From 762d1a188aaeada41dadcc521b57146ac54c9348 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko <debian@onerussian.com> Date: Sun, 10 Dec 2006 23:40:04 +0000 Subject: [PATCH] * NEWS.Debian confusions - the latest NEWS entry and postinst message were rephrased (Closes: #402350) * Added mail-whois-lines action, which emails log lines containing abuser IP. Those lines are often required for proper abuse reports sent to the Internet providers. Forwarding of such received emails to the email addresses of abuse departments present in the output of whois is a tentative solution for semi-automatic abuse reporting (Closes: #358810) --- debian/changelog | 11 ++- debian/jail.conf | 23 +++--- debian/patches/00_mail-whois-lines.dpatch | 87 +++++++++++++++++++++++ debian/patches/00list | 1 + 4 files changed, 111 insertions(+), 11 deletions(-) create mode 100755 debian/patches/00_mail-whois-lines.dpatch diff --git a/debian/changelog b/debian/changelog index c82cef17..8798a9f2 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,9 +1,14 @@ fail2ban (0.7.5-2) UNRELEASED; urgency=low - * NEWS.Debian confusions - the latest NEWS entry and postinst message - were rephrased (Closes: #402350) + * NEWS.Debian confusions - the latest NEWS entry and postinst message were + rephrased (Closes: #402350) + * Added mail-whois-lines action, which emails log lines containing abuser + IP. Those lines are often required for proper abuse reports sent to the + Internet providers. Forwarding of such received emails to the email + addresses of abuse departments present in the output of whois is a + tentative solution for semi-automatic abuse reporting (Closes: #358810) - -- Yaroslav Halchenko <debian@onerussian.com> Sat, 9 Dec 2006 14:12:43 -0500 + -- Yaroslav Halchenko <debian@onerussian.com> Sun, 10 Dec 2006 18:29:23 -0500 fail2ban (0.7.5-1) unstable; urgency=low diff --git a/debian/jail.conf b/debian/jail.conf index 1770d057..5b46267e 100644 --- a/debian/jail.conf +++ b/debian/jail.conf @@ -36,20 +36,27 @@ destemail = root@localhost # Default action to take: ban only action = iptables[name=%(__name__)s, port=%(port)s] -# Default action to take: ban & send an e-mail with whois report -# to the destemail. Copy/paste+uncomment next 2 lines into jail.local -# to activate -#action = iptables[name=%(__name__)s, port=%(port)s] -# mail-whois[name=%(__name__)s, dest=%(destemail)s] +# Following actions can be chosen as an alternatives to the above action. +# To activate, just copy/paste+uncomment chosen 2 (excluding comments) lines +# into jail.local -# +# Default action to take: ban & send an e-mail with whois report +# to the destemail. +# action = iptables[name=%(__name__)s, port=%(port)s] +# mail-whois[name=%(__name__)s, dest=%(destemail)s] + +# Default action to take: ban & send an e-mail with whois report +# and relevant log lines to the destemail. +# action = iptables[name=%(__name__)s, port=%(port)s] +# mail-whois-lines[name=%(__name__)s, dest=%(destemail)s, logpath=%(logpath)s] + # Next jails corresponds to the standard configuration in Fail2ban 0.6 -# which was shipped in Debian. Please enable them by including +# which was shipped in Debian. Please enable any defined here jail by including # # [SECTION_NAME] # enabled = true # -# in /etc/fail2ban/jail.local +# in /etc/fail2ban/jail.local. # [ssh] diff --git a/debian/patches/00_mail-whois-lines.dpatch b/debian/patches/00_mail-whois-lines.dpatch new file mode 100755 index 00000000..f426a269 --- /dev/null +++ b/debian/patches/00_mail-whois-lines.dpatch @@ -0,0 +1,87 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 00_mail-whois-lines.dpatch by Yaroslav Halchenko <debian@onerussian.com> +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: New action which mails not only whois but the result of grep using the +## DP: abuser IP over the log files + +@DPATCH@ +diff -urNad fail2ban-0.7.5~/config/action.d/mail-whois-lines.conf fail2ban-0.7.5/config/action.d/mail-whois-lines.conf +--- fail2ban-0.7.5~/config/action.d/mail-whois-lines.conf 1969-12-31 19:00:00.000000000 -0500 ++++ fail2ban-0.7.5/config/action.d/mail-whois-lines.conf 2006-12-10 18:27:46.000000000 -0500 +@@ -0,0 +1,75 @@ ++# Fail2Ban configuration file ++# ++# Author: Cyril Jaquier ++# Modified-By: Yaroslav Halchenko to include grepping on IP over log files ++# $Revision: 254 $ ++# ++ ++[Definition] ++ ++# Option: fwstart ++# Notes.: command executed once at the start of Fail2Ban. ++# Values: CMD ++# ++actionstart = echo -en "Hi,\n ++ The jail <name> has been started successfuly.\n ++ Regards,\n ++ Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest> ++ ++# Option: fwend ++# Notes.: command executed once at the end of Fail2Ban ++# Values: CMD ++# ++actionstop = echo -en "Hi,\n ++ The jail <name> has been stopped.\n ++ Regards,\n ++ Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest> ++ ++# Option: fwcheck ++# Notes.: command executed once before each fwban command ++# Values: CMD ++# ++actioncheck = ++ ++# Option: fwban ++# Notes.: command executed when banning an IP. Take care that the ++# command is executed with Fail2Ban user rights. ++# Tags: <ip> IP address ++# <failures> number of failures ++# <failtime> unix timestamp of the last failure ++# <bantime> unix timestamp of the ban time ++# Values: CMD ++# ++actionban = echo -en "Hi,\n ++ The IP <ip> has just been banned by Fail2Ban after ++ <failures> attempts against <name>.\n\n ++ Here are more information about <ip>:\n ++ `whois <ip>`\n\n ++ Lines containing IP:<ip> in <logpath>\n ++ `grep '\<<ip>\>' <logpath>`\n\n ++ Regards,\n ++ Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest> ++ ++# Option: fwunban ++# Notes.: command executed when unbanning an IP. Take care that the ++# command is executed with Fail2Ban user rights. ++# Tags: <ip> IP address ++# <bantime> unix timestamp of the ban time ++# <unbantime> unix timestamp of the unban time ++# Values: CMD ++# ++actionunban = ++ ++[Init] ++ ++# Defaut name of the chain ++# ++name = default ++ ++# Destinataire of the mail ++# ++dest = root ++ ++# Path to the log files which contain relevant lines for the abuser IP ++# ++logpath = /dev/null diff --git a/debian/patches/00list b/debian/patches/00list index 3b758a62..66ed4e58 100644 --- a/debian/patches/00list +++ b/debian/patches/00list @@ -3,3 +3,4 @@ X00_rigid_python24 00_iptables_NEW 10_dbts_manpages 10_wuftpd_section +00_mail-whois-lines