diff --git a/ChangeLog b/ChangeLog index 4ffb04e6..d6f15039 100644 --- a/ChangeLog +++ b/ChangeLog @@ -92,7 +92,9 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better - Fix apache-common for apache-2.4 log file format. Thanks Mark White. Closes gh-516 - Asynchat changed to use push method which verifys whether all data was - send. This ensures that all data is sent before closing the connection. + send. This ensures that all data is sent before closing the connection. + - Removed unnecessary reference to as yet undeclared $jail_name when checking + a specific jail in nagios script. - Enhancements: - added firewallcmd-ipset action @@ -108,13 +110,20 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better - exim-spam filter to match spamassassin log entry for option SAdevnull. Thanks Ivo Truxa. Closes gh-533 - filter.d/nsd.conf -- also amended Unix date template to match nsd format + - Added to sshd filter expression for "Received disconnect from : 3: + ...: Auth fail". Thanks Marcel Dopita. Closes gh-289 - loglines now also report "[PID]" after the name portion - New Features: - - Added filter for solid-pop3d -- thanks to Jacques Lav!gnotte on mailinglist. - - Added filter for apache-modsecurity - - Added filter for openwebmail thanks Ivo Truxa. Closes gh-543 + - filter.d/solid-pop3d -- added thanks to Jacques Lav!gnotte on mailinglist. + - Add filter for apache-modsecurity + - filter.d/nsd.conf -- also amended Unix date template to match nsd format + - Added openwebmail filter thanks Ivo Truxa. Closes gh-543 + - Added filter for freeswitch. Thanks Jim and editors and authors of + http://wiki.freeswitch.org/wiki/Fail2ban + - Added groupoffice filter thanks to logs from Merijn Schering. + Closes gh-566 - Added filter for horde ver. 0.8.11 (2013/11/13) - loves-unittests-and-tight-DoS-free-filter-regexes diff --git a/MANIFEST b/MANIFEST index b1af2feb..b30b602b 100644 --- a/MANIFEST +++ b/MANIFEST @@ -116,6 +116,8 @@ fail2ban/tests/files/logs/dropbear fail2ban/tests/files/logs/ejabberd-auth fail2ban/tests/files/logs/exim fail2ban/tests/files/logs/exim-spam +fail2ban/tests/files/logs/freeswitch +fail2ban/tests/files/logs/groupoffice fail2ban/tests/files/logs/gssftpd fail2ban/tests/files/logs/guacamole fail2ban/tests/files/logs/lighttpd-auth @@ -213,6 +215,8 @@ config/filter.d/3proxy.conf config/filter.d/apache-common.conf config/filter.d/exim-common.conf config/filter.d/exim-spam.conf +config/filter.d/freeswitch.conf +config/filter.d/groupoffice.conf config/filter.d/perdition.conf config/filter.d/uwimap-auth.conf config/filter.d/courier-auth.conf diff --git a/THANKS b/THANKS index 23870ca9..fc2e4e58 100644 --- a/THANKS +++ b/THANKS @@ -62,6 +62,7 @@ Markus Hoffmann Marvin Rouge mEDI Мернов Георгий +Merijn Schering Michael C. Haller Michael Hanselmann Nick Munger diff --git a/config/action.d/apf.conf b/config/action.d/apf.conf index f1d54dd2..5c4a2614 100644 --- a/config/action.d/apf.conf +++ b/config/action.d/apf.conf @@ -1,45 +1,17 @@ # Fail2Ban configuration file +# https://www.rfxn.com/projects/advanced-policy-firewall/ # -# Author: Mark McKinstry +# Note: APF doesn't play nicely with other actions. It has been observed to +# remove bans created by other iptables based actions. If you are going to use +# this action, use it for all of your jails. # +# DON'T MIX APF and other IPTABLES based actions [Definition] -# Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. -# Values: CMD -# actionstart = - -# Option: actionstop -# Notes.: command executed once at the end of Fail2Ban -# Values: CMD -# actionstop = - -# Option: actioncheck -# Notes.: command executed once before each actionban command -# Values: CMD -# actioncheck = - -# Option: actionban -# Notes.: command executed when banning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: IP address -# number of failures -#