>' `\n\n ++ Regards,\n ++ Fail2Ban"|mail -s "[Fail2Ban] : banned " ++ ++# Option: fwunban ++# Notes.: command executed when unbanning an IP. Take care that the ++# command is executed with Fail2Ban user rights. ++# Tags: IP address ++# unix timestamp of the ban time ++# unix timestamp of the unban time ++# Values: CMD ++# ++actionunban = ++ ++[Init] ++ ++# Defaut name of the chain ++# ++name = default ++ ++# Destinataire of the mail ++# ++dest = root ++ ++# Path to the log files which contain relevant lines for the abuser IP ++# ++logpath = /dev/null diff --git a/debian/patches/00list b/debian/patches/00list index 3b758a62..66ed4e58 100644 --- a/debian/patches/00list +++ b/debian/patches/00list @@ -3,3 +3,4 @@ X00_rigid_python24 00_iptables_NEW 10_dbts_manpages 10_wuftpd_section +00_mail-whois-lines